Malware Analysis Report

2024-11-30 11:28

Sample ID 241119-qy359sxdmn
Target 88169b1d4778ed6c5fda97375efb5b9171ea52649c8715bb449801c39bce4ad4.exe
SHA256 88169b1d4778ed6c5fda97375efb5b9171ea52649c8715bb449801c39bce4ad4
Tags
dragonforce defense_evasion discovery ransomware spyware stealer lockbit
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

88169b1d4778ed6c5fda97375efb5b9171ea52649c8715bb449801c39bce4ad4

Threat Level: Known bad

The file 88169b1d4778ed6c5fda97375efb5b9171ea52649c8715bb449801c39bce4ad4.exe was found to be: Known bad.

Malicious Activity Summary

dragonforce defense_evasion discovery ransomware spyware stealer lockbit

Lockbit family

Rule to detect Lockbit 3.0 ransomware Windows payload

DragonForce

Dragonforce family

Executes dropped EXE

Reads user/profile data of web browsers

Checks computer location settings

Loads dropped DLL

Deletes itself

Drops desktop.ini file(s)

Indicator Removal: File Deletion

Suspicious use of NtSetInformationThreadHideFromDebugger

Drops file in System32 directory

Enumerates physical storage devices

Unsigned PE

System Location Discovery: System Language Discovery

Suspicious behavior: EnumeratesProcesses

Suspicious behavior: RenamesItself

Checks processor information in registry

Suspicious use of WriteProcessMemory

Suspicious use of AdjustPrivilegeToken

Enumerates system info in registry

Suspicious use of SetWindowsHookEx

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-11-19 13:41

Signatures

Lockbit family

lockbit

Rule to detect Lockbit 3.0 ransomware Windows payload

Description Indicator Process Target
N/A N/A N/A N/A

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral2

Detonation Overview

Submitted

2024-11-19 13:41

Reported

2024-11-19 13:43

Platform

win10v2004-20241007-en

Max time kernel

92s

Max time network

150s

Command Line

"C:\Users\Admin\AppData\Local\Temp\88169b1d4778ed6c5fda97375efb5b9171ea52649c8715bb449801c39bce4ad4.exe"

Signatures

DragonForce

ransomware dragonforce

Dragonforce family

dragonforce

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\Control Panel\International\Geo\Nation C:\ProgramData\AFD8.tmp N/A

Deletes itself

Description Indicator Process Target
N/A N/A C:\ProgramData\AFD8.tmp N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\ProgramData\AFD8.tmp N/A

Reads user/profile data of web browsers

spyware stealer

Drops desktop.ini file(s)

Description Indicator Process Target
File opened for modification C:\$Recycle.Bin\S-1-5-21-3227495264-2217614367-4027411560-1000\desktop.ini C:\Users\Admin\AppData\Local\Temp\88169b1d4778ed6c5fda97375efb5b9171ea52649c8715bb449801c39bce4ad4.exe N/A
File opened for modification F:\$RECYCLE.BIN\S-1-5-21-3227495264-2217614367-4027411560-1000\desktop.ini C:\Users\Admin\AppData\Local\Temp\88169b1d4778ed6c5fda97375efb5b9171ea52649c8715bb449801c39bce4ad4.exe N/A

Indicator Removal: File Deletion

defense_evasion

Drops file in System32 directory

Description Indicator Process Target
File created C:\Windows\system32\spool\PRINTERS\PPg32c8loprf2s23wam7i_2k9sb.TMP C:\Windows\system32\printfilterpipelinesvc.exe N/A
File created C:\Windows\system32\spool\PRINTERS\PPw9dm8372258qg2a1t0ups9_2d.TMP C:\Windows\system32\printfilterpipelinesvc.exe N/A
File created C:\Windows\system32\spool\PRINTERS\00002.SPL C:\Windows\splwow64.exe N/A
File created C:\Windows\system32\spool\PRINTERS\PPv_b8nft0aew43z_pzawt0dak.TMP C:\Windows\system32\printfilterpipelinesvc.exe N/A

Enumerates physical storage devices

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\88169b1d4778ed6c5fda97375efb5b9171ea52649c8715bb449801c39bce4ad4.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\ProgramData\AFD8.tmp N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A

Checks processor information in registry

Description Indicator Process Target
Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 C:\Program Files\Microsoft Office\root\Office16\ONENOTE.EXE N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz C:\Program Files\Microsoft Office\root\Office16\ONENOTE.EXE N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString C:\Program Files\Microsoft Office\root\Office16\ONENOTE.EXE N/A

Enumerates system info in registry

Description Indicator Process Target
Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS C:\Program Files\Microsoft Office\root\Office16\ONENOTE.EXE N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily C:\Program Files\Microsoft Office\root\Office16\ONENOTE.EXE N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU C:\Program Files\Microsoft Office\root\Office16\ONENOTE.EXE N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\88169b1d4778ed6c5fda97375efb5b9171ea52649c8715bb449801c39bce4ad4.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\88169b1d4778ed6c5fda97375efb5b9171ea52649c8715bb449801c39bce4ad4.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\88169b1d4778ed6c5fda97375efb5b9171ea52649c8715bb449801c39bce4ad4.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\88169b1d4778ed6c5fda97375efb5b9171ea52649c8715bb449801c39bce4ad4.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\88169b1d4778ed6c5fda97375efb5b9171ea52649c8715bb449801c39bce4ad4.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\88169b1d4778ed6c5fda97375efb5b9171ea52649c8715bb449801c39bce4ad4.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\88169b1d4778ed6c5fda97375efb5b9171ea52649c8715bb449801c39bce4ad4.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\88169b1d4778ed6c5fda97375efb5b9171ea52649c8715bb449801c39bce4ad4.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\88169b1d4778ed6c5fda97375efb5b9171ea52649c8715bb449801c39bce4ad4.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\88169b1d4778ed6c5fda97375efb5b9171ea52649c8715bb449801c39bce4ad4.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\88169b1d4778ed6c5fda97375efb5b9171ea52649c8715bb449801c39bce4ad4.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\88169b1d4778ed6c5fda97375efb5b9171ea52649c8715bb449801c39bce4ad4.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\88169b1d4778ed6c5fda97375efb5b9171ea52649c8715bb449801c39bce4ad4.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\88169b1d4778ed6c5fda97375efb5b9171ea52649c8715bb449801c39bce4ad4.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\88169b1d4778ed6c5fda97375efb5b9171ea52649c8715bb449801c39bce4ad4.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\88169b1d4778ed6c5fda97375efb5b9171ea52649c8715bb449801c39bce4ad4.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\88169b1d4778ed6c5fda97375efb5b9171ea52649c8715bb449801c39bce4ad4.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\88169b1d4778ed6c5fda97375efb5b9171ea52649c8715bb449801c39bce4ad4.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\88169b1d4778ed6c5fda97375efb5b9171ea52649c8715bb449801c39bce4ad4.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\88169b1d4778ed6c5fda97375efb5b9171ea52649c8715bb449801c39bce4ad4.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\88169b1d4778ed6c5fda97375efb5b9171ea52649c8715bb449801c39bce4ad4.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\88169b1d4778ed6c5fda97375efb5b9171ea52649c8715bb449801c39bce4ad4.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\88169b1d4778ed6c5fda97375efb5b9171ea52649c8715bb449801c39bce4ad4.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\88169b1d4778ed6c5fda97375efb5b9171ea52649c8715bb449801c39bce4ad4.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\88169b1d4778ed6c5fda97375efb5b9171ea52649c8715bb449801c39bce4ad4.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\88169b1d4778ed6c5fda97375efb5b9171ea52649c8715bb449801c39bce4ad4.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\88169b1d4778ed6c5fda97375efb5b9171ea52649c8715bb449801c39bce4ad4.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\88169b1d4778ed6c5fda97375efb5b9171ea52649c8715bb449801c39bce4ad4.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\88169b1d4778ed6c5fda97375efb5b9171ea52649c8715bb449801c39bce4ad4.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\88169b1d4778ed6c5fda97375efb5b9171ea52649c8715bb449801c39bce4ad4.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\88169b1d4778ed6c5fda97375efb5b9171ea52649c8715bb449801c39bce4ad4.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\88169b1d4778ed6c5fda97375efb5b9171ea52649c8715bb449801c39bce4ad4.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\88169b1d4778ed6c5fda97375efb5b9171ea52649c8715bb449801c39bce4ad4.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\88169b1d4778ed6c5fda97375efb5b9171ea52649c8715bb449801c39bce4ad4.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\88169b1d4778ed6c5fda97375efb5b9171ea52649c8715bb449801c39bce4ad4.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\88169b1d4778ed6c5fda97375efb5b9171ea52649c8715bb449801c39bce4ad4.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\88169b1d4778ed6c5fda97375efb5b9171ea52649c8715bb449801c39bce4ad4.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\88169b1d4778ed6c5fda97375efb5b9171ea52649c8715bb449801c39bce4ad4.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\88169b1d4778ed6c5fda97375efb5b9171ea52649c8715bb449801c39bce4ad4.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\88169b1d4778ed6c5fda97375efb5b9171ea52649c8715bb449801c39bce4ad4.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\88169b1d4778ed6c5fda97375efb5b9171ea52649c8715bb449801c39bce4ad4.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\88169b1d4778ed6c5fda97375efb5b9171ea52649c8715bb449801c39bce4ad4.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\88169b1d4778ed6c5fda97375efb5b9171ea52649c8715bb449801c39bce4ad4.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\88169b1d4778ed6c5fda97375efb5b9171ea52649c8715bb449801c39bce4ad4.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\88169b1d4778ed6c5fda97375efb5b9171ea52649c8715bb449801c39bce4ad4.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\88169b1d4778ed6c5fda97375efb5b9171ea52649c8715bb449801c39bce4ad4.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\88169b1d4778ed6c5fda97375efb5b9171ea52649c8715bb449801c39bce4ad4.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\88169b1d4778ed6c5fda97375efb5b9171ea52649c8715bb449801c39bce4ad4.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\88169b1d4778ed6c5fda97375efb5b9171ea52649c8715bb449801c39bce4ad4.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\88169b1d4778ed6c5fda97375efb5b9171ea52649c8715bb449801c39bce4ad4.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\88169b1d4778ed6c5fda97375efb5b9171ea52649c8715bb449801c39bce4ad4.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\88169b1d4778ed6c5fda97375efb5b9171ea52649c8715bb449801c39bce4ad4.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\88169b1d4778ed6c5fda97375efb5b9171ea52649c8715bb449801c39bce4ad4.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\88169b1d4778ed6c5fda97375efb5b9171ea52649c8715bb449801c39bce4ad4.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\88169b1d4778ed6c5fda97375efb5b9171ea52649c8715bb449801c39bce4ad4.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\88169b1d4778ed6c5fda97375efb5b9171ea52649c8715bb449801c39bce4ad4.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\88169b1d4778ed6c5fda97375efb5b9171ea52649c8715bb449801c39bce4ad4.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\88169b1d4778ed6c5fda97375efb5b9171ea52649c8715bb449801c39bce4ad4.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\88169b1d4778ed6c5fda97375efb5b9171ea52649c8715bb449801c39bce4ad4.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\88169b1d4778ed6c5fda97375efb5b9171ea52649c8715bb449801c39bce4ad4.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\88169b1d4778ed6c5fda97375efb5b9171ea52649c8715bb449801c39bce4ad4.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\88169b1d4778ed6c5fda97375efb5b9171ea52649c8715bb449801c39bce4ad4.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\88169b1d4778ed6c5fda97375efb5b9171ea52649c8715bb449801c39bce4ad4.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\88169b1d4778ed6c5fda97375efb5b9171ea52649c8715bb449801c39bce4ad4.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeAssignPrimaryTokenPrivilege N/A C:\Users\Admin\AppData\Local\Temp\88169b1d4778ed6c5fda97375efb5b9171ea52649c8715bb449801c39bce4ad4.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\88169b1d4778ed6c5fda97375efb5b9171ea52649c8715bb449801c39bce4ad4.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\88169b1d4778ed6c5fda97375efb5b9171ea52649c8715bb449801c39bce4ad4.exe N/A
Token: 36 N/A C:\Users\Admin\AppData\Local\Temp\88169b1d4778ed6c5fda97375efb5b9171ea52649c8715bb449801c39bce4ad4.exe N/A
Token: SeImpersonatePrivilege N/A C:\Users\Admin\AppData\Local\Temp\88169b1d4778ed6c5fda97375efb5b9171ea52649c8715bb449801c39bce4ad4.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\88169b1d4778ed6c5fda97375efb5b9171ea52649c8715bb449801c39bce4ad4.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Users\Admin\AppData\Local\Temp\88169b1d4778ed6c5fda97375efb5b9171ea52649c8715bb449801c39bce4ad4.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Local\Temp\88169b1d4778ed6c5fda97375efb5b9171ea52649c8715bb449801c39bce4ad4.exe N/A
Token: SeManageVolumePrivilege N/A C:\Users\Admin\AppData\Local\Temp\88169b1d4778ed6c5fda97375efb5b9171ea52649c8715bb449801c39bce4ad4.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Users\Admin\AppData\Local\Temp\88169b1d4778ed6c5fda97375efb5b9171ea52649c8715bb449801c39bce4ad4.exe N/A
Token: SeRestorePrivilege N/A C:\Users\Admin\AppData\Local\Temp\88169b1d4778ed6c5fda97375efb5b9171ea52649c8715bb449801c39bce4ad4.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\88169b1d4778ed6c5fda97375efb5b9171ea52649c8715bb449801c39bce4ad4.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Users\Admin\AppData\Local\Temp\88169b1d4778ed6c5fda97375efb5b9171ea52649c8715bb449801c39bce4ad4.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Users\Admin\AppData\Local\Temp\88169b1d4778ed6c5fda97375efb5b9171ea52649c8715bb449801c39bce4ad4.exe N/A
Token: SeShutdownPrivilege N/A C:\Users\Admin\AppData\Local\Temp\88169b1d4778ed6c5fda97375efb5b9171ea52649c8715bb449801c39bce4ad4.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\88169b1d4778ed6c5fda97375efb5b9171ea52649c8715bb449801c39bce4ad4.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\88169b1d4778ed6c5fda97375efb5b9171ea52649c8715bb449801c39bce4ad4.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\88169b1d4778ed6c5fda97375efb5b9171ea52649c8715bb449801c39bce4ad4.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\88169b1d4778ed6c5fda97375efb5b9171ea52649c8715bb449801c39bce4ad4.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\88169b1d4778ed6c5fda97375efb5b9171ea52649c8715bb449801c39bce4ad4.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\88169b1d4778ed6c5fda97375efb5b9171ea52649c8715bb449801c39bce4ad4.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\88169b1d4778ed6c5fda97375efb5b9171ea52649c8715bb449801c39bce4ad4.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\88169b1d4778ed6c5fda97375efb5b9171ea52649c8715bb449801c39bce4ad4.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\88169b1d4778ed6c5fda97375efb5b9171ea52649c8715bb449801c39bce4ad4.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\88169b1d4778ed6c5fda97375efb5b9171ea52649c8715bb449801c39bce4ad4.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\88169b1d4778ed6c5fda97375efb5b9171ea52649c8715bb449801c39bce4ad4.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\88169b1d4778ed6c5fda97375efb5b9171ea52649c8715bb449801c39bce4ad4.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\88169b1d4778ed6c5fda97375efb5b9171ea52649c8715bb449801c39bce4ad4.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\88169b1d4778ed6c5fda97375efb5b9171ea52649c8715bb449801c39bce4ad4.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\88169b1d4778ed6c5fda97375efb5b9171ea52649c8715bb449801c39bce4ad4.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\88169b1d4778ed6c5fda97375efb5b9171ea52649c8715bb449801c39bce4ad4.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\88169b1d4778ed6c5fda97375efb5b9171ea52649c8715bb449801c39bce4ad4.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\88169b1d4778ed6c5fda97375efb5b9171ea52649c8715bb449801c39bce4ad4.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\88169b1d4778ed6c5fda97375efb5b9171ea52649c8715bb449801c39bce4ad4.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\88169b1d4778ed6c5fda97375efb5b9171ea52649c8715bb449801c39bce4ad4.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\88169b1d4778ed6c5fda97375efb5b9171ea52649c8715bb449801c39bce4ad4.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\88169b1d4778ed6c5fda97375efb5b9171ea52649c8715bb449801c39bce4ad4.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\88169b1d4778ed6c5fda97375efb5b9171ea52649c8715bb449801c39bce4ad4.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\88169b1d4778ed6c5fda97375efb5b9171ea52649c8715bb449801c39bce4ad4.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\88169b1d4778ed6c5fda97375efb5b9171ea52649c8715bb449801c39bce4ad4.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\88169b1d4778ed6c5fda97375efb5b9171ea52649c8715bb449801c39bce4ad4.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\88169b1d4778ed6c5fda97375efb5b9171ea52649c8715bb449801c39bce4ad4.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\88169b1d4778ed6c5fda97375efb5b9171ea52649c8715bb449801c39bce4ad4.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\88169b1d4778ed6c5fda97375efb5b9171ea52649c8715bb449801c39bce4ad4.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\88169b1d4778ed6c5fda97375efb5b9171ea52649c8715bb449801c39bce4ad4.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\88169b1d4778ed6c5fda97375efb5b9171ea52649c8715bb449801c39bce4ad4.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\88169b1d4778ed6c5fda97375efb5b9171ea52649c8715bb449801c39bce4ad4.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\88169b1d4778ed6c5fda97375efb5b9171ea52649c8715bb449801c39bce4ad4.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\88169b1d4778ed6c5fda97375efb5b9171ea52649c8715bb449801c39bce4ad4.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\88169b1d4778ed6c5fda97375efb5b9171ea52649c8715bb449801c39bce4ad4.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\88169b1d4778ed6c5fda97375efb5b9171ea52649c8715bb449801c39bce4ad4.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\88169b1d4778ed6c5fda97375efb5b9171ea52649c8715bb449801c39bce4ad4.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\88169b1d4778ed6c5fda97375efb5b9171ea52649c8715bb449801c39bce4ad4.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\88169b1d4778ed6c5fda97375efb5b9171ea52649c8715bb449801c39bce4ad4.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\88169b1d4778ed6c5fda97375efb5b9171ea52649c8715bb449801c39bce4ad4.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\88169b1d4778ed6c5fda97375efb5b9171ea52649c8715bb449801c39bce4ad4.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\88169b1d4778ed6c5fda97375efb5b9171ea52649c8715bb449801c39bce4ad4.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\88169b1d4778ed6c5fda97375efb5b9171ea52649c8715bb449801c39bce4ad4.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\88169b1d4778ed6c5fda97375efb5b9171ea52649c8715bb449801c39bce4ad4.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\88169b1d4778ed6c5fda97375efb5b9171ea52649c8715bb449801c39bce4ad4.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\88169b1d4778ed6c5fda97375efb5b9171ea52649c8715bb449801c39bce4ad4.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\88169b1d4778ed6c5fda97375efb5b9171ea52649c8715bb449801c39bce4ad4.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\88169b1d4778ed6c5fda97375efb5b9171ea52649c8715bb449801c39bce4ad4.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\88169b1d4778ed6c5fda97375efb5b9171ea52649c8715bb449801c39bce4ad4.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 448 wrote to memory of 4848 N/A C:\Users\Admin\AppData\Local\Temp\88169b1d4778ed6c5fda97375efb5b9171ea52649c8715bb449801c39bce4ad4.exe C:\Windows\splwow64.exe
PID 448 wrote to memory of 4848 N/A C:\Users\Admin\AppData\Local\Temp\88169b1d4778ed6c5fda97375efb5b9171ea52649c8715bb449801c39bce4ad4.exe C:\Windows\splwow64.exe
PID 448 wrote to memory of 1076 N/A C:\Users\Admin\AppData\Local\Temp\88169b1d4778ed6c5fda97375efb5b9171ea52649c8715bb449801c39bce4ad4.exe C:\ProgramData\AFD8.tmp
PID 448 wrote to memory of 1076 N/A C:\Users\Admin\AppData\Local\Temp\88169b1d4778ed6c5fda97375efb5b9171ea52649c8715bb449801c39bce4ad4.exe C:\ProgramData\AFD8.tmp
PID 448 wrote to memory of 1076 N/A C:\Users\Admin\AppData\Local\Temp\88169b1d4778ed6c5fda97375efb5b9171ea52649c8715bb449801c39bce4ad4.exe C:\ProgramData\AFD8.tmp
PID 448 wrote to memory of 1076 N/A C:\Users\Admin\AppData\Local\Temp\88169b1d4778ed6c5fda97375efb5b9171ea52649c8715bb449801c39bce4ad4.exe C:\ProgramData\AFD8.tmp
PID 3732 wrote to memory of 3764 N/A C:\Windows\system32\printfilterpipelinesvc.exe C:\Program Files\Microsoft Office\root\Office16\ONENOTE.EXE
PID 3732 wrote to memory of 3764 N/A C:\Windows\system32\printfilterpipelinesvc.exe C:\Program Files\Microsoft Office\root\Office16\ONENOTE.EXE
PID 1076 wrote to memory of 4780 N/A C:\ProgramData\AFD8.tmp C:\Windows\SysWOW64\cmd.exe
PID 1076 wrote to memory of 4780 N/A C:\ProgramData\AFD8.tmp C:\Windows\SysWOW64\cmd.exe
PID 1076 wrote to memory of 4780 N/A C:\ProgramData\AFD8.tmp C:\Windows\SysWOW64\cmd.exe

Processes

C:\Users\Admin\AppData\Local\Temp\88169b1d4778ed6c5fda97375efb5b9171ea52649c8715bb449801c39bce4ad4.exe

"C:\Users\Admin\AppData\Local\Temp\88169b1d4778ed6c5fda97375efb5b9171ea52649c8715bb449801c39bce4ad4.exe"

C:\Windows\splwow64.exe

C:\Windows\splwow64.exe 12288

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k PrintWorkflow -s PrintWorkflowUserSvc

C:\Windows\system32\printfilterpipelinesvc.exe

C:\Windows\system32\printfilterpipelinesvc.exe -Embedding

C:\ProgramData\AFD8.tmp

"C:\ProgramData\AFD8.tmp"

C:\Program Files\Microsoft Office\root\Office16\ONENOTE.EXE

/insertdoc "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\{7CC11971-551F-4A92-A048-D0E26A37BE42}.xps" 133764972776090000

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /C DEL /F /Q C:\PROGRA~3\AFD8.tmp >> NUL

Network

Country Destination Domain Proto
US 8.8.8.8:53 8.8.8.8.in-addr.arpa udp
US 8.8.8.8:53 149.220.183.52.in-addr.arpa udp
US 8.8.8.8:53 138.32.126.40.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 196.249.167.52.in-addr.arpa udp
US 8.8.8.8:53 roaming.officeapps.live.com udp
NL 52.109.89.19:443 roaming.officeapps.live.com tcp
US 8.8.8.8:53 19.89.109.52.in-addr.arpa udp
US 8.8.8.8:53 90.16.208.104.in-addr.arpa udp
US 8.8.8.8:53 200.163.202.172.in-addr.arpa udp
US 8.8.8.8:53 15.164.165.52.in-addr.arpa udp
US 8.8.8.8:53 240.221.184.93.in-addr.arpa udp
US 8.8.8.8:53 22.236.111.52.in-addr.arpa udp

Files

memory/448-0-0x0000000003070000-0x0000000003080000-memory.dmp

memory/448-2-0x0000000003070000-0x0000000003080000-memory.dmp

memory/448-1-0x0000000003070000-0x0000000003080000-memory.dmp

C:\$Recycle.Bin\S-1-5-21-3227495264-2217614367-4027411560-1000\desktop.ini

MD5 0ad6b3253f71fd4134054f6db5548a50
SHA1 b9c5ec1a5fe1ccd8e67c626422b40a57e2272d2f
SHA256 8f7865596e1f491015aae748d4559d388d9247ca6baf09bca8e2ba453e583271
SHA512 d3738be57f4d830cdd6f3b07022c5a63b0cf3474527ea46936d35943729191c744d17e117b4d04c2b0c1460abc45c0680b8d78be1601a2c7bd8efea534dad537

C:\EUPTJQjet.README.txt

MD5 6e7518f51594ee064a86a4003f0f0345
SHA1 ecffead1e3d310d36c7b8c00ebd7bba61bcacb0a
SHA256 dab5c2feb87aa201be58d3652f0933d39e423a5b8edfe9824521c01a68f6b6d3
SHA512 43f4c78c0cfb8ce806ddf910324603ad04d5990be28d407ef5138d25515bbdae03e759fc550a330f1efb950e1259608f35ae08d4cc263727f19aba9c64693823

F:\$RECYCLE.BIN\S-1-5-21-3227495264-2217614367-4027411560-1000\DDDDDDDDDDD

MD5 2be82da7dd207495b7db93f84e9f0210
SHA1 fbb33def7c322d791203456ea5d5d598438cbebd
SHA256 392b681b70e0226c356caec8fdc362a38f64e7fc0e49d616a04fb83b95a2e57c
SHA512 7f0b94a070c163e8db0c66018c0d24d7b57bd2ccd5c5c518815f30757594ec6d7e7831a8fab5e1e7e06139819e2d572a14c4cb5986ae262e9afb58e33a8c30c6

memory/448-2772-0x0000000003070000-0x0000000003080000-memory.dmp

memory/448-2773-0x0000000003070000-0x0000000003080000-memory.dmp

memory/448-2774-0x0000000003070000-0x0000000003080000-memory.dmp

C:\ProgramData\AFD8.tmp

MD5 294e9f64cb1642dd89229fff0592856b
SHA1 97b148c27f3da29ba7b18d6aee8a0db9102f47c9
SHA256 917e115cc403e29b4388e0d175cbfac3e7e40ca1742299fbdb353847db2de7c2
SHA512 b87d531890bf1577b9b4af41dddb2cdbbfa164cf197bd5987df3a3075983645a3acba443e289b7bfd338422978a104f55298fbfe346872de0895bde44adc89cf

memory/3764-2790-0x00007FFD93990000-0x00007FFD939A0000-memory.dmp

memory/3764-2789-0x00007FFD93990000-0x00007FFD939A0000-memory.dmp

memory/3764-2791-0x00007FFD93990000-0x00007FFD939A0000-memory.dmp

memory/3764-2793-0x00007FFD93990000-0x00007FFD939A0000-memory.dmp

memory/3764-2796-0x00007FFD93990000-0x00007FFD939A0000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\DDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDD

MD5 2743b066f6a79529f1bffdc2ce276c92
SHA1 60269b421af361e433278aa9e9350e43293f3fa2
SHA256 8fb45dbd1521c2fe7732afd197c2343c850e3a65978bb870468d916c25aefdea
SHA512 31d875bc8785f674b83db453e73d4171073bc66ea611f2314c31eac2a2d955cd43d5a038a7fc18c9314505d1156085debb39ae89f11410968df27b4a7e7a771d

memory/3764-2822-0x00007FFD91700000-0x00007FFD91710000-memory.dmp

memory/3764-2823-0x00007FFD91700000-0x00007FFD91710000-memory.dmp

C:\Users\Admin\Documents\OneNote Notebooks\My Notebook\Open Notebook.onetoc2

MD5 32708012e991bf7ae117dc4bf3bd7c4e
SHA1 7f3a85ecf6e29a8d9b756a172d1a71b23808bcfc
SHA256 81b7a4450fce23dd64e65bddce66380698cca9f6733ec7f9346514320c214013
SHA512 79a72fd45a9f8289146cb1d210de48fd489d269ab4c93c2ead002d035a166acbe908c3057714cd21476f3944f1408dd6afbac69e423dbf83277944fe5f95e8b9

Analysis: behavioral1

Detonation Overview

Submitted

2024-11-19 13:41

Reported

2024-11-19 13:43

Platform

win7-20240708-en

Max time kernel

121s

Max time network

123s

Command Line

"C:\Users\Admin\AppData\Local\Temp\88169b1d4778ed6c5fda97375efb5b9171ea52649c8715bb449801c39bce4ad4.exe"

Signatures

DragonForce

ransomware dragonforce

Dragonforce family

dragonforce

Deletes itself

Description Indicator Process Target
N/A N/A C:\ProgramData\D6BF.tmp N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\ProgramData\D6BF.tmp N/A

Reads user/profile data of web browsers

spyware stealer

Drops desktop.ini file(s)

Description Indicator Process Target
File opened for modification C:\$Recycle.Bin\S-1-5-21-3551809350-4263495960-1443967649-1000\desktop.ini C:\Users\Admin\AppData\Local\Temp\88169b1d4778ed6c5fda97375efb5b9171ea52649c8715bb449801c39bce4ad4.exe N/A
File opened for modification F:\$RECYCLE.BIN\S-1-5-21-3551809350-4263495960-1443967649-1000\desktop.ini C:\Users\Admin\AppData\Local\Temp\88169b1d4778ed6c5fda97375efb5b9171ea52649c8715bb449801c39bce4ad4.exe N/A

Indicator Removal: File Deletion

defense_evasion

Enumerates physical storage devices

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\88169b1d4778ed6c5fda97375efb5b9171ea52649c8715bb449801c39bce4ad4.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\ProgramData\D6BF.tmp N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\88169b1d4778ed6c5fda97375efb5b9171ea52649c8715bb449801c39bce4ad4.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\88169b1d4778ed6c5fda97375efb5b9171ea52649c8715bb449801c39bce4ad4.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\88169b1d4778ed6c5fda97375efb5b9171ea52649c8715bb449801c39bce4ad4.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\88169b1d4778ed6c5fda97375efb5b9171ea52649c8715bb449801c39bce4ad4.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\88169b1d4778ed6c5fda97375efb5b9171ea52649c8715bb449801c39bce4ad4.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\88169b1d4778ed6c5fda97375efb5b9171ea52649c8715bb449801c39bce4ad4.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\88169b1d4778ed6c5fda97375efb5b9171ea52649c8715bb449801c39bce4ad4.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\88169b1d4778ed6c5fda97375efb5b9171ea52649c8715bb449801c39bce4ad4.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\88169b1d4778ed6c5fda97375efb5b9171ea52649c8715bb449801c39bce4ad4.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\88169b1d4778ed6c5fda97375efb5b9171ea52649c8715bb449801c39bce4ad4.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\88169b1d4778ed6c5fda97375efb5b9171ea52649c8715bb449801c39bce4ad4.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\88169b1d4778ed6c5fda97375efb5b9171ea52649c8715bb449801c39bce4ad4.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\88169b1d4778ed6c5fda97375efb5b9171ea52649c8715bb449801c39bce4ad4.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\88169b1d4778ed6c5fda97375efb5b9171ea52649c8715bb449801c39bce4ad4.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeAssignPrimaryTokenPrivilege N/A C:\Users\Admin\AppData\Local\Temp\88169b1d4778ed6c5fda97375efb5b9171ea52649c8715bb449801c39bce4ad4.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\88169b1d4778ed6c5fda97375efb5b9171ea52649c8715bb449801c39bce4ad4.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\88169b1d4778ed6c5fda97375efb5b9171ea52649c8715bb449801c39bce4ad4.exe N/A
Token: 36 N/A C:\Users\Admin\AppData\Local\Temp\88169b1d4778ed6c5fda97375efb5b9171ea52649c8715bb449801c39bce4ad4.exe N/A
Token: SeImpersonatePrivilege N/A C:\Users\Admin\AppData\Local\Temp\88169b1d4778ed6c5fda97375efb5b9171ea52649c8715bb449801c39bce4ad4.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\88169b1d4778ed6c5fda97375efb5b9171ea52649c8715bb449801c39bce4ad4.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Users\Admin\AppData\Local\Temp\88169b1d4778ed6c5fda97375efb5b9171ea52649c8715bb449801c39bce4ad4.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Local\Temp\88169b1d4778ed6c5fda97375efb5b9171ea52649c8715bb449801c39bce4ad4.exe N/A
Token: SeManageVolumePrivilege N/A C:\Users\Admin\AppData\Local\Temp\88169b1d4778ed6c5fda97375efb5b9171ea52649c8715bb449801c39bce4ad4.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Users\Admin\AppData\Local\Temp\88169b1d4778ed6c5fda97375efb5b9171ea52649c8715bb449801c39bce4ad4.exe N/A
Token: SeRestorePrivilege N/A C:\Users\Admin\AppData\Local\Temp\88169b1d4778ed6c5fda97375efb5b9171ea52649c8715bb449801c39bce4ad4.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\88169b1d4778ed6c5fda97375efb5b9171ea52649c8715bb449801c39bce4ad4.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Users\Admin\AppData\Local\Temp\88169b1d4778ed6c5fda97375efb5b9171ea52649c8715bb449801c39bce4ad4.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Users\Admin\AppData\Local\Temp\88169b1d4778ed6c5fda97375efb5b9171ea52649c8715bb449801c39bce4ad4.exe N/A
Token: SeShutdownPrivilege N/A C:\Users\Admin\AppData\Local\Temp\88169b1d4778ed6c5fda97375efb5b9171ea52649c8715bb449801c39bce4ad4.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\88169b1d4778ed6c5fda97375efb5b9171ea52649c8715bb449801c39bce4ad4.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\88169b1d4778ed6c5fda97375efb5b9171ea52649c8715bb449801c39bce4ad4.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\88169b1d4778ed6c5fda97375efb5b9171ea52649c8715bb449801c39bce4ad4.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\88169b1d4778ed6c5fda97375efb5b9171ea52649c8715bb449801c39bce4ad4.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\88169b1d4778ed6c5fda97375efb5b9171ea52649c8715bb449801c39bce4ad4.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\88169b1d4778ed6c5fda97375efb5b9171ea52649c8715bb449801c39bce4ad4.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\88169b1d4778ed6c5fda97375efb5b9171ea52649c8715bb449801c39bce4ad4.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\88169b1d4778ed6c5fda97375efb5b9171ea52649c8715bb449801c39bce4ad4.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\88169b1d4778ed6c5fda97375efb5b9171ea52649c8715bb449801c39bce4ad4.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\88169b1d4778ed6c5fda97375efb5b9171ea52649c8715bb449801c39bce4ad4.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\88169b1d4778ed6c5fda97375efb5b9171ea52649c8715bb449801c39bce4ad4.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\88169b1d4778ed6c5fda97375efb5b9171ea52649c8715bb449801c39bce4ad4.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\88169b1d4778ed6c5fda97375efb5b9171ea52649c8715bb449801c39bce4ad4.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\88169b1d4778ed6c5fda97375efb5b9171ea52649c8715bb449801c39bce4ad4.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\88169b1d4778ed6c5fda97375efb5b9171ea52649c8715bb449801c39bce4ad4.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\88169b1d4778ed6c5fda97375efb5b9171ea52649c8715bb449801c39bce4ad4.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\88169b1d4778ed6c5fda97375efb5b9171ea52649c8715bb449801c39bce4ad4.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\88169b1d4778ed6c5fda97375efb5b9171ea52649c8715bb449801c39bce4ad4.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\88169b1d4778ed6c5fda97375efb5b9171ea52649c8715bb449801c39bce4ad4.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\88169b1d4778ed6c5fda97375efb5b9171ea52649c8715bb449801c39bce4ad4.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\88169b1d4778ed6c5fda97375efb5b9171ea52649c8715bb449801c39bce4ad4.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\88169b1d4778ed6c5fda97375efb5b9171ea52649c8715bb449801c39bce4ad4.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\88169b1d4778ed6c5fda97375efb5b9171ea52649c8715bb449801c39bce4ad4.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\88169b1d4778ed6c5fda97375efb5b9171ea52649c8715bb449801c39bce4ad4.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\88169b1d4778ed6c5fda97375efb5b9171ea52649c8715bb449801c39bce4ad4.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\88169b1d4778ed6c5fda97375efb5b9171ea52649c8715bb449801c39bce4ad4.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\88169b1d4778ed6c5fda97375efb5b9171ea52649c8715bb449801c39bce4ad4.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\88169b1d4778ed6c5fda97375efb5b9171ea52649c8715bb449801c39bce4ad4.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\88169b1d4778ed6c5fda97375efb5b9171ea52649c8715bb449801c39bce4ad4.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\88169b1d4778ed6c5fda97375efb5b9171ea52649c8715bb449801c39bce4ad4.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\88169b1d4778ed6c5fda97375efb5b9171ea52649c8715bb449801c39bce4ad4.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\88169b1d4778ed6c5fda97375efb5b9171ea52649c8715bb449801c39bce4ad4.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\88169b1d4778ed6c5fda97375efb5b9171ea52649c8715bb449801c39bce4ad4.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\88169b1d4778ed6c5fda97375efb5b9171ea52649c8715bb449801c39bce4ad4.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\88169b1d4778ed6c5fda97375efb5b9171ea52649c8715bb449801c39bce4ad4.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\88169b1d4778ed6c5fda97375efb5b9171ea52649c8715bb449801c39bce4ad4.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\88169b1d4778ed6c5fda97375efb5b9171ea52649c8715bb449801c39bce4ad4.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\88169b1d4778ed6c5fda97375efb5b9171ea52649c8715bb449801c39bce4ad4.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\88169b1d4778ed6c5fda97375efb5b9171ea52649c8715bb449801c39bce4ad4.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\88169b1d4778ed6c5fda97375efb5b9171ea52649c8715bb449801c39bce4ad4.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\88169b1d4778ed6c5fda97375efb5b9171ea52649c8715bb449801c39bce4ad4.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\88169b1d4778ed6c5fda97375efb5b9171ea52649c8715bb449801c39bce4ad4.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\88169b1d4778ed6c5fda97375efb5b9171ea52649c8715bb449801c39bce4ad4.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\88169b1d4778ed6c5fda97375efb5b9171ea52649c8715bb449801c39bce4ad4.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\88169b1d4778ed6c5fda97375efb5b9171ea52649c8715bb449801c39bce4ad4.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\88169b1d4778ed6c5fda97375efb5b9171ea52649c8715bb449801c39bce4ad4.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\88169b1d4778ed6c5fda97375efb5b9171ea52649c8715bb449801c39bce4ad4.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\88169b1d4778ed6c5fda97375efb5b9171ea52649c8715bb449801c39bce4ad4.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\88169b1d4778ed6c5fda97375efb5b9171ea52649c8715bb449801c39bce4ad4.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\88169b1d4778ed6c5fda97375efb5b9171ea52649c8715bb449801c39bce4ad4.exe

"C:\Users\Admin\AppData\Local\Temp\88169b1d4778ed6c5fda97375efb5b9171ea52649c8715bb449801c39bce4ad4.exe"

C:\ProgramData\D6BF.tmp

"C:\ProgramData\D6BF.tmp"

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /C DEL /F /Q C:\PROGRA~3\D6BF.tmp >> NUL

C:\Windows\system32\AUDIODG.EXE

C:\Windows\system32\AUDIODG.EXE 0x14c

Network

N/A

Files

memory/2972-0-0x00000000004B0000-0x00000000004F0000-memory.dmp

memory/2972-1-0x00000000004B0000-0x00000000004F0000-memory.dmp

C:\$Recycle.Bin\S-1-5-21-3551809350-4263495960-1443967649-1000\desktop.ini

MD5 be5c3179a3770f6ed6d2f031d8809e37
SHA1 4daa0f4ad4a2b11039dafe235666a34127654d2e
SHA256 18a937ccebc3d538761491135520634e9b0be48f59ec52108eacfa14a314ac37
SHA512 817c97fb00ca3f4592bc969643ce3d0fca4e0f6c6e74e1d9306579988c066011a8cefdb9db867f0db1f6f5d6c4f64957374d15fe092fd94fe56f2bcbc69d8555

F:\$RECYCLE.BIN\S-1-5-21-3551809350-4263495960-1443967649-1000\CCCCCCCCCCC

MD5 9561d1951103c580e633b49c8ce2129c
SHA1 e04f580c23df506f806f9e20030b1fb3dab9cd83
SHA256 b662dcf0771828fb9cf746f3861c9b62c895f6474fdf9fac8668ce16210e8704
SHA512 54e511704053969e07a40593faf92e96c5dfda3fc3e75890a0d416fb00a2508ca89134218cbd7d5bbd9c328fa5810c11a2132ef7b258ada533d7d1a04c4e88f5

C:\EUPTJQjet.README.txt

MD5 7810eeea177acae7375240b1ac071ed5
SHA1 da7ce75c26f471c59b0160fa5d0e330f3d784411
SHA256 98b93a277b4349a1b16bda7442231a9a1b705d451e7335c802b0084eafc4c833
SHA512 65b93a7155c3b93fa346a9d5708a8426fb7ce2fd8e8950b1d2136bc339b8d5a2100d3216bbe92f70856b6ef5dbd8a9008057f976a681f5a69d6695e14d2011d6

\ProgramData\D6BF.tmp

MD5 294e9f64cb1642dd89229fff0592856b
SHA1 97b148c27f3da29ba7b18d6aee8a0db9102f47c9
SHA256 917e115cc403e29b4388e0d175cbfac3e7e40ca1742299fbdb353847db2de7c2
SHA512 b87d531890bf1577b9b4af41dddb2cdbbfa164cf197bd5987df3a3075983645a3acba443e289b7bfd338422978a104f55298fbfe346872de0895bde44adc89cf

memory/2136-891-0x000000007EF20000-0x000000007EF21000-memory.dmp

memory/2136-894-0x000000007EF80000-0x000000007EF81000-memory.dmp

memory/2136-893-0x0000000000230000-0x0000000000270000-memory.dmp

memory/2136-892-0x0000000000230000-0x0000000000270000-memory.dmp

memory/2136-889-0x000000007EFA0000-0x000000007EFA1000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\DDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDD

MD5 abd571b17672484e51896443369c7194
SHA1 faef85e88189219976b057554858329e6c6f6b0c
SHA256 420c92bba0fdef426669809fa5f43ab4457a2d3aa874f3c6a28d62c9392601b0
SHA512 0f4053ea3b7482ee4283074438d7e9e9f4a229b4765b6144b926fb6e1c9ac8d7bc3bd163b3983438df2a4ad136c5bdc3dba1b41149381c765e1314c870d4b604

memory/2136-924-0x000000007EF60000-0x000000007EF61000-memory.dmp

memory/2136-923-0x000000007EF40000-0x000000007EF41000-memory.dmp