Analysis
-
max time kernel
103s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
20-11-2024 02:57
Behavioral task
behavioral1
Sample
82b336cd120ef07d8df5a3e3fa082bcca8b5c0a3481fae78cb5dd29072979f69.exe
Resource
win7-20241010-en
windows7-x64
16 signatures
150 seconds
Behavioral task
behavioral2
Sample
82b336cd120ef07d8df5a3e3fa082bcca8b5c0a3481fae78cb5dd29072979f69.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
20 signatures
150 seconds
General
-
Target
82b336cd120ef07d8df5a3e3fa082bcca8b5c0a3481fae78cb5dd29072979f69.exe
-
Size
90KB
-
MD5
6c755a742f2b2e5c1820f57d0338365f
-
SHA1
0b22b6e5269ec241b82450a7e65009685a3010fb
-
SHA256
82b336cd120ef07d8df5a3e3fa082bcca8b5c0a3481fae78cb5dd29072979f69
-
SHA512
580fec443cb3236201750e643078b98e3d9f46cad3cc890b74371119f0ec33a0c5ba526e6135cc1ddcb90d867c214e37c700af55309c7725ed44e100173630ed
-
SSDEEP
1536:yvXFnGvewvD/F3nICjRM5CEL92vR2zh9ckMBsA1RXZN1Mevt5:Ow3FE79UUzh9mBjBZNe
Malware Config
Extracted
Path
C:\EUPTJQjet.README.txt
Family
dragonforce
Ransom Note
Hello!
Your files have been stolen from your network and encrypted with a strong algorithm. We work for money and are not associated with politics. All you need to do is contact us and pay.
--- Our communication process:
1. You contact us.
2. We send you a list of files that were stolen.
3. We decrypt 1 file to confirm that our decryptor works.
4. We agree on the amount, which must be paid using BTC.
5. We delete your files, we give you a decryptor.
6. We give you a detailed report on how we compromised your company, and recommendations on how to avoid such situations in the future.
--- Client area (use this site to contact us):
Link for Tor Browser: http://3pktcrcbmssvrnwe5skburdwe2h3v6ibdnn5kbjqihsg6eu6s6b7ryqd.onion
>>> Use this ID: 39C1BACACEDFEC0F5727D0811EFB90A3 to begin the recovery process.
* In order to access the site, you will need Tor Browser,
you can download it from this link: https://www.torproject.org/
--- Additional contacts:
Support Tox: 1C054B722BCBF41A918EF3C485712742088F5C3E81B2FDD91ADEA6BA55F4A856D90A65E99D20
--- Recommendations:
DO NOT RESET OR SHUTDOWN - files may be damaged.
DO NOT RENAME OR MOVE the encrypted and readme files.
DO NOT DELETE readme files.
--- Important:
If you refuse to pay or do not get in touch with us, we start publishing your files.
26/04/2024 00:00 UTC the decryptor will be destroyed and the files will be published on our blog.
Blog: http://z3wqggtxft7id3ibr7srivv5gjof5fwg76slewnzwwakjuf3nlhukdid.onion
Sincerely, 01000100 01110010 01100001 01100111 01101111 01101110 01000110 01101111 01110010 01100011 01100101
URLs
http://3pktcrcbmssvrnwe5skburdwe2h3v6ibdnn5kbjqihsg6eu6s6b7ryqd.onion
http://z3wqggtxft7id3ibr7srivv5gjof5fwg76slewnzwwakjuf3nlhukdid.onion
Signatures
-
DragonForce
Ransomware family based on Lockbit that was first observed in November 2023.
-
Dragonforce family
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Control Panel\International\Geo\Nation 11DE.tmp -
Deletes itself 1 IoCs
pid Process 3756 11DE.tmp -
Executes dropped EXE 1 IoCs
pid Process 3756 11DE.tmp -
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Drops desktop.ini file(s) 2 IoCs
description ioc Process File opened for modification C:\$Recycle.Bin\S-1-5-21-2437139445-1151884604-3026847218-1000\desktop.ini 82b336cd120ef07d8df5a3e3fa082bcca8b5c0a3481fae78cb5dd29072979f69.exe File opened for modification F:\$RECYCLE.BIN\S-1-5-21-2437139445-1151884604-3026847218-1000\desktop.ini 82b336cd120ef07d8df5a3e3fa082bcca8b5c0a3481fae78cb5dd29072979f69.exe -
Indicator Removal: File Deletion 1 TTPs
Adversaries may delete files left behind by the actions of their intrusion activity.
-
Drops file in System32 directory 4 IoCs
description ioc Process File created C:\Windows\system32\spool\PRINTERS\PPfnr9the_cnlwxe9v0xiebni9.TMP printfilterpipelinesvc.exe File created C:\Windows\system32\spool\PRINTERS\00002.SPL splwow64.exe File created C:\Windows\system32\spool\PRINTERS\PPo5x_fade90924e7z_vaavsnxc.TMP printfilterpipelinesvc.exe File created C:\Windows\system32\spool\PRINTERS\PPh1grvwl7lchlte5xyb1974p5d.TMP printfilterpipelinesvc.exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 5 IoCs
pid Process 4564 82b336cd120ef07d8df5a3e3fa082bcca8b5c0a3481fae78cb5dd29072979f69.exe 4564 82b336cd120ef07d8df5a3e3fa082bcca8b5c0a3481fae78cb5dd29072979f69.exe 4564 82b336cd120ef07d8df5a3e3fa082bcca8b5c0a3481fae78cb5dd29072979f69.exe 4564 82b336cd120ef07d8df5a3e3fa082bcca8b5c0a3481fae78cb5dd29072979f69.exe 3756 11DE.tmp -
resource yara_rule behavioral2/memory/4564-0-0x0000000000220000-0x000000000024B000-memory.dmp upx behavioral2/memory/4564-2789-0x0000000000220000-0x000000000024B000-memory.dmp upx behavioral2/memory/4564-2790-0x0000000000220000-0x000000000024B000-memory.dmp upx behavioral2/memory/4564-2794-0x0000000000220000-0x000000000024B000-memory.dmp upx -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 82b336cd120ef07d8df5a3e3fa082bcca8b5c0a3481fae78cb5dd29072979f69.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 11DE.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe -
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 ONENOTE.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz ONENOTE.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString ONENOTE.EXE -
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS ONENOTE.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily ONENOTE.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU ONENOTE.EXE -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4564 82b336cd120ef07d8df5a3e3fa082bcca8b5c0a3481fae78cb5dd29072979f69.exe 4564 82b336cd120ef07d8df5a3e3fa082bcca8b5c0a3481fae78cb5dd29072979f69.exe 4564 82b336cd120ef07d8df5a3e3fa082bcca8b5c0a3481fae78cb5dd29072979f69.exe 4564 82b336cd120ef07d8df5a3e3fa082bcca8b5c0a3481fae78cb5dd29072979f69.exe 4564 82b336cd120ef07d8df5a3e3fa082bcca8b5c0a3481fae78cb5dd29072979f69.exe 4564 82b336cd120ef07d8df5a3e3fa082bcca8b5c0a3481fae78cb5dd29072979f69.exe 4564 82b336cd120ef07d8df5a3e3fa082bcca8b5c0a3481fae78cb5dd29072979f69.exe 4564 82b336cd120ef07d8df5a3e3fa082bcca8b5c0a3481fae78cb5dd29072979f69.exe 4564 82b336cd120ef07d8df5a3e3fa082bcca8b5c0a3481fae78cb5dd29072979f69.exe 4564 82b336cd120ef07d8df5a3e3fa082bcca8b5c0a3481fae78cb5dd29072979f69.exe 4564 82b336cd120ef07d8df5a3e3fa082bcca8b5c0a3481fae78cb5dd29072979f69.exe 4564 82b336cd120ef07d8df5a3e3fa082bcca8b5c0a3481fae78cb5dd29072979f69.exe 4564 82b336cd120ef07d8df5a3e3fa082bcca8b5c0a3481fae78cb5dd29072979f69.exe 4564 82b336cd120ef07d8df5a3e3fa082bcca8b5c0a3481fae78cb5dd29072979f69.exe 4564 82b336cd120ef07d8df5a3e3fa082bcca8b5c0a3481fae78cb5dd29072979f69.exe 4564 82b336cd120ef07d8df5a3e3fa082bcca8b5c0a3481fae78cb5dd29072979f69.exe 4564 82b336cd120ef07d8df5a3e3fa082bcca8b5c0a3481fae78cb5dd29072979f69.exe 4564 82b336cd120ef07d8df5a3e3fa082bcca8b5c0a3481fae78cb5dd29072979f69.exe 4564 82b336cd120ef07d8df5a3e3fa082bcca8b5c0a3481fae78cb5dd29072979f69.exe 4564 82b336cd120ef07d8df5a3e3fa082bcca8b5c0a3481fae78cb5dd29072979f69.exe 4564 82b336cd120ef07d8df5a3e3fa082bcca8b5c0a3481fae78cb5dd29072979f69.exe 4564 82b336cd120ef07d8df5a3e3fa082bcca8b5c0a3481fae78cb5dd29072979f69.exe 4564 82b336cd120ef07d8df5a3e3fa082bcca8b5c0a3481fae78cb5dd29072979f69.exe 4564 82b336cd120ef07d8df5a3e3fa082bcca8b5c0a3481fae78cb5dd29072979f69.exe 4564 82b336cd120ef07d8df5a3e3fa082bcca8b5c0a3481fae78cb5dd29072979f69.exe 4564 82b336cd120ef07d8df5a3e3fa082bcca8b5c0a3481fae78cb5dd29072979f69.exe 4564 82b336cd120ef07d8df5a3e3fa082bcca8b5c0a3481fae78cb5dd29072979f69.exe 4564 82b336cd120ef07d8df5a3e3fa082bcca8b5c0a3481fae78cb5dd29072979f69.exe 4564 82b336cd120ef07d8df5a3e3fa082bcca8b5c0a3481fae78cb5dd29072979f69.exe 4564 82b336cd120ef07d8df5a3e3fa082bcca8b5c0a3481fae78cb5dd29072979f69.exe 4564 82b336cd120ef07d8df5a3e3fa082bcca8b5c0a3481fae78cb5dd29072979f69.exe 4564 82b336cd120ef07d8df5a3e3fa082bcca8b5c0a3481fae78cb5dd29072979f69.exe 4564 82b336cd120ef07d8df5a3e3fa082bcca8b5c0a3481fae78cb5dd29072979f69.exe 4564 82b336cd120ef07d8df5a3e3fa082bcca8b5c0a3481fae78cb5dd29072979f69.exe 4564 82b336cd120ef07d8df5a3e3fa082bcca8b5c0a3481fae78cb5dd29072979f69.exe 4564 82b336cd120ef07d8df5a3e3fa082bcca8b5c0a3481fae78cb5dd29072979f69.exe 4564 82b336cd120ef07d8df5a3e3fa082bcca8b5c0a3481fae78cb5dd29072979f69.exe 4564 82b336cd120ef07d8df5a3e3fa082bcca8b5c0a3481fae78cb5dd29072979f69.exe 4564 82b336cd120ef07d8df5a3e3fa082bcca8b5c0a3481fae78cb5dd29072979f69.exe 4564 82b336cd120ef07d8df5a3e3fa082bcca8b5c0a3481fae78cb5dd29072979f69.exe 4564 82b336cd120ef07d8df5a3e3fa082bcca8b5c0a3481fae78cb5dd29072979f69.exe 4564 82b336cd120ef07d8df5a3e3fa082bcca8b5c0a3481fae78cb5dd29072979f69.exe 4564 82b336cd120ef07d8df5a3e3fa082bcca8b5c0a3481fae78cb5dd29072979f69.exe 4564 82b336cd120ef07d8df5a3e3fa082bcca8b5c0a3481fae78cb5dd29072979f69.exe 4564 82b336cd120ef07d8df5a3e3fa082bcca8b5c0a3481fae78cb5dd29072979f69.exe 4564 82b336cd120ef07d8df5a3e3fa082bcca8b5c0a3481fae78cb5dd29072979f69.exe 4564 82b336cd120ef07d8df5a3e3fa082bcca8b5c0a3481fae78cb5dd29072979f69.exe 4564 82b336cd120ef07d8df5a3e3fa082bcca8b5c0a3481fae78cb5dd29072979f69.exe 4564 82b336cd120ef07d8df5a3e3fa082bcca8b5c0a3481fae78cb5dd29072979f69.exe 4564 82b336cd120ef07d8df5a3e3fa082bcca8b5c0a3481fae78cb5dd29072979f69.exe 4564 82b336cd120ef07d8df5a3e3fa082bcca8b5c0a3481fae78cb5dd29072979f69.exe 4564 82b336cd120ef07d8df5a3e3fa082bcca8b5c0a3481fae78cb5dd29072979f69.exe 4564 82b336cd120ef07d8df5a3e3fa082bcca8b5c0a3481fae78cb5dd29072979f69.exe 4564 82b336cd120ef07d8df5a3e3fa082bcca8b5c0a3481fae78cb5dd29072979f69.exe 4564 82b336cd120ef07d8df5a3e3fa082bcca8b5c0a3481fae78cb5dd29072979f69.exe 4564 82b336cd120ef07d8df5a3e3fa082bcca8b5c0a3481fae78cb5dd29072979f69.exe 4564 82b336cd120ef07d8df5a3e3fa082bcca8b5c0a3481fae78cb5dd29072979f69.exe 4564 82b336cd120ef07d8df5a3e3fa082bcca8b5c0a3481fae78cb5dd29072979f69.exe 4564 82b336cd120ef07d8df5a3e3fa082bcca8b5c0a3481fae78cb5dd29072979f69.exe 4564 82b336cd120ef07d8df5a3e3fa082bcca8b5c0a3481fae78cb5dd29072979f69.exe 4564 82b336cd120ef07d8df5a3e3fa082bcca8b5c0a3481fae78cb5dd29072979f69.exe 4564 82b336cd120ef07d8df5a3e3fa082bcca8b5c0a3481fae78cb5dd29072979f69.exe 4564 82b336cd120ef07d8df5a3e3fa082bcca8b5c0a3481fae78cb5dd29072979f69.exe 4564 82b336cd120ef07d8df5a3e3fa082bcca8b5c0a3481fae78cb5dd29072979f69.exe -
Suspicious behavior: RenamesItself 26 IoCs
pid Process 3756 11DE.tmp 3756 11DE.tmp 3756 11DE.tmp 3756 11DE.tmp 3756 11DE.tmp 3756 11DE.tmp 3756 11DE.tmp 3756 11DE.tmp 3756 11DE.tmp 3756 11DE.tmp 3756 11DE.tmp 3756 11DE.tmp 3756 11DE.tmp 3756 11DE.tmp 3756 11DE.tmp 3756 11DE.tmp 3756 11DE.tmp 3756 11DE.tmp 3756 11DE.tmp 3756 11DE.tmp 3756 11DE.tmp 3756 11DE.tmp 3756 11DE.tmp 3756 11DE.tmp 3756 11DE.tmp 3756 11DE.tmp -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeAssignPrimaryTokenPrivilege 4564 82b336cd120ef07d8df5a3e3fa082bcca8b5c0a3481fae78cb5dd29072979f69.exe Token: SeBackupPrivilege 4564 82b336cd120ef07d8df5a3e3fa082bcca8b5c0a3481fae78cb5dd29072979f69.exe Token: SeDebugPrivilege 4564 82b336cd120ef07d8df5a3e3fa082bcca8b5c0a3481fae78cb5dd29072979f69.exe Token: 36 4564 82b336cd120ef07d8df5a3e3fa082bcca8b5c0a3481fae78cb5dd29072979f69.exe Token: SeImpersonatePrivilege 4564 82b336cd120ef07d8df5a3e3fa082bcca8b5c0a3481fae78cb5dd29072979f69.exe Token: SeIncBasePriorityPrivilege 4564 82b336cd120ef07d8df5a3e3fa082bcca8b5c0a3481fae78cb5dd29072979f69.exe Token: SeIncreaseQuotaPrivilege 4564 82b336cd120ef07d8df5a3e3fa082bcca8b5c0a3481fae78cb5dd29072979f69.exe Token: 33 4564 82b336cd120ef07d8df5a3e3fa082bcca8b5c0a3481fae78cb5dd29072979f69.exe Token: SeManageVolumePrivilege 4564 82b336cd120ef07d8df5a3e3fa082bcca8b5c0a3481fae78cb5dd29072979f69.exe Token: SeProfSingleProcessPrivilege 4564 82b336cd120ef07d8df5a3e3fa082bcca8b5c0a3481fae78cb5dd29072979f69.exe Token: SeRestorePrivilege 4564 82b336cd120ef07d8df5a3e3fa082bcca8b5c0a3481fae78cb5dd29072979f69.exe Token: SeSecurityPrivilege 4564 82b336cd120ef07d8df5a3e3fa082bcca8b5c0a3481fae78cb5dd29072979f69.exe Token: SeSystemProfilePrivilege 4564 82b336cd120ef07d8df5a3e3fa082bcca8b5c0a3481fae78cb5dd29072979f69.exe Token: SeTakeOwnershipPrivilege 4564 82b336cd120ef07d8df5a3e3fa082bcca8b5c0a3481fae78cb5dd29072979f69.exe Token: SeShutdownPrivilege 4564 82b336cd120ef07d8df5a3e3fa082bcca8b5c0a3481fae78cb5dd29072979f69.exe Token: SeDebugPrivilege 4564 82b336cd120ef07d8df5a3e3fa082bcca8b5c0a3481fae78cb5dd29072979f69.exe Token: SeBackupPrivilege 4564 82b336cd120ef07d8df5a3e3fa082bcca8b5c0a3481fae78cb5dd29072979f69.exe Token: SeBackupPrivilege 4564 82b336cd120ef07d8df5a3e3fa082bcca8b5c0a3481fae78cb5dd29072979f69.exe Token: SeSecurityPrivilege 4564 82b336cd120ef07d8df5a3e3fa082bcca8b5c0a3481fae78cb5dd29072979f69.exe Token: SeSecurityPrivilege 4564 82b336cd120ef07d8df5a3e3fa082bcca8b5c0a3481fae78cb5dd29072979f69.exe Token: SeBackupPrivilege 4564 82b336cd120ef07d8df5a3e3fa082bcca8b5c0a3481fae78cb5dd29072979f69.exe Token: SeBackupPrivilege 4564 82b336cd120ef07d8df5a3e3fa082bcca8b5c0a3481fae78cb5dd29072979f69.exe Token: SeSecurityPrivilege 4564 82b336cd120ef07d8df5a3e3fa082bcca8b5c0a3481fae78cb5dd29072979f69.exe Token: SeSecurityPrivilege 4564 82b336cd120ef07d8df5a3e3fa082bcca8b5c0a3481fae78cb5dd29072979f69.exe Token: SeBackupPrivilege 4564 82b336cd120ef07d8df5a3e3fa082bcca8b5c0a3481fae78cb5dd29072979f69.exe Token: SeBackupPrivilege 4564 82b336cd120ef07d8df5a3e3fa082bcca8b5c0a3481fae78cb5dd29072979f69.exe Token: SeSecurityPrivilege 4564 82b336cd120ef07d8df5a3e3fa082bcca8b5c0a3481fae78cb5dd29072979f69.exe Token: SeSecurityPrivilege 4564 82b336cd120ef07d8df5a3e3fa082bcca8b5c0a3481fae78cb5dd29072979f69.exe Token: SeBackupPrivilege 4564 82b336cd120ef07d8df5a3e3fa082bcca8b5c0a3481fae78cb5dd29072979f69.exe Token: SeBackupPrivilege 4564 82b336cd120ef07d8df5a3e3fa082bcca8b5c0a3481fae78cb5dd29072979f69.exe Token: SeSecurityPrivilege 4564 82b336cd120ef07d8df5a3e3fa082bcca8b5c0a3481fae78cb5dd29072979f69.exe Token: SeSecurityPrivilege 4564 82b336cd120ef07d8df5a3e3fa082bcca8b5c0a3481fae78cb5dd29072979f69.exe Token: SeBackupPrivilege 4564 82b336cd120ef07d8df5a3e3fa082bcca8b5c0a3481fae78cb5dd29072979f69.exe Token: SeBackupPrivilege 4564 82b336cd120ef07d8df5a3e3fa082bcca8b5c0a3481fae78cb5dd29072979f69.exe Token: SeSecurityPrivilege 4564 82b336cd120ef07d8df5a3e3fa082bcca8b5c0a3481fae78cb5dd29072979f69.exe Token: SeSecurityPrivilege 4564 82b336cd120ef07d8df5a3e3fa082bcca8b5c0a3481fae78cb5dd29072979f69.exe Token: SeBackupPrivilege 4564 82b336cd120ef07d8df5a3e3fa082bcca8b5c0a3481fae78cb5dd29072979f69.exe Token: SeBackupPrivilege 4564 82b336cd120ef07d8df5a3e3fa082bcca8b5c0a3481fae78cb5dd29072979f69.exe Token: SeSecurityPrivilege 4564 82b336cd120ef07d8df5a3e3fa082bcca8b5c0a3481fae78cb5dd29072979f69.exe Token: SeSecurityPrivilege 4564 82b336cd120ef07d8df5a3e3fa082bcca8b5c0a3481fae78cb5dd29072979f69.exe Token: SeBackupPrivilege 4564 82b336cd120ef07d8df5a3e3fa082bcca8b5c0a3481fae78cb5dd29072979f69.exe Token: SeBackupPrivilege 4564 82b336cd120ef07d8df5a3e3fa082bcca8b5c0a3481fae78cb5dd29072979f69.exe Token: SeSecurityPrivilege 4564 82b336cd120ef07d8df5a3e3fa082bcca8b5c0a3481fae78cb5dd29072979f69.exe Token: SeSecurityPrivilege 4564 82b336cd120ef07d8df5a3e3fa082bcca8b5c0a3481fae78cb5dd29072979f69.exe Token: SeBackupPrivilege 4564 82b336cd120ef07d8df5a3e3fa082bcca8b5c0a3481fae78cb5dd29072979f69.exe Token: SeBackupPrivilege 4564 82b336cd120ef07d8df5a3e3fa082bcca8b5c0a3481fae78cb5dd29072979f69.exe Token: SeSecurityPrivilege 4564 82b336cd120ef07d8df5a3e3fa082bcca8b5c0a3481fae78cb5dd29072979f69.exe Token: SeSecurityPrivilege 4564 82b336cd120ef07d8df5a3e3fa082bcca8b5c0a3481fae78cb5dd29072979f69.exe Token: SeBackupPrivilege 4564 82b336cd120ef07d8df5a3e3fa082bcca8b5c0a3481fae78cb5dd29072979f69.exe Token: SeBackupPrivilege 4564 82b336cd120ef07d8df5a3e3fa082bcca8b5c0a3481fae78cb5dd29072979f69.exe Token: SeSecurityPrivilege 4564 82b336cd120ef07d8df5a3e3fa082bcca8b5c0a3481fae78cb5dd29072979f69.exe Token: SeSecurityPrivilege 4564 82b336cd120ef07d8df5a3e3fa082bcca8b5c0a3481fae78cb5dd29072979f69.exe Token: SeBackupPrivilege 4564 82b336cd120ef07d8df5a3e3fa082bcca8b5c0a3481fae78cb5dd29072979f69.exe Token: SeBackupPrivilege 4564 82b336cd120ef07d8df5a3e3fa082bcca8b5c0a3481fae78cb5dd29072979f69.exe Token: SeSecurityPrivilege 4564 82b336cd120ef07d8df5a3e3fa082bcca8b5c0a3481fae78cb5dd29072979f69.exe Token: SeSecurityPrivilege 4564 82b336cd120ef07d8df5a3e3fa082bcca8b5c0a3481fae78cb5dd29072979f69.exe Token: SeBackupPrivilege 4564 82b336cd120ef07d8df5a3e3fa082bcca8b5c0a3481fae78cb5dd29072979f69.exe Token: SeBackupPrivilege 4564 82b336cd120ef07d8df5a3e3fa082bcca8b5c0a3481fae78cb5dd29072979f69.exe Token: SeSecurityPrivilege 4564 82b336cd120ef07d8df5a3e3fa082bcca8b5c0a3481fae78cb5dd29072979f69.exe Token: SeSecurityPrivilege 4564 82b336cd120ef07d8df5a3e3fa082bcca8b5c0a3481fae78cb5dd29072979f69.exe Token: SeBackupPrivilege 4564 82b336cd120ef07d8df5a3e3fa082bcca8b5c0a3481fae78cb5dd29072979f69.exe Token: SeBackupPrivilege 4564 82b336cd120ef07d8df5a3e3fa082bcca8b5c0a3481fae78cb5dd29072979f69.exe Token: SeSecurityPrivilege 4564 82b336cd120ef07d8df5a3e3fa082bcca8b5c0a3481fae78cb5dd29072979f69.exe Token: SeSecurityPrivilege 4564 82b336cd120ef07d8df5a3e3fa082bcca8b5c0a3481fae78cb5dd29072979f69.exe -
Suspicious use of SetWindowsHookEx 13 IoCs
pid Process 1580 ONENOTE.EXE 1580 ONENOTE.EXE 1580 ONENOTE.EXE 1580 ONENOTE.EXE 1580 ONENOTE.EXE 1580 ONENOTE.EXE 1580 ONENOTE.EXE 1580 ONENOTE.EXE 1580 ONENOTE.EXE 1580 ONENOTE.EXE 1580 ONENOTE.EXE 1580 ONENOTE.EXE 1580 ONENOTE.EXE -
Suspicious use of WriteProcessMemory 11 IoCs
description pid Process procid_target PID 4564 wrote to memory of 2948 4564 82b336cd120ef07d8df5a3e3fa082bcca8b5c0a3481fae78cb5dd29072979f69.exe 97 PID 4564 wrote to memory of 2948 4564 82b336cd120ef07d8df5a3e3fa082bcca8b5c0a3481fae78cb5dd29072979f69.exe 97 PID 4564 wrote to memory of 3756 4564 82b336cd120ef07d8df5a3e3fa082bcca8b5c0a3481fae78cb5dd29072979f69.exe 106 PID 4564 wrote to memory of 3756 4564 82b336cd120ef07d8df5a3e3fa082bcca8b5c0a3481fae78cb5dd29072979f69.exe 106 PID 4564 wrote to memory of 3756 4564 82b336cd120ef07d8df5a3e3fa082bcca8b5c0a3481fae78cb5dd29072979f69.exe 106 PID 4564 wrote to memory of 3756 4564 82b336cd120ef07d8df5a3e3fa082bcca8b5c0a3481fae78cb5dd29072979f69.exe 106 PID 1612 wrote to memory of 1580 1612 printfilterpipelinesvc.exe 105 PID 1612 wrote to memory of 1580 1612 printfilterpipelinesvc.exe 105 PID 3756 wrote to memory of 372 3756 11DE.tmp 108 PID 3756 wrote to memory of 372 3756 11DE.tmp 108 PID 3756 wrote to memory of 372 3756 11DE.tmp 108
Processes
-
C:\Users\Admin\AppData\Local\Temp\82b336cd120ef07d8df5a3e3fa082bcca8b5c0a3481fae78cb5dd29072979f69.exe"C:\Users\Admin\AppData\Local\Temp\82b336cd120ef07d8df5a3e3fa082bcca8b5c0a3481fae78cb5dd29072979f69.exe"1⤵
- Drops desktop.ini file(s)
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4564 -
C:\Windows\splwow64.exeC:\Windows\splwow64.exe 122882⤵
- Drops file in System32 directory
PID:2948
-
-
C:\ProgramData\11DE.tmp"C:\ProgramData\11DE.tmp"2⤵
- Checks computer location settings
- Deletes itself
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:3756 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C DEL /F /Q C:\PROGRA~3\11DE.tmp >> NUL3⤵
- System Location Discovery: System Language Discovery
PID:372
-
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k PrintWorkflow -s PrintWorkflowUserSvc1⤵PID:4528
-
C:\Windows\system32\printfilterpipelinesvc.exeC:\Windows\system32\printfilterpipelinesvc.exe -Embedding1⤵
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:1612 -
C:\Program Files\Microsoft Office\root\Office16\ONENOTE.EXE/insertdoc "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\{B4B27ADD-D8D1-4D77-8D7F-220E6A9F7744}.xps" 1337654509844000002⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious use of SetWindowsHookEx
PID:1580
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
129B
MD5092a391bb462d35f2aa5208c338c80f5
SHA1b253925e05f782a44452633ccadfb8b3ed131d17
SHA256a0fecfe87a4887cb06ee966111e2ccb668992601df655802eaf3c38963120aa9
SHA512d46ce0f4b9a01cfa3953e1b74fda0c33131d9a5e7d3bba0b4466a03a8d940305d580befbdb3c85c176372f96bb995a367904dd3361293cc438fcb199ed4c7e78
-
Filesize
1KB
MD5b5bd1e1b4c7121f3f56fc3d72e504dd2
SHA1dbfaa7a22f5323bf9934591bb9355255438f9705
SHA256a47a606ecfe7209126b4a8d439f52507638f125371cc2e6b2509603ee1ca140e
SHA512599ea6ff80b624c994be8b782f94a80f282e5946466ba0ac30e328f5c7ef1899ce7be578cdccdd6de8e85f1992d84a126e685bd992cb7e0a14a0e15189470f4e
-
Filesize
14KB
MD5294e9f64cb1642dd89229fff0592856b
SHA197b148c27f3da29ba7b18d6aee8a0db9102f47c9
SHA256917e115cc403e29b4388e0d175cbfac3e7e40ca1742299fbdb353847db2de7c2
SHA512b87d531890bf1577b9b4af41dddb2cdbbfa164cf197bd5987df3a3075983645a3acba443e289b7bfd338422978a104f55298fbfe346872de0895bde44adc89cf
-
C:\Users\Admin\AppData\Local\Temp\DDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDD
Filesize90KB
MD55b90fac0f04a7f754124bfe23b406fe4
SHA18e6753188e5abe4aec6c6905f716d2fbc31786a3
SHA256854c87e6ea1971035ae41c96b404cb7d3989290f6c6d0c4d56f3c290605b4847
SHA512009f95b4c88592d13193f81e099c0e882ad5b36ec90ab9e13fd249b8fd9d2cb73d78855631fbe4ec1237c69cb45cf933db7979cb799f2fa6c610e9bfa02a58b9
-
Filesize
4KB
MD5e19000ed56df7a0d321450efa7c0bb51
SHA1e3b865f235f4942325e4987637288aa2d61c5bb6
SHA256d1eb1769e01b4b55186b9bee8f7322acd864ae007b8efd79812282cc57e66c88
SHA5120dc29f75bb23a612597fd83d0a650db1c2dea3f4a6584a537dba75cfa57d99c16c3e9dc5a5822fc15bd4caec730049b18d03709c00bcd1079bbe0e318f5649da
-
Filesize
4KB
MD5c05c634f35a55c45c6e36c9b16fd2fab
SHA1502c47350e2d4e213e9dc057607cdb878b12a319
SHA2562cb98a8072bd607c5b81689eec42a8ea545919a6d5b6cdfc103d7296ae866753
SHA5125a4c212077510ea813fc3036d79bcd63d294eac203cff6bbb86f458f68eb19c41cb02a8fd22946760d2a03f4fd9bbe1b35c5317f8c835bab09be5214b8526a1a
-
Filesize
129B
MD5873934097ec0c8b7a35ce55d6564f28e
SHA1fc8036f52377ba3f9cf71103f21c4f91f87a117c
SHA2560716f3c8ed35ce61a098ce84a0cac97293512eba7d3c97d7abf9d3170420f726
SHA5124ba09e3659836d20edbaced57cee42a8cfdda928a0bf3ef0ad9f196c131bf422faec0c52da9435f7a948a2f7818d08a6c574112f407c4544e8759474185238af