Malware Analysis Report

2024-11-30 11:28

Sample ID 241120-dk6b9aygph
Target 88169b1d4778ed6c5fda97375efb5b9171ea52649c8715bb449801c39bce4ad4.exe
SHA256 88169b1d4778ed6c5fda97375efb5b9171ea52649c8715bb449801c39bce4ad4
Tags
dragonforce defense_evasion discovery ransomware spyware stealer lockbit
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

88169b1d4778ed6c5fda97375efb5b9171ea52649c8715bb449801c39bce4ad4

Threat Level: Known bad

The file 88169b1d4778ed6c5fda97375efb5b9171ea52649c8715bb449801c39bce4ad4.exe was found to be: Known bad.

Malicious Activity Summary

dragonforce defense_evasion discovery ransomware spyware stealer lockbit

Lockbit family

DragonForce

Dragonforce family

Rule to detect Lockbit 3.0 ransomware Windows payload

Reads user/profile data of web browsers

Deletes itself

Checks computer location settings

Executes dropped EXE

Loads dropped DLL

Drops desktop.ini file(s)

Indicator Removal: File Deletion

Drops file in System32 directory

Suspicious use of NtSetInformationThreadHideFromDebugger

Enumerates physical storage devices

System Location Discovery: System Language Discovery

Unsigned PE

Enumerates system info in registry

Suspicious use of SetWindowsHookEx

Suspicious behavior: EnumeratesProcesses

Suspicious behavior: RenamesItself

Suspicious use of WriteProcessMemory

Suspicious use of AdjustPrivilegeToken

Checks processor information in registry

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-11-20 03:05

Signatures

Lockbit family

lockbit

Rule to detect Lockbit 3.0 ransomware Windows payload

Description Indicator Process Target
N/A N/A N/A N/A

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral2

Detonation Overview

Submitted

2024-11-20 03:05

Reported

2024-11-20 03:09

Platform

win10v2004-20241007-en

Max time kernel

148s

Max time network

146s

Command Line

"C:\Users\Admin\AppData\Local\Temp\88169b1d4778ed6c5fda97375efb5b9171ea52649c8715bb449801c39bce4ad4.exe"

Signatures

DragonForce

ransomware dragonforce

Dragonforce family

dragonforce

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\Control Panel\International\Geo\Nation C:\ProgramData\EFFE.tmp N/A

Deletes itself

Description Indicator Process Target
N/A N/A C:\ProgramData\EFFE.tmp N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\ProgramData\EFFE.tmp N/A

Reads user/profile data of web browsers

spyware stealer

Drops desktop.ini file(s)

Description Indicator Process Target
File opened for modification F:\$RECYCLE.BIN\S-1-5-21-3350944739-639801879-157714471-1000\desktop.ini C:\Users\Admin\AppData\Local\Temp\88169b1d4778ed6c5fda97375efb5b9171ea52649c8715bb449801c39bce4ad4.exe N/A
File opened for modification C:\$Recycle.Bin\S-1-5-21-3350944739-639801879-157714471-1000\desktop.ini C:\Users\Admin\AppData\Local\Temp\88169b1d4778ed6c5fda97375efb5b9171ea52649c8715bb449801c39bce4ad4.exe N/A

Indicator Removal: File Deletion

defense_evasion

Drops file in System32 directory

Description Indicator Process Target
File created C:\Windows\system32\spool\PRINTERS\00002.SPL C:\Windows\splwow64.exe N/A
File created C:\Windows\system32\spool\PRINTERS\PPppu4ilvd0buo0sv0lkom1tdmd.TMP C:\Windows\system32\printfilterpipelinesvc.exe N/A
File created C:\Windows\system32\spool\PRINTERS\PPu_kl39hjyc10ru9kxmsbrlfu.TMP C:\Windows\system32\printfilterpipelinesvc.exe N/A
File created C:\Windows\system32\spool\PRINTERS\PPvw3amzicqirnzqwch9kq9vm5.TMP C:\Windows\system32\printfilterpipelinesvc.exe N/A

Enumerates physical storage devices

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\88169b1d4778ed6c5fda97375efb5b9171ea52649c8715bb449801c39bce4ad4.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\ProgramData\EFFE.tmp N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A

Checks processor information in registry

Description Indicator Process Target
Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 C:\Program Files\Microsoft Office\root\Office16\ONENOTE.EXE N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz C:\Program Files\Microsoft Office\root\Office16\ONENOTE.EXE N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString C:\Program Files\Microsoft Office\root\Office16\ONENOTE.EXE N/A

Enumerates system info in registry

Description Indicator Process Target
Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS C:\Program Files\Microsoft Office\root\Office16\ONENOTE.EXE N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily C:\Program Files\Microsoft Office\root\Office16\ONENOTE.EXE N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU C:\Program Files\Microsoft Office\root\Office16\ONENOTE.EXE N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\88169b1d4778ed6c5fda97375efb5b9171ea52649c8715bb449801c39bce4ad4.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\88169b1d4778ed6c5fda97375efb5b9171ea52649c8715bb449801c39bce4ad4.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\88169b1d4778ed6c5fda97375efb5b9171ea52649c8715bb449801c39bce4ad4.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\88169b1d4778ed6c5fda97375efb5b9171ea52649c8715bb449801c39bce4ad4.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\88169b1d4778ed6c5fda97375efb5b9171ea52649c8715bb449801c39bce4ad4.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\88169b1d4778ed6c5fda97375efb5b9171ea52649c8715bb449801c39bce4ad4.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\88169b1d4778ed6c5fda97375efb5b9171ea52649c8715bb449801c39bce4ad4.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\88169b1d4778ed6c5fda97375efb5b9171ea52649c8715bb449801c39bce4ad4.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\88169b1d4778ed6c5fda97375efb5b9171ea52649c8715bb449801c39bce4ad4.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\88169b1d4778ed6c5fda97375efb5b9171ea52649c8715bb449801c39bce4ad4.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\88169b1d4778ed6c5fda97375efb5b9171ea52649c8715bb449801c39bce4ad4.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\88169b1d4778ed6c5fda97375efb5b9171ea52649c8715bb449801c39bce4ad4.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\88169b1d4778ed6c5fda97375efb5b9171ea52649c8715bb449801c39bce4ad4.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\88169b1d4778ed6c5fda97375efb5b9171ea52649c8715bb449801c39bce4ad4.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\88169b1d4778ed6c5fda97375efb5b9171ea52649c8715bb449801c39bce4ad4.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\88169b1d4778ed6c5fda97375efb5b9171ea52649c8715bb449801c39bce4ad4.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\88169b1d4778ed6c5fda97375efb5b9171ea52649c8715bb449801c39bce4ad4.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\88169b1d4778ed6c5fda97375efb5b9171ea52649c8715bb449801c39bce4ad4.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\88169b1d4778ed6c5fda97375efb5b9171ea52649c8715bb449801c39bce4ad4.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\88169b1d4778ed6c5fda97375efb5b9171ea52649c8715bb449801c39bce4ad4.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\88169b1d4778ed6c5fda97375efb5b9171ea52649c8715bb449801c39bce4ad4.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\88169b1d4778ed6c5fda97375efb5b9171ea52649c8715bb449801c39bce4ad4.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\88169b1d4778ed6c5fda97375efb5b9171ea52649c8715bb449801c39bce4ad4.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\88169b1d4778ed6c5fda97375efb5b9171ea52649c8715bb449801c39bce4ad4.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\88169b1d4778ed6c5fda97375efb5b9171ea52649c8715bb449801c39bce4ad4.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\88169b1d4778ed6c5fda97375efb5b9171ea52649c8715bb449801c39bce4ad4.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\88169b1d4778ed6c5fda97375efb5b9171ea52649c8715bb449801c39bce4ad4.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\88169b1d4778ed6c5fda97375efb5b9171ea52649c8715bb449801c39bce4ad4.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\88169b1d4778ed6c5fda97375efb5b9171ea52649c8715bb449801c39bce4ad4.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\88169b1d4778ed6c5fda97375efb5b9171ea52649c8715bb449801c39bce4ad4.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\88169b1d4778ed6c5fda97375efb5b9171ea52649c8715bb449801c39bce4ad4.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\88169b1d4778ed6c5fda97375efb5b9171ea52649c8715bb449801c39bce4ad4.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\88169b1d4778ed6c5fda97375efb5b9171ea52649c8715bb449801c39bce4ad4.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\88169b1d4778ed6c5fda97375efb5b9171ea52649c8715bb449801c39bce4ad4.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\88169b1d4778ed6c5fda97375efb5b9171ea52649c8715bb449801c39bce4ad4.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\88169b1d4778ed6c5fda97375efb5b9171ea52649c8715bb449801c39bce4ad4.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\88169b1d4778ed6c5fda97375efb5b9171ea52649c8715bb449801c39bce4ad4.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\88169b1d4778ed6c5fda97375efb5b9171ea52649c8715bb449801c39bce4ad4.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\88169b1d4778ed6c5fda97375efb5b9171ea52649c8715bb449801c39bce4ad4.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\88169b1d4778ed6c5fda97375efb5b9171ea52649c8715bb449801c39bce4ad4.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\88169b1d4778ed6c5fda97375efb5b9171ea52649c8715bb449801c39bce4ad4.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\88169b1d4778ed6c5fda97375efb5b9171ea52649c8715bb449801c39bce4ad4.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\88169b1d4778ed6c5fda97375efb5b9171ea52649c8715bb449801c39bce4ad4.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\88169b1d4778ed6c5fda97375efb5b9171ea52649c8715bb449801c39bce4ad4.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\88169b1d4778ed6c5fda97375efb5b9171ea52649c8715bb449801c39bce4ad4.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\88169b1d4778ed6c5fda97375efb5b9171ea52649c8715bb449801c39bce4ad4.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\88169b1d4778ed6c5fda97375efb5b9171ea52649c8715bb449801c39bce4ad4.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\88169b1d4778ed6c5fda97375efb5b9171ea52649c8715bb449801c39bce4ad4.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\88169b1d4778ed6c5fda97375efb5b9171ea52649c8715bb449801c39bce4ad4.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\88169b1d4778ed6c5fda97375efb5b9171ea52649c8715bb449801c39bce4ad4.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\88169b1d4778ed6c5fda97375efb5b9171ea52649c8715bb449801c39bce4ad4.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\88169b1d4778ed6c5fda97375efb5b9171ea52649c8715bb449801c39bce4ad4.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\88169b1d4778ed6c5fda97375efb5b9171ea52649c8715bb449801c39bce4ad4.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\88169b1d4778ed6c5fda97375efb5b9171ea52649c8715bb449801c39bce4ad4.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\88169b1d4778ed6c5fda97375efb5b9171ea52649c8715bb449801c39bce4ad4.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\88169b1d4778ed6c5fda97375efb5b9171ea52649c8715bb449801c39bce4ad4.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\88169b1d4778ed6c5fda97375efb5b9171ea52649c8715bb449801c39bce4ad4.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\88169b1d4778ed6c5fda97375efb5b9171ea52649c8715bb449801c39bce4ad4.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\88169b1d4778ed6c5fda97375efb5b9171ea52649c8715bb449801c39bce4ad4.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\88169b1d4778ed6c5fda97375efb5b9171ea52649c8715bb449801c39bce4ad4.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\88169b1d4778ed6c5fda97375efb5b9171ea52649c8715bb449801c39bce4ad4.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\88169b1d4778ed6c5fda97375efb5b9171ea52649c8715bb449801c39bce4ad4.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\88169b1d4778ed6c5fda97375efb5b9171ea52649c8715bb449801c39bce4ad4.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\88169b1d4778ed6c5fda97375efb5b9171ea52649c8715bb449801c39bce4ad4.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeAssignPrimaryTokenPrivilege N/A C:\Users\Admin\AppData\Local\Temp\88169b1d4778ed6c5fda97375efb5b9171ea52649c8715bb449801c39bce4ad4.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\88169b1d4778ed6c5fda97375efb5b9171ea52649c8715bb449801c39bce4ad4.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\88169b1d4778ed6c5fda97375efb5b9171ea52649c8715bb449801c39bce4ad4.exe N/A
Token: 36 N/A C:\Users\Admin\AppData\Local\Temp\88169b1d4778ed6c5fda97375efb5b9171ea52649c8715bb449801c39bce4ad4.exe N/A
Token: SeImpersonatePrivilege N/A C:\Users\Admin\AppData\Local\Temp\88169b1d4778ed6c5fda97375efb5b9171ea52649c8715bb449801c39bce4ad4.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\88169b1d4778ed6c5fda97375efb5b9171ea52649c8715bb449801c39bce4ad4.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Users\Admin\AppData\Local\Temp\88169b1d4778ed6c5fda97375efb5b9171ea52649c8715bb449801c39bce4ad4.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Local\Temp\88169b1d4778ed6c5fda97375efb5b9171ea52649c8715bb449801c39bce4ad4.exe N/A
Token: SeManageVolumePrivilege N/A C:\Users\Admin\AppData\Local\Temp\88169b1d4778ed6c5fda97375efb5b9171ea52649c8715bb449801c39bce4ad4.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Users\Admin\AppData\Local\Temp\88169b1d4778ed6c5fda97375efb5b9171ea52649c8715bb449801c39bce4ad4.exe N/A
Token: SeRestorePrivilege N/A C:\Users\Admin\AppData\Local\Temp\88169b1d4778ed6c5fda97375efb5b9171ea52649c8715bb449801c39bce4ad4.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\88169b1d4778ed6c5fda97375efb5b9171ea52649c8715bb449801c39bce4ad4.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Users\Admin\AppData\Local\Temp\88169b1d4778ed6c5fda97375efb5b9171ea52649c8715bb449801c39bce4ad4.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Users\Admin\AppData\Local\Temp\88169b1d4778ed6c5fda97375efb5b9171ea52649c8715bb449801c39bce4ad4.exe N/A
Token: SeShutdownPrivilege N/A C:\Users\Admin\AppData\Local\Temp\88169b1d4778ed6c5fda97375efb5b9171ea52649c8715bb449801c39bce4ad4.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\88169b1d4778ed6c5fda97375efb5b9171ea52649c8715bb449801c39bce4ad4.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\88169b1d4778ed6c5fda97375efb5b9171ea52649c8715bb449801c39bce4ad4.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\88169b1d4778ed6c5fda97375efb5b9171ea52649c8715bb449801c39bce4ad4.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\88169b1d4778ed6c5fda97375efb5b9171ea52649c8715bb449801c39bce4ad4.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\88169b1d4778ed6c5fda97375efb5b9171ea52649c8715bb449801c39bce4ad4.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\88169b1d4778ed6c5fda97375efb5b9171ea52649c8715bb449801c39bce4ad4.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\88169b1d4778ed6c5fda97375efb5b9171ea52649c8715bb449801c39bce4ad4.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\88169b1d4778ed6c5fda97375efb5b9171ea52649c8715bb449801c39bce4ad4.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\88169b1d4778ed6c5fda97375efb5b9171ea52649c8715bb449801c39bce4ad4.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\88169b1d4778ed6c5fda97375efb5b9171ea52649c8715bb449801c39bce4ad4.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\88169b1d4778ed6c5fda97375efb5b9171ea52649c8715bb449801c39bce4ad4.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\88169b1d4778ed6c5fda97375efb5b9171ea52649c8715bb449801c39bce4ad4.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\88169b1d4778ed6c5fda97375efb5b9171ea52649c8715bb449801c39bce4ad4.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\88169b1d4778ed6c5fda97375efb5b9171ea52649c8715bb449801c39bce4ad4.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\88169b1d4778ed6c5fda97375efb5b9171ea52649c8715bb449801c39bce4ad4.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\88169b1d4778ed6c5fda97375efb5b9171ea52649c8715bb449801c39bce4ad4.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\88169b1d4778ed6c5fda97375efb5b9171ea52649c8715bb449801c39bce4ad4.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\88169b1d4778ed6c5fda97375efb5b9171ea52649c8715bb449801c39bce4ad4.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\88169b1d4778ed6c5fda97375efb5b9171ea52649c8715bb449801c39bce4ad4.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\88169b1d4778ed6c5fda97375efb5b9171ea52649c8715bb449801c39bce4ad4.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\88169b1d4778ed6c5fda97375efb5b9171ea52649c8715bb449801c39bce4ad4.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\88169b1d4778ed6c5fda97375efb5b9171ea52649c8715bb449801c39bce4ad4.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\88169b1d4778ed6c5fda97375efb5b9171ea52649c8715bb449801c39bce4ad4.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\88169b1d4778ed6c5fda97375efb5b9171ea52649c8715bb449801c39bce4ad4.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\88169b1d4778ed6c5fda97375efb5b9171ea52649c8715bb449801c39bce4ad4.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\88169b1d4778ed6c5fda97375efb5b9171ea52649c8715bb449801c39bce4ad4.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\88169b1d4778ed6c5fda97375efb5b9171ea52649c8715bb449801c39bce4ad4.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\88169b1d4778ed6c5fda97375efb5b9171ea52649c8715bb449801c39bce4ad4.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\88169b1d4778ed6c5fda97375efb5b9171ea52649c8715bb449801c39bce4ad4.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\88169b1d4778ed6c5fda97375efb5b9171ea52649c8715bb449801c39bce4ad4.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\88169b1d4778ed6c5fda97375efb5b9171ea52649c8715bb449801c39bce4ad4.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\88169b1d4778ed6c5fda97375efb5b9171ea52649c8715bb449801c39bce4ad4.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\88169b1d4778ed6c5fda97375efb5b9171ea52649c8715bb449801c39bce4ad4.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\88169b1d4778ed6c5fda97375efb5b9171ea52649c8715bb449801c39bce4ad4.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\88169b1d4778ed6c5fda97375efb5b9171ea52649c8715bb449801c39bce4ad4.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\88169b1d4778ed6c5fda97375efb5b9171ea52649c8715bb449801c39bce4ad4.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\88169b1d4778ed6c5fda97375efb5b9171ea52649c8715bb449801c39bce4ad4.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\88169b1d4778ed6c5fda97375efb5b9171ea52649c8715bb449801c39bce4ad4.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\88169b1d4778ed6c5fda97375efb5b9171ea52649c8715bb449801c39bce4ad4.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\88169b1d4778ed6c5fda97375efb5b9171ea52649c8715bb449801c39bce4ad4.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\88169b1d4778ed6c5fda97375efb5b9171ea52649c8715bb449801c39bce4ad4.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\88169b1d4778ed6c5fda97375efb5b9171ea52649c8715bb449801c39bce4ad4.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\88169b1d4778ed6c5fda97375efb5b9171ea52649c8715bb449801c39bce4ad4.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\88169b1d4778ed6c5fda97375efb5b9171ea52649c8715bb449801c39bce4ad4.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\88169b1d4778ed6c5fda97375efb5b9171ea52649c8715bb449801c39bce4ad4.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\88169b1d4778ed6c5fda97375efb5b9171ea52649c8715bb449801c39bce4ad4.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\88169b1d4778ed6c5fda97375efb5b9171ea52649c8715bb449801c39bce4ad4.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\88169b1d4778ed6c5fda97375efb5b9171ea52649c8715bb449801c39bce4ad4.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\88169b1d4778ed6c5fda97375efb5b9171ea52649c8715bb449801c39bce4ad4.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 1416 wrote to memory of 3656 N/A C:\Users\Admin\AppData\Local\Temp\88169b1d4778ed6c5fda97375efb5b9171ea52649c8715bb449801c39bce4ad4.exe C:\Windows\splwow64.exe
PID 1416 wrote to memory of 3656 N/A C:\Users\Admin\AppData\Local\Temp\88169b1d4778ed6c5fda97375efb5b9171ea52649c8715bb449801c39bce4ad4.exe C:\Windows\splwow64.exe
PID 5052 wrote to memory of 3508 N/A C:\Windows\system32\printfilterpipelinesvc.exe C:\Program Files\Microsoft Office\root\Office16\ONENOTE.EXE
PID 5052 wrote to memory of 3508 N/A C:\Windows\system32\printfilterpipelinesvc.exe C:\Program Files\Microsoft Office\root\Office16\ONENOTE.EXE
PID 1416 wrote to memory of 4860 N/A C:\Users\Admin\AppData\Local\Temp\88169b1d4778ed6c5fda97375efb5b9171ea52649c8715bb449801c39bce4ad4.exe C:\ProgramData\EFFE.tmp
PID 1416 wrote to memory of 4860 N/A C:\Users\Admin\AppData\Local\Temp\88169b1d4778ed6c5fda97375efb5b9171ea52649c8715bb449801c39bce4ad4.exe C:\ProgramData\EFFE.tmp
PID 1416 wrote to memory of 4860 N/A C:\Users\Admin\AppData\Local\Temp\88169b1d4778ed6c5fda97375efb5b9171ea52649c8715bb449801c39bce4ad4.exe C:\ProgramData\EFFE.tmp
PID 1416 wrote to memory of 4860 N/A C:\Users\Admin\AppData\Local\Temp\88169b1d4778ed6c5fda97375efb5b9171ea52649c8715bb449801c39bce4ad4.exe C:\ProgramData\EFFE.tmp
PID 4860 wrote to memory of 4372 N/A C:\ProgramData\EFFE.tmp C:\Windows\SysWOW64\cmd.exe
PID 4860 wrote to memory of 4372 N/A C:\ProgramData\EFFE.tmp C:\Windows\SysWOW64\cmd.exe
PID 4860 wrote to memory of 4372 N/A C:\ProgramData\EFFE.tmp C:\Windows\SysWOW64\cmd.exe

Processes

C:\Users\Admin\AppData\Local\Temp\88169b1d4778ed6c5fda97375efb5b9171ea52649c8715bb449801c39bce4ad4.exe

"C:\Users\Admin\AppData\Local\Temp\88169b1d4778ed6c5fda97375efb5b9171ea52649c8715bb449801c39bce4ad4.exe"

C:\Windows\splwow64.exe

C:\Windows\splwow64.exe 12288

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k PrintWorkflow -s PrintWorkflowUserSvc

C:\Windows\system32\printfilterpipelinesvc.exe

C:\Windows\system32\printfilterpipelinesvc.exe -Embedding

C:\Program Files\Microsoft Office\root\Office16\ONENOTE.EXE

/insertdoc "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\{92676B96-F9D2-457C-875F-3AB7511BD19A}.xps" 133765456349200000

C:\ProgramData\EFFE.tmp

"C:\ProgramData\EFFE.tmp"

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /C DEL /F /Q C:\PROGRA~3\EFFE.tmp >> NUL

Network

Country Destination Domain Proto
US 8.8.8.8:53 8.8.8.8.in-addr.arpa udp
US 8.8.8.8:53 28.118.140.52.in-addr.arpa udp
US 8.8.8.8:53 180.129.81.91.in-addr.arpa udp
US 8.8.8.8:53 73.159.190.20.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 209.205.72.20.in-addr.arpa udp
US 8.8.8.8:53 46.28.109.52.in-addr.arpa udp
US 8.8.8.8:53 roaming.officeapps.live.com udp
GB 52.109.28.47:443 roaming.officeapps.live.com tcp
US 8.8.8.8:53 47.28.109.52.in-addr.arpa udp
US 8.8.8.8:53 31.73.42.20.in-addr.arpa udp
US 8.8.8.8:53 212.20.149.52.in-addr.arpa udp
US 8.8.8.8:53 198.187.3.20.in-addr.arpa udp
US 8.8.8.8:53 65.139.73.23.in-addr.arpa udp
US 8.8.8.8:53 172.210.232.199.in-addr.arpa udp

Files

memory/1416-1-0x0000000000E00000-0x0000000000E10000-memory.dmp

memory/1416-2-0x0000000000E00000-0x0000000000E10000-memory.dmp

memory/1416-0-0x0000000000E00000-0x0000000000E10000-memory.dmp

C:\$Recycle.Bin\S-1-5-21-3350944739-639801879-157714471-1000\VVVVVVVVVVV

MD5 8204f6696bbc86e1ed3629a3f239f109
SHA1 64f90148f80d47bbafdc9bea76ac3da25c8e1c60
SHA256 10926126950871459b2573cf7d0b4e3c8bc38746a297c296d7aba314c8783f5b
SHA512 6161517d1963a386c82dcfdee39a68f14400b727cdf96977c356b3173db3810b4529eb649aedc0d4b81f7860df372c79f898d2f9d0634098bf2f6880767f6d54

C:\EUPTJQjet.README.txt

MD5 f73e450397ba139b8480f6d7d5b3e208
SHA1 5e543b0ecd3398710d2350ebe0d2deaf353547e5
SHA256 33ac7af74efacf750458988118a80a6809728e2578d3ba4dab7e7b70bc15f154
SHA512 25612f4f1b2283d624862a3e67149f85a32860b1e2b5d496f9292bb6a7e67d6ab1cccb9b4e7e9b24c12d9a7a869be771a715c402ad94aa97ada5f46532d73c11

F:\$RECYCLE.BIN\S-1-5-21-3350944739-639801879-157714471-1000\DDDDDDDDDDD

MD5 4ddea199648c2b9b4faf8a9df81f8322
SHA1 7df2cd333a52299fbd21d308b22f76c89a0dc7ca
SHA256 7642e2c889ac9b58f8a4af5bddc849e86bf8234fd1187c7b89c0ed19dd046927
SHA512 a87d0c544e25038f82929b333c6c4950f0411fbe20070cdd3ea42abb11510a3de28abdd4897a8ef67d74dbeae294c2e0e92133881f8580729e9eb1c6ab557add

memory/1416-2923-0x0000000000E00000-0x0000000000E10000-memory.dmp

memory/1416-2922-0x0000000000E00000-0x0000000000E10000-memory.dmp

memory/1416-2921-0x0000000000E00000-0x0000000000E10000-memory.dmp

C:\ProgramData\EFFE.tmp

MD5 294e9f64cb1642dd89229fff0592856b
SHA1 97b148c27f3da29ba7b18d6aee8a0db9102f47c9
SHA256 917e115cc403e29b4388e0d175cbfac3e7e40ca1742299fbdb353847db2de7c2
SHA512 b87d531890bf1577b9b4af41dddb2cdbbfa164cf197bd5987df3a3075983645a3acba443e289b7bfd338422978a104f55298fbfe346872de0895bde44adc89cf

memory/3508-2942-0x00007FFFBF090000-0x00007FFFBF0A0000-memory.dmp

memory/3508-2941-0x00007FFFBF090000-0x00007FFFBF0A0000-memory.dmp

memory/3508-2940-0x00007FFFBF090000-0x00007FFFBF0A0000-memory.dmp

memory/3508-2939-0x00007FFFBF090000-0x00007FFFBF0A0000-memory.dmp

memory/3508-2938-0x00007FFFBF090000-0x00007FFFBF0A0000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\DDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDD

MD5 288b1e88ef28159eab2743b4b9107cbc
SHA1 e4d4a6bea200ae1beda545f125106a1ade853273
SHA256 6788bfd02ea8666fb61efb093d5546fb915df4d5113918201ae08b4adb990e3d
SHA512 6b9cf9bff4e464e86b603f19c544b27748bb5f1507b6b4c9e26f755359be969925577f4352e70e756bc624eba6430e0c373e6c19ad622ba1c1b609aa11f2e120

memory/3508-2971-0x00007FFFBC9D0000-0x00007FFFBC9E0000-memory.dmp

memory/3508-2972-0x00007FFFBC9D0000-0x00007FFFBC9E0000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\{C1F9D5BD-A5A2-4703-8ED4-694A19CF5C47}

MD5 2b0782fff3042c0faeaa0b9d9648f2b8
SHA1 d455973d6777a4331e62dfa6a0e6bdc2669665db
SHA256 457661644dde9d3ae7a5be0fbde691ef2789034f94dc22ec1de8869162c1b9ae
SHA512 1d8415ce41cd45858555eb669f7b1e8b225ccf7c8153b57e884a186549302abdf2780b72fcfd3ff46955e147e05a83185fba8cdc52e2ada84eb2a3a332c15ae5

C:\Users\Admin\Documents\OneNote Notebooks\My Notebook\Open Notebook.onetoc2

MD5 8bea2437242d000fd6d9efc982c54442
SHA1 6a274318a5874e6b2c2510c7428a79b97dba1bd2
SHA256 c9f32056ca63771d7f5bda16781e36401c0f3d8459e36839b97e0d74d95418ac
SHA512 dcf6c92a2f3e910c90dd18948c02e200615c2e2f3b0f2434526edf0ccda33ea4ea1de57be853aa35621979c78ca38105e205cd7ad7a42633ac8cfea26f3551bc

Analysis: behavioral1

Detonation Overview

Submitted

2024-11-20 03:05

Reported

2024-11-20 03:08

Platform

win7-20240903-en

Max time kernel

121s

Max time network

123s

Command Line

"C:\Users\Admin\AppData\Local\Temp\88169b1d4778ed6c5fda97375efb5b9171ea52649c8715bb449801c39bce4ad4.exe"

Signatures

DragonForce

ransomware dragonforce

Dragonforce family

dragonforce

Deletes itself

Description Indicator Process Target
N/A N/A C:\ProgramData\B97F.tmp N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\ProgramData\B97F.tmp N/A

Reads user/profile data of web browsers

spyware stealer

Drops desktop.ini file(s)

Description Indicator Process Target
File opened for modification C:\$Recycle.Bin\S-1-5-21-3533259084-2542256011-65585152-1000\desktop.ini C:\Users\Admin\AppData\Local\Temp\88169b1d4778ed6c5fda97375efb5b9171ea52649c8715bb449801c39bce4ad4.exe N/A
File opened for modification F:\$RECYCLE.BIN\S-1-5-21-3533259084-2542256011-65585152-1000\desktop.ini C:\Users\Admin\AppData\Local\Temp\88169b1d4778ed6c5fda97375efb5b9171ea52649c8715bb449801c39bce4ad4.exe N/A

Indicator Removal: File Deletion

defense_evasion

Enumerates physical storage devices

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\88169b1d4778ed6c5fda97375efb5b9171ea52649c8715bb449801c39bce4ad4.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\ProgramData\B97F.tmp N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeAssignPrimaryTokenPrivilege N/A C:\Users\Admin\AppData\Local\Temp\88169b1d4778ed6c5fda97375efb5b9171ea52649c8715bb449801c39bce4ad4.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\88169b1d4778ed6c5fda97375efb5b9171ea52649c8715bb449801c39bce4ad4.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\88169b1d4778ed6c5fda97375efb5b9171ea52649c8715bb449801c39bce4ad4.exe N/A
Token: 36 N/A C:\Users\Admin\AppData\Local\Temp\88169b1d4778ed6c5fda97375efb5b9171ea52649c8715bb449801c39bce4ad4.exe N/A
Token: SeImpersonatePrivilege N/A C:\Users\Admin\AppData\Local\Temp\88169b1d4778ed6c5fda97375efb5b9171ea52649c8715bb449801c39bce4ad4.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\88169b1d4778ed6c5fda97375efb5b9171ea52649c8715bb449801c39bce4ad4.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Users\Admin\AppData\Local\Temp\88169b1d4778ed6c5fda97375efb5b9171ea52649c8715bb449801c39bce4ad4.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Local\Temp\88169b1d4778ed6c5fda97375efb5b9171ea52649c8715bb449801c39bce4ad4.exe N/A
Token: SeManageVolumePrivilege N/A C:\Users\Admin\AppData\Local\Temp\88169b1d4778ed6c5fda97375efb5b9171ea52649c8715bb449801c39bce4ad4.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Users\Admin\AppData\Local\Temp\88169b1d4778ed6c5fda97375efb5b9171ea52649c8715bb449801c39bce4ad4.exe N/A
Token: SeRestorePrivilege N/A C:\Users\Admin\AppData\Local\Temp\88169b1d4778ed6c5fda97375efb5b9171ea52649c8715bb449801c39bce4ad4.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\88169b1d4778ed6c5fda97375efb5b9171ea52649c8715bb449801c39bce4ad4.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Users\Admin\AppData\Local\Temp\88169b1d4778ed6c5fda97375efb5b9171ea52649c8715bb449801c39bce4ad4.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Users\Admin\AppData\Local\Temp\88169b1d4778ed6c5fda97375efb5b9171ea52649c8715bb449801c39bce4ad4.exe N/A
Token: SeShutdownPrivilege N/A C:\Users\Admin\AppData\Local\Temp\88169b1d4778ed6c5fda97375efb5b9171ea52649c8715bb449801c39bce4ad4.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\88169b1d4778ed6c5fda97375efb5b9171ea52649c8715bb449801c39bce4ad4.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\88169b1d4778ed6c5fda97375efb5b9171ea52649c8715bb449801c39bce4ad4.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\88169b1d4778ed6c5fda97375efb5b9171ea52649c8715bb449801c39bce4ad4.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\88169b1d4778ed6c5fda97375efb5b9171ea52649c8715bb449801c39bce4ad4.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\88169b1d4778ed6c5fda97375efb5b9171ea52649c8715bb449801c39bce4ad4.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\88169b1d4778ed6c5fda97375efb5b9171ea52649c8715bb449801c39bce4ad4.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\88169b1d4778ed6c5fda97375efb5b9171ea52649c8715bb449801c39bce4ad4.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\88169b1d4778ed6c5fda97375efb5b9171ea52649c8715bb449801c39bce4ad4.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\88169b1d4778ed6c5fda97375efb5b9171ea52649c8715bb449801c39bce4ad4.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\88169b1d4778ed6c5fda97375efb5b9171ea52649c8715bb449801c39bce4ad4.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\88169b1d4778ed6c5fda97375efb5b9171ea52649c8715bb449801c39bce4ad4.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\88169b1d4778ed6c5fda97375efb5b9171ea52649c8715bb449801c39bce4ad4.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\88169b1d4778ed6c5fda97375efb5b9171ea52649c8715bb449801c39bce4ad4.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\88169b1d4778ed6c5fda97375efb5b9171ea52649c8715bb449801c39bce4ad4.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\88169b1d4778ed6c5fda97375efb5b9171ea52649c8715bb449801c39bce4ad4.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\88169b1d4778ed6c5fda97375efb5b9171ea52649c8715bb449801c39bce4ad4.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\88169b1d4778ed6c5fda97375efb5b9171ea52649c8715bb449801c39bce4ad4.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\88169b1d4778ed6c5fda97375efb5b9171ea52649c8715bb449801c39bce4ad4.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\88169b1d4778ed6c5fda97375efb5b9171ea52649c8715bb449801c39bce4ad4.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\88169b1d4778ed6c5fda97375efb5b9171ea52649c8715bb449801c39bce4ad4.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\88169b1d4778ed6c5fda97375efb5b9171ea52649c8715bb449801c39bce4ad4.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\88169b1d4778ed6c5fda97375efb5b9171ea52649c8715bb449801c39bce4ad4.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\88169b1d4778ed6c5fda97375efb5b9171ea52649c8715bb449801c39bce4ad4.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\88169b1d4778ed6c5fda97375efb5b9171ea52649c8715bb449801c39bce4ad4.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\88169b1d4778ed6c5fda97375efb5b9171ea52649c8715bb449801c39bce4ad4.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\88169b1d4778ed6c5fda97375efb5b9171ea52649c8715bb449801c39bce4ad4.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\88169b1d4778ed6c5fda97375efb5b9171ea52649c8715bb449801c39bce4ad4.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\88169b1d4778ed6c5fda97375efb5b9171ea52649c8715bb449801c39bce4ad4.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\88169b1d4778ed6c5fda97375efb5b9171ea52649c8715bb449801c39bce4ad4.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\88169b1d4778ed6c5fda97375efb5b9171ea52649c8715bb449801c39bce4ad4.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\88169b1d4778ed6c5fda97375efb5b9171ea52649c8715bb449801c39bce4ad4.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\88169b1d4778ed6c5fda97375efb5b9171ea52649c8715bb449801c39bce4ad4.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\88169b1d4778ed6c5fda97375efb5b9171ea52649c8715bb449801c39bce4ad4.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\88169b1d4778ed6c5fda97375efb5b9171ea52649c8715bb449801c39bce4ad4.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\88169b1d4778ed6c5fda97375efb5b9171ea52649c8715bb449801c39bce4ad4.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\88169b1d4778ed6c5fda97375efb5b9171ea52649c8715bb449801c39bce4ad4.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\88169b1d4778ed6c5fda97375efb5b9171ea52649c8715bb449801c39bce4ad4.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\88169b1d4778ed6c5fda97375efb5b9171ea52649c8715bb449801c39bce4ad4.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\88169b1d4778ed6c5fda97375efb5b9171ea52649c8715bb449801c39bce4ad4.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\88169b1d4778ed6c5fda97375efb5b9171ea52649c8715bb449801c39bce4ad4.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\88169b1d4778ed6c5fda97375efb5b9171ea52649c8715bb449801c39bce4ad4.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\88169b1d4778ed6c5fda97375efb5b9171ea52649c8715bb449801c39bce4ad4.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\88169b1d4778ed6c5fda97375efb5b9171ea52649c8715bb449801c39bce4ad4.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\88169b1d4778ed6c5fda97375efb5b9171ea52649c8715bb449801c39bce4ad4.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\88169b1d4778ed6c5fda97375efb5b9171ea52649c8715bb449801c39bce4ad4.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\88169b1d4778ed6c5fda97375efb5b9171ea52649c8715bb449801c39bce4ad4.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\88169b1d4778ed6c5fda97375efb5b9171ea52649c8715bb449801c39bce4ad4.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\88169b1d4778ed6c5fda97375efb5b9171ea52649c8715bb449801c39bce4ad4.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\88169b1d4778ed6c5fda97375efb5b9171ea52649c8715bb449801c39bce4ad4.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\88169b1d4778ed6c5fda97375efb5b9171ea52649c8715bb449801c39bce4ad4.exe

"C:\Users\Admin\AppData\Local\Temp\88169b1d4778ed6c5fda97375efb5b9171ea52649c8715bb449801c39bce4ad4.exe"

C:\ProgramData\B97F.tmp

"C:\ProgramData\B97F.tmp"

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /C DEL /F /Q C:\PROGRA~3\B97F.tmp >> NUL

C:\Windows\system32\AUDIODG.EXE

C:\Windows\system32\AUDIODG.EXE 0x14c

Network

N/A

Files

memory/1968-0-0x0000000000680000-0x00000000006C0000-memory.dmp

C:\$Recycle.Bin\S-1-5-21-3533259084-2542256011-65585152-1000\BBBBBBBBBBB

MD5 15c6785918aabee4e5c187a3ed295523
SHA1 b21a73657dfeafa2d7a6670d3cc990d2b6f19538
SHA256 2295cee8eb122c1741bfc23d42488ba8f03e15e697c2fd7025601a03c0db58c2
SHA512 ace1d31b850a4a518bad4003d062f45d865e4528d853a897cea3cd8e31091bf9621ef62fe06f4f4e382a850e2e0e16e17995b82361c15aceaffc9a1c268319dd

C:\EUPTJQjet.README.txt

MD5 0701460eb52ff312ec29d7d74a48ceef
SHA1 5209879e6a6b9302f5b4f902bbbe4af5b57aaf93
SHA256 9c236c1d970c2df7b431649e8174795d621a76de08653387b117a3cc16a2db1f
SHA512 dd4260e76e0e2e55278774994aa54c81570d822786ea97b2f1bfdb07ac10e84a287a5d8fd2b473624234a5253221e0400b69cdb45d25d86c8c6687c4497606cb

F:\$RECYCLE.BIN\S-1-5-21-3533259084-2542256011-65585152-1000\DDDDDDDDDDD

MD5 b4db56486de7a0184a08d169f8a8aee4
SHA1 6080396805a30fcbfa9b17b36d9768cc48a38bae
SHA256 49d1e211546e6a775385c7df48b86d20ece0513bee48eb9a01854881499a73c5
SHA512 58668aa2df32ae6f6b6c5a8a48a85cc6d2f64fa01f176c6c63857d1a747e1b4b5dee72c21028dd3794df33c3bd9d77597a5a2baa428a9277ab0abd7a13fa4451

\ProgramData\B97F.tmp

MD5 294e9f64cb1642dd89229fff0592856b
SHA1 97b148c27f3da29ba7b18d6aee8a0db9102f47c9
SHA256 917e115cc403e29b4388e0d175cbfac3e7e40ca1742299fbdb353847db2de7c2
SHA512 b87d531890bf1577b9b4af41dddb2cdbbfa164cf197bd5987df3a3075983645a3acba443e289b7bfd338422978a104f55298fbfe346872de0895bde44adc89cf

memory/1796-858-0x0000000000401000-0x0000000000404000-memory.dmp

memory/1796-861-0x0000000000400000-0x0000000000407000-memory.dmp

memory/1796-860-0x0000000000400000-0x0000000000407000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\DDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDD

MD5 2ef29d8ce6d7e506b07e0d53b16fb951
SHA1 9dfa9aa4d71ca9e23c344a295e70a1f56ad0162b
SHA256 fe367afd47e2c9706161ebea3eb9e6acdb564a4f764515e7492dafec0f2bbd93
SHA512 669ee057b198f20956da2feaff5b6da86a3c25402d06698dd34901a4c78da5cac9c171b63c4a8b702ac23992ad98d5f8a0fba412bf6e934c6a0644ad715f49b3