Analysis
-
max time kernel
95s -
max time network
142s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
23-11-2024 03:24
Behavioral task
behavioral1
Sample
c1e76af376454bab05e44634ca4e017e7607e41c9df6e067162d28064a1c7cd6.exe
Resource
win7-20240903-en
windows7-x64
11 signatures
150 seconds
Behavioral task
behavioral2
Sample
c1e76af376454bab05e44634ca4e017e7607e41c9df6e067162d28064a1c7cd6.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
15 signatures
150 seconds
General
-
Target
c1e76af376454bab05e44634ca4e017e7607e41c9df6e067162d28064a1c7cd6.exe
-
Size
145KB
-
MD5
913458a5e9eb4026c62609375b534227
-
SHA1
9739ae38effef090b3b558531e01bf2252bd018f
-
SHA256
c1e76af376454bab05e44634ca4e017e7607e41c9df6e067162d28064a1c7cd6
-
SHA512
5b653989cafdbd586216ccd11d243001b066b044df93478f574577f170b72a84b3831c89933c023ac458d8c2d4fb2fe4cdfcac0608806258150c3df101a79275
-
SSDEEP
1536:DzICS4AAwczUUf8y8gvMH+1zGSNAojMP95D1xDXcl74OOjAp31AyNpCSV6O9xv2T:cqJogYkcSNm9V7DG98YlXjCSV6O9R2T
Score
7/10
Malware Config
Signatures
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\Control Panel\International\Geo\Nation E919.tmp -
Executes dropped EXE 1 IoCs
pid Process 4504 E919.tmp -
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Drops desktop.ini file(s) 2 IoCs
description ioc Process File opened for modification C:\$Recycle.Bin\S-1-5-21-4050598569-1597076380-177084960-1000\desktop.ini c1e76af376454bab05e44634ca4e017e7607e41c9df6e067162d28064a1c7cd6.exe File opened for modification F:\$RECYCLE.BIN\S-1-5-21-4050598569-1597076380-177084960-1000\desktop.ini c1e76af376454bab05e44634ca4e017e7607e41c9df6e067162d28064a1c7cd6.exe -
Indicator Removal: File Deletion 1 TTPs
Adversaries may delete files left behind by the actions of their intrusion activity.
-
Drops file in System32 directory 4 IoCs
description ioc Process File created C:\Windows\system32\spool\PRINTERS\PP2b0ngi_ktjjxlk8blt_n0qrs.TMP printfilterpipelinesvc.exe File created C:\Windows\system32\spool\PRINTERS\PPr25_ctmsu0fc8kp6jj713m8cb.TMP printfilterpipelinesvc.exe File created C:\Windows\system32\spool\PRINTERS\PP2cnjrk12y8t7nbqldq4gazin.TMP printfilterpipelinesvc.exe File created C:\Windows\system32\spool\PRINTERS\00002.SPL splwow64.exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 6 IoCs
pid Process 4504 E919.tmp 4504 E919.tmp 4504 E919.tmp 4504 E919.tmp 4504 E919.tmp 4504 E919.tmp -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language c1e76af376454bab05e44634ca4e017e7607e41c9df6e067162d28064a1c7cd6.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E919.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe -
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 ONENOTE.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz ONENOTE.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString ONENOTE.EXE -
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS ONENOTE.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily ONENOTE.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU ONENOTE.EXE -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4724 c1e76af376454bab05e44634ca4e017e7607e41c9df6e067162d28064a1c7cd6.exe 4724 c1e76af376454bab05e44634ca4e017e7607e41c9df6e067162d28064a1c7cd6.exe 4724 c1e76af376454bab05e44634ca4e017e7607e41c9df6e067162d28064a1c7cd6.exe 4724 c1e76af376454bab05e44634ca4e017e7607e41c9df6e067162d28064a1c7cd6.exe 4724 c1e76af376454bab05e44634ca4e017e7607e41c9df6e067162d28064a1c7cd6.exe 4724 c1e76af376454bab05e44634ca4e017e7607e41c9df6e067162d28064a1c7cd6.exe 4724 c1e76af376454bab05e44634ca4e017e7607e41c9df6e067162d28064a1c7cd6.exe 4724 c1e76af376454bab05e44634ca4e017e7607e41c9df6e067162d28064a1c7cd6.exe 4724 c1e76af376454bab05e44634ca4e017e7607e41c9df6e067162d28064a1c7cd6.exe 4724 c1e76af376454bab05e44634ca4e017e7607e41c9df6e067162d28064a1c7cd6.exe 4724 c1e76af376454bab05e44634ca4e017e7607e41c9df6e067162d28064a1c7cd6.exe 4724 c1e76af376454bab05e44634ca4e017e7607e41c9df6e067162d28064a1c7cd6.exe 4724 c1e76af376454bab05e44634ca4e017e7607e41c9df6e067162d28064a1c7cd6.exe 4724 c1e76af376454bab05e44634ca4e017e7607e41c9df6e067162d28064a1c7cd6.exe 4724 c1e76af376454bab05e44634ca4e017e7607e41c9df6e067162d28064a1c7cd6.exe 4724 c1e76af376454bab05e44634ca4e017e7607e41c9df6e067162d28064a1c7cd6.exe 4724 c1e76af376454bab05e44634ca4e017e7607e41c9df6e067162d28064a1c7cd6.exe 4724 c1e76af376454bab05e44634ca4e017e7607e41c9df6e067162d28064a1c7cd6.exe 4724 c1e76af376454bab05e44634ca4e017e7607e41c9df6e067162d28064a1c7cd6.exe 4724 c1e76af376454bab05e44634ca4e017e7607e41c9df6e067162d28064a1c7cd6.exe 4724 c1e76af376454bab05e44634ca4e017e7607e41c9df6e067162d28064a1c7cd6.exe 4724 c1e76af376454bab05e44634ca4e017e7607e41c9df6e067162d28064a1c7cd6.exe 4724 c1e76af376454bab05e44634ca4e017e7607e41c9df6e067162d28064a1c7cd6.exe 4724 c1e76af376454bab05e44634ca4e017e7607e41c9df6e067162d28064a1c7cd6.exe 4724 c1e76af376454bab05e44634ca4e017e7607e41c9df6e067162d28064a1c7cd6.exe 4724 c1e76af376454bab05e44634ca4e017e7607e41c9df6e067162d28064a1c7cd6.exe 4724 c1e76af376454bab05e44634ca4e017e7607e41c9df6e067162d28064a1c7cd6.exe 4724 c1e76af376454bab05e44634ca4e017e7607e41c9df6e067162d28064a1c7cd6.exe 4724 c1e76af376454bab05e44634ca4e017e7607e41c9df6e067162d28064a1c7cd6.exe 4724 c1e76af376454bab05e44634ca4e017e7607e41c9df6e067162d28064a1c7cd6.exe 4724 c1e76af376454bab05e44634ca4e017e7607e41c9df6e067162d28064a1c7cd6.exe 4724 c1e76af376454bab05e44634ca4e017e7607e41c9df6e067162d28064a1c7cd6.exe 4724 c1e76af376454bab05e44634ca4e017e7607e41c9df6e067162d28064a1c7cd6.exe 4724 c1e76af376454bab05e44634ca4e017e7607e41c9df6e067162d28064a1c7cd6.exe 4724 c1e76af376454bab05e44634ca4e017e7607e41c9df6e067162d28064a1c7cd6.exe 4724 c1e76af376454bab05e44634ca4e017e7607e41c9df6e067162d28064a1c7cd6.exe 4724 c1e76af376454bab05e44634ca4e017e7607e41c9df6e067162d28064a1c7cd6.exe 4724 c1e76af376454bab05e44634ca4e017e7607e41c9df6e067162d28064a1c7cd6.exe 4724 c1e76af376454bab05e44634ca4e017e7607e41c9df6e067162d28064a1c7cd6.exe 4724 c1e76af376454bab05e44634ca4e017e7607e41c9df6e067162d28064a1c7cd6.exe 4724 c1e76af376454bab05e44634ca4e017e7607e41c9df6e067162d28064a1c7cd6.exe 4724 c1e76af376454bab05e44634ca4e017e7607e41c9df6e067162d28064a1c7cd6.exe 4724 c1e76af376454bab05e44634ca4e017e7607e41c9df6e067162d28064a1c7cd6.exe 4724 c1e76af376454bab05e44634ca4e017e7607e41c9df6e067162d28064a1c7cd6.exe 4724 c1e76af376454bab05e44634ca4e017e7607e41c9df6e067162d28064a1c7cd6.exe 4724 c1e76af376454bab05e44634ca4e017e7607e41c9df6e067162d28064a1c7cd6.exe 4724 c1e76af376454bab05e44634ca4e017e7607e41c9df6e067162d28064a1c7cd6.exe 4724 c1e76af376454bab05e44634ca4e017e7607e41c9df6e067162d28064a1c7cd6.exe 4724 c1e76af376454bab05e44634ca4e017e7607e41c9df6e067162d28064a1c7cd6.exe 4724 c1e76af376454bab05e44634ca4e017e7607e41c9df6e067162d28064a1c7cd6.exe 4724 c1e76af376454bab05e44634ca4e017e7607e41c9df6e067162d28064a1c7cd6.exe 4724 c1e76af376454bab05e44634ca4e017e7607e41c9df6e067162d28064a1c7cd6.exe 4724 c1e76af376454bab05e44634ca4e017e7607e41c9df6e067162d28064a1c7cd6.exe 4724 c1e76af376454bab05e44634ca4e017e7607e41c9df6e067162d28064a1c7cd6.exe 4724 c1e76af376454bab05e44634ca4e017e7607e41c9df6e067162d28064a1c7cd6.exe 4724 c1e76af376454bab05e44634ca4e017e7607e41c9df6e067162d28064a1c7cd6.exe 4724 c1e76af376454bab05e44634ca4e017e7607e41c9df6e067162d28064a1c7cd6.exe 4724 c1e76af376454bab05e44634ca4e017e7607e41c9df6e067162d28064a1c7cd6.exe 4724 c1e76af376454bab05e44634ca4e017e7607e41c9df6e067162d28064a1c7cd6.exe 4724 c1e76af376454bab05e44634ca4e017e7607e41c9df6e067162d28064a1c7cd6.exe 4724 c1e76af376454bab05e44634ca4e017e7607e41c9df6e067162d28064a1c7cd6.exe 4724 c1e76af376454bab05e44634ca4e017e7607e41c9df6e067162d28064a1c7cd6.exe 4724 c1e76af376454bab05e44634ca4e017e7607e41c9df6e067162d28064a1c7cd6.exe 4724 c1e76af376454bab05e44634ca4e017e7607e41c9df6e067162d28064a1c7cd6.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeAssignPrimaryTokenPrivilege 4724 c1e76af376454bab05e44634ca4e017e7607e41c9df6e067162d28064a1c7cd6.exe Token: SeBackupPrivilege 4724 c1e76af376454bab05e44634ca4e017e7607e41c9df6e067162d28064a1c7cd6.exe Token: SeDebugPrivilege 4724 c1e76af376454bab05e44634ca4e017e7607e41c9df6e067162d28064a1c7cd6.exe Token: 36 4724 c1e76af376454bab05e44634ca4e017e7607e41c9df6e067162d28064a1c7cd6.exe Token: SeImpersonatePrivilege 4724 c1e76af376454bab05e44634ca4e017e7607e41c9df6e067162d28064a1c7cd6.exe Token: SeIncBasePriorityPrivilege 4724 c1e76af376454bab05e44634ca4e017e7607e41c9df6e067162d28064a1c7cd6.exe Token: SeIncreaseQuotaPrivilege 4724 c1e76af376454bab05e44634ca4e017e7607e41c9df6e067162d28064a1c7cd6.exe Token: 33 4724 c1e76af376454bab05e44634ca4e017e7607e41c9df6e067162d28064a1c7cd6.exe Token: SeManageVolumePrivilege 4724 c1e76af376454bab05e44634ca4e017e7607e41c9df6e067162d28064a1c7cd6.exe Token: SeProfSingleProcessPrivilege 4724 c1e76af376454bab05e44634ca4e017e7607e41c9df6e067162d28064a1c7cd6.exe Token: SeRestorePrivilege 4724 c1e76af376454bab05e44634ca4e017e7607e41c9df6e067162d28064a1c7cd6.exe Token: SeSecurityPrivilege 4724 c1e76af376454bab05e44634ca4e017e7607e41c9df6e067162d28064a1c7cd6.exe Token: SeSystemProfilePrivilege 4724 c1e76af376454bab05e44634ca4e017e7607e41c9df6e067162d28064a1c7cd6.exe Token: SeTakeOwnershipPrivilege 4724 c1e76af376454bab05e44634ca4e017e7607e41c9df6e067162d28064a1c7cd6.exe Token: SeShutdownPrivilege 4724 c1e76af376454bab05e44634ca4e017e7607e41c9df6e067162d28064a1c7cd6.exe Token: SeBackupPrivilege 4724 c1e76af376454bab05e44634ca4e017e7607e41c9df6e067162d28064a1c7cd6.exe Token: SeBackupPrivilege 4724 c1e76af376454bab05e44634ca4e017e7607e41c9df6e067162d28064a1c7cd6.exe Token: SeSecurityPrivilege 4724 c1e76af376454bab05e44634ca4e017e7607e41c9df6e067162d28064a1c7cd6.exe Token: SeSecurityPrivilege 4724 c1e76af376454bab05e44634ca4e017e7607e41c9df6e067162d28064a1c7cd6.exe Token: SeBackupPrivilege 4724 c1e76af376454bab05e44634ca4e017e7607e41c9df6e067162d28064a1c7cd6.exe Token: SeBackupPrivilege 4724 c1e76af376454bab05e44634ca4e017e7607e41c9df6e067162d28064a1c7cd6.exe Token: SeSecurityPrivilege 4724 c1e76af376454bab05e44634ca4e017e7607e41c9df6e067162d28064a1c7cd6.exe Token: SeSecurityPrivilege 4724 c1e76af376454bab05e44634ca4e017e7607e41c9df6e067162d28064a1c7cd6.exe Token: SeBackupPrivilege 4724 c1e76af376454bab05e44634ca4e017e7607e41c9df6e067162d28064a1c7cd6.exe Token: SeBackupPrivilege 4724 c1e76af376454bab05e44634ca4e017e7607e41c9df6e067162d28064a1c7cd6.exe Token: SeSecurityPrivilege 4724 c1e76af376454bab05e44634ca4e017e7607e41c9df6e067162d28064a1c7cd6.exe Token: SeSecurityPrivilege 4724 c1e76af376454bab05e44634ca4e017e7607e41c9df6e067162d28064a1c7cd6.exe Token: SeBackupPrivilege 4724 c1e76af376454bab05e44634ca4e017e7607e41c9df6e067162d28064a1c7cd6.exe Token: SeBackupPrivilege 4724 c1e76af376454bab05e44634ca4e017e7607e41c9df6e067162d28064a1c7cd6.exe Token: SeSecurityPrivilege 4724 c1e76af376454bab05e44634ca4e017e7607e41c9df6e067162d28064a1c7cd6.exe Token: SeSecurityPrivilege 4724 c1e76af376454bab05e44634ca4e017e7607e41c9df6e067162d28064a1c7cd6.exe Token: SeBackupPrivilege 4724 c1e76af376454bab05e44634ca4e017e7607e41c9df6e067162d28064a1c7cd6.exe Token: SeBackupPrivilege 4724 c1e76af376454bab05e44634ca4e017e7607e41c9df6e067162d28064a1c7cd6.exe Token: SeSecurityPrivilege 4724 c1e76af376454bab05e44634ca4e017e7607e41c9df6e067162d28064a1c7cd6.exe Token: SeSecurityPrivilege 4724 c1e76af376454bab05e44634ca4e017e7607e41c9df6e067162d28064a1c7cd6.exe Token: SeBackupPrivilege 4724 c1e76af376454bab05e44634ca4e017e7607e41c9df6e067162d28064a1c7cd6.exe Token: SeBackupPrivilege 4724 c1e76af376454bab05e44634ca4e017e7607e41c9df6e067162d28064a1c7cd6.exe Token: SeSecurityPrivilege 4724 c1e76af376454bab05e44634ca4e017e7607e41c9df6e067162d28064a1c7cd6.exe Token: SeSecurityPrivilege 4724 c1e76af376454bab05e44634ca4e017e7607e41c9df6e067162d28064a1c7cd6.exe Token: SeBackupPrivilege 4724 c1e76af376454bab05e44634ca4e017e7607e41c9df6e067162d28064a1c7cd6.exe Token: SeBackupPrivilege 4724 c1e76af376454bab05e44634ca4e017e7607e41c9df6e067162d28064a1c7cd6.exe Token: SeSecurityPrivilege 4724 c1e76af376454bab05e44634ca4e017e7607e41c9df6e067162d28064a1c7cd6.exe Token: SeSecurityPrivilege 4724 c1e76af376454bab05e44634ca4e017e7607e41c9df6e067162d28064a1c7cd6.exe Token: SeBackupPrivilege 4724 c1e76af376454bab05e44634ca4e017e7607e41c9df6e067162d28064a1c7cd6.exe Token: SeBackupPrivilege 4724 c1e76af376454bab05e44634ca4e017e7607e41c9df6e067162d28064a1c7cd6.exe Token: SeSecurityPrivilege 4724 c1e76af376454bab05e44634ca4e017e7607e41c9df6e067162d28064a1c7cd6.exe Token: SeSecurityPrivilege 4724 c1e76af376454bab05e44634ca4e017e7607e41c9df6e067162d28064a1c7cd6.exe Token: SeBackupPrivilege 4724 c1e76af376454bab05e44634ca4e017e7607e41c9df6e067162d28064a1c7cd6.exe Token: SeBackupPrivilege 4724 c1e76af376454bab05e44634ca4e017e7607e41c9df6e067162d28064a1c7cd6.exe Token: SeSecurityPrivilege 4724 c1e76af376454bab05e44634ca4e017e7607e41c9df6e067162d28064a1c7cd6.exe Token: SeSecurityPrivilege 4724 c1e76af376454bab05e44634ca4e017e7607e41c9df6e067162d28064a1c7cd6.exe Token: SeBackupPrivilege 4724 c1e76af376454bab05e44634ca4e017e7607e41c9df6e067162d28064a1c7cd6.exe Token: SeBackupPrivilege 4724 c1e76af376454bab05e44634ca4e017e7607e41c9df6e067162d28064a1c7cd6.exe Token: SeSecurityPrivilege 4724 c1e76af376454bab05e44634ca4e017e7607e41c9df6e067162d28064a1c7cd6.exe Token: SeSecurityPrivilege 4724 c1e76af376454bab05e44634ca4e017e7607e41c9df6e067162d28064a1c7cd6.exe Token: SeBackupPrivilege 4724 c1e76af376454bab05e44634ca4e017e7607e41c9df6e067162d28064a1c7cd6.exe Token: SeBackupPrivilege 4724 c1e76af376454bab05e44634ca4e017e7607e41c9df6e067162d28064a1c7cd6.exe Token: SeSecurityPrivilege 4724 c1e76af376454bab05e44634ca4e017e7607e41c9df6e067162d28064a1c7cd6.exe Token: SeSecurityPrivilege 4724 c1e76af376454bab05e44634ca4e017e7607e41c9df6e067162d28064a1c7cd6.exe Token: SeBackupPrivilege 4724 c1e76af376454bab05e44634ca4e017e7607e41c9df6e067162d28064a1c7cd6.exe Token: SeBackupPrivilege 4724 c1e76af376454bab05e44634ca4e017e7607e41c9df6e067162d28064a1c7cd6.exe Token: SeSecurityPrivilege 4724 c1e76af376454bab05e44634ca4e017e7607e41c9df6e067162d28064a1c7cd6.exe Token: SeSecurityPrivilege 4724 c1e76af376454bab05e44634ca4e017e7607e41c9df6e067162d28064a1c7cd6.exe Token: SeBackupPrivilege 4724 c1e76af376454bab05e44634ca4e017e7607e41c9df6e067162d28064a1c7cd6.exe -
Suspicious use of SetWindowsHookEx 13 IoCs
pid Process 3840 ONENOTE.EXE 3840 ONENOTE.EXE 3840 ONENOTE.EXE 3840 ONENOTE.EXE 3840 ONENOTE.EXE 3840 ONENOTE.EXE 3840 ONENOTE.EXE 3840 ONENOTE.EXE 3840 ONENOTE.EXE 3840 ONENOTE.EXE 3840 ONENOTE.EXE 3840 ONENOTE.EXE 3840 ONENOTE.EXE -
Suspicious use of WriteProcessMemory 11 IoCs
description pid Process procid_target PID 4724 wrote to memory of 2080 4724 c1e76af376454bab05e44634ca4e017e7607e41c9df6e067162d28064a1c7cd6.exe 90 PID 4724 wrote to memory of 2080 4724 c1e76af376454bab05e44634ca4e017e7607e41c9df6e067162d28064a1c7cd6.exe 90 PID 1528 wrote to memory of 3840 1528 printfilterpipelinesvc.exe 93 PID 1528 wrote to memory of 3840 1528 printfilterpipelinesvc.exe 93 PID 4724 wrote to memory of 4504 4724 c1e76af376454bab05e44634ca4e017e7607e41c9df6e067162d28064a1c7cd6.exe 94 PID 4724 wrote to memory of 4504 4724 c1e76af376454bab05e44634ca4e017e7607e41c9df6e067162d28064a1c7cd6.exe 94 PID 4724 wrote to memory of 4504 4724 c1e76af376454bab05e44634ca4e017e7607e41c9df6e067162d28064a1c7cd6.exe 94 PID 4724 wrote to memory of 4504 4724 c1e76af376454bab05e44634ca4e017e7607e41c9df6e067162d28064a1c7cd6.exe 94 PID 4504 wrote to memory of 716 4504 E919.tmp 100 PID 4504 wrote to memory of 716 4504 E919.tmp 100 PID 4504 wrote to memory of 716 4504 E919.tmp 100
Processes
-
C:\Users\Admin\AppData\Local\Temp\c1e76af376454bab05e44634ca4e017e7607e41c9df6e067162d28064a1c7cd6.exe"C:\Users\Admin\AppData\Local\Temp\c1e76af376454bab05e44634ca4e017e7607e41c9df6e067162d28064a1c7cd6.exe"1⤵
- Drops desktop.ini file(s)
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4724 -
C:\Windows\splwow64.exeC:\Windows\splwow64.exe 122882⤵
- Drops file in System32 directory
PID:2080
-
-
C:\ProgramData\E919.tmp"C:\ProgramData\E919.tmp"2⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4504 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C DEL /F /Q C:\PROGRA~3\E919.tmp >> NUL3⤵
- System Location Discovery: System Language Discovery
PID:716
-
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k PrintWorkflow -s PrintWorkflowUserSvc1⤵PID:2564
-
C:\Windows\system32\printfilterpipelinesvc.exeC:\Windows\system32\printfilterpipelinesvc.exe -Embedding1⤵
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:1528 -
C:\Program Files\Microsoft Office\root\Office16\ONENOTE.EXE/insertdoc "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\{202E41C7-E542-4302-A725-25259E55C5DA}.xps" 1337680586427000002⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious use of SetWindowsHookEx
PID:3840
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
129B
MD54fc6c2cc67b8f5b9b788dc0d1d02c8ab
SHA17f7c54d8537f72fb9b6bf52d89105ba0e9526faa
SHA25683c904564b37508ecbf91042b5be12c24f7071b521379baa35cb6dad0f22af01
SHA51274914fcbc140c41efac934b95468bc707edffc4b8df7e320e701988c00ae5977a8e225d5483108dcf889e2bf7d6c2bcef84735e0bff979f45a80a647ef88f0fb
-
Filesize
452B
MD595568f7bd4a0e9fd9941c4921048a77c
SHA199f03265438326936abcbdfd2e1749bf4c6bbac9
SHA256245f37d6b20376964f906368a6884cb7bdc5904a43500e6a7f4c1f7b54c9bf9d
SHA5129991ff278e3768eb9bafaf64787b04bcaec7ef94aaff1e9a80a4e7558e35c35eb13b8fd6650e9dbfaa815b8e8e1e5a5de90e992d8b95f4eef08bde36731bae32
-
Filesize
14KB
MD5294e9f64cb1642dd89229fff0592856b
SHA197b148c27f3da29ba7b18d6aee8a0db9102f47c9
SHA256917e115cc403e29b4388e0d175cbfac3e7e40ca1742299fbdb353847db2de7c2
SHA512b87d531890bf1577b9b4af41dddb2cdbbfa164cf197bd5987df3a3075983645a3acba443e289b7bfd338422978a104f55298fbfe346872de0895bde44adc89cf
-
Filesize
4KB
MD5cf07a182731fc33b2fb4b75b697e2133
SHA13fe0dd65fe0d327e348a16c3409305acd6df48e5
SHA2560ed93904d60fcd074215390d49dd80819d4e9e3e6a803dffdb1dbc030dea6c30
SHA5129a46aa8712228a66b6b980dc47dbb65882cbf6aa2e74fe2e7061b762e524b96308bfa296a51a7e3a83972accdc73b27e5c99a2ebf18a25d9e7b81410c5b59f7b
-
Filesize
129B
MD551d8a1e7f8524e5e6585967e1912b0d2
SHA1be484002cf8a451e020f647978ac9130bdd0b4d8
SHA256a41a086ba3b91b5c87d82479fefbb72ebf42024450703690b77a5225b0fb2443
SHA5123c592997a7771565bd7d57e32dd5843ab914118a49c07381eb9c01ff65cfa34714da16cdb38bd84c98008996792d14627d209c488302d630411f9a6ccdc0837e