Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
84s -
max time network
141s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
10/01/2025, 12:41
Static task
static1
Behavioral task
behavioral1
Sample
6375e7e4c7cdc3f96afd991c4dfedd5cdfe4b31bf0662dccfa703c117e951f71.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
6375e7e4c7cdc3f96afd991c4dfedd5cdfe4b31bf0662dccfa703c117e951f71.exe
Resource
win10v2004-20241007-en
General
-
Target
6375e7e4c7cdc3f96afd991c4dfedd5cdfe4b31bf0662dccfa703c117e951f71.exe
-
Size
1.7MB
-
MD5
927426bafb84fe8daff84cff77258e0d
-
SHA1
320a91f6b810e4f5dbb38f58fd2949c780d4c807
-
SHA256
6375e7e4c7cdc3f96afd991c4dfedd5cdfe4b31bf0662dccfa703c117e951f71
-
SHA512
1eb9eb0e65a6cb5ea43db76b476f8a0a78942664980eee67e46929685005f40d7f7d85be3e1dec98fce3ca7bfdce62ad2d6daafdc96a4844e84a72a721d55181
-
SSDEEP
24576:/5dZufOrzvckB+Fr+waFHTcqunNW3QdWvPiVD2CWgrUE94FFs+n9rQOF8nux8igX:/5dVwPaFHTTgkAAn2IQ39y9rRF8uxG
Malware Config
Extracted
C:\ZQXLByuZ3.README.txt
lockbit
http://lockbitapt2yfbt7lchxejug47kmqvqqxvvjpqkmevv4l3azl3gy6pyd.onion
http://lockbitapt5x4zkjbcqmz6frdhecqqgadevyiwqxukksspnlidyvd7qd.onion
http://lockbitapt6vx57t3eeqjofwgcglmutr3a35nygvokja5uuccip4ykyd.onion
http://lockbitapt34kvrip6xojylohhxrwsvpzdffgs5z4pbbsywnzsbdguqd.onion
http://lockbitaptc2iq4atewz2ise62q63wfktyrl4qtwuk5qax262kgtzjqd.onion
http://lockbitaptjpikdqjynvgozhgc6bgetgucdk5xjacozeaawihmoio6yd.onion
http://lockbitaptq7ephv2oigdncfhtwhpqgwmqojnxqdyhprxxfpcllqdxad.onion
http://lockbitaptstzf3er2lz6ku3xuifafq2yh5lmiqj5ncur6rtlmkteiqd.onion
http://lockbitaptoofrpignlz6dt2wqqc5z3a4evjevoa3eqdfcntxad5lmyd.onion
http://lockbitapt.uz
http://lockbitapt2yfbt7lchxejug47kmqvqqxvvjpqkmevv4l3azl3gy6pyd.onion.ly
http://lockbitapt5x4zkjbcqmz6frdhecqqgadevyiwqxukksspnlidyvd7qd.onion.ly
http://lockbitapt6vx57t3eeqjofwgcglmutr3a35nygvokja5uuccip4ykyd.onion.ly
http://lockbitapt34kvrip6xojylohhxrwsvpzdffgs5z4pbbsywnzsbdguqd.onion.ly
http://lockbitaptc2iq4atewz2ise62q63wfktyrl4qtwuk5qax262kgtzjqd.onion.ly
http://lockbitaptjpikdqjynvgozhgc6bgetgucdk5xjacozeaawihmoio6yd.onion.ly
http://lockbitaptq7ephv2oigdncfhtwhpqgwmqojnxqdyhprxxfpcllqdxad.onion.ly
http://lockbitaptstzf3er2lz6ku3xuifafq2yh5lmiqj5ncur6rtlmkteiqd.onion.ly
http://lockbitaptoofrpignlz6dt2wqqc5z3a4evjevoa3eqdfcntxad5lmyd.onion.ly
https://twitter.com/hashtag/lockbit?f=live
https://tox.chat/download.html
Signatures
-
Lockbit
Ransomware family with multiple variants released since late 2019.
-
Lockbit family
-
Renames multiple (614) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion 6375e7e4c7cdc3f96afd991c4dfedd5cdfe4b31bf0662dccfa703c117e951f71.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate 6375e7e4c7cdc3f96afd991c4dfedd5cdfe4b31bf0662dccfa703c117e951f71.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\Control Panel\International\Geo\Nation F1B4.tmp -
Deletes itself 1 IoCs
pid Process 4664 F1B4.tmp -
Executes dropped EXE 1 IoCs
pid Process 4664 F1B4.tmp -
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Drops desktop.ini file(s) 2 IoCs
description ioc Process File opened for modification C:\$Recycle.Bin\S-1-5-21-4089630652-1596403869-279772308-1000\desktop.ini 6375e7e4c7cdc3f96afd991c4dfedd5cdfe4b31bf0662dccfa703c117e951f71.exe File opened for modification F:\$RECYCLE.BIN\S-1-5-21-4089630652-1596403869-279772308-1000\desktop.ini 6375e7e4c7cdc3f96afd991c4dfedd5cdfe4b31bf0662dccfa703c117e951f71.exe -
Indicator Removal: File Deletion 1 TTPs
Adversaries may delete files left behind by the actions of their intrusion activity.
-
Drops file in System32 directory 4 IoCs
description ioc Process File created C:\Windows\system32\spool\PRINTERS\PPq6tyovvm00fsy008881kccwuc.TMP printfilterpipelinesvc.exe File created C:\Windows\system32\spool\PRINTERS\PPk8zk401z38p_i9iwh3yi32y2d.TMP printfilterpipelinesvc.exe File created C:\Windows\system32\spool\PRINTERS\00002.SPL splwow64.exe File created C:\Windows\system32\spool\PRINTERS\PPz0t3t50p_rqaavv30ne8wqn0b.TMP printfilterpipelinesvc.exe -
Sets desktop wallpaper using registry 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\Control Panel\Desktop\WallPaper = "C:\\ProgramData\\ZQXLByuZ3.bmp" 6375e7e4c7cdc3f96afd991c4dfedd5cdfe4b31bf0662dccfa703c117e951f71.exe Set value (str) \REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\Control Panel\Desktop\Wallpaper = "C:\\ProgramData\\ZQXLByuZ3.bmp" 6375e7e4c7cdc3f96afd991c4dfedd5cdfe4b31bf0662dccfa703c117e951f71.exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
pid Process 4664 F1B4.tmp -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 4120 set thread context of 1232 4120 6375e7e4c7cdc3f96afd991c4dfedd5cdfe4b31bf0662dccfa703c117e951f71.exe 86 -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 5 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F1B4.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6375e7e4c7cdc3f96afd991c4dfedd5cdfe4b31bf0662dccfa703c117e951f71.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6375e7e4c7cdc3f96afd991c4dfedd5cdfe4b31bf0662dccfa703c117e951f71.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6375e7e4c7cdc3f96afd991c4dfedd5cdfe4b31bf0662dccfa703c117e951f71.exe -
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz ONENOTE.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString ONENOTE.EXE Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 ONENOTE.EXE -
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU ONENOTE.EXE Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS ONENOTE.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily ONENOTE.EXE -
Modifies Control Panel 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\Control Panel\Desktop 6375e7e4c7cdc3f96afd991c4dfedd5cdfe4b31bf0662dccfa703c117e951f71.exe Set value (str) \REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\Control Panel\Desktop\WallpaperStyle = "10" 6375e7e4c7cdc3f96afd991c4dfedd5cdfe4b31bf0662dccfa703c117e951f71.exe -
Modifies registry class 9 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0D2A3105-81F1-9565-BAA6-C0777B43DEEB} 6375e7e4c7cdc3f96afd991c4dfedd5cdfe4b31bf0662dccfa703c117e951f71.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0D2A3105-81F1-9565-BAA6-C0777B43DEEB}\TreatAs 6375e7e4c7cdc3f96afd991c4dfedd5cdfe4b31bf0662dccfa703c117e951f71.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0D2A3105-81F1-9565-BAA6-C0777B43DEEB}\TreatAs\ = "{F20DA720-C02F-11CE-927B-0800095AE340}" 6375e7e4c7cdc3f96afd991c4dfedd5cdfe4b31bf0662dccfa703c117e951f71.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.ZQXLByuZ3\ = "ZQXLByuZ3" 6375e7e4c7cdc3f96afd991c4dfedd5cdfe4b31bf0662dccfa703c117e951f71.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\ZQXLByuZ3\DefaultIcon 6375e7e4c7cdc3f96afd991c4dfedd5cdfe4b31bf0662dccfa703c117e951f71.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0D2A3105-81F1-9565-BAA6-C0777B43DEEB}\ = "Sound (OLE2)" 6375e7e4c7cdc3f96afd991c4dfedd5cdfe4b31bf0662dccfa703c117e951f71.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.ZQXLByuZ3 6375e7e4c7cdc3f96afd991c4dfedd5cdfe4b31bf0662dccfa703c117e951f71.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\ZQXLByuZ3 6375e7e4c7cdc3f96afd991c4dfedd5cdfe4b31bf0662dccfa703c117e951f71.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\ZQXLByuZ3\DefaultIcon\ = "C:\\ProgramData\\ZQXLByuZ3.ico" 6375e7e4c7cdc3f96afd991c4dfedd5cdfe4b31bf0662dccfa703c117e951f71.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1232 6375e7e4c7cdc3f96afd991c4dfedd5cdfe4b31bf0662dccfa703c117e951f71.exe 1232 6375e7e4c7cdc3f96afd991c4dfedd5cdfe4b31bf0662dccfa703c117e951f71.exe 1232 6375e7e4c7cdc3f96afd991c4dfedd5cdfe4b31bf0662dccfa703c117e951f71.exe 1232 6375e7e4c7cdc3f96afd991c4dfedd5cdfe4b31bf0662dccfa703c117e951f71.exe 1232 6375e7e4c7cdc3f96afd991c4dfedd5cdfe4b31bf0662dccfa703c117e951f71.exe 1232 6375e7e4c7cdc3f96afd991c4dfedd5cdfe4b31bf0662dccfa703c117e951f71.exe 1232 6375e7e4c7cdc3f96afd991c4dfedd5cdfe4b31bf0662dccfa703c117e951f71.exe 1232 6375e7e4c7cdc3f96afd991c4dfedd5cdfe4b31bf0662dccfa703c117e951f71.exe 1232 6375e7e4c7cdc3f96afd991c4dfedd5cdfe4b31bf0662dccfa703c117e951f71.exe 1232 6375e7e4c7cdc3f96afd991c4dfedd5cdfe4b31bf0662dccfa703c117e951f71.exe 1232 6375e7e4c7cdc3f96afd991c4dfedd5cdfe4b31bf0662dccfa703c117e951f71.exe 1232 6375e7e4c7cdc3f96afd991c4dfedd5cdfe4b31bf0662dccfa703c117e951f71.exe 1232 6375e7e4c7cdc3f96afd991c4dfedd5cdfe4b31bf0662dccfa703c117e951f71.exe 1232 6375e7e4c7cdc3f96afd991c4dfedd5cdfe4b31bf0662dccfa703c117e951f71.exe 1232 6375e7e4c7cdc3f96afd991c4dfedd5cdfe4b31bf0662dccfa703c117e951f71.exe 1232 6375e7e4c7cdc3f96afd991c4dfedd5cdfe4b31bf0662dccfa703c117e951f71.exe 1232 6375e7e4c7cdc3f96afd991c4dfedd5cdfe4b31bf0662dccfa703c117e951f71.exe 1232 6375e7e4c7cdc3f96afd991c4dfedd5cdfe4b31bf0662dccfa703c117e951f71.exe 1232 6375e7e4c7cdc3f96afd991c4dfedd5cdfe4b31bf0662dccfa703c117e951f71.exe 1232 6375e7e4c7cdc3f96afd991c4dfedd5cdfe4b31bf0662dccfa703c117e951f71.exe 1232 6375e7e4c7cdc3f96afd991c4dfedd5cdfe4b31bf0662dccfa703c117e951f71.exe 1232 6375e7e4c7cdc3f96afd991c4dfedd5cdfe4b31bf0662dccfa703c117e951f71.exe 1232 6375e7e4c7cdc3f96afd991c4dfedd5cdfe4b31bf0662dccfa703c117e951f71.exe 1232 6375e7e4c7cdc3f96afd991c4dfedd5cdfe4b31bf0662dccfa703c117e951f71.exe 1232 6375e7e4c7cdc3f96afd991c4dfedd5cdfe4b31bf0662dccfa703c117e951f71.exe 1232 6375e7e4c7cdc3f96afd991c4dfedd5cdfe4b31bf0662dccfa703c117e951f71.exe 1232 6375e7e4c7cdc3f96afd991c4dfedd5cdfe4b31bf0662dccfa703c117e951f71.exe 1232 6375e7e4c7cdc3f96afd991c4dfedd5cdfe4b31bf0662dccfa703c117e951f71.exe 1232 6375e7e4c7cdc3f96afd991c4dfedd5cdfe4b31bf0662dccfa703c117e951f71.exe 1232 6375e7e4c7cdc3f96afd991c4dfedd5cdfe4b31bf0662dccfa703c117e951f71.exe 1232 6375e7e4c7cdc3f96afd991c4dfedd5cdfe4b31bf0662dccfa703c117e951f71.exe 1232 6375e7e4c7cdc3f96afd991c4dfedd5cdfe4b31bf0662dccfa703c117e951f71.exe 1232 6375e7e4c7cdc3f96afd991c4dfedd5cdfe4b31bf0662dccfa703c117e951f71.exe 1232 6375e7e4c7cdc3f96afd991c4dfedd5cdfe4b31bf0662dccfa703c117e951f71.exe 1232 6375e7e4c7cdc3f96afd991c4dfedd5cdfe4b31bf0662dccfa703c117e951f71.exe 1232 6375e7e4c7cdc3f96afd991c4dfedd5cdfe4b31bf0662dccfa703c117e951f71.exe 1232 6375e7e4c7cdc3f96afd991c4dfedd5cdfe4b31bf0662dccfa703c117e951f71.exe 1232 6375e7e4c7cdc3f96afd991c4dfedd5cdfe4b31bf0662dccfa703c117e951f71.exe 1232 6375e7e4c7cdc3f96afd991c4dfedd5cdfe4b31bf0662dccfa703c117e951f71.exe 1232 6375e7e4c7cdc3f96afd991c4dfedd5cdfe4b31bf0662dccfa703c117e951f71.exe 1232 6375e7e4c7cdc3f96afd991c4dfedd5cdfe4b31bf0662dccfa703c117e951f71.exe 1232 6375e7e4c7cdc3f96afd991c4dfedd5cdfe4b31bf0662dccfa703c117e951f71.exe 1232 6375e7e4c7cdc3f96afd991c4dfedd5cdfe4b31bf0662dccfa703c117e951f71.exe 1232 6375e7e4c7cdc3f96afd991c4dfedd5cdfe4b31bf0662dccfa703c117e951f71.exe 1232 6375e7e4c7cdc3f96afd991c4dfedd5cdfe4b31bf0662dccfa703c117e951f71.exe 1232 6375e7e4c7cdc3f96afd991c4dfedd5cdfe4b31bf0662dccfa703c117e951f71.exe 1232 6375e7e4c7cdc3f96afd991c4dfedd5cdfe4b31bf0662dccfa703c117e951f71.exe 1232 6375e7e4c7cdc3f96afd991c4dfedd5cdfe4b31bf0662dccfa703c117e951f71.exe 1232 6375e7e4c7cdc3f96afd991c4dfedd5cdfe4b31bf0662dccfa703c117e951f71.exe 1232 6375e7e4c7cdc3f96afd991c4dfedd5cdfe4b31bf0662dccfa703c117e951f71.exe 1232 6375e7e4c7cdc3f96afd991c4dfedd5cdfe4b31bf0662dccfa703c117e951f71.exe 1232 6375e7e4c7cdc3f96afd991c4dfedd5cdfe4b31bf0662dccfa703c117e951f71.exe 1232 6375e7e4c7cdc3f96afd991c4dfedd5cdfe4b31bf0662dccfa703c117e951f71.exe 1232 6375e7e4c7cdc3f96afd991c4dfedd5cdfe4b31bf0662dccfa703c117e951f71.exe 1232 6375e7e4c7cdc3f96afd991c4dfedd5cdfe4b31bf0662dccfa703c117e951f71.exe 1232 6375e7e4c7cdc3f96afd991c4dfedd5cdfe4b31bf0662dccfa703c117e951f71.exe 1232 6375e7e4c7cdc3f96afd991c4dfedd5cdfe4b31bf0662dccfa703c117e951f71.exe 1232 6375e7e4c7cdc3f96afd991c4dfedd5cdfe4b31bf0662dccfa703c117e951f71.exe 1232 6375e7e4c7cdc3f96afd991c4dfedd5cdfe4b31bf0662dccfa703c117e951f71.exe 1232 6375e7e4c7cdc3f96afd991c4dfedd5cdfe4b31bf0662dccfa703c117e951f71.exe 1232 6375e7e4c7cdc3f96afd991c4dfedd5cdfe4b31bf0662dccfa703c117e951f71.exe 1232 6375e7e4c7cdc3f96afd991c4dfedd5cdfe4b31bf0662dccfa703c117e951f71.exe 1232 6375e7e4c7cdc3f96afd991c4dfedd5cdfe4b31bf0662dccfa703c117e951f71.exe 1232 6375e7e4c7cdc3f96afd991c4dfedd5cdfe4b31bf0662dccfa703c117e951f71.exe -
Suspicious behavior: RenamesItself 26 IoCs
pid Process 4664 F1B4.tmp 4664 F1B4.tmp 4664 F1B4.tmp 4664 F1B4.tmp 4664 F1B4.tmp 4664 F1B4.tmp 4664 F1B4.tmp 4664 F1B4.tmp 4664 F1B4.tmp 4664 F1B4.tmp 4664 F1B4.tmp 4664 F1B4.tmp 4664 F1B4.tmp 4664 F1B4.tmp 4664 F1B4.tmp 4664 F1B4.tmp 4664 F1B4.tmp 4664 F1B4.tmp 4664 F1B4.tmp 4664 F1B4.tmp 4664 F1B4.tmp 4664 F1B4.tmp 4664 F1B4.tmp 4664 F1B4.tmp 4664 F1B4.tmp 4664 F1B4.tmp -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: 33 4120 6375e7e4c7cdc3f96afd991c4dfedd5cdfe4b31bf0662dccfa703c117e951f71.exe Token: SeIncBasePriorityPrivilege 4120 6375e7e4c7cdc3f96afd991c4dfedd5cdfe4b31bf0662dccfa703c117e951f71.exe Token: 33 4120 6375e7e4c7cdc3f96afd991c4dfedd5cdfe4b31bf0662dccfa703c117e951f71.exe Token: SeIncBasePriorityPrivilege 4120 6375e7e4c7cdc3f96afd991c4dfedd5cdfe4b31bf0662dccfa703c117e951f71.exe Token: SeAssignPrimaryTokenPrivilege 1232 6375e7e4c7cdc3f96afd991c4dfedd5cdfe4b31bf0662dccfa703c117e951f71.exe Token: SeBackupPrivilege 1232 6375e7e4c7cdc3f96afd991c4dfedd5cdfe4b31bf0662dccfa703c117e951f71.exe Token: SeDebugPrivilege 1232 6375e7e4c7cdc3f96afd991c4dfedd5cdfe4b31bf0662dccfa703c117e951f71.exe Token: 36 1232 6375e7e4c7cdc3f96afd991c4dfedd5cdfe4b31bf0662dccfa703c117e951f71.exe Token: SeImpersonatePrivilege 1232 6375e7e4c7cdc3f96afd991c4dfedd5cdfe4b31bf0662dccfa703c117e951f71.exe Token: SeIncBasePriorityPrivilege 1232 6375e7e4c7cdc3f96afd991c4dfedd5cdfe4b31bf0662dccfa703c117e951f71.exe Token: SeIncreaseQuotaPrivilege 1232 6375e7e4c7cdc3f96afd991c4dfedd5cdfe4b31bf0662dccfa703c117e951f71.exe Token: 33 1232 6375e7e4c7cdc3f96afd991c4dfedd5cdfe4b31bf0662dccfa703c117e951f71.exe Token: SeManageVolumePrivilege 1232 6375e7e4c7cdc3f96afd991c4dfedd5cdfe4b31bf0662dccfa703c117e951f71.exe Token: SeProfSingleProcessPrivilege 1232 6375e7e4c7cdc3f96afd991c4dfedd5cdfe4b31bf0662dccfa703c117e951f71.exe Token: SeRestorePrivilege 1232 6375e7e4c7cdc3f96afd991c4dfedd5cdfe4b31bf0662dccfa703c117e951f71.exe Token: SeSecurityPrivilege 1232 6375e7e4c7cdc3f96afd991c4dfedd5cdfe4b31bf0662dccfa703c117e951f71.exe Token: SeSystemProfilePrivilege 1232 6375e7e4c7cdc3f96afd991c4dfedd5cdfe4b31bf0662dccfa703c117e951f71.exe Token: SeTakeOwnershipPrivilege 1232 6375e7e4c7cdc3f96afd991c4dfedd5cdfe4b31bf0662dccfa703c117e951f71.exe Token: SeShutdownPrivilege 1232 6375e7e4c7cdc3f96afd991c4dfedd5cdfe4b31bf0662dccfa703c117e951f71.exe Token: SeDebugPrivilege 1232 6375e7e4c7cdc3f96afd991c4dfedd5cdfe4b31bf0662dccfa703c117e951f71.exe Token: SeBackupPrivilege 1232 6375e7e4c7cdc3f96afd991c4dfedd5cdfe4b31bf0662dccfa703c117e951f71.exe Token: SeBackupPrivilege 1232 6375e7e4c7cdc3f96afd991c4dfedd5cdfe4b31bf0662dccfa703c117e951f71.exe Token: SeSecurityPrivilege 1232 6375e7e4c7cdc3f96afd991c4dfedd5cdfe4b31bf0662dccfa703c117e951f71.exe Token: SeSecurityPrivilege 1232 6375e7e4c7cdc3f96afd991c4dfedd5cdfe4b31bf0662dccfa703c117e951f71.exe Token: SeBackupPrivilege 1232 6375e7e4c7cdc3f96afd991c4dfedd5cdfe4b31bf0662dccfa703c117e951f71.exe Token: SeBackupPrivilege 1232 6375e7e4c7cdc3f96afd991c4dfedd5cdfe4b31bf0662dccfa703c117e951f71.exe Token: SeSecurityPrivilege 1232 6375e7e4c7cdc3f96afd991c4dfedd5cdfe4b31bf0662dccfa703c117e951f71.exe Token: SeSecurityPrivilege 1232 6375e7e4c7cdc3f96afd991c4dfedd5cdfe4b31bf0662dccfa703c117e951f71.exe Token: SeBackupPrivilege 1232 6375e7e4c7cdc3f96afd991c4dfedd5cdfe4b31bf0662dccfa703c117e951f71.exe Token: SeBackupPrivilege 1232 6375e7e4c7cdc3f96afd991c4dfedd5cdfe4b31bf0662dccfa703c117e951f71.exe Token: SeSecurityPrivilege 1232 6375e7e4c7cdc3f96afd991c4dfedd5cdfe4b31bf0662dccfa703c117e951f71.exe Token: SeSecurityPrivilege 1232 6375e7e4c7cdc3f96afd991c4dfedd5cdfe4b31bf0662dccfa703c117e951f71.exe Token: SeBackupPrivilege 1232 6375e7e4c7cdc3f96afd991c4dfedd5cdfe4b31bf0662dccfa703c117e951f71.exe Token: SeBackupPrivilege 1232 6375e7e4c7cdc3f96afd991c4dfedd5cdfe4b31bf0662dccfa703c117e951f71.exe Token: SeSecurityPrivilege 1232 6375e7e4c7cdc3f96afd991c4dfedd5cdfe4b31bf0662dccfa703c117e951f71.exe Token: SeSecurityPrivilege 1232 6375e7e4c7cdc3f96afd991c4dfedd5cdfe4b31bf0662dccfa703c117e951f71.exe Token: SeBackupPrivilege 1232 6375e7e4c7cdc3f96afd991c4dfedd5cdfe4b31bf0662dccfa703c117e951f71.exe Token: SeBackupPrivilege 1232 6375e7e4c7cdc3f96afd991c4dfedd5cdfe4b31bf0662dccfa703c117e951f71.exe Token: SeSecurityPrivilege 1232 6375e7e4c7cdc3f96afd991c4dfedd5cdfe4b31bf0662dccfa703c117e951f71.exe Token: SeSecurityPrivilege 1232 6375e7e4c7cdc3f96afd991c4dfedd5cdfe4b31bf0662dccfa703c117e951f71.exe Token: SeBackupPrivilege 1232 6375e7e4c7cdc3f96afd991c4dfedd5cdfe4b31bf0662dccfa703c117e951f71.exe Token: SeBackupPrivilege 1232 6375e7e4c7cdc3f96afd991c4dfedd5cdfe4b31bf0662dccfa703c117e951f71.exe Token: SeSecurityPrivilege 1232 6375e7e4c7cdc3f96afd991c4dfedd5cdfe4b31bf0662dccfa703c117e951f71.exe Token: SeSecurityPrivilege 1232 6375e7e4c7cdc3f96afd991c4dfedd5cdfe4b31bf0662dccfa703c117e951f71.exe Token: SeBackupPrivilege 1232 6375e7e4c7cdc3f96afd991c4dfedd5cdfe4b31bf0662dccfa703c117e951f71.exe Token: SeBackupPrivilege 1232 6375e7e4c7cdc3f96afd991c4dfedd5cdfe4b31bf0662dccfa703c117e951f71.exe Token: SeSecurityPrivilege 1232 6375e7e4c7cdc3f96afd991c4dfedd5cdfe4b31bf0662dccfa703c117e951f71.exe Token: SeSecurityPrivilege 1232 6375e7e4c7cdc3f96afd991c4dfedd5cdfe4b31bf0662dccfa703c117e951f71.exe Token: SeBackupPrivilege 1232 6375e7e4c7cdc3f96afd991c4dfedd5cdfe4b31bf0662dccfa703c117e951f71.exe Token: SeBackupPrivilege 1232 6375e7e4c7cdc3f96afd991c4dfedd5cdfe4b31bf0662dccfa703c117e951f71.exe Token: SeSecurityPrivilege 1232 6375e7e4c7cdc3f96afd991c4dfedd5cdfe4b31bf0662dccfa703c117e951f71.exe Token: SeSecurityPrivilege 1232 6375e7e4c7cdc3f96afd991c4dfedd5cdfe4b31bf0662dccfa703c117e951f71.exe Token: SeBackupPrivilege 1232 6375e7e4c7cdc3f96afd991c4dfedd5cdfe4b31bf0662dccfa703c117e951f71.exe Token: SeBackupPrivilege 1232 6375e7e4c7cdc3f96afd991c4dfedd5cdfe4b31bf0662dccfa703c117e951f71.exe Token: SeSecurityPrivilege 1232 6375e7e4c7cdc3f96afd991c4dfedd5cdfe4b31bf0662dccfa703c117e951f71.exe Token: SeSecurityPrivilege 1232 6375e7e4c7cdc3f96afd991c4dfedd5cdfe4b31bf0662dccfa703c117e951f71.exe Token: SeBackupPrivilege 1232 6375e7e4c7cdc3f96afd991c4dfedd5cdfe4b31bf0662dccfa703c117e951f71.exe Token: SeBackupPrivilege 1232 6375e7e4c7cdc3f96afd991c4dfedd5cdfe4b31bf0662dccfa703c117e951f71.exe Token: SeSecurityPrivilege 1232 6375e7e4c7cdc3f96afd991c4dfedd5cdfe4b31bf0662dccfa703c117e951f71.exe Token: SeSecurityPrivilege 1232 6375e7e4c7cdc3f96afd991c4dfedd5cdfe4b31bf0662dccfa703c117e951f71.exe Token: SeBackupPrivilege 1232 6375e7e4c7cdc3f96afd991c4dfedd5cdfe4b31bf0662dccfa703c117e951f71.exe Token: SeBackupPrivilege 1232 6375e7e4c7cdc3f96afd991c4dfedd5cdfe4b31bf0662dccfa703c117e951f71.exe Token: SeSecurityPrivilege 1232 6375e7e4c7cdc3f96afd991c4dfedd5cdfe4b31bf0662dccfa703c117e951f71.exe Token: SeSecurityPrivilege 1232 6375e7e4c7cdc3f96afd991c4dfedd5cdfe4b31bf0662dccfa703c117e951f71.exe -
Suspicious use of SetWindowsHookEx 13 IoCs
pid Process 3656 ONENOTE.EXE 3656 ONENOTE.EXE 3656 ONENOTE.EXE 3656 ONENOTE.EXE 3656 ONENOTE.EXE 3656 ONENOTE.EXE 3656 ONENOTE.EXE 3656 ONENOTE.EXE 3656 ONENOTE.EXE 3656 ONENOTE.EXE 3656 ONENOTE.EXE 3656 ONENOTE.EXE 3656 ONENOTE.EXE -
Suspicious use of WriteProcessMemory 27 IoCs
description pid Process procid_target PID 4456 wrote to memory of 4120 4456 6375e7e4c7cdc3f96afd991c4dfedd5cdfe4b31bf0662dccfa703c117e951f71.exe 84 PID 4456 wrote to memory of 4120 4456 6375e7e4c7cdc3f96afd991c4dfedd5cdfe4b31bf0662dccfa703c117e951f71.exe 84 PID 4456 wrote to memory of 4120 4456 6375e7e4c7cdc3f96afd991c4dfedd5cdfe4b31bf0662dccfa703c117e951f71.exe 84 PID 4456 wrote to memory of 4120 4456 6375e7e4c7cdc3f96afd991c4dfedd5cdfe4b31bf0662dccfa703c117e951f71.exe 84 PID 4456 wrote to memory of 4120 4456 6375e7e4c7cdc3f96afd991c4dfedd5cdfe4b31bf0662dccfa703c117e951f71.exe 84 PID 4120 wrote to memory of 1232 4120 6375e7e4c7cdc3f96afd991c4dfedd5cdfe4b31bf0662dccfa703c117e951f71.exe 86 PID 4120 wrote to memory of 1232 4120 6375e7e4c7cdc3f96afd991c4dfedd5cdfe4b31bf0662dccfa703c117e951f71.exe 86 PID 4120 wrote to memory of 1232 4120 6375e7e4c7cdc3f96afd991c4dfedd5cdfe4b31bf0662dccfa703c117e951f71.exe 86 PID 4120 wrote to memory of 1232 4120 6375e7e4c7cdc3f96afd991c4dfedd5cdfe4b31bf0662dccfa703c117e951f71.exe 86 PID 4120 wrote to memory of 1232 4120 6375e7e4c7cdc3f96afd991c4dfedd5cdfe4b31bf0662dccfa703c117e951f71.exe 86 PID 4120 wrote to memory of 1232 4120 6375e7e4c7cdc3f96afd991c4dfedd5cdfe4b31bf0662dccfa703c117e951f71.exe 86 PID 4120 wrote to memory of 1232 4120 6375e7e4c7cdc3f96afd991c4dfedd5cdfe4b31bf0662dccfa703c117e951f71.exe 86 PID 4120 wrote to memory of 1232 4120 6375e7e4c7cdc3f96afd991c4dfedd5cdfe4b31bf0662dccfa703c117e951f71.exe 86 PID 4120 wrote to memory of 1232 4120 6375e7e4c7cdc3f96afd991c4dfedd5cdfe4b31bf0662dccfa703c117e951f71.exe 86 PID 4120 wrote to memory of 1232 4120 6375e7e4c7cdc3f96afd991c4dfedd5cdfe4b31bf0662dccfa703c117e951f71.exe 86 PID 4120 wrote to memory of 1232 4120 6375e7e4c7cdc3f96afd991c4dfedd5cdfe4b31bf0662dccfa703c117e951f71.exe 86 PID 1232 wrote to memory of 648 1232 6375e7e4c7cdc3f96afd991c4dfedd5cdfe4b31bf0662dccfa703c117e951f71.exe 88 PID 1232 wrote to memory of 648 1232 6375e7e4c7cdc3f96afd991c4dfedd5cdfe4b31bf0662dccfa703c117e951f71.exe 88 PID 3304 wrote to memory of 3656 3304 printfilterpipelinesvc.exe 94 PID 3304 wrote to memory of 3656 3304 printfilterpipelinesvc.exe 94 PID 1232 wrote to memory of 4664 1232 6375e7e4c7cdc3f96afd991c4dfedd5cdfe4b31bf0662dccfa703c117e951f71.exe 95 PID 1232 wrote to memory of 4664 1232 6375e7e4c7cdc3f96afd991c4dfedd5cdfe4b31bf0662dccfa703c117e951f71.exe 95 PID 1232 wrote to memory of 4664 1232 6375e7e4c7cdc3f96afd991c4dfedd5cdfe4b31bf0662dccfa703c117e951f71.exe 95 PID 1232 wrote to memory of 4664 1232 6375e7e4c7cdc3f96afd991c4dfedd5cdfe4b31bf0662dccfa703c117e951f71.exe 95 PID 4664 wrote to memory of 1848 4664 F1B4.tmp 96 PID 4664 wrote to memory of 1848 4664 F1B4.tmp 96 PID 4664 wrote to memory of 1848 4664 F1B4.tmp 96
Processes
-
C:\Users\Admin\AppData\Local\Temp\6375e7e4c7cdc3f96afd991c4dfedd5cdfe4b31bf0662dccfa703c117e951f71.exe"C:\Users\Admin\AppData\Local\Temp\6375e7e4c7cdc3f96afd991c4dfedd5cdfe4b31bf0662dccfa703c117e951f71.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4456 -
C:\Users\Admin\AppData\Local\Temp\6375e7e4c7cdc3f96afd991c4dfedd5cdfe4b31bf0662dccfa703c117e951f71.exe"C:\Users\Admin\AppData\Local\Temp\6375e7e4c7cdc3f96afd991c4dfedd5cdfe4b31bf0662dccfa703c117e951f71.exe"2⤵
- Checks BIOS information in registry
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4120 -
C:\Users\Admin\AppData\Local\Temp\6375e7e4c7cdc3f96afd991c4dfedd5cdfe4b31bf0662dccfa703c117e951f71.exeC:\Users\Admin\AppData\Local\Temp\6375e7e4c7cdc3f96afd991c4dfedd5cdfe4b31bf0662dccfa703c117e951f71.exe3⤵
- Drops desktop.ini file(s)
- Sets desktop wallpaper using registry
- System Location Discovery: System Language Discovery
- Modifies Control Panel
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1232 -
C:\Windows\splwow64.exeC:\Windows\splwow64.exe 122884⤵
- Drops file in System32 directory
PID:648
-
-
C:\ProgramData\F1B4.tmp"C:\ProgramData\F1B4.tmp"4⤵
- Checks computer location settings
- Deletes itself
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:4664 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C DEL /F /Q C:\PROGRA~3\F1B4.tmp >> NUL5⤵
- System Location Discovery: System Language Discovery
PID:1848
-
-
-
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k PrintWorkflow -s PrintWorkflowUserSvc1⤵PID:2924
-
C:\Windows\system32\printfilterpipelinesvc.exeC:\Windows\system32\printfilterpipelinesvc.exe -Embedding1⤵
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:3304 -
C:\Program Files\Microsoft Office\root\Office16\ONENOTE.EXE/insertdoc "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\{5C2BA39F-D202-407C-BEEF-F6E076BC853C}.xps" 1338098653668100002⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious use of SetWindowsHookEx
PID:3656
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
129B
MD5660a760ac007f3234f2967d5e45a50f3
SHA199c59f9264fa2d218e97879990f1cd3434ab56bf
SHA256169809a62cb05c19cfb32de2d5808875c5547237022cafc6debf354e61aee878
SHA5121c612620b0a4245378168cd1d014600ef17832da88d21afc47dab09382aa016ec8d6685e7a6e7a82995862000a3fe396063995cac51e45a26c240ca95baaf2ef
-
Filesize
14KB
MD5294e9f64cb1642dd89229fff0592856b
SHA197b148c27f3da29ba7b18d6aee8a0db9102f47c9
SHA256917e115cc403e29b4388e0d175cbfac3e7e40ca1742299fbdb353847db2de7c2
SHA512b87d531890bf1577b9b4af41dddb2cdbbfa164cf197bd5987df3a3075983645a3acba443e289b7bfd338422978a104f55298fbfe346872de0895bde44adc89cf
-
C:\Users\Admin\AppData\Local\Temp\DDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDD
Filesize1.7MB
MD5b1dbf96cbac92d09620f908add74123a
SHA1721311bb9f042a8d0298f294f9a9c25386a5bb5d
SHA256c74cb00fc0ab4dab4011220be8ebbc98928fbd7185ea1ce20644f2918c0756a6
SHA51286c930d9321d2b7d0f9d283017d19c5548c9d75935e7611dfb711d883d01f03dbc9bfd2cdb91e3ab34f526886358e7bc62ca2e0e3c1b50cbb776ecc42612e96d
-
Filesize
4KB
MD592313fcabf805e0c0a68a0a1cdc55496
SHA19bce924befffc639553461690094652d35888f62
SHA2565316481275c4115fa3727da7ce1326d479a3a7edf006803fb0153d1b24810ef8
SHA5124cdb68b6d5397c0f1db692986a4ec8e410174db8283c879a80363efbb89b9d62582b2fd2c9a7626adab6a30bc4a419a6bc03a3bcbf40733f0c1240b35611881a
-
Filesize
4KB
MD55bc945a644003e24c49b83dbebd4ee70
SHA1d174db67cc1092ecd56e85cc2f448c7b85b1f8e6
SHA256e6d37f749ad25aba9687523acaa0dead6dde371df68a566210d3fec73172f930
SHA5122e476eb4bafd59b94348d01aa46a8ba91979e3ed74a96e8cca5f9c2a4bfe4504f9cb2fd985076a59161515b55633e8e7d8f99aa14926c3f67205c9d809dc2465
-
Filesize
5KB
MD55d059a43265f2b6dee086721bf8a251a
SHA112abeec0e1c9b55caa73ae01ca33e156a1eea434
SHA25681a9270f3478012eaa0ac8ae38663d477a62d3606bb1508c1ece53a9b61a1d7d
SHA512e8548d7a846a869edcd2e719ad2f097af23053f26a672a06ca639417db61cfb46dbaec98a76aa76d31d81486847a9a41bc9b75a7e46c26555a16551b4d572c5e
-
Filesize
129B
MD5747a098b8318582aefec952f67120be3
SHA145e0a2e7712161e9c1006fd3996acdfb470f3c9a
SHA2563981ea8b56bb90f02302f0467e14aa159c1bd7af67168f2c7a8dc1b5c7fc5c45
SHA512d5d7dd38b5fd4afd0f90c9ed28049b0ea1c1c7dc766b53d65c0309ac6700f2f1be343e98ab7a7329d5579d2d691f59b263710fc280505fbbaf8d0c4357da83ef