Analysis
- max time kernel
249s - max time network
210s - platform
windows11-21h2_x64 - resource
win11-20250217-en - resource tags
arch:x64arch:x86image:win11-20250217-enlocale:en-usos:windows11-21h2-x64system - submitted
09/03/2025, 14:05
Behavioral task
behavioral1
Sample
Loader.zip
Resource
win7-20240903-en
windows7-x64
0 signatures
150 seconds
Behavioral task
behavioral2
Sample
Loader.zip
Resource
win11-20250217-en
windows11-21h2-x64
0 signatures
150 seconds
Behavioral task
behavioral3
Sample
Loader 3.0.exe
Resource
win7-20240903-en
windows7-x64
22 signatures
150 seconds
Behavioral task
behavioral4
Sample
Loader 3.0.exe
Resource
win11-20250217-en
windows11-21h2-x64
20 signatures
150 seconds
General
- Target Loader 3.0.exe
- Size 147KB
- Sample250309-rd6lbssm19
- SHA256 6dd7522accb6773bade16720b53ca577574defae5b1c7caf4b7fc6826dfed7e7
- MD5 ff4cd364323fc2048c35783a38070aef
- SHA1 4736172dd07a3a196343b94dd56b4e4edc0f2bce
- SHA512 c72b07b78ccbcfad14fa9f7bc3e8a086c29969b4f7f30dbe57a1a173cd82d61a20bf5ead0bc7b627d5d7f7f0def71710e2ce09590be7a886ad6c9414981eb961
- SSDEEP 1536:FzICS4AAwczUUf8y8gvMH+1zGSNAojMP95D1xDEtDyI4njdbJBGCkmsQwvB6jr4j:GqJogYkcSNm9V7Dk4F91qYUrnbT
- MD5 SHA1 SHA512 SSDEEP
Malware Config
Signatures
- Renames multiple (588) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
- Deletes itself 1 IoCs
pid Process 4072 3A79.tmp - Executes dropped EXE 1 IoCs
pid Process 4072 3A79.tmp - Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Drops desktop.ini file(s) 2 IoCs
description ioc Process File opened for modification C:\$Recycle.Bin\S-1-5-21-2786730451-600132509-465537259-1000\desktop.ini Loader 3.0.exe File opened for modification F:\$RECYCLE.BIN\S-1-5-21-2786730451-600132509-465537259-1000\desktop.ini Loader 3.0.exe - Indicator Removal: File Deletion 1 TTPs
Adversaries may delete files left behind by the actions of their intrusion activity.
- Drops file in System32 directory 4 IoCs
description ioc Process File created C:\Windows\system32\spool\PRINTERS\00002.SPL splwow64.exe File created C:\Windows\system32\spool\PRINTERS\PPkjv0hqju7wr0b0f176e53inp.TMP printfilterpipelinesvc.exe File created C:\Windows\system32\spool\PRINTERS\PP91f72mfr4zd9tt593ajcg70o.TMP printfilterpipelinesvc.exe File created C:\Windows\system32\spool\PRINTERS\PPr0qp55164iamvu2yoj87v1qeb.TMP printfilterpipelinesvc.exe - Sets desktop wallpaper using registry 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2786730451-600132509-465537259-1000\Control Panel\Desktop\WallPaper = "C:\\ProgramData\\Jw5Jgl9mC.bmp" Loader 3.0.exe Set value (str) \REGISTRY\USER\S-1-5-21-2786730451-600132509-465537259-1000\Control Panel\Desktop\Wallpaper = "C:\\ProgramData\\Jw5Jgl9mC.bmp" Loader 3.0.exe - Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
pid Process 4072 3A79.tmp - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Loader 3.0.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3A79.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe - Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 ONENOTE.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz ONENOTE.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString ONENOTE.EXE - Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily ONENOTE.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU ONENOTE.EXE Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS ONENOTE.EXE - Modifies Control Panel 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2786730451-600132509-465537259-1000\Control Panel\Desktop Loader 3.0.exe Set value (str) \REGISTRY\USER\S-1-5-21-2786730451-600132509-465537259-1000\Control Panel\Desktop\WallpaperStyle = "10" Loader 3.0.exe - Modifies registry class 5 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Jw5Jgl9mC\DefaultIcon\ = "C:\\ProgramData\\Jw5Jgl9mC.ico" Loader 3.0.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.Jw5Jgl9mC Loader 3.0.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.Jw5Jgl9mC\ = "Jw5Jgl9mC" Loader 3.0.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Jw5Jgl9mC\DefaultIcon Loader 3.0.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Jw5Jgl9mC Loader 3.0.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1916 Loader 3.0.exe 1916 Loader 3.0.exe 1916 Loader 3.0.exe 1916 Loader 3.0.exe 1916 Loader 3.0.exe 1916 Loader 3.0.exe 1916 Loader 3.0.exe 1916 Loader 3.0.exe 1916 Loader 3.0.exe 1916 Loader 3.0.exe 1916 Loader 3.0.exe 1916 Loader 3.0.exe 1916 Loader 3.0.exe 1916 Loader 3.0.exe 1916 Loader 3.0.exe 1916 Loader 3.0.exe 1916 Loader 3.0.exe 1916 Loader 3.0.exe 1916 Loader 3.0.exe 1916 Loader 3.0.exe 1916 Loader 3.0.exe 1916 Loader 3.0.exe 1916 Loader 3.0.exe 1916 Loader 3.0.exe 1916 Loader 3.0.exe 1916 Loader 3.0.exe 1916 Loader 3.0.exe 1916 Loader 3.0.exe 1916 Loader 3.0.exe 1916 Loader 3.0.exe 1916 Loader 3.0.exe 1916 Loader 3.0.exe 1916 Loader 3.0.exe 1916 Loader 3.0.exe 1916 Loader 3.0.exe 1916 Loader 3.0.exe 1916 Loader 3.0.exe 1916 Loader 3.0.exe 1916 Loader 3.0.exe 1916 Loader 3.0.exe 1916 Loader 3.0.exe 1916 Loader 3.0.exe 1916 Loader 3.0.exe 1916 Loader 3.0.exe 1916 Loader 3.0.exe 1916 Loader 3.0.exe 1916 Loader 3.0.exe 1916 Loader 3.0.exe 1916 Loader 3.0.exe 1916 Loader 3.0.exe 1916 Loader 3.0.exe 1916 Loader 3.0.exe 1916 Loader 3.0.exe 1916 Loader 3.0.exe 1916 Loader 3.0.exe 1916 Loader 3.0.exe 1916 Loader 3.0.exe 1916 Loader 3.0.exe 1916 Loader 3.0.exe 1916 Loader 3.0.exe 1916 Loader 3.0.exe 1916 Loader 3.0.exe 1916 Loader 3.0.exe 1916 Loader 3.0.exe - Suspicious behavior: RenamesItself 26 IoCs
pid Process 4072 3A79.tmp 4072 3A79.tmp 4072 3A79.tmp 4072 3A79.tmp 4072 3A79.tmp 4072 3A79.tmp 4072 3A79.tmp 4072 3A79.tmp 4072 3A79.tmp 4072 3A79.tmp 4072 3A79.tmp 4072 3A79.tmp 4072 3A79.tmp 4072 3A79.tmp 4072 3A79.tmp 4072 3A79.tmp 4072 3A79.tmp 4072 3A79.tmp 4072 3A79.tmp 4072 3A79.tmp 4072 3A79.tmp 4072 3A79.tmp 4072 3A79.tmp 4072 3A79.tmp 4072 3A79.tmp 4072 3A79.tmp - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeAssignPrimaryTokenPrivilege 1916 Loader 3.0.exe Token: SeBackupPrivilege 1916 Loader 3.0.exe Token: SeDebugPrivilege 1916 Loader 3.0.exe Token: 36 1916 Loader 3.0.exe Token: SeImpersonatePrivilege 1916 Loader 3.0.exe Token: SeIncBasePriorityPrivilege 1916 Loader 3.0.exe Token: SeIncreaseQuotaPrivilege 1916 Loader 3.0.exe Token: 33 1916 Loader 3.0.exe Token: SeManageVolumePrivilege 1916 Loader 3.0.exe Token: SeProfSingleProcessPrivilege 1916 Loader 3.0.exe Token: SeRestorePrivilege 1916 Loader 3.0.exe Token: SeSecurityPrivilege 1916 Loader 3.0.exe Token: SeSystemProfilePrivilege 1916 Loader 3.0.exe Token: SeTakeOwnershipPrivilege 1916 Loader 3.0.exe Token: SeShutdownPrivilege 1916 Loader 3.0.exe Token: SeDebugPrivilege 1916 Loader 3.0.exe Token: SeBackupPrivilege 1916 Loader 3.0.exe Token: SeBackupPrivilege 1916 Loader 3.0.exe Token: SeSecurityPrivilege 1916 Loader 3.0.exe Token: SeSecurityPrivilege 1916 Loader 3.0.exe Token: SeBackupPrivilege 1916 Loader 3.0.exe Token: SeBackupPrivilege 1916 Loader 3.0.exe Token: SeSecurityPrivilege 1916 Loader 3.0.exe Token: SeSecurityPrivilege 1916 Loader 3.0.exe Token: SeBackupPrivilege 1916 Loader 3.0.exe Token: SeBackupPrivilege 1916 Loader 3.0.exe Token: SeSecurityPrivilege 1916 Loader 3.0.exe Token: SeSecurityPrivilege 1916 Loader 3.0.exe Token: SeBackupPrivilege 1916 Loader 3.0.exe Token: SeBackupPrivilege 1916 Loader 3.0.exe Token: SeSecurityPrivilege 1916 Loader 3.0.exe Token: SeSecurityPrivilege 1916 Loader 3.0.exe Token: SeBackupPrivilege 1916 Loader 3.0.exe Token: SeBackupPrivilege 1916 Loader 3.0.exe Token: SeSecurityPrivilege 1916 Loader 3.0.exe Token: SeSecurityPrivilege 1916 Loader 3.0.exe Token: SeBackupPrivilege 1916 Loader 3.0.exe Token: SeBackupPrivilege 1916 Loader 3.0.exe Token: SeSecurityPrivilege 1916 Loader 3.0.exe Token: SeSecurityPrivilege 1916 Loader 3.0.exe Token: SeBackupPrivilege 1916 Loader 3.0.exe Token: SeBackupPrivilege 1916 Loader 3.0.exe Token: SeSecurityPrivilege 1916 Loader 3.0.exe Token: SeSecurityPrivilege 1916 Loader 3.0.exe Token: SeBackupPrivilege 1916 Loader 3.0.exe Token: SeBackupPrivilege 1916 Loader 3.0.exe Token: SeSecurityPrivilege 1916 Loader 3.0.exe Token: SeSecurityPrivilege 1916 Loader 3.0.exe Token: SeBackupPrivilege 1916 Loader 3.0.exe Token: SeBackupPrivilege 1916 Loader 3.0.exe Token: SeSecurityPrivilege 1916 Loader 3.0.exe Token: SeSecurityPrivilege 1916 Loader 3.0.exe Token: SeBackupPrivilege 1916 Loader 3.0.exe Token: SeBackupPrivilege 1916 Loader 3.0.exe Token: SeSecurityPrivilege 1916 Loader 3.0.exe Token: SeSecurityPrivilege 1916 Loader 3.0.exe Token: SeBackupPrivilege 1916 Loader 3.0.exe Token: SeBackupPrivilege 1916 Loader 3.0.exe Token: SeSecurityPrivilege 1916 Loader 3.0.exe Token: SeSecurityPrivilege 1916 Loader 3.0.exe Token: SeBackupPrivilege 1916 Loader 3.0.exe Token: SeBackupPrivilege 1916 Loader 3.0.exe Token: SeSecurityPrivilege 1916 Loader 3.0.exe Token: SeSecurityPrivilege 1916 Loader 3.0.exe - Suspicious use of SetWindowsHookEx 13 IoCs
pid Process 4304 ONENOTE.EXE 4304 ONENOTE.EXE 4304 ONENOTE.EXE 4304 ONENOTE.EXE 4304 ONENOTE.EXE 4304 ONENOTE.EXE 4304 ONENOTE.EXE 4304 ONENOTE.EXE 4304 ONENOTE.EXE 4304 ONENOTE.EXE 4304 ONENOTE.EXE 4304 ONENOTE.EXE 4304 ONENOTE.EXE - Suspicious use of WriteProcessMemory 11 IoCs
description pid Process procid_target PID 1916 wrote to memory of 3080 1916 Loader 3.0.exe 82 PID 1916 wrote to memory of 3080 1916 Loader 3.0.exe 82 PID 1616 wrote to memory of 4304 1616 printfilterpipelinesvc.exe 85 PID 1616 wrote to memory of 4304 1616 printfilterpipelinesvc.exe 85 PID 1916 wrote to memory of 4072 1916 Loader 3.0.exe 86 PID 1916 wrote to memory of 4072 1916 Loader 3.0.exe 86 PID 1916 wrote to memory of 4072 1916 Loader 3.0.exe 86 PID 1916 wrote to memory of 4072 1916 Loader 3.0.exe 86 PID 4072 wrote to memory of 2820 4072 3A79.tmp 87 PID 4072 wrote to memory of 2820 4072 3A79.tmp 87 PID 4072 wrote to memory of 2820 4072 3A79.tmp 87
Processes
-
C:\Users\Admin\AppData\Local\Temp\Loader 3.0.exe"C:\Users\Admin\AppData\Local\Temp\Loader 3.0.exe"1⤵
- Drops desktop.ini file(s)
- Sets desktop wallpaper using registry
- System Location Discovery: System Language Discovery
- Modifies Control Panel
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1916 -
C:\Windows\splwow64.exeC:\Windows\splwow64.exe 122882⤵
- Drops file in System32 directory
PID:3080
-
-
C:\ProgramData\3A79.tmp"C:\ProgramData\3A79.tmp"2⤵
- Deletes itself
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:4072 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C DEL /F /Q C:\PROGRA~3\3A79.tmp >> NUL3⤵
- System Location Discovery: System Language Discovery
PID:2820
-
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k PrintWorkflow -s PrintWorkflowUserSvc1⤵PID:2256
-
C:\Windows\system32\printfilterpipelinesvc.exeC:\Windows\system32\printfilterpipelinesvc.exe -Embedding1⤵
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:1616 -
C:\Program Files\Microsoft Office\root\Office16\ONENOTE.EXE/insertdoc "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\{DA51860A-F301-485D-BB1B-2015752D1C63}.xps" 1338600276412800002⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious use of SetWindowsHookEx
PID:4304
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\$Recycle.Bin\S-1-5-21-2786730451-600132509-465537259-1000\desktop.ini
- Size 129B
- SHA256 5e8a934af60a15084ddf0c180170dd6f7d697eadec7a8cef18493e6d78979269
- MD5 7dc1ca9f80ea94f7ad05eeb23b7c9985
- SHA1 bde38d1d06bc55bed24e797a7e2ecdbd0c1250e7
- SHA512 1e4f3c43423c33531000d19a9b51df41083726e144953e11f4de4ae33592d330754336f8a72164b4ea6979d3753a01e794ae4df2e6568699ca23f3187195a75c
- MD5 SHA1 SHA512
- Path C:\Jw5Jgl9mC.README.txt
- Size 1KB
- SHA256 7b3daacf846fe79840647e67d9c5226a7fda47d5b32c24d874654e8ff78ffcc9
- MD5 8b28296a2c168d86adbafc888d0f95f0
- SHA1 49d6b109bf24f39c2c0f62c0796b8693c0bd99e5
- SHA512 b0f0e0a6f2962250c3b9f87637854756e7a0fcde561aae14654d0dcd1e1013876442c0354e41c5bc8e3ef57f170ac2073874ff22fdc5656f62f930350f9df6ac
- MD5 SHA1 SHA512
- Path C:\ProgramData\3A79.tmp
- Size 14KB
- SHA256 917e115cc403e29b4388e0d175cbfac3e7e40ca1742299fbdb353847db2de7c2
- MD5 294e9f64cb1642dd89229fff0592856b
- SHA1 97b148c27f3da29ba7b18d6aee8a0db9102f47c9
- SHA512 b87d531890bf1577b9b4af41dddb2cdbbfa164cf197bd5987df3a3075983645a3acba443e289b7bfd338422978a104f55298fbfe346872de0895bde44adc89cf
- SSDEEP 384:5cFP7VtpK4p+31Mzh79W5vM+ZyUgGq4BtMvAxXCRsi:A7Vf9p+qQ02y5HW6kX
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\DDDDDDDDDDDDDD
- Size 147KB
- SHA256 311bcdd751a5460e1b57dd03a5b4a8726b33e58efe12da229851c80695d3daaa
- MD5 dd9f4efdd6ae98c4f9e09b8890a66293
- SHA1 5a0a73ec137397f8a8642ac8fa18ee90d9599853
- SHA512 9a4ca4f103e5b0046b775a2408f8c20bfedd1964991d6df42210b18cf0066bbfc234e36014252bbec6837799ae272ff07bf62d97c8128aef5065a9b12c262517
- SSDEEP 3072:tzIQraYFN5G+i8H/g812lzIQraYFN5G+i8H/g812lzIQraYT:9HrLDE+lY3VHrLDE+lY3VHrLT
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\{A12C7A9F-E0C2-4963-90EE-AE12A16427B8}
- Size 4KB
- SHA256 bf5216cbcf368be08b943ebd25fb6ce60fc2155e420d89d10fe4e53e6eddd761
- MD5 658d5fc57aa60fea2641d5f4b933c15d
- SHA1 29028777ac3587231f80e59a62c7edab26d9ed6f
- SHA512 af8345474ee6ad94b22365b0f80a1a2a7f36b0edc078159c14f2986e3311b6a7202681bcac5373c7b88ca3567aec8a686287de01e4d210055b228242866ec09b
- SSDEEP 6:Ray786jYyfB3h1RRXUnftpO/MlL2/FK4cUsklldEskllDRujlw//0lweI/mvVsks:Ray78gYyf9/UffO/gCdfnEfGWf/mvVf6
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\Documents\OneNote Notebooks\My Notebook\Open Notebook.onetoc2
- Size 4KB
- SHA256 1edb07c68bd3bb66bc27faee3719b6e22e9284fce080b9fe128e9b2054a63c3f
- MD5 1d5ddfddb44608a79db3589718bbe847
- SHA1 d57235c429952e70189577b52fcf5185efe357d5
- SHA512 7e5cd6aa7acb343364f75932a7f823735b4f6d195cef5b651bde55fd937f490f7488effb87855329fde3d04394a1c8cb3650e72de946b75825cb8abfd107dd0b
- SSDEEP 12:Ray78gYyfHj/Uv+veCdfnEfGW6/mvVfrgVfDm6dglEIxA/L:Yy7dYyfHYmveOnGGEvprgpDNs1Aj
- MD5 SHA1 SHA512 SSDEEP
- Path F:\$RECYCLE.BIN\S-1-5-21-2786730451-600132509-465537259-1000\DDDDDDDDDDD
- Size 129B
- SHA256 f8ab755974dc66a38826ea02794182b2d921514a21a401031cb326e0e8761cd4
- MD5 b218057f24e32d7af9972e2b3e018637
- SHA1 e3e86fd3b7ea12f402682ead7d51a0921a7d281a
- SHA512 df28eccf416a727e3c14bb0faecf5b1a878020976456000f6cb8a7f2b63c9470fbd7cefdb3ab3c734cf36c772d87afd105b95c635158d94c8f83ae9a30dfc194
- MD5 SHA1 SHA512