Analysis
- max time kernel
149s - max time network
140s - platform
windows11-21h2_x64 - resource
win11-20251229-en - resource tags
arch:x64arch:x86image:win11-20251229-enlocale:en-usos:windows11-21h2-x64system - submitted
23/01/2026, 07:03
Behavioral task
behavioral1
Sample
file.exe
Resource
win10v2004-20251231-en
windows10-2004-x64
22 signatures
150 seconds
Behavioral task
behavioral2
Sample
file.exe
Resource
win11-20251229-en
windows11-21h2-x64
21 signatures
150 seconds
General
- Target file.exe
- Size 146KB
- Sample260123-hvmecaes7d
- SHA256 8fb06ea350e49fa9ef38c56e731adf6713a47c8de714fe55aee6519cfd6b4da3
- MD5 0bb5cec1d3281876715e59743ee972fb
- SHA1 86d0094007d38b3e7dd3dd4805690cb4ccdd19f1
- SHA512 470e78423a21db8aa7223664c6028c3c56a1e73b71d2be87cdd0960d350790e54faac50d0186f5d78c2def3b8e3f20ed47c92ba81a4ca9f8f9e39d2abfc7b9b7
- SSDEEP 3072:Q6glyuxE4GsUPnliByocWepZIoLVlbSkqITDig:Q6gDBGpvEByocWeUoLVZSFITDi
- MD5 SHA1 SHA512 SSDEEP
Malware Config
Signatures
- Renames multiple (552) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
- Deletes itself 1 IoCs
pid Process 736 B6FD.tmp - Executes dropped EXE 1 IoCs
pid Process 736 B6FD.tmp - Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Drops desktop.ini file(s) 2 IoCs
description ioc Process File opened for modification C:\$Recycle.Bin\S-1-5-21-4220518935-1083122485-1008052776-1000\desktop.ini file.exe File opened for modification F:\$RECYCLE.BIN\S-1-5-21-4220518935-1083122485-1008052776-1000\desktop.ini file.exe - Enumerates connected drives 3 TTPs 1 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\Z: file.exe - Indicator Removal: File Deletion 1 TTPs
Adversaries may delete files left behind by the actions of their intrusion activity.
- Drops file in System32 directory 4 IoCs
description ioc Process File created C:\Windows\system32\spool\PRINTERS\00002.SPL splwow64.exe File created C:\Windows\system32\spool\PRINTERS\PPjs8y_2g63qscq4vy__o65u4d.TMP printfilterpipelinesvc.exe File created C:\Windows\system32\spool\PRINTERS\PP5_yghg8n_a0m6k9i1s38f39gd.TMP printfilterpipelinesvc.exe File created C:\Windows\system32\spool\PRINTERS\PP0vf7jn2dnn04vuh0_70q30yxc.TMP printfilterpipelinesvc.exe - Sets desktop wallpaper using registry 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-4220518935-1083122485-1008052776-1000\Control Panel\Desktop\WallPaper = "C:\\ProgramData\\nMRJHwIfR.bmp" file.exe Set value (str) \REGISTRY\USER\S-1-5-21-4220518935-1083122485-1008052776-1000\Control Panel\Desktop\Wallpaper = "C:\\ProgramData\\nMRJHwIfR.bmp" file.exe - Suspicious use of NtSetInformationThreadHideFromDebugger 5 IoCs
pid Process 4796 file.exe 4796 file.exe 4796 file.exe 4796 file.exe 736 B6FD.tmp - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language file.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B6FD.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe - Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 ONENOTE.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz ONENOTE.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString ONENOTE.EXE - Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS ONENOTE.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily ONENOTE.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU ONENOTE.EXE - Modifies Control Panel 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-4220518935-1083122485-1008052776-1000\Control Panel\Desktop file.exe Set value (str) \REGISTRY\USER\S-1-5-21-4220518935-1083122485-1008052776-1000\Control Panel\Desktop\WallpaperStyle = "10" file.exe - Modifies registry class 5 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.nMRJHwIfR file.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.nMRJHwIfR\ = "nMRJHwIfR" file.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\nMRJHwIfR\DefaultIcon file.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\nMRJHwIfR file.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\nMRJHwIfR\DefaultIcon\ = "C:\\ProgramData\\nMRJHwIfR.ico" file.exe - Suspicious behavior: EnumeratesProcesses 62 IoCs
pid Process 4796 file.exe 4796 file.exe 4796 file.exe 4796 file.exe 4796 file.exe 4796 file.exe 4796 file.exe 4796 file.exe 4796 file.exe 4796 file.exe 4796 file.exe 4796 file.exe 4796 file.exe 4796 file.exe 4796 file.exe 4796 file.exe 4796 file.exe 4796 file.exe 4796 file.exe 4796 file.exe 4796 file.exe 4796 file.exe 4796 file.exe 4796 file.exe 4796 file.exe 4796 file.exe 4796 file.exe 4796 file.exe 4796 file.exe 4796 file.exe 4796 file.exe 4796 file.exe 4796 file.exe 4796 file.exe 4796 file.exe 4796 file.exe 4796 file.exe 4796 file.exe 4796 file.exe 4796 file.exe 4796 file.exe 4796 file.exe 4796 file.exe 4796 file.exe 4796 file.exe 4796 file.exe 4796 file.exe 4796 file.exe 4796 file.exe 4796 file.exe 4796 file.exe 4796 file.exe 4796 file.exe 4796 file.exe 4796 file.exe 4796 file.exe 4796 file.exe 4796 file.exe 4796 file.exe 4796 file.exe 4456 ONENOTE.EXE 4456 ONENOTE.EXE - Suspicious behavior: RenamesItself 26 IoCs
pid Process 736 B6FD.tmp 736 B6FD.tmp 736 B6FD.tmp 736 B6FD.tmp 736 B6FD.tmp 736 B6FD.tmp 736 B6FD.tmp 736 B6FD.tmp 736 B6FD.tmp 736 B6FD.tmp 736 B6FD.tmp 736 B6FD.tmp 736 B6FD.tmp 736 B6FD.tmp 736 B6FD.tmp 736 B6FD.tmp 736 B6FD.tmp 736 B6FD.tmp 736 B6FD.tmp 736 B6FD.tmp 736 B6FD.tmp 736 B6FD.tmp 736 B6FD.tmp 736 B6FD.tmp 736 B6FD.tmp 736 B6FD.tmp - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeAssignPrimaryTokenPrivilege 4796 file.exe Token: SeBackupPrivilege 4796 file.exe Token: SeDebugPrivilege 4796 file.exe Token: 36 4796 file.exe Token: SeImpersonatePrivilege 4796 file.exe Token: SeIncBasePriorityPrivilege 4796 file.exe Token: SeIncreaseQuotaPrivilege 4796 file.exe Token: 33 4796 file.exe Token: SeManageVolumePrivilege 4796 file.exe Token: SeProfSingleProcessPrivilege 4796 file.exe Token: SeRestorePrivilege 4796 file.exe Token: SeSecurityPrivilege 4796 file.exe Token: SeSystemProfilePrivilege 4796 file.exe Token: SeTakeOwnershipPrivilege 4796 file.exe Token: SeShutdownPrivilege 4796 file.exe Token: SeDebugPrivilege 4796 file.exe Token: SeBackupPrivilege 4796 file.exe Token: SeBackupPrivilege 4796 file.exe Token: SeSecurityPrivilege 4796 file.exe Token: SeSecurityPrivilege 4796 file.exe Token: SeBackupPrivilege 4796 file.exe Token: SeBackupPrivilege 4796 file.exe Token: SeSecurityPrivilege 4796 file.exe Token: SeSecurityPrivilege 4796 file.exe Token: SeBackupPrivilege 4796 file.exe Token: SeBackupPrivilege 4796 file.exe Token: SeSecurityPrivilege 4796 file.exe Token: SeSecurityPrivilege 4796 file.exe Token: SeBackupPrivilege 4796 file.exe Token: SeBackupPrivilege 4796 file.exe Token: SeSecurityPrivilege 4796 file.exe Token: SeSecurityPrivilege 4796 file.exe Token: SeBackupPrivilege 4796 file.exe Token: SeBackupPrivilege 4796 file.exe Token: SeSecurityPrivilege 4796 file.exe Token: SeSecurityPrivilege 4796 file.exe Token: SeBackupPrivilege 4796 file.exe Token: SeBackupPrivilege 4796 file.exe Token: SeSecurityPrivilege 4796 file.exe Token: SeSecurityPrivilege 4796 file.exe Token: SeBackupPrivilege 4796 file.exe Token: SeBackupPrivilege 4796 file.exe Token: SeSecurityPrivilege 4796 file.exe Token: SeSecurityPrivilege 4796 file.exe Token: SeBackupPrivilege 4796 file.exe Token: SeBackupPrivilege 4796 file.exe Token: SeSecurityPrivilege 4796 file.exe Token: SeSecurityPrivilege 4796 file.exe Token: SeBackupPrivilege 4796 file.exe Token: SeBackupPrivilege 4796 file.exe Token: SeSecurityPrivilege 4796 file.exe Token: SeSecurityPrivilege 4796 file.exe Token: SeBackupPrivilege 4796 file.exe Token: SeBackupPrivilege 4796 file.exe Token: SeSecurityPrivilege 4796 file.exe Token: SeSecurityPrivilege 4796 file.exe Token: SeBackupPrivilege 4796 file.exe Token: SeBackupPrivilege 4796 file.exe Token: SeSecurityPrivilege 4796 file.exe Token: SeSecurityPrivilege 4796 file.exe Token: SeBackupPrivilege 4796 file.exe Token: SeBackupPrivilege 4796 file.exe Token: SeSecurityPrivilege 4796 file.exe Token: SeSecurityPrivilege 4796 file.exe - Suspicious use of SetWindowsHookEx 13 IoCs
pid Process 4456 ONENOTE.EXE 4456 ONENOTE.EXE 4456 ONENOTE.EXE 4456 ONENOTE.EXE 4456 ONENOTE.EXE 4456 ONENOTE.EXE 4456 ONENOTE.EXE 4456 ONENOTE.EXE 4456 ONENOTE.EXE 4456 ONENOTE.EXE 4456 ONENOTE.EXE 4456 ONENOTE.EXE 4456 ONENOTE.EXE - Suspicious use of WriteProcessMemory 5 IoCs
description pid Process procid_target PID 4796 wrote to memory of 4696 4796 file.exe 79 PID 380 wrote to memory of 4456 380 printfilterpipelinesvc.exe 82 PID 4796 wrote to memory of 736 4796 file.exe 83 PID 4796 wrote to memory of 736 4796 file.exe 83 PID 736 wrote to memory of 2256 736 B6FD.tmp 84
Processes
-
C:\Users\Admin\AppData\Local\Temp\file.exe"C:\Users\Admin\AppData\Local\Temp\file.exe"1⤵
- Drops desktop.ini file(s)
- Enumerates connected drives
- Sets desktop wallpaper using registry
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Modifies Control Panel
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4796 -
C:\Windows\splwow64.exeC:\Windows\splwow64.exe 122882⤵
- Drops file in System32 directory
PID:4696
-
-
C:\ProgramData\B6FD.tmp"C:\ProgramData\B6FD.tmp"2⤵
- Deletes itself
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:736 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C DEL /F /Q C:\PROGRA~3\B6FD.tmp >> NUL3⤵
- System Location Discovery: System Language Discovery
PID:2256
-
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k PrintWorkflow -s PrintWorkflowUserSvc1⤵PID:5320
-
C:\Windows\system32\printfilterpipelinesvc.exeC:\Windows\system32\printfilterpipelinesvc.exe -Embedding1⤵
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:380 -
C:\Program Files\Microsoft Office\root\Office16\ONENOTE.EXE/insertdoc "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\{47FCC1BC-5DD7-44E9-936C-F54F90917201}.xps" 1341362542545800002⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:4456
-
Network
MITRE ATT&CK Enterprise v16
Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\$Recycle.Bin\S-1-5-21-4220518935-1083122485-1008052776-1000\WWWWWWWWWWW
- Size 129B
- SHA256 e61f44ec9d530ffb233960540bfb54562f31d7dd3809c392c89c9c64b5b72150
- MD5 81edb1db39020cf12883f607effa179b
- SHA1 6638ffc9e744eecc3af2420621c33f10c65821e9
- SHA512 d53dbb82778cbb727e465a8bf194fb3429ccacd0c4965bd2fc00f7270cc05c3626762ceea6c1f14404261fc452e5fc4e9420a9cd2ba43887691a379f07e84800
- TLSH T1CCB02B8016E22107701E793128C64007B0480820F30688D08404B50D210B94C1A11CF0
- MD5 SHA1 SHA512 TLSH
- Path C:\ProgramData\B6FD.tmp
- Size 14KB
- SHA256 917e115cc403e29b4388e0d175cbfac3e7e40ca1742299fbdb353847db2de7c2
- MD5 294e9f64cb1642dd89229fff0592856b
- SHA1 97b148c27f3da29ba7b18d6aee8a0db9102f47c9
- SHA512 b87d531890bf1577b9b4af41dddb2cdbbfa164cf197bd5987df3a3075983645a3acba443e289b7bfd338422978a104f55298fbfe346872de0895bde44adc89cf
- SSDEEP 384:5cFP7VtpK4p+31Mzh79W5vM+ZyUgGq4BtMvAxXCRsi:A7Vf9p+qQ02y5HW6kX
- TLSH T15A52BECB73E75FCAF03B43740857340AB795BB062B966A92EDC4091E1DE66440A8743B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\CCCCCCCC
- Size 146KB
- SHA256 bdb451728150d6a1a4fe7eaa0488d09eb37b5d541b7f2ce92c975b02e8ee2d19
- MD5 d41b198ac6b2931ea54648b7d3150732
- SHA1 3048e59ca9dc664f68b0a565559c9dc4c4905ca7
- SHA512 4ffaf23939a04530b7bdb738cc1b73f18e942abc6d6feca17a1eaeddfe0c3a7df91730ebb84dad12b7725e06df3e89de2b213d764cdf20407c023a1ca0b8ef13
- SSDEEP 3072:Upl/qkkSEZ1VgKith964NNz2Lapl/qkkSEZ1VgKith964NNz2Lapl/qk6:2iOG3it3AkiOG3it3Akix
- TLSH T104E30180E027576B964843DB47FBFA4210F995E7009F4BBB625CE55A0B81CE93EE7324
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\{638888FD-BC8D-4244-AC05-A15D092CCBFD}
- Size 4KB
- SHA256 19d7721b55ad436a0684fe551ccd6fa85e800814790b171470a56cad66144385
- MD5 4a8d416b9f60a055f93a0a2853086d39
- SHA1 b602fd41af070e6ebcbc4082271f1702ba63166a
- SHA512 cf0d03b345d275b0482e3c89b4837f59da4d6def474c8eb58eb5c033e40530d7d6bd1bcc3af39e898c3ecd10cab5bf05379e950bd6d453ddb4be7fa86ce9b21d
- SSDEEP 6:RaU/IiYyfB3h1RRXUnfc2ljBFK8aGihGiDRujlw//0lweI//Gi5Rujd:RaUgiYyf9/Uf/tRfxTWf/e3
- TLSH T10EA1D8A837EAC165C5605E3D2E46CADA4A623DC48C55256B7CCC772DCC32A901514511
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\Documents\OneNote Notebooks\My Notebook\Open Notebook.onetoc2
- Size 4KB
- SHA256 5f2c1f1cf23f89dd028bcf68378a3b1e180628d025056381dc78857a94eccd42
- MD5 2cba3415df3af699d9d06b7ccc37c48e
- SHA1 c8700add36cdb0151e56a642da9a9eee53112c41
- SHA512 321e424f80a8de132e37f5fd302d0df2ca5c644b623293d470476d9e1dcafaa4640f5141a943efe2b2047c902801a1a76f4b016014b9e66c3e8d684dbe75e0fd
- SSDEEP 12:RaUgiYyfHj/Uv+RfxTW6/ekmojHMlSJwEIxA/L:YUtYyfHYeBHRjssJw1Aj
- TLSH T179A1AC987395D558CA906E3C2E47CBBF4B72BD828C69262B39C8772ECC36B901610914
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\nMRJHwIfR.README.txt
- Size 427B
- SHA256 29a544b27712da1f10bbf00378e7ccfd0ba5fdef465e221512cb9733ed31ff60
- MD5 e46429c9288ce455fcf5e80ecd99d2c8
- SHA1 76948e570ec0a492bbc71e5485d8fa744c846796
- SHA512 a4ef30a36f60e4788cdb26aaaecf3115ed44ff01d19773e3f2652e7817a85a5732c76806484460095550395db95ff29a6024d998fe7b9a14ec06c0897bde5455
- TLSH T170E0F19C61BF95C447120295393CDDB50669F112CAB8A4C6B8C124FB2FA9EF48360DAF
- MD5 SHA1 SHA512 TLSH
- Path F:\$RECYCLE.BIN\S-1-5-21-4220518935-1083122485-1008052776-1000\DDDDDDDDDDD
- Size 129B
- SHA256 17728108c85586591a19744b4f4f25b3148cf00992267e1c75d5d4da4b749644
- MD5 ebd751299e43428a1fd3eb4a185cd21e
- SHA1 15c7fb39b9d05d31630bff20062e97b4ba1aa336
- SHA512 b93214db5d03dad5af472f19d9c8d1497abd68ee27fc23417b9cc486306f8366918a34c0782df457ba968bc6114f61c710fa7cfa3bdaeb5202bdd33a2858c11d
- TLSH T1D7B02BB10171FC44570FC6231CE94A000880F0343240D752462C52C2F100D26DBCC304
- MD5 SHA1 SHA512 TLSH