Analysis
- max time kernel
149s - max time network
149s - platform
windows11-21h2_x64 - resource
win11-20251231-en - resource tags
arch:x64arch:x86image:win11-20251231-enlocale:en-usos:windows11-21h2-x64system - submitted
23/01/2026, 07:29
Behavioral task
behavioral1
Sample
2.exe
Resource
win10v2004-20251231-en
windows10-2004-x64
22 signatures
150 seconds
Behavioral task
behavioral2
Sample
2.exe
Resource
win11-20251231-en
windows11-21h2-x64
21 signatures
150 seconds
General
- Target 2.exe
- Size 146KB
- Sample260123-ja7p8aex6h
- SHA256 41fb6be80f588c9e7823f862baf7b43dff49206a1c45f8a03e3dbd5f15678e14
- MD5 a428fa4107600e2b727875b50ecaee5b
- SHA1 c0bd64d834319059f399d4734fb07c8052fd8cec
- SHA512 80bd5f5132e6255e5ee94c31925fa63f79d009ab7994e6eca0f6d14c129b8bc67065006dabd0924953df965bda4ca73307ceeb3ca8492f4f672c272084460507
- SSDEEP 3072:V6glyuxE4GsUPnliByocWepM+CXIhlxYxBd5h:V6gDBGpvEByocWe7rhlWL
- MD5 SHA1 SHA512 SSDEEP
Malware Config
Signatures
- Renames multiple (524) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
- Deletes itself 1 IoCs
pid Process 5808 E214.tmp - Executes dropped EXE 1 IoCs
pid Process 5808 E214.tmp - Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Drops desktop.ini file(s) 2 IoCs
description ioc Process File opened for modification F:\$RECYCLE.BIN\S-1-5-21-1879222327-309181551-1066679662-1000\desktop.ini 2.exe File opened for modification C:\$Recycle.Bin\S-1-5-21-1879222327-309181551-1066679662-1000\desktop.ini 2.exe - Enumerates connected drives 3 TTPs 1 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\Z: 2.exe - Indicator Removal: File Deletion 1 TTPs
Adversaries may delete files left behind by the actions of their intrusion activity.
- Drops file in System32 directory 4 IoCs
description ioc Process File created C:\Windows\system32\spool\PRINTERS\00002.SPL splwow64.exe File created C:\Windows\system32\spool\PRINTERS\PP9o65a0rsebidyowl_353khe0c.TMP printfilterpipelinesvc.exe File created C:\Windows\system32\spool\PRINTERS\PPjnarq3xm_97ji1tsxaqwv3hhd.TMP printfilterpipelinesvc.exe File created C:\Windows\system32\spool\PRINTERS\PPkozr2wyeehzxky9pwk8k2ltlc.TMP printfilterpipelinesvc.exe - Sets desktop wallpaper using registry 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-1879222327-309181551-1066679662-1000\Control Panel\Desktop\Wallpaper = "C:\\ProgramData\\ZDOHT8Cj4.bmp" 2.exe Set value (str) \REGISTRY\USER\S-1-5-21-1879222327-309181551-1066679662-1000\Control Panel\Desktop\WallPaper = "C:\\ProgramData\\ZDOHT8Cj4.bmp" 2.exe - Suspicious use of NtSetInformationThreadHideFromDebugger 5 IoCs
pid Process 1492 2.exe 1492 2.exe 1492 2.exe 1492 2.exe 5808 E214.tmp - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E214.tmp - Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 ONENOTE.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz ONENOTE.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString ONENOTE.EXE - Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily ONENOTE.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU ONENOTE.EXE Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS ONENOTE.EXE - Modifies Control Panel 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-1879222327-309181551-1066679662-1000\Control Panel\Desktop 2.exe Set value (str) \REGISTRY\USER\S-1-5-21-1879222327-309181551-1066679662-1000\Control Panel\Desktop\WallpaperStyle = "10" 2.exe - Modifies registry class 5 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.ZDOHT8Cj4 2.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.ZDOHT8Cj4\ = "ZDOHT8Cj4" 2.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\ZDOHT8Cj4\DefaultIcon 2.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\ZDOHT8Cj4 2.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\ZDOHT8Cj4\DefaultIcon\ = "C:\\ProgramData\\ZDOHT8Cj4.ico" 2.exe - Suspicious behavior: EnumeratesProcesses 62 IoCs
pid Process 1492 2.exe 1492 2.exe 1492 2.exe 1492 2.exe 1492 2.exe 1492 2.exe 1492 2.exe 1492 2.exe 1492 2.exe 1492 2.exe 1492 2.exe 1492 2.exe 1492 2.exe 1492 2.exe 1492 2.exe 1492 2.exe 1492 2.exe 1492 2.exe 1492 2.exe 1492 2.exe 1492 2.exe 1492 2.exe 1492 2.exe 1492 2.exe 1492 2.exe 1492 2.exe 1492 2.exe 1492 2.exe 1492 2.exe 1492 2.exe 1492 2.exe 1492 2.exe 1492 2.exe 1492 2.exe 1492 2.exe 1492 2.exe 1492 2.exe 1492 2.exe 1492 2.exe 1492 2.exe 1492 2.exe 1492 2.exe 1492 2.exe 1492 2.exe 1492 2.exe 1492 2.exe 1492 2.exe 1492 2.exe 1492 2.exe 1492 2.exe 1492 2.exe 1492 2.exe 1492 2.exe 1492 2.exe 1492 2.exe 1492 2.exe 1492 2.exe 1492 2.exe 1492 2.exe 1492 2.exe 1660 ONENOTE.EXE 1660 ONENOTE.EXE - Suspicious behavior: RenamesItself 26 IoCs
pid Process 5808 E214.tmp 5808 E214.tmp 5808 E214.tmp 5808 E214.tmp 5808 E214.tmp 5808 E214.tmp 5808 E214.tmp 5808 E214.tmp 5808 E214.tmp 5808 E214.tmp 5808 E214.tmp 5808 E214.tmp 5808 E214.tmp 5808 E214.tmp 5808 E214.tmp 5808 E214.tmp 5808 E214.tmp 5808 E214.tmp 5808 E214.tmp 5808 E214.tmp 5808 E214.tmp 5808 E214.tmp 5808 E214.tmp 5808 E214.tmp 5808 E214.tmp 5808 E214.tmp - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeAssignPrimaryTokenPrivilege 1492 2.exe Token: SeBackupPrivilege 1492 2.exe Token: SeDebugPrivilege 1492 2.exe Token: 36 1492 2.exe Token: SeImpersonatePrivilege 1492 2.exe Token: SeIncBasePriorityPrivilege 1492 2.exe Token: SeIncreaseQuotaPrivilege 1492 2.exe Token: 33 1492 2.exe Token: SeManageVolumePrivilege 1492 2.exe Token: SeProfSingleProcessPrivilege 1492 2.exe Token: SeRestorePrivilege 1492 2.exe Token: SeSecurityPrivilege 1492 2.exe Token: SeSystemProfilePrivilege 1492 2.exe Token: SeTakeOwnershipPrivilege 1492 2.exe Token: SeShutdownPrivilege 1492 2.exe Token: SeDebugPrivilege 1492 2.exe Token: SeBackupPrivilege 1492 2.exe Token: SeBackupPrivilege 1492 2.exe Token: SeSecurityPrivilege 1492 2.exe Token: SeSecurityPrivilege 1492 2.exe Token: SeBackupPrivilege 1492 2.exe Token: SeBackupPrivilege 1492 2.exe Token: SeSecurityPrivilege 1492 2.exe Token: SeSecurityPrivilege 1492 2.exe Token: SeBackupPrivilege 1492 2.exe Token: SeBackupPrivilege 1492 2.exe Token: SeSecurityPrivilege 1492 2.exe Token: SeSecurityPrivilege 1492 2.exe Token: SeBackupPrivilege 1492 2.exe Token: SeBackupPrivilege 1492 2.exe Token: SeSecurityPrivilege 1492 2.exe Token: SeSecurityPrivilege 1492 2.exe Token: SeBackupPrivilege 1492 2.exe Token: SeBackupPrivilege 1492 2.exe Token: SeSecurityPrivilege 1492 2.exe Token: SeSecurityPrivilege 1492 2.exe Token: SeBackupPrivilege 1492 2.exe Token: SeBackupPrivilege 1492 2.exe Token: SeSecurityPrivilege 1492 2.exe Token: SeSecurityPrivilege 1492 2.exe Token: SeBackupPrivilege 1492 2.exe Token: SeBackupPrivilege 1492 2.exe Token: SeSecurityPrivilege 1492 2.exe Token: SeSecurityPrivilege 1492 2.exe Token: SeBackupPrivilege 1492 2.exe Token: SeBackupPrivilege 1492 2.exe Token: SeSecurityPrivilege 1492 2.exe Token: SeSecurityPrivilege 1492 2.exe Token: SeBackupPrivilege 1492 2.exe Token: SeBackupPrivilege 1492 2.exe Token: SeSecurityPrivilege 1492 2.exe Token: SeSecurityPrivilege 1492 2.exe Token: SeBackupPrivilege 1492 2.exe Token: SeBackupPrivilege 1492 2.exe Token: SeSecurityPrivilege 1492 2.exe Token: SeSecurityPrivilege 1492 2.exe Token: SeBackupPrivilege 1492 2.exe Token: SeBackupPrivilege 1492 2.exe Token: SeSecurityPrivilege 1492 2.exe Token: SeSecurityPrivilege 1492 2.exe Token: SeBackupPrivilege 1492 2.exe Token: SeBackupPrivilege 1492 2.exe Token: SeSecurityPrivilege 1492 2.exe Token: SeSecurityPrivilege 1492 2.exe - Suspicious use of SetWindowsHookEx 13 IoCs
pid Process 1660 ONENOTE.EXE 1660 ONENOTE.EXE 1660 ONENOTE.EXE 1660 ONENOTE.EXE 1660 ONENOTE.EXE 1660 ONENOTE.EXE 1660 ONENOTE.EXE 1660 ONENOTE.EXE 1660 ONENOTE.EXE 1660 ONENOTE.EXE 1660 ONENOTE.EXE 1660 ONENOTE.EXE 1660 ONENOTE.EXE - Suspicious use of WriteProcessMemory 5 IoCs
description pid Process procid_target PID 1492 wrote to memory of 2980 1492 2.exe 79 PID 2476 wrote to memory of 1660 2476 printfilterpipelinesvc.exe 82 PID 1492 wrote to memory of 5808 1492 2.exe 83 PID 1492 wrote to memory of 5808 1492 2.exe 83 PID 5808 wrote to memory of 4100 5808 E214.tmp 84
Processes
-
C:\Users\Admin\AppData\Local\Temp\2.exe"C:\Users\Admin\AppData\Local\Temp\2.exe"1⤵
- Drops desktop.ini file(s)
- Enumerates connected drives
- Sets desktop wallpaper using registry
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Modifies Control Panel
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1492 -
C:\Windows\splwow64.exeC:\Windows\splwow64.exe 122882⤵
- Drops file in System32 directory
PID:2980
-
-
C:\ProgramData\E214.tmp"C:\ProgramData\E214.tmp"2⤵
- Deletes itself
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:5808 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C DEL /F /Q C:\PROGRA~3\E214.tmp >> NUL3⤵
- System Location Discovery: System Language Discovery
PID:4100
-
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k PrintWorkflow -s PrintWorkflowUserSvc1⤵PID:908
-
C:\Windows\system32\printfilterpipelinesvc.exeC:\Windows\system32\printfilterpipelinesvc.exe -Embedding1⤵
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:2476 -
C:\Program Files\Microsoft Office\root\Office16\ONENOTE.EXE/insertdoc "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\{C2C2850E-9F8C-4CAD-B0A4-8ACD346E708B}.xps" 1341362694911200002⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:1660
-
Network
MITRE ATT&CK Enterprise v16
Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\$Recycle.Bin\S-1-5-21-1879222327-309181551-1066679662-1000\TTTTTTTTTTT
- Size 129B
- SHA256 95e7e3f75175ed2d377adf381a54434f21b1cb67fe8a1b4c1c6f9b1e1e50ee2c
- MD5 26b3326108eb66a0e10f082ae35799b5
- SHA1 33abd0c94d1ca87b56714ceafff5755526f92541
- SHA512 dec9391da6e8646939dd4b7d3ff24bc14153910658e52a74a1c8b7e407f41849c8ea2ad0519de5744d74383fe34d4fa446d4ad5f38aaeaba98a99a8cd46ef070
- TLSH T13EB02B211DAF54407037191CD0C4DAC0C32482AE0C882250630A614370130418635C42
- MD5 SHA1 SHA512 TLSH
- Path C:\ProgramData\E214.tmp
- Size 14KB
- SHA256 917e115cc403e29b4388e0d175cbfac3e7e40ca1742299fbdb353847db2de7c2
- MD5 294e9f64cb1642dd89229fff0592856b
- SHA1 97b148c27f3da29ba7b18d6aee8a0db9102f47c9
- SHA512 b87d531890bf1577b9b4af41dddb2cdbbfa164cf197bd5987df3a3075983645a3acba443e289b7bfd338422978a104f55298fbfe346872de0895bde44adc89cf
- SSDEEP 384:5cFP7VtpK4p+31Mzh79W5vM+ZyUgGq4BtMvAxXCRsi:A7Vf9p+qQ02y5HW6kX
- TLSH T15A52BECB73E75FCAF03B43740857340AB795BB062B966A92EDC4091E1DE66440A8743B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\EEEEE
- Size 146KB
- SHA256 1d744d442453e0d759ff0d226987817429c8c1831d8c201cc64cecf5960a0eb4
- MD5 3e0e0bef5278e8cd1752a9e5aba94e1e
- SHA1 5a5e28f04072d866c78bb049b926ff066e81e367
- SHA512 fe684d0068c88aa0ba701e474e998fdf9ee32313c9c75b51e2ba7b9c964569ac7963237645b899d7be6b32ecc0ab76c71ee969e7f79c20a0aecd67b3914dd386
- SSDEEP 3072:m/iqdBQWyt0i+S0Adm/mECTQjU0F4/iqdBQWyt0i+S0Adm/mECTQjU0F4/iqdBQq:m/icBQWye9AdQg0F4/icBQWye9AdQg0C
- TLSH T173E302753A6DE82866BC39E9CA645216CF31ACC4F8D02BE74A9D827E77445300F683DD
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\{97CC3BB0-F0F3-4075-ACA4-B929A6C0CCD4}
- Size 4KB
- SHA256 a6b315846838162859af1316c0769010b9797d07c61ccfafb5badd1a7cb87f2e
- MD5 60cf2b37e71f2454a431e6d2140f8e1e
- SHA1 34bf41db35d4129829117b71e7bdb7136cdc8584
- SHA512 f6086226183e85b635802ad677201696276bc37cacdef06967aa068bcd6458147bff486b0553bc03d50e6ac69e46ef6435bbb1527b336a5bd049bbbea8d1751e
- SSDEEP 6:Ra/PIbYyfB3h1RRXUnf1Dp/YHFK3NlthFLtllBRujlw//0lweI/ECtlljRujd:RaiYyf9/Uf1Dp/xzt3t+Wf/ECtS
- TLSH T123A14F547F95D49DD0E4493C3EC2CBDD4986BCE6CD960143FFC9372E4832E951485254
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\Documents\OneNote Notebooks\My Notebook\Open Notebook.onetoc2
- Size 4KB
- SHA256 55ef23416ead0b5ac31e4cfa4b0b68f6f23c56221476796cf6f51cc63c03f719
- MD5 35cfe78238b14e03f963850cf3b546db
- SHA1 3b7f06fbe4e49e8ab5091730b0a7183de463553c
- SHA512 b644fb5982d09a291f31c3d9519800f3f1530fb8b735c99600763c8d61e319e5a65061579f86eff4792673c65861c5d71dcda6efd4d7235d6823bdf50cd7eb33
- SSDEEP 12:RaiYyfHj/Uvip/xzt3t+W6/ECtD8CtW4ADEIxA/L:YiYyfHYUxd+OWD8WWJD1Aj
- TLSH T1C6A12D50BF88E44CC1E89A7C2ECBCBEE8B92FC92CC520207BBD5333D4C31A940A80214
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ZDOHT8Cj4.README.txt
- Size 427B
- SHA256 29a544b27712da1f10bbf00378e7ccfd0ba5fdef465e221512cb9733ed31ff60
- MD5 e46429c9288ce455fcf5e80ecd99d2c8
- SHA1 76948e570ec0a492bbc71e5485d8fa744c846796
- SHA512 a4ef30a36f60e4788cdb26aaaecf3115ed44ff01d19773e3f2652e7817a85a5732c76806484460095550395db95ff29a6024d998fe7b9a14ec06c0897bde5455
- TLSH T170E0F19C61BF95C447120295393CDDB50669F112CAB8A4C6B8C124FB2FA9EF48360DAF
- MD5 SHA1 SHA512 TLSH
- Path F:\$RECYCLE.BIN\S-1-5-21-1879222327-309181551-1066679662-1000\DDDDDDDDDDD
- Size 129B
- SHA256 aca6d3377fad196599e6abcf50198c5153a5db5c931b0de1331992faa1b5f8f1
- MD5 324f3436e3cc986c365444e43e4712fd
- SHA1 be3c26d95919eb2235f7ac74ebb920cfddd8ad28
- SHA512 6e5a0bc204e9a03e70e3e078da55e2cbb1a693b46807ea185809ae0adea673c00a3a177c8c956a6eda08bf97d96a9b4c980a8795f5fba7115c12e2ed2b7542e0
- TLSH T191B09B9C51440335765D09B8A3C145444A09565BE4E162A9527C5556015791D709450D
- MD5 SHA1 SHA512 TLSH