Analysis
- max time kernel
149s - max time network
152s - platform
windows11-21h2_x64 - resource
win11-20260513-en - resource tags
arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows - submitted
29/05/2026, 12:12
Behavioral task
behavioral1
Sample
file.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
22 signatures
150 seconds
Behavioral task
behavioral2
Sample
file.exe
Resource
win11-20260513-en
windows11-21h2-x64
21 signatures
150 seconds
General
- Target file.exe
- Size 146KB
- Sample260529-pdgwvsbs4x
- SHA256 93da3f615d041dc37a4b3db4a3d0c60bfd3c3fb1fc3ff4d5b764c646b629da7b
- MD5 115e584c09344a8139fed9296f0ee070
- SHA1 f0f6723c5baa8cd77f53428072e31fa6206eaf48
- SHA512 ca2ac4e1a3a3fb48fa11142a82a6a4a87f81b1aad7c1de89a515ca23d2f8d91f321beba344e09b47ca536ebbe41cca18413161920c2de61209423a5c7f48290a
- SSDEEP 3072:06glyuxE4GsUPnliByocWepyYRb8vPZToVTJZxUTR6:06gDBGpvEByocWer0OJZqF
- TLSH T110E36D21F212D0B3C87718F53B36B572F39E8E2C15A96847DAE90F59BC648232F05697
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Renames multiple (1001) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
- Deletes itself 1 IoCs
pid Process 3576 AECA.tmp - Executes dropped EXE 1 IoCs
pid Process 3576 AECA.tmp - Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Drops desktop.ini file(s) 2 IoCs
description ioc Process File opened for modification C:\$Recycle.Bin\S-1-5-21-2043432456-1617298091-2772621413-1000\desktop.ini file.exe File opened for modification F:\$RECYCLE.BIN\S-1-5-21-2043432456-1617298091-2772621413-1000\desktop.ini file.exe - Enumerates connected drives 3 TTPs 1 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\Z: file.exe - Indicator Removal: File Deletion 1 TTPs
Adversaries may delete files left behind by the actions of their intrusion activity.
- Drops file in System32 directory 4 IoCs
description ioc Process File created C:\Windows\system32\spool\PRINTERS\PPkx2h7no2xoaxdcgg6_wz1auvd.TMP printfilterpipelinesvc.exe File created C:\Windows\system32\spool\PRINTERS\00002.SPL splwow64.exe File created C:\Windows\system32\spool\PRINTERS\PPhez0thu2cmhhn4z1lcgukbydd.TMP printfilterpipelinesvc.exe File created C:\Windows\system32\spool\PRINTERS\PPoezg37vsz82zisrxw0pjla6ee.TMP printfilterpipelinesvc.exe - Sets desktop wallpaper using registry 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2043432456-1617298091-2772621413-1000\Control Panel\Desktop\WallPaper = "C:\\ProgramData\\LSR7FG1H1.bmp" file.exe Set value (str) \REGISTRY\USER\S-1-5-21-2043432456-1617298091-2772621413-1000\Control Panel\Desktop\Wallpaper = "C:\\ProgramData\\LSR7FG1H1.bmp" file.exe - Suspicious use of NtSetInformationThreadHideFromDebugger 5 IoCs
pid Process 836 file.exe 836 file.exe 836 file.exe 836 file.exe 3576 AECA.tmp - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language file.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AECA.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe - Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 ONENOTE.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz ONENOTE.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString ONENOTE.EXE - Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS ONENOTE.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily ONENOTE.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU ONENOTE.EXE - Modifies Control Panel 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2043432456-1617298091-2772621413-1000\Control Panel\Desktop file.exe Set value (str) \REGISTRY\USER\S-1-5-21-2043432456-1617298091-2772621413-1000\Control Panel\Desktop\WallpaperStyle = "10" file.exe - Modifies registry class 5 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.LSR7FG1H1\ = "LSR7FG1H1" file.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\LSR7FG1H1\DefaultIcon file.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\LSR7FG1H1 file.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\LSR7FG1H1\DefaultIcon\ = "C:\\ProgramData\\LSR7FG1H1.ico" file.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.LSR7FG1H1 file.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 836 file.exe 836 file.exe 836 file.exe 836 file.exe 836 file.exe 836 file.exe 836 file.exe 836 file.exe 836 file.exe 836 file.exe 836 file.exe 836 file.exe 836 file.exe 836 file.exe 836 file.exe 836 file.exe 836 file.exe 836 file.exe 836 file.exe 836 file.exe 836 file.exe 836 file.exe 836 file.exe 836 file.exe 836 file.exe 836 file.exe 836 file.exe 836 file.exe 836 file.exe 836 file.exe 836 file.exe 836 file.exe 836 file.exe 836 file.exe 836 file.exe 836 file.exe 836 file.exe 836 file.exe 836 file.exe 836 file.exe 836 file.exe 836 file.exe 836 file.exe 836 file.exe 836 file.exe 836 file.exe 836 file.exe 836 file.exe 836 file.exe 836 file.exe 836 file.exe 836 file.exe 836 file.exe 836 file.exe 836 file.exe 836 file.exe 836 file.exe 836 file.exe 836 file.exe 836 file.exe 836 file.exe 836 file.exe 840 ONENOTE.EXE 840 ONENOTE.EXE - Suspicious behavior: RenamesItself 26 IoCs
pid Process 3576 AECA.tmp 3576 AECA.tmp 3576 AECA.tmp 3576 AECA.tmp 3576 AECA.tmp 3576 AECA.tmp 3576 AECA.tmp 3576 AECA.tmp 3576 AECA.tmp 3576 AECA.tmp 3576 AECA.tmp 3576 AECA.tmp 3576 AECA.tmp 3576 AECA.tmp 3576 AECA.tmp 3576 AECA.tmp 3576 AECA.tmp 3576 AECA.tmp 3576 AECA.tmp 3576 AECA.tmp 3576 AECA.tmp 3576 AECA.tmp 3576 AECA.tmp 3576 AECA.tmp 3576 AECA.tmp 3576 AECA.tmp - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeAssignPrimaryTokenPrivilege 836 file.exe Token: SeBackupPrivilege 836 file.exe Token: SeDebugPrivilege 836 file.exe Token: 36 836 file.exe Token: SeImpersonatePrivilege 836 file.exe Token: SeIncBasePriorityPrivilege 836 file.exe Token: SeIncreaseQuotaPrivilege 836 file.exe Token: 33 836 file.exe Token: SeManageVolumePrivilege 836 file.exe Token: SeProfSingleProcessPrivilege 836 file.exe Token: SeRestorePrivilege 836 file.exe Token: SeSecurityPrivilege 836 file.exe Token: SeSystemProfilePrivilege 836 file.exe Token: SeTakeOwnershipPrivilege 836 file.exe Token: SeShutdownPrivilege 836 file.exe Token: SeDebugPrivilege 836 file.exe Token: SeBackupPrivilege 836 file.exe Token: SeBackupPrivilege 836 file.exe Token: SeSecurityPrivilege 836 file.exe Token: SeSecurityPrivilege 836 file.exe Token: SeBackupPrivilege 836 file.exe Token: SeBackupPrivilege 836 file.exe Token: SeSecurityPrivilege 836 file.exe Token: SeSecurityPrivilege 836 file.exe Token: SeBackupPrivilege 836 file.exe Token: SeBackupPrivilege 836 file.exe Token: SeSecurityPrivilege 836 file.exe Token: SeSecurityPrivilege 836 file.exe Token: SeBackupPrivilege 836 file.exe Token: SeBackupPrivilege 836 file.exe Token: SeSecurityPrivilege 836 file.exe Token: SeSecurityPrivilege 836 file.exe Token: SeBackupPrivilege 836 file.exe Token: SeBackupPrivilege 836 file.exe Token: SeSecurityPrivilege 836 file.exe Token: SeSecurityPrivilege 836 file.exe Token: SeBackupPrivilege 836 file.exe Token: SeBackupPrivilege 836 file.exe Token: SeSecurityPrivilege 836 file.exe Token: SeSecurityPrivilege 836 file.exe Token: SeBackupPrivilege 836 file.exe Token: SeBackupPrivilege 836 file.exe Token: SeSecurityPrivilege 836 file.exe Token: SeSecurityPrivilege 836 file.exe Token: SeBackupPrivilege 836 file.exe Token: SeBackupPrivilege 836 file.exe Token: SeSecurityPrivilege 836 file.exe Token: SeSecurityPrivilege 836 file.exe Token: SeBackupPrivilege 836 file.exe Token: SeBackupPrivilege 836 file.exe Token: SeSecurityPrivilege 836 file.exe Token: SeSecurityPrivilege 836 file.exe Token: SeBackupPrivilege 836 file.exe Token: SeBackupPrivilege 836 file.exe Token: SeSecurityPrivilege 836 file.exe Token: SeSecurityPrivilege 836 file.exe Token: SeBackupPrivilege 836 file.exe Token: SeBackupPrivilege 836 file.exe Token: SeSecurityPrivilege 836 file.exe Token: SeSecurityPrivilege 836 file.exe Token: SeBackupPrivilege 836 file.exe Token: SeBackupPrivilege 836 file.exe Token: SeSecurityPrivilege 836 file.exe Token: SeSecurityPrivilege 836 file.exe - Suspicious use of SetWindowsHookEx 13 IoCs
pid Process 840 ONENOTE.EXE 840 ONENOTE.EXE 840 ONENOTE.EXE 840 ONENOTE.EXE 840 ONENOTE.EXE 840 ONENOTE.EXE 840 ONENOTE.EXE 840 ONENOTE.EXE 840 ONENOTE.EXE 840 ONENOTE.EXE 840 ONENOTE.EXE 840 ONENOTE.EXE 840 ONENOTE.EXE - Suspicious use of WriteProcessMemory 5 IoCs
description pid Process procid_target PID 836 wrote to memory of 4092 836 file.exe 82 PID 4940 wrote to memory of 840 4940 printfilterpipelinesvc.exe 85 PID 836 wrote to memory of 3576 836 file.exe 86 PID 836 wrote to memory of 3576 836 file.exe 86 PID 3576 wrote to memory of 4992 3576 AECA.tmp 87
Processes
-
C:\Users\Admin\AppData\Local\Temp\file.exe"C:\Users\Admin\AppData\Local\Temp\file.exe"1⤵
- Drops desktop.ini file(s)
- Enumerates connected drives
- Sets desktop wallpaper using registry
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Modifies Control Panel
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:836 -
C:\Windows\splwow64.exeC:\Windows\splwow64.exe 122882⤵
- Drops file in System32 directory
PID:4092
-
-
C:\ProgramData\AECA.tmp"C:\ProgramData\AECA.tmp"2⤵
- Deletes itself
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:3576 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C DEL /F /Q C:\PROGRA~3\AECA.tmp >> NUL3⤵
- System Location Discovery: System Language Discovery
PID:4992
-
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k PrintWorkflow -s PrintWorkflowUserSvc1⤵PID:4468
-
C:\Windows\system32\printfilterpipelinesvc.exeC:\Windows\system32\printfilterpipelinesvc.exe -Embedding1⤵
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:4940 -
C:\Program Files\Microsoft Office\root\Office16\ONENOTE.EXE/insertdoc "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\{AD57E29C-7E0A-4BB5-B7D7-879CB4B9D490}.xps" 1342453041592900002⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:840
-
Network
MITRE ATT&CK Enterprise v16
Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\$Recycle.Bin\S-1-5-21-2043432456-1617298091-2772621413-1000\AAAAAAAAAAA
- Size 129B
- SHA256 cacedc04b7a92c1d8a485a769772175f3ec11d49563154a66b7d4065392cdcee
- MD5 a746f64205e0ae26e670f2d4fe1dea09
- SHA1 d6d6f2c541f78940ec1e20216df0e83c5ae497ce
- SHA512 d07e1abfc87b4141b6b31239d56566006039ee086c38fa6ed22809200056abaaf4dc5b51906c26156944af77c7b9919e9f7f7fbef3d3fa3d2e01737590399600
- TLSH T108B02BEFC8084D44CAAC38C10880112C0344440850610F3895213B9145E3098C001083
- MD5 SHA1 SHA512 TLSH
- Path C:\LSR7FG1H1.README.txt
- Size 427B
- SHA256 29a544b27712da1f10bbf00378e7ccfd0ba5fdef465e221512cb9733ed31ff60
- MD5 e46429c9288ce455fcf5e80ecd99d2c8
- SHA1 76948e570ec0a492bbc71e5485d8fa744c846796
- SHA512 a4ef30a36f60e4788cdb26aaaecf3115ed44ff01d19773e3f2652e7817a85a5732c76806484460095550395db95ff29a6024d998fe7b9a14ec06c0897bde5455
- TLSH T170E0F19C61BF95C447120295393CDDB50669F112CAB8A4C6B8C124FB2FA9EF48360DAF
- MD5 SHA1 SHA512 TLSH
- Path C:\ProgramData\AECA.tmp
- Size 14KB
- SHA256 917e115cc403e29b4388e0d175cbfac3e7e40ca1742299fbdb353847db2de7c2
- MD5 294e9f64cb1642dd89229fff0592856b
- SHA1 97b148c27f3da29ba7b18d6aee8a0db9102f47c9
- SHA512 b87d531890bf1577b9b4af41dddb2cdbbfa164cf197bd5987df3a3075983645a3acba443e289b7bfd338422978a104f55298fbfe346872de0895bde44adc89cf
- SSDEEP 384:5cFP7VtpK4p+31Mzh79W5vM+ZyUgGq4BtMvAxXCRsi:A7Vf9p+qQ02y5HW6kX
- TLSH T15A52BECB73E75FCAF03B43740857340AB795BB062B966A92EDC4091E1DE66440A8743B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\DDDDDDDD
- Size 146KB
- SHA256 e859536e90f8fdb35532a382286d922c0b982582aa4f41396c95b8073fd77597
- MD5 f4ff0e2c2455414ff94b1be104ccf2f6
- SHA1 3ecd7d02af1d6644a1cbf93b846b98ee0367d9cb
- SHA512 8bccfae0bd88c92591490f670e277ab665b3a77eece5359ac01627d0b9736b23e8d5e471e09296b6eb00236e058bdb8cadc9e7232a90acece2f1f930bb1fa18f
- SSDEEP 3072:wl3TO0GJ68yA5q1mykUY0l3TO0GJ68yA5q1mykUY0l3TO0GJ/:wli0YtyA5Xcli0YtyA5Xcli0Y/
- TLSH T172E302896195D901B30CE9C53FF10646C01017EE2A7B5B3ABA94F4D67EE02D548CDF9B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\Documents\OneNote Notebooks\My Notebook\Open Notebook.onetoc2
- Size 4KB
- SHA256 f5ce6552d9eea61b8e0bfbf01d370941154ca07fcff36e64b32a034dcea59ab9
- MD5 fc75fb32d6ae0e3baf18a3379a21f52d
- SHA1 8fc84ef81c09167b60677009853559fdd9e1028f
- SHA512 297de19884fb58f2c8e727e6af09ec6756cbd539b641106aea521b90200e4f2fe8ca7eb5adeeba6dd3fe456a702e3f38044debe041ec4b0dd7debd19b5f06a6b
- SSDEEP 12:RaDHYyfHj/UvOFG1GD2W6/7XowahmmWxEIxA/L:Y7YyfHYSz2JfaYmWx1Aj
- TLSH T1B7A14C957748D948C2959CB81F87C7BE9B51FD069D24070735E4731E4E397948A04624
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path F:\$RECYCLE.BIN\S-1-5-21-2043432456-1617298091-2772621413-1000\DDDDDDDDDDD
- Size 129B
- SHA256 321158af6640abfa5d19b23498ee00f5a80f58bb7ca66c28ecf71d30ec28be89
- MD5 a0f4c992593ac70d66e8fa44319c9e1e
- SHA1 5f8fd4e586cb3eb42e216081f2d54163c63c88b0
- SHA512 5b14b31ee13379599f947ecbd3b8548777f0eff526b4f70d67ced0201fe757f119e8b8eac986f6ed271c44821a41c11b02ae254fc7d148734ef37b5f3a27a6b5
- TLSH T1EBB02B1F10E694B1710000B4BD3C960981160068DCB0053804880381E0A1BC440CD803
- MD5 SHA1 SHA512 TLSH