Analysis
- max time kernel
149s - max time network
151s - platform
windows11-21h2_x64 - resource
win11-20260513-en - resource tags
arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows - submitted
29/05/2026, 12:12
Behavioral task
behavioral1
Sample
file.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
22 signatures
150 seconds
Behavioral task
behavioral2
Sample
file.exe
Resource
win11-20260513-en
windows11-21h2-x64
21 signatures
150 seconds
General
- Target file.exe
- Size 146KB
- Sample260529-pdnpeabs51
- SHA256 06fe6a157bd3f67ae9f7cdf3478a0db670c2772b584cae5900d2473b6b109bb7
- MD5 2e166b0ed08d9a559fe3ab4194eebf9b
- SHA1 8a97aa6405949976461441e74526debb05984658
- SHA512 1fa6c0068f0fb72b3f1a6f79f408b350176308e919dc58a29242bcbe59599267f299a04c9b8c5defa342d889852faf653b534ff67456f630f9fba9db11e650c7
- SSDEEP 3072:26glyuxE4GsUPnliByocWepDP7LENPCHCpmzd08C:26gDBGpvEByocWe5z+PCip0T
- TLSH T179E36E21F212D0B3C83718F12736B572F39E8D2C16A96907EAE80F5DBC658236F45697
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Renames multiple (942) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
- Deletes itself 1 IoCs
pid Process 3512 5177.tmp - Executes dropped EXE 1 IoCs
pid Process 3512 5177.tmp - Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Drops desktop.ini file(s) 2 IoCs
description ioc Process File opened for modification C:\$Recycle.Bin\S-1-5-21-1768642833-2142038154-4041560723-1000\desktop.ini file.exe File opened for modification F:\$RECYCLE.BIN\S-1-5-21-1768642833-2142038154-4041560723-1000\desktop.ini file.exe - Enumerates connected drives 3 TTPs 1 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\Z: file.exe - Indicator Removal: File Deletion 1 TTPs
Adversaries may delete files left behind by the actions of their intrusion activity.
- Drops file in System32 directory 4 IoCs
description ioc Process File created C:\Windows\system32\spool\PRINTERS\00002.SPL splwow64.exe File created C:\Windows\system32\spool\PRINTERS\PP4ll6cib_d50950gi6icnmpbbd.TMP printfilterpipelinesvc.exe File created C:\Windows\system32\spool\PRINTERS\PPboaxu73b07dtsjauqmw35s1sb.TMP printfilterpipelinesvc.exe File created C:\Windows\system32\spool\PRINTERS\PP300sp1o0i0_aj9kmtj3hagzcd.TMP printfilterpipelinesvc.exe - Sets desktop wallpaper using registry 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-1768642833-2142038154-4041560723-1000\Control Panel\Desktop\WallPaper = "C:\\ProgramData\\cCFUYwJne.bmp" file.exe Set value (str) \REGISTRY\USER\S-1-5-21-1768642833-2142038154-4041560723-1000\Control Panel\Desktop\Wallpaper = "C:\\ProgramData\\cCFUYwJne.bmp" file.exe - Suspicious use of NtSetInformationThreadHideFromDebugger 5 IoCs
pid Process 4796 file.exe 4796 file.exe 4796 file.exe 4796 file.exe 3512 5177.tmp - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language file.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5177.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe - Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 ONENOTE.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz ONENOTE.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString ONENOTE.EXE - Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS ONENOTE.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily ONENOTE.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU ONENOTE.EXE - Modifies Control Panel 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-1768642833-2142038154-4041560723-1000\Control Panel\Desktop file.exe Set value (str) \REGISTRY\USER\S-1-5-21-1768642833-2142038154-4041560723-1000\Control Panel\Desktop\WallpaperStyle = "10" file.exe - Modifies registry class 5 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.cCFUYwJne file.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.cCFUYwJne\ = "cCFUYwJne" file.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\cCFUYwJne\DefaultIcon file.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\cCFUYwJne file.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\cCFUYwJne\DefaultIcon\ = "C:\\ProgramData\\cCFUYwJne.ico" file.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4796 file.exe 4796 file.exe 4796 file.exe 4796 file.exe 4796 file.exe 4796 file.exe 4796 file.exe 4796 file.exe 4796 file.exe 4796 file.exe 4796 file.exe 4796 file.exe 4796 file.exe 4796 file.exe 4796 file.exe 4796 file.exe 4796 file.exe 4796 file.exe 4796 file.exe 4796 file.exe 4796 file.exe 4796 file.exe 4796 file.exe 4796 file.exe 4796 file.exe 4796 file.exe 4796 file.exe 4796 file.exe 4796 file.exe 4796 file.exe 4796 file.exe 4796 file.exe 4796 file.exe 4796 file.exe 4796 file.exe 4796 file.exe 4796 file.exe 4796 file.exe 4796 file.exe 4796 file.exe 4796 file.exe 4796 file.exe 4796 file.exe 4796 file.exe 4796 file.exe 4796 file.exe 4796 file.exe 4796 file.exe 4796 file.exe 4796 file.exe 4796 file.exe 4796 file.exe 4796 file.exe 4796 file.exe 4796 file.exe 4796 file.exe 4796 file.exe 4796 file.exe 4796 file.exe 4796 file.exe 4796 file.exe 4796 file.exe 1760 ONENOTE.EXE 1760 ONENOTE.EXE - Suspicious behavior: RenamesItself 26 IoCs
pid Process 3512 5177.tmp 3512 5177.tmp 3512 5177.tmp 3512 5177.tmp 3512 5177.tmp 3512 5177.tmp 3512 5177.tmp 3512 5177.tmp 3512 5177.tmp 3512 5177.tmp 3512 5177.tmp 3512 5177.tmp 3512 5177.tmp 3512 5177.tmp 3512 5177.tmp 3512 5177.tmp 3512 5177.tmp 3512 5177.tmp 3512 5177.tmp 3512 5177.tmp 3512 5177.tmp 3512 5177.tmp 3512 5177.tmp 3512 5177.tmp 3512 5177.tmp 3512 5177.tmp - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeAssignPrimaryTokenPrivilege 4796 file.exe Token: SeBackupPrivilege 4796 file.exe Token: SeDebugPrivilege 4796 file.exe Token: 36 4796 file.exe Token: SeImpersonatePrivilege 4796 file.exe Token: SeIncBasePriorityPrivilege 4796 file.exe Token: SeIncreaseQuotaPrivilege 4796 file.exe Token: 33 4796 file.exe Token: SeManageVolumePrivilege 4796 file.exe Token: SeProfSingleProcessPrivilege 4796 file.exe Token: SeRestorePrivilege 4796 file.exe Token: SeSecurityPrivilege 4796 file.exe Token: SeSystemProfilePrivilege 4796 file.exe Token: SeTakeOwnershipPrivilege 4796 file.exe Token: SeShutdownPrivilege 4796 file.exe Token: SeDebugPrivilege 4796 file.exe Token: SeBackupPrivilege 4796 file.exe Token: SeBackupPrivilege 4796 file.exe Token: SeSecurityPrivilege 4796 file.exe Token: SeSecurityPrivilege 4796 file.exe Token: SeBackupPrivilege 4796 file.exe Token: SeBackupPrivilege 4796 file.exe Token: SeSecurityPrivilege 4796 file.exe Token: SeSecurityPrivilege 4796 file.exe Token: SeBackupPrivilege 4796 file.exe Token: SeBackupPrivilege 4796 file.exe Token: SeSecurityPrivilege 4796 file.exe Token: SeSecurityPrivilege 4796 file.exe Token: SeBackupPrivilege 4796 file.exe Token: SeBackupPrivilege 4796 file.exe Token: SeSecurityPrivilege 4796 file.exe Token: SeSecurityPrivilege 4796 file.exe Token: SeBackupPrivilege 4796 file.exe Token: SeBackupPrivilege 4796 file.exe Token: SeSecurityPrivilege 4796 file.exe Token: SeSecurityPrivilege 4796 file.exe Token: SeBackupPrivilege 4796 file.exe Token: SeBackupPrivilege 4796 file.exe Token: SeSecurityPrivilege 4796 file.exe Token: SeSecurityPrivilege 4796 file.exe Token: SeBackupPrivilege 4796 file.exe Token: SeBackupPrivilege 4796 file.exe Token: SeSecurityPrivilege 4796 file.exe Token: SeSecurityPrivilege 4796 file.exe Token: SeBackupPrivilege 4796 file.exe Token: SeBackupPrivilege 4796 file.exe Token: SeSecurityPrivilege 4796 file.exe Token: SeSecurityPrivilege 4796 file.exe Token: SeBackupPrivilege 4796 file.exe Token: SeBackupPrivilege 4796 file.exe Token: SeSecurityPrivilege 4796 file.exe Token: SeSecurityPrivilege 4796 file.exe Token: SeBackupPrivilege 4796 file.exe Token: SeBackupPrivilege 4796 file.exe Token: SeSecurityPrivilege 4796 file.exe Token: SeSecurityPrivilege 4796 file.exe Token: SeBackupPrivilege 4796 file.exe Token: SeBackupPrivilege 4796 file.exe Token: SeSecurityPrivilege 4796 file.exe Token: SeSecurityPrivilege 4796 file.exe Token: SeBackupPrivilege 4796 file.exe Token: SeBackupPrivilege 4796 file.exe Token: SeSecurityPrivilege 4796 file.exe Token: SeSecurityPrivilege 4796 file.exe - Suspicious use of SetWindowsHookEx 13 IoCs
pid Process 1760 ONENOTE.EXE 1760 ONENOTE.EXE 1760 ONENOTE.EXE 1760 ONENOTE.EXE 1760 ONENOTE.EXE 1760 ONENOTE.EXE 1760 ONENOTE.EXE 1760 ONENOTE.EXE 1760 ONENOTE.EXE 1760 ONENOTE.EXE 1760 ONENOTE.EXE 1760 ONENOTE.EXE 1760 ONENOTE.EXE - Suspicious use of WriteProcessMemory 5 IoCs
description pid Process procid_target PID 4796 wrote to memory of 3968 4796 file.exe 82 PID 436 wrote to memory of 1760 436 printfilterpipelinesvc.exe 85 PID 4796 wrote to memory of 3512 4796 file.exe 86 PID 4796 wrote to memory of 3512 4796 file.exe 86 PID 3512 wrote to memory of 1548 3512 5177.tmp 87
Processes
-
C:\Users\Admin\AppData\Local\Temp\file.exe"C:\Users\Admin\AppData\Local\Temp\file.exe"1⤵
- Drops desktop.ini file(s)
- Enumerates connected drives
- Sets desktop wallpaper using registry
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Modifies Control Panel
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4796 -
C:\Windows\splwow64.exeC:\Windows\splwow64.exe 122882⤵
- Drops file in System32 directory
PID:3968
-
-
C:\ProgramData\5177.tmp"C:\ProgramData\5177.tmp"2⤵
- Deletes itself
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:3512 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C DEL /F /Q C:\PROGRA~3\5177.tmp >> NUL3⤵
- System Location Discovery: System Language Discovery
PID:1548
-
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k PrintWorkflow -s PrintWorkflowUserSvc1⤵PID:1568
-
C:\Windows\system32\printfilterpipelinesvc.exeC:\Windows\system32\printfilterpipelinesvc.exe -Embedding1⤵
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:436 -
C:\Program Files\Microsoft Office\root\Office16\ONENOTE.EXE/insertdoc "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\{0CFEF660-074B-4BCC-B877-37B03A4955DF}.xps" 1342453041330500002⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:1760
-
Network
MITRE ATT&CK Enterprise v16
Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\$Recycle.Bin\S-1-5-21-1768642833-2142038154-4041560723-1000\PPPPPPPPPPP
- Size 129B
- SHA256 4adee488ce9f31be832bf15159e27ccc1f64d2a139ca0452e3e807884866d8b8
- MD5 8ddf445a9dec6816a7ff95e5511b7571
- SHA1 3166a61ff75bbdd8c02c96e730e4d91b1bb01e55
- SHA512 bbfb66dc1692e6fe2a2850540cfd348a4f7c826c68df65d781f33bef68d18e1d2553d177ee4f66170d957c078f1aaef6f7e59693894a6cf5d89f2301b4f43324
- TLSH T141B02B384D20D5003438D7487600D1C30404088B0D1354A8BC00150ED8D50706D001C4
- MD5 SHA1 SHA512 TLSH
- Path C:\ProgramData\5177.tmp
- Size 14KB
- SHA256 917e115cc403e29b4388e0d175cbfac3e7e40ca1742299fbdb353847db2de7c2
- MD5 294e9f64cb1642dd89229fff0592856b
- SHA1 97b148c27f3da29ba7b18d6aee8a0db9102f47c9
- SHA512 b87d531890bf1577b9b4af41dddb2cdbbfa164cf197bd5987df3a3075983645a3acba443e289b7bfd338422978a104f55298fbfe346872de0895bde44adc89cf
- SSDEEP 384:5cFP7VtpK4p+31Mzh79W5vM+ZyUgGq4BtMvAxXCRsi:A7Vf9p+qQ02y5HW6kX
- TLSH T15A52BECB73E75FCAF03B43740857340AB795BB062B966A92EDC4091E1DE66440A8743B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\DDDDDDDD
- Size 146KB
- SHA256 aed7a05c4b47222cc8596b537fd60305ac38d5754ebcd82925d5e9905ec54d6d
- MD5 cbc8b663fda8c3c5748b6a8b21902d0c
- SHA1 c4fd92442daace21d04776ae69192c3e2144adfc
- SHA512 d378ded83b3051a0bd1f8f4a12a3178d4346b523acc7c314b3a66246a64d11fe5427d425903254f4cdb339a23de8675d7812b933783c8b4e3c05d2c27a90dbed
- SSDEEP 3072:W01+T7kjCLs2MBg0N8TohO501+T7kjCLs2MBg0N8TohO501+TV:WO+LsjBg0NxGO+LsjBg0NxGL
- TLSH T18CE302D23A4EE1411725AEABA6BD940DA43942CEE23AC54BB1C7B06DD953E090ACD70C
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\{E8B2CA56-192F-46B2-BF7E-AE9DF09C62BF}
- Size 4KB
- SHA256 8a1db8cbe3d7e96118e57fe52c313694d639c397a4583399fc21a56a2ab801a1
- MD5 e27283d8f3071219e90a0a9348c7a1b7
- SHA1 7de7fd45911cc062302ade32a9461187b4594740
- SHA512 f677b2e063d60b47457616ef00abf36ba830b3a830980e75a476f9af635a0850ab89065c22c465afe7771ccc0ea6b886181266d7219106bc98343ef32aaf3a49
- SSDEEP 6:Ra89aZ02ZjjYyfB3h1RRXUnf4HPgKP8NVFKktuOOtJRujlw//0lweI/YBt7Rujd:Ra89IvXYyf9/UfCP8NNZWf/j
- TLSH T19DA14F5D3BACE269F17099381F99CEAD8D927CC55D4D12433AD9B31E8D37E840156181
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\Documents\OneNote Notebooks\My Notebook\Open Notebook.onetoc2
- Size 4KB
- SHA256 73b080e6e4bf58c5a70c78e7cfccfa3b659751e065adddd520581f62205d3f07
- MD5 97577520685afbba6e920e8740104625
- SHA1 9fc455ef644bc1419b2bd110bd5b13b5302530cb
- SHA512 cb17dfd61647587eeb67641f947895ffe1ce63c4d4849e640a297cfbe46e482b85e321a4693e082739fe94d3097753e05d28ca4e9a4fc17be6ec9e44465e1b58
- SSDEEP 12:Ra89IvXYyfHj/Uv72+P6P8NNZW6/QokllFgLi/OEIxA/L:Y8mvXYyfHYqs6PWuoslFt/O1Aj
- TLSH T1DCA128597BA8E558F0B099342F9BCB7D0F51BC826C1D020736D5731D4E36A840220550
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\cCFUYwJne.README.txt
- Size 427B
- SHA256 29a544b27712da1f10bbf00378e7ccfd0ba5fdef465e221512cb9733ed31ff60
- MD5 e46429c9288ce455fcf5e80ecd99d2c8
- SHA1 76948e570ec0a492bbc71e5485d8fa744c846796
- SHA512 a4ef30a36f60e4788cdb26aaaecf3115ed44ff01d19773e3f2652e7817a85a5732c76806484460095550395db95ff29a6024d998fe7b9a14ec06c0897bde5455
- TLSH T170E0F19C61BF95C447120295393CDDB50669F112CAB8A4C6B8C124FB2FA9EF48360DAF
- MD5 SHA1 SHA512 TLSH
- Path F:\$RECYCLE.BIN\S-1-5-21-1768642833-2142038154-4041560723-1000\DDDDDDDDDDD
- Size 129B
- SHA256 cc780d9a82571b6992d34a278adf6531f9b91793af7654142c6bd86f87092665
- MD5 c706d0306f46910ff42a31fe1ec37d81
- SHA1 d56f3c6ec2701cefb714c1dc6fed6a92765387b4
- SHA512 e582ef5e89747b83d8a87f2094c5083b50a80c1bf1406b4974359ab1f84773eaa002a09142b9d20fca1e25e8d2f7071d645c355c19b1fa89348ca62fe5464a3d
- TLSH T14CB02B20F778740B0083330234106110000D8138C8932CF3AF18084478545005102B83
- MD5 SHA1 SHA512 TLSH