Analysis
- max time kernel
149s - max time network
147s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
29/05/2026, 12:14
Behavioral task
behavioral1
Sample
file.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
22 signatures
150 seconds
Behavioral task
behavioral2
Sample
file.exe
Resource
win11-20260513-en
windows11-21h2-x64
21 signatures
150 seconds
General
- Target file.exe
- Size 146KB
- Sample260529-ped7csbt2y
- SHA256 1e399538c41be1c39566a00c95b78b39186510254e24562ec53a414ad74c23a1
- MD5 f448ba89857e8e173ea821f06f4aa6d3
- SHA1 5c5664eb61e44e9fe7ba2e5a8f23fd2e1bc5ff02
- SHA512 41696da1f0a95d773a95611e550cc13c7d7a9f5bde388e802c7c5de417edd9b04c5a8ed57ae160591ca1696a46125659c9d6a1347488cee76b528202bddafe48
- SSDEEP 3072:26glyuxE4GsUPnliByocWepo7wglcr869H4h9:26gDBGpvEByocWeG7HlcDV4h9
- TLSH T1E0E37E21F212D0B3C87718F13736B5B2F39E8D6C15A96807DAD80F99BCA58232F15997
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Renames multiple (981) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
- Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000\Control Panel\International\Geo\Nation 91BD.tmp - Deletes itself 1 IoCs
pid Process 6620 91BD.tmp - Executes dropped EXE 1 IoCs
pid Process 6620 91BD.tmp - Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Drops desktop.ini file(s) 2 IoCs
description ioc Process File opened for modification C:\$Recycle.Bin\S-1-5-21-2937465464-4167303362-2236413517-1000\desktop.ini file.exe File opened for modification F:\$RECYCLE.BIN\S-1-5-21-2937465464-4167303362-2236413517-1000\desktop.ini file.exe - Enumerates connected drives 3 TTPs 1 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\Z: file.exe - Indicator Removal: File Deletion 1 TTPs
Adversaries may delete files left behind by the actions of their intrusion activity.
- Drops file in System32 directory 4 IoCs
description ioc Process File created C:\Windows\system32\spool\PRINTERS\PP7k10ksannx8vmdymsjqyxtvad.TMP printfilterpipelinesvc.exe File created C:\Windows\system32\spool\PRINTERS\PP75q24pi0o5_rut6n60fc54yv.TMP printfilterpipelinesvc.exe File created C:\Windows\system32\spool\PRINTERS\00002.SPL splwow64.exe File created C:\Windows\system32\spool\PRINTERS\PPv2zl3fb9g8hbhn82lc749m_k.TMP printfilterpipelinesvc.exe - Sets desktop wallpaper using registry 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000\Control Panel\Desktop\WallPaper = "C:\\ProgramData\\E2Fgx1PWf.bmp" file.exe Set value (str) \REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000\Control Panel\Desktop\Wallpaper = "C:\\ProgramData\\E2Fgx1PWf.bmp" file.exe - Suspicious use of NtSetInformationThreadHideFromDebugger 5 IoCs
pid Process 1940 file.exe 1940 file.exe 1940 file.exe 1940 file.exe 6620 91BD.tmp - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language file.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 91BD.tmp - Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 ONENOTE.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz ONENOTE.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString ONENOTE.EXE - Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS ONENOTE.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily ONENOTE.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU ONENOTE.EXE - Modifies Control Panel 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000\Control Panel\Desktop file.exe Set value (str) \REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000\Control Panel\Desktop\WallpaperStyle = "10" file.exe - Modifies registry class 5 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.E2Fgx1PWf file.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.E2Fgx1PWf\ = "E2Fgx1PWf" file.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\E2Fgx1PWf\DefaultIcon file.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\E2Fgx1PWf file.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\E2Fgx1PWf\DefaultIcon\ = "C:\\ProgramData\\E2Fgx1PWf.ico" file.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1940 file.exe 1940 file.exe 1940 file.exe 1940 file.exe 1940 file.exe 1940 file.exe 1940 file.exe 1940 file.exe 1940 file.exe 1940 file.exe 1940 file.exe 1940 file.exe 1940 file.exe 1940 file.exe 1940 file.exe 1940 file.exe 1940 file.exe 1940 file.exe 1940 file.exe 1940 file.exe 1940 file.exe 1940 file.exe 1940 file.exe 1940 file.exe 1940 file.exe 1940 file.exe 1940 file.exe 1940 file.exe 1940 file.exe 1940 file.exe 1940 file.exe 1940 file.exe 1940 file.exe 1940 file.exe 1940 file.exe 1940 file.exe 1940 file.exe 1940 file.exe 1940 file.exe 1940 file.exe 1940 file.exe 1940 file.exe 1940 file.exe 1940 file.exe 1940 file.exe 1940 file.exe 1940 file.exe 1940 file.exe 1940 file.exe 1940 file.exe 1940 file.exe 1940 file.exe 1940 file.exe 1940 file.exe 1940 file.exe 1940 file.exe 1940 file.exe 1940 file.exe 1940 file.exe 1940 file.exe 1940 file.exe 1940 file.exe 1940 file.exe 1940 file.exe - Suspicious behavior: RenamesItself 26 IoCs
pid Process 6620 91BD.tmp 6620 91BD.tmp 6620 91BD.tmp 6620 91BD.tmp 6620 91BD.tmp 6620 91BD.tmp 6620 91BD.tmp 6620 91BD.tmp 6620 91BD.tmp 6620 91BD.tmp 6620 91BD.tmp 6620 91BD.tmp 6620 91BD.tmp 6620 91BD.tmp 6620 91BD.tmp 6620 91BD.tmp 6620 91BD.tmp 6620 91BD.tmp 6620 91BD.tmp 6620 91BD.tmp 6620 91BD.tmp 6620 91BD.tmp 6620 91BD.tmp 6620 91BD.tmp 6620 91BD.tmp 6620 91BD.tmp - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeAssignPrimaryTokenPrivilege 1940 file.exe Token: SeBackupPrivilege 1940 file.exe Token: SeDebugPrivilege 1940 file.exe Token: 36 1940 file.exe Token: SeImpersonatePrivilege 1940 file.exe Token: SeIncBasePriorityPrivilege 1940 file.exe Token: SeIncreaseQuotaPrivilege 1940 file.exe Token: 33 1940 file.exe Token: SeManageVolumePrivilege 1940 file.exe Token: SeProfSingleProcessPrivilege 1940 file.exe Token: SeRestorePrivilege 1940 file.exe Token: SeSecurityPrivilege 1940 file.exe Token: SeSystemProfilePrivilege 1940 file.exe Token: SeTakeOwnershipPrivilege 1940 file.exe Token: SeShutdownPrivilege 1940 file.exe Token: SeDebugPrivilege 1940 file.exe Token: SeBackupPrivilege 1940 file.exe Token: SeBackupPrivilege 1940 file.exe Token: SeSecurityPrivilege 1940 file.exe Token: SeSecurityPrivilege 1940 file.exe Token: SeBackupPrivilege 1940 file.exe Token: SeBackupPrivilege 1940 file.exe Token: SeSecurityPrivilege 1940 file.exe Token: SeSecurityPrivilege 1940 file.exe Token: SeBackupPrivilege 1940 file.exe Token: SeBackupPrivilege 1940 file.exe Token: SeSecurityPrivilege 1940 file.exe Token: SeSecurityPrivilege 1940 file.exe Token: SeBackupPrivilege 1940 file.exe Token: SeBackupPrivilege 1940 file.exe Token: SeSecurityPrivilege 1940 file.exe Token: SeSecurityPrivilege 1940 file.exe Token: SeBackupPrivilege 1940 file.exe Token: SeBackupPrivilege 1940 file.exe Token: SeSecurityPrivilege 1940 file.exe Token: SeSecurityPrivilege 1940 file.exe Token: SeBackupPrivilege 1940 file.exe Token: SeBackupPrivilege 1940 file.exe Token: SeSecurityPrivilege 1940 file.exe Token: SeSecurityPrivilege 1940 file.exe Token: SeBackupPrivilege 1940 file.exe Token: SeBackupPrivilege 1940 file.exe Token: SeSecurityPrivilege 1940 file.exe Token: SeSecurityPrivilege 1940 file.exe Token: SeBackupPrivilege 1940 file.exe Token: SeBackupPrivilege 1940 file.exe Token: SeSecurityPrivilege 1940 file.exe Token: SeSecurityPrivilege 1940 file.exe Token: SeBackupPrivilege 1940 file.exe Token: SeBackupPrivilege 1940 file.exe Token: SeSecurityPrivilege 1940 file.exe Token: SeSecurityPrivilege 1940 file.exe Token: SeBackupPrivilege 1940 file.exe Token: SeBackupPrivilege 1940 file.exe Token: SeSecurityPrivilege 1940 file.exe Token: SeSecurityPrivilege 1940 file.exe Token: SeBackupPrivilege 1940 file.exe Token: SeBackupPrivilege 1940 file.exe Token: SeSecurityPrivilege 1940 file.exe Token: SeSecurityPrivilege 1940 file.exe Token: SeBackupPrivilege 1940 file.exe Token: SeBackupPrivilege 1940 file.exe Token: SeSecurityPrivilege 1940 file.exe Token: SeSecurityPrivilege 1940 file.exe - Suspicious use of SetWindowsHookEx 13 IoCs
pid Process 6556 ONENOTE.EXE 6556 ONENOTE.EXE 6556 ONENOTE.EXE 6556 ONENOTE.EXE 6556 ONENOTE.EXE 6556 ONENOTE.EXE 6556 ONENOTE.EXE 6556 ONENOTE.EXE 6556 ONENOTE.EXE 6556 ONENOTE.EXE 6556 ONENOTE.EXE 6556 ONENOTE.EXE 6556 ONENOTE.EXE - Suspicious use of WriteProcessMemory 5 IoCs
description pid Process procid_target PID 1940 wrote to memory of 6168 1940 file.exe 100 PID 6456 wrote to memory of 6556 6456 printfilterpipelinesvc.exe 105 PID 1940 wrote to memory of 6620 1940 file.exe 106 PID 1940 wrote to memory of 6620 1940 file.exe 106 PID 6620 wrote to memory of 6768 6620 91BD.tmp 107
Processes
-
C:\Users\Admin\AppData\Local\Temp\file.exe"C:\Users\Admin\AppData\Local\Temp\file.exe"1⤵
- Drops desktop.ini file(s)
- Enumerates connected drives
- Sets desktop wallpaper using registry
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Modifies Control Panel
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1940 -
C:\Windows\splwow64.exeC:\Windows\splwow64.exe 122882⤵
- Drops file in System32 directory
PID:6168
-
-
C:\ProgramData\91BD.tmp"C:\ProgramData\91BD.tmp"2⤵
- Checks computer location settings
- Deletes itself
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:6620 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C DEL /F /Q C:\PROGRA~3\91BD.tmp >> NUL3⤵
- System Location Discovery: System Language Discovery
PID:6768
-
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k PrintWorkflow -s PrintWorkflowUserSvc1⤵PID:6216
-
C:\Windows\system32\printfilterpipelinesvc.exeC:\Windows\system32\printfilterpipelinesvc.exe -Embedding1⤵
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:6456 -
C:\Program Files\Microsoft Office\root\Office16\ONENOTE.EXE/insertdoc "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\{34D1052E-08A8-483A-8CE6-25D13B78A141}.xps" 1342453052990100002⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious use of SetWindowsHookEx
PID:6556
-
Network
MITRE ATT&CK Enterprise v16
Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\$Recycle.Bin\S-1-5-21-2937465464-4167303362-2236413517-1000\desktop.ini
- Size 129B
- SHA256 93b3329c4c3c8a808b27e5015dcb55b6443947811764dc7306e8f0fe0984f8d7
- MD5 6cd1c722f463fb9ceb07c5dfb45fbd94
- SHA1 370d0e47657c518c5c1f486fd19be2d3f45aa83e
- SHA512 86b44abd773cce312ad6b11aa48922e67ddcaab5d93ffbf8ae4092534afe36d5233e103bd73b7e29572b4c43ca7619b39342d7153f7448692dab97cc79c29f7f
- TLSH T1A1B02BC504E114B2AF5425000466C207010A0CC0C268D184520E10120C80B302B47428
- MD5 SHA1 SHA512 TLSH
- Path C:\E2Fgx1PWf.README.txt
- Size 427B
- SHA256 29a544b27712da1f10bbf00378e7ccfd0ba5fdef465e221512cb9733ed31ff60
- MD5 e46429c9288ce455fcf5e80ecd99d2c8
- SHA1 76948e570ec0a492bbc71e5485d8fa744c846796
- SHA512 a4ef30a36f60e4788cdb26aaaecf3115ed44ff01d19773e3f2652e7817a85a5732c76806484460095550395db95ff29a6024d998fe7b9a14ec06c0897bde5455
- TLSH T170E0F19C61BF95C447120295393CDDB50669F112CAB8A4C6B8C124FB2FA9EF48360DAF
- MD5 SHA1 SHA512 TLSH
- Path C:\ProgramData\91BD.tmp
- Size 14KB
- SHA256 917e115cc403e29b4388e0d175cbfac3e7e40ca1742299fbdb353847db2de7c2
- MD5 294e9f64cb1642dd89229fff0592856b
- SHA1 97b148c27f3da29ba7b18d6aee8a0db9102f47c9
- SHA512 b87d531890bf1577b9b4af41dddb2cdbbfa164cf197bd5987df3a3075983645a3acba443e289b7bfd338422978a104f55298fbfe346872de0895bde44adc89cf
- SSDEEP 384:5cFP7VtpK4p+31Mzh79W5vM+ZyUgGq4BtMvAxXCRsi:A7Vf9p+qQ02y5HW6kX
- TLSH T15A52BECB73E75FCAF03B43740857340AB795BB062B966A92EDC4091E1DE66440A8743B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\DDDDDDDD
- Size 146KB
- SHA256 8e912a64a2386889e184105e78b3361d1588e0cf47e59eaa2960e766bd0212de
- MD5 cec4e2894f707603db94d95f3b330372
- SHA1 2e703cd9c677806315a2da2aa3ae115bd161bc67
- SHA512 1a166f351e5475f3c4fa755ceb054097398ee09eaec202e65202375b9bab4f420d1c60d5aa5076ec6c9ba6698a830f6bbdd52aad32f2dac5fad0cb26e6ad8121
- SSDEEP 3072:APIIPdDc/eepz6topPIIPdDc/eepz6topPIIP5:APIIPdDc2Gz6tsPIIPdDc2Gz6tsPIIP5
- TLSH T1D5E31233BDE58F71482BF0D5ADF6AD7C0A2E5C1E69B44053821BCDA2DAC9D0423456BD
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\{B2A028F6-9A93-4F9C-A41E-8A1EBE1D5CB6}
- Size 4KB
- SHA256 1a0fbc652056d2d8b7560bcb15cf3076a71436dec40c1526a8cbdcacf4eae338
- MD5 844e7fbbeeb8fa8eaf26f2ab8801f379
- SHA1 a80061ae281f6fdc5537dfac3c10cb9912aa3619
- SHA512 5cd0b4cd10e947d47c9222f1694e29db5887334712ebe6b6c3adf8ca876bf396faf886979b579caaf926ea66e8303ff5f14d696d9233e033524cf3cce97f271c
- SSDEEP 6:Rag1WBlFYyfB3h1RRXUnf7cAv1jlFK5YcpEctrRujlw//0lweI/6vctxRujd:Rag1YFYyf9/Uf7ccpcScGWf/6vc6
- TLSH T162A1DF58BBD0C0AAE1A65C781D6BCEDA5D81BC95DC0101633ECC732E5837AD0469A212
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\Documents\OneNote Notebooks\My Notebook\Open Notebook.onetoc2
- Size 4KB
- SHA256 a142a77276380cafe56574e2f605bc51e09fc974dce26f0da0ddf9b287df1dd8
- MD5 0cb5d6b53d984c0e63ddbe064ba42d86
- SHA1 0509be221f62be657cee38e642fa9eceb6ea3a62
- SHA512 85cfd2ab56919dbce4d7bd15b954cb240beff276ae6dc4df2d662339cdfc164d7eaa4ea52f1cb083920a9ba49f12d97b766b013b6347b3fd533280e193b294bd
- SSDEEP 12:Rag1YFYyfHj/UvwwJucScGW6/6vcrScJoBaK3EIxA/L:YwyYyfHY4wJu7JICS+K31Aj
- TLSH T195A12858F790D059D2A5AC741D57CFEA1F91FC52DC1102237AD4332E4C376D45A9A621
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path F:\$RECYCLE.BIN\S-1-5-21-2937465464-4167303362-2236413517-1000\DDDDDDDDDDD
- Size 129B
- SHA256 32cf4b798ec683bc156dfa5f4e3af695f84ba6ea03c7fc068e3a2397443bf323
- MD5 7616be5acaffd668897c206ca2f359f5
- SHA1 d65377d97f8f9d94d0a62e7c7999d47ebfe929ac
- SHA512 770735698f957cc8044a10495c4dd56e21760f62cd8512cba1cca1624cbf5f8f24f9e2d02e300303e6d36dac28190ea1f8d0f5ce93e5003493844feba140eee3
- TLSH T1C1B02B2D48C451004092418821A04F64002F014068CC84A80228C030B527D4AC0F2FF8
- MD5 SHA1 SHA512 TLSH