Analysis
- max time kernel
149s - max time network
150s - platform
windows11-21h2_x64 - resource
win11-20260513-en - resource tags
arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows - submitted
29/05/2026, 12:14
Behavioral task
behavioral1
Sample
file.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
22 signatures
150 seconds
Behavioral task
behavioral2
Sample
file.exe
Resource
win11-20260513-en
windows11-21h2-x64
21 signatures
150 seconds
General
- Target file.exe
- Size 146KB
- Sample260529-ped7csbt2y
- SHA256 1e399538c41be1c39566a00c95b78b39186510254e24562ec53a414ad74c23a1
- MD5 f448ba89857e8e173ea821f06f4aa6d3
- SHA1 5c5664eb61e44e9fe7ba2e5a8f23fd2e1bc5ff02
- SHA512 41696da1f0a95d773a95611e550cc13c7d7a9f5bde388e802c7c5de417edd9b04c5a8ed57ae160591ca1696a46125659c9d6a1347488cee76b528202bddafe48
- SSDEEP 3072:26glyuxE4GsUPnliByocWepo7wglcr869H4h9:26gDBGpvEByocWeG7HlcDV4h9
- TLSH T1E0E37E21F212D0B3C87718F13736B5B2F39E8D6C15A96807DAD80F99BCA58232F15997
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Renames multiple (959) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
- Deletes itself 1 IoCs
pid Process 5228 2E5.tmp - Executes dropped EXE 1 IoCs
pid Process 5228 2E5.tmp - Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Drops desktop.ini file(s) 2 IoCs
description ioc Process File opened for modification C:\$Recycle.Bin\S-1-5-21-1636999435-3883760687-346127294-1000\desktop.ini file.exe File opened for modification F:\$RECYCLE.BIN\S-1-5-21-1636999435-3883760687-346127294-1000\desktop.ini file.exe - Enumerates connected drives 3 TTPs 1 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\Z: file.exe - Indicator Removal: File Deletion 1 TTPs
Adversaries may delete files left behind by the actions of their intrusion activity.
- Drops file in System32 directory 4 IoCs
description ioc Process File created C:\Windows\system32\spool\PRINTERS\PPhi6g42j0gpd8vf8zj_kdaesnd.TMP printfilterpipelinesvc.exe File created C:\Windows\system32\spool\PRINTERS\PP1ow3kf0p2dv060v3ixeb3q1dc.TMP printfilterpipelinesvc.exe File created C:\Windows\system32\spool\PRINTERS\PP3us9t50fflqigopg6vyilc26d.TMP printfilterpipelinesvc.exe File created C:\Windows\system32\spool\PRINTERS\00002.SPL splwow64.exe - Sets desktop wallpaper using registry 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-1636999435-3883760687-346127294-1000\Control Panel\Desktop\WallPaper = "C:\\ProgramData\\E2Fgx1PWf.bmp" file.exe Set value (str) \REGISTRY\USER\S-1-5-21-1636999435-3883760687-346127294-1000\Control Panel\Desktop\Wallpaper = "C:\\ProgramData\\E2Fgx1PWf.bmp" file.exe - Suspicious use of NtSetInformationThreadHideFromDebugger 5 IoCs
pid Process 2248 file.exe 2248 file.exe 2248 file.exe 2248 file.exe 5228 2E5.tmp - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language file.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2E5.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe - Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 ONENOTE.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz ONENOTE.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString ONENOTE.EXE - Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily ONENOTE.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU ONENOTE.EXE Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS ONENOTE.EXE - Modifies Control Panel 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-1636999435-3883760687-346127294-1000\Control Panel\Desktop file.exe Set value (str) \REGISTRY\USER\S-1-5-21-1636999435-3883760687-346127294-1000\Control Panel\Desktop\WallpaperStyle = "10" file.exe - Modifies registry class 5 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.E2Fgx1PWf file.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.E2Fgx1PWf\ = "E2Fgx1PWf" file.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\E2Fgx1PWf\DefaultIcon file.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\E2Fgx1PWf file.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\E2Fgx1PWf\DefaultIcon\ = "C:\\ProgramData\\E2Fgx1PWf.ico" file.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2248 file.exe 2248 file.exe 2248 file.exe 2248 file.exe 2248 file.exe 2248 file.exe 2248 file.exe 2248 file.exe 2248 file.exe 2248 file.exe 2248 file.exe 2248 file.exe 2248 file.exe 2248 file.exe 2248 file.exe 2248 file.exe 2248 file.exe 2248 file.exe 2248 file.exe 2248 file.exe 2248 file.exe 2248 file.exe 2248 file.exe 2248 file.exe 2248 file.exe 2248 file.exe 2248 file.exe 2248 file.exe 2248 file.exe 2248 file.exe 2248 file.exe 2248 file.exe 2248 file.exe 2248 file.exe 2248 file.exe 2248 file.exe 2248 file.exe 2248 file.exe 2248 file.exe 2248 file.exe 2248 file.exe 2248 file.exe 2248 file.exe 2248 file.exe 2248 file.exe 2248 file.exe 2248 file.exe 2248 file.exe 2248 file.exe 2248 file.exe 2248 file.exe 2248 file.exe 2248 file.exe 2248 file.exe 2248 file.exe 2248 file.exe 2248 file.exe 2248 file.exe 2248 file.exe 2248 file.exe 2248 file.exe 2248 file.exe 3436 ONENOTE.EXE 3436 ONENOTE.EXE - Suspicious behavior: RenamesItself 26 IoCs
pid Process 5228 2E5.tmp 5228 2E5.tmp 5228 2E5.tmp 5228 2E5.tmp 5228 2E5.tmp 5228 2E5.tmp 5228 2E5.tmp 5228 2E5.tmp 5228 2E5.tmp 5228 2E5.tmp 5228 2E5.tmp 5228 2E5.tmp 5228 2E5.tmp 5228 2E5.tmp 5228 2E5.tmp 5228 2E5.tmp 5228 2E5.tmp 5228 2E5.tmp 5228 2E5.tmp 5228 2E5.tmp 5228 2E5.tmp 5228 2E5.tmp 5228 2E5.tmp 5228 2E5.tmp 5228 2E5.tmp 5228 2E5.tmp - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeAssignPrimaryTokenPrivilege 2248 file.exe Token: SeBackupPrivilege 2248 file.exe Token: SeDebugPrivilege 2248 file.exe Token: 36 2248 file.exe Token: SeImpersonatePrivilege 2248 file.exe Token: SeIncBasePriorityPrivilege 2248 file.exe Token: SeIncreaseQuotaPrivilege 2248 file.exe Token: 33 2248 file.exe Token: SeManageVolumePrivilege 2248 file.exe Token: SeProfSingleProcessPrivilege 2248 file.exe Token: SeRestorePrivilege 2248 file.exe Token: SeSecurityPrivilege 2248 file.exe Token: SeSystemProfilePrivilege 2248 file.exe Token: SeTakeOwnershipPrivilege 2248 file.exe Token: SeShutdownPrivilege 2248 file.exe Token: SeDebugPrivilege 2248 file.exe Token: SeBackupPrivilege 2248 file.exe Token: SeBackupPrivilege 2248 file.exe Token: SeSecurityPrivilege 2248 file.exe Token: SeSecurityPrivilege 2248 file.exe Token: SeBackupPrivilege 2248 file.exe Token: SeBackupPrivilege 2248 file.exe Token: SeSecurityPrivilege 2248 file.exe Token: SeSecurityPrivilege 2248 file.exe Token: SeBackupPrivilege 2248 file.exe Token: SeBackupPrivilege 2248 file.exe Token: SeSecurityPrivilege 2248 file.exe Token: SeSecurityPrivilege 2248 file.exe Token: SeBackupPrivilege 2248 file.exe Token: SeBackupPrivilege 2248 file.exe Token: SeSecurityPrivilege 2248 file.exe Token: SeSecurityPrivilege 2248 file.exe Token: SeBackupPrivilege 2248 file.exe Token: SeBackupPrivilege 2248 file.exe Token: SeSecurityPrivilege 2248 file.exe Token: SeSecurityPrivilege 2248 file.exe Token: SeBackupPrivilege 2248 file.exe Token: SeBackupPrivilege 2248 file.exe Token: SeSecurityPrivilege 2248 file.exe Token: SeSecurityPrivilege 2248 file.exe Token: SeBackupPrivilege 2248 file.exe Token: SeBackupPrivilege 2248 file.exe Token: SeSecurityPrivilege 2248 file.exe Token: SeSecurityPrivilege 2248 file.exe Token: SeBackupPrivilege 2248 file.exe Token: SeBackupPrivilege 2248 file.exe Token: SeSecurityPrivilege 2248 file.exe Token: SeSecurityPrivilege 2248 file.exe Token: SeBackupPrivilege 2248 file.exe Token: SeBackupPrivilege 2248 file.exe Token: SeSecurityPrivilege 2248 file.exe Token: SeSecurityPrivilege 2248 file.exe Token: SeBackupPrivilege 2248 file.exe Token: SeBackupPrivilege 2248 file.exe Token: SeSecurityPrivilege 2248 file.exe Token: SeSecurityPrivilege 2248 file.exe Token: SeBackupPrivilege 2248 file.exe Token: SeBackupPrivilege 2248 file.exe Token: SeSecurityPrivilege 2248 file.exe Token: SeSecurityPrivilege 2248 file.exe Token: SeBackupPrivilege 2248 file.exe Token: SeBackupPrivilege 2248 file.exe Token: SeSecurityPrivilege 2248 file.exe Token: SeSecurityPrivilege 2248 file.exe - Suspicious use of SetWindowsHookEx 13 IoCs
pid Process 3436 ONENOTE.EXE 3436 ONENOTE.EXE 3436 ONENOTE.EXE 3436 ONENOTE.EXE 3436 ONENOTE.EXE 3436 ONENOTE.EXE 3436 ONENOTE.EXE 3436 ONENOTE.EXE 3436 ONENOTE.EXE 3436 ONENOTE.EXE 3436 ONENOTE.EXE 3436 ONENOTE.EXE 3436 ONENOTE.EXE - Suspicious use of WriteProcessMemory 5 IoCs
description pid Process procid_target PID 2248 wrote to memory of 3424 2248 file.exe 82 PID 4352 wrote to memory of 3436 4352 printfilterpipelinesvc.exe 85 PID 2248 wrote to memory of 5228 2248 file.exe 86 PID 2248 wrote to memory of 5228 2248 file.exe 86 PID 5228 wrote to memory of 1028 5228 2E5.tmp 87
Processes
-
C:\Users\Admin\AppData\Local\Temp\file.exe"C:\Users\Admin\AppData\Local\Temp\file.exe"1⤵
- Drops desktop.ini file(s)
- Enumerates connected drives
- Sets desktop wallpaper using registry
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Modifies Control Panel
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2248 -
C:\Windows\splwow64.exeC:\Windows\splwow64.exe 122882⤵
- Drops file in System32 directory
PID:3424
-
-
C:\ProgramData\2E5.tmp"C:\ProgramData\2E5.tmp"2⤵
- Deletes itself
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:5228 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C DEL /F /Q C:\PROGRA~3\2E5.tmp >> NUL3⤵
- System Location Discovery: System Language Discovery
PID:1028
-
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k PrintWorkflow -s PrintWorkflowUserSvc1⤵PID:4512
-
C:\Windows\system32\printfilterpipelinesvc.exeC:\Windows\system32\printfilterpipelinesvc.exe -Embedding1⤵
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:4352 -
C:\Program Files\Microsoft Office\root\Office16\ONENOTE.EXE/insertdoc "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\{4315DB10-D065-4A01-963C-35ED101FAC47}.xps" 1342453046850600002⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:3436
-
Network
MITRE ATT&CK Enterprise v16
Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\$Recycle.Bin\S-1-5-21-1636999435-3883760687-346127294-1000\BBBBBBBBBBB
- Size 129B
- SHA256 fc90e1879dc0cc681e652dd73180d89c380d40c08f095d729ff6fc8b1d833009
- MD5 ce81b0c6cfac8edd093e5f472abaa7ff
- SHA1 4aa2ec5a511568ef40561745818f1be1eddff98a
- SHA512 b553521c2a5ee14ec775adef480f091c3840b691db6a416d03a87c3cd4c6e148af6060aef98a553e8d633a6a24f2d8af5f7b80069ae49c4ee7ecb6dc82249cea
- TLSH T135B09BB50C15565317A451252E456B9604C68690079ED4C2152061F787761A1BEB1F74
- MD5 SHA1 SHA512 TLSH
- Path C:\E2Fgx1PWf.README.txt
- Size 427B
- SHA256 29a544b27712da1f10bbf00378e7ccfd0ba5fdef465e221512cb9733ed31ff60
- MD5 e46429c9288ce455fcf5e80ecd99d2c8
- SHA1 76948e570ec0a492bbc71e5485d8fa744c846796
- SHA512 a4ef30a36f60e4788cdb26aaaecf3115ed44ff01d19773e3f2652e7817a85a5732c76806484460095550395db95ff29a6024d998fe7b9a14ec06c0897bde5455
- TLSH T170E0F19C61BF95C447120295393CDDB50669F112CAB8A4C6B8C124FB2FA9EF48360DAF
- MD5 SHA1 SHA512 TLSH
- Path C:\ProgramData\2E5.tmp
- Size 14KB
- SHA256 917e115cc403e29b4388e0d175cbfac3e7e40ca1742299fbdb353847db2de7c2
- MD5 294e9f64cb1642dd89229fff0592856b
- SHA1 97b148c27f3da29ba7b18d6aee8a0db9102f47c9
- SHA512 b87d531890bf1577b9b4af41dddb2cdbbfa164cf197bd5987df3a3075983645a3acba443e289b7bfd338422978a104f55298fbfe346872de0895bde44adc89cf
- SSDEEP 384:5cFP7VtpK4p+31Mzh79W5vM+ZyUgGq4BtMvAxXCRsi:A7Vf9p+qQ02y5HW6kX
- TLSH T15A52BECB73E75FCAF03B43740857340AB795BB062B966A92EDC4091E1DE66440A8743B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\DDDDDDDD
- Size 146KB
- SHA256 f4ed2c3ed96355c95dec7be5d8df7d21d2c37c1b9a78b7163b36c91812074bb8
- MD5 a9703831ed023d15c3f493512a9d136b
- SHA1 a1120ab12bb2a3c5730ef20970bfaf7b3f7df24a
- SHA512 f4121903317507883bbc156c31f8b5cd476e73740e5a1aa4a5299e18e38e6de520c7b17b8bddee1e1ed39857ec8b4ddfb896067fbc86dd6c8792d7b843c6364d
- SSDEEP 3072:FWi/yIBH4lhvZgUKNPDWi/yIBH4lhvZgUKNPDWI:4i/ywchvg0i/ywchvg0I
- TLSH T149E3F2818A537A640798440B9203B2570EFC9DA9F7BFC7A244426F8DD763469EBD6C33
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\Documents\OneNote Notebooks\My Notebook\Open Notebook.onetoc2
- Size 4KB
- SHA256 a285be74404538fb7b95c177770bd1d4e2d22ad66cdcfc168836381aaf7dfac7
- MD5 d14c7462d4f8b236bcae142f82330d30
- SHA1 db1ee13b43c83fc906fd71916a31b5eb4328114f
- SHA512 c494f00601e59d20cdc4dddd8eeb20dab1be40f75380ebdee9e8e4566702d481cf0c7aa88d9e72c21d97d0a2c37f52cf503114a76d4f5a7652b7065c81ff541c
- SSDEEP 12:RaLTYyfHj/UvXjRPPW6/adASdBx/kWuwztEIxA/L:YPYyfHYdnU2SrxsWt1Aj
- TLSH T10BA14655BB26C16CD4D298BC2EC3DBAF0B11BC12AC06074739D4B31D4E7A7890110974
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path F:\$RECYCLE.BIN\S-1-5-21-1636999435-3883760687-346127294-1000\DDDDDDDDDDD
- Size 129B
- SHA256 68c6157e02bb8b00f8cd84f1e342408d3591af6ff196d480f32be70756c8c7ee
- MD5 3c56d1520807e3372f398bce50e92695
- SHA1 a8bfc4ddced82dc7d0bbe71e93674146ccbabd48
- SHA512 df3bfd129089043c18e6e163b35907e427caa3fa8df56456dfbdf2e01531830f54d9a76aa241c7ca8732419db9f40f20fd3bbd15300e08eb44c96fca36844096
- TLSH T116B02B4049B1A871CD0E09C004193043093B8B220C8084C20631AC05CE028BCAA01206
- MD5 SHA1 SHA512 TLSH