Analysis
- max time kernel
149s - max time network
150s - platform
windows11-21h2_x64 - resource
win11-20260513-en - resource tags
arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows - submitted
29/05/2026, 12:19
Behavioral task
behavioral1
Sample
_d715b248f71cd6ba4fcc78b89e9184ff5f0a04b9d02790bcbc30e13c040d3973.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
22 signatures
150 seconds
Behavioral task
behavioral2
Sample
_d715b248f71cd6ba4fcc78b89e9184ff5f0a04b9d02790bcbc30e13c040d3973.exe
Resource
win11-20260513-en
windows11-21h2-x64
21 signatures
150 seconds
General
- Target _d715b248f71cd6ba4fcc78b89e9184ff5f0a04b9d02790bcbc30e13c040d3973.exe
- Size 146KB
- Sample260529-phkhjsct5m
- SHA256 d715b248f71cd6ba4fcc78b89e9184ff5f0a04b9d02790bcbc30e13c040d3973
- MD5 9a09e701d79bc9048160d861dbafcb18
- SHA1 06dc8b0505092d93c9c4fe60de0434d93321d7a6
- SHA512 04985b7ed24c94e1b771c8ec78a55c984f6afeaeb08990b32378f86fbff5a1afbb7195193679e613b03b645a1e4a5adc3cd0034cd484ae935a0753d8faa846f1
- SSDEEP 3072:s6glyuxE4GsUPnliByocWepWLl1F9Z2uOyIk:s6gDBGpvEByocWekLHROyj
- TLSH T137E37D21F212D0B3C83718F13736B172F39A8D6C19A96847EAD80F5DBCA58236F45997
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Renames multiple (814) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
- Deletes itself 1 IoCs
pid Process 992 A312.tmp - Executes dropped EXE 1 IoCs
pid Process 992 A312.tmp - Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Drops desktop.ini file(s) 2 IoCs
description ioc Process File opened for modification C:\$Recycle.Bin\S-1-5-21-2654269261-3199571979-4291878722-1000\desktop.ini _d715b248f71cd6ba4fcc78b89e9184ff5f0a04b9d02790bcbc30e13c040d3973.exe File opened for modification F:\$RECYCLE.BIN\S-1-5-21-2654269261-3199571979-4291878722-1000\desktop.ini _d715b248f71cd6ba4fcc78b89e9184ff5f0a04b9d02790bcbc30e13c040d3973.exe - Enumerates connected drives 3 TTPs 1 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\Z: _d715b248f71cd6ba4fcc78b89e9184ff5f0a04b9d02790bcbc30e13c040d3973.exe - Indicator Removal: File Deletion 1 TTPs
Adversaries may delete files left behind by the actions of their intrusion activity.
- Drops file in System32 directory 4 IoCs
description ioc Process File created C:\Windows\system32\spool\PRINTERS\00002.SPL splwow64.exe File created C:\Windows\system32\spool\PRINTERS\PPh7h_9cx0rbos28m03ojkmzabd.TMP printfilterpipelinesvc.exe File created C:\Windows\system32\spool\PRINTERS\PPrj28f4xyu0_20xr09hh0alqeb.TMP printfilterpipelinesvc.exe File created C:\Windows\system32\spool\PRINTERS\PPvacz45avoc7ltn0f5wgr7cx7.TMP printfilterpipelinesvc.exe - Sets desktop wallpaper using registry 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2654269261-3199571979-4291878722-1000\Control Panel\Desktop\WallPaper = "C:\\ProgramData\\9iA0IslMY.bmp" _d715b248f71cd6ba4fcc78b89e9184ff5f0a04b9d02790bcbc30e13c040d3973.exe Set value (str) \REGISTRY\USER\S-1-5-21-2654269261-3199571979-4291878722-1000\Control Panel\Desktop\Wallpaper = "C:\\ProgramData\\9iA0IslMY.bmp" _d715b248f71cd6ba4fcc78b89e9184ff5f0a04b9d02790bcbc30e13c040d3973.exe - Suspicious use of NtSetInformationThreadHideFromDebugger 5 IoCs
pid Process 2632 _d715b248f71cd6ba4fcc78b89e9184ff5f0a04b9d02790bcbc30e13c040d3973.exe 2632 _d715b248f71cd6ba4fcc78b89e9184ff5f0a04b9d02790bcbc30e13c040d3973.exe 2632 _d715b248f71cd6ba4fcc78b89e9184ff5f0a04b9d02790bcbc30e13c040d3973.exe 2632 _d715b248f71cd6ba4fcc78b89e9184ff5f0a04b9d02790bcbc30e13c040d3973.exe 992 A312.tmp - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language _d715b248f71cd6ba4fcc78b89e9184ff5f0a04b9d02790bcbc30e13c040d3973.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A312.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe - Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 ONENOTE.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz ONENOTE.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString ONENOTE.EXE - Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily ONENOTE.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU ONENOTE.EXE Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS ONENOTE.EXE - Modifies Control Panel 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2654269261-3199571979-4291878722-1000\Control Panel\Desktop _d715b248f71cd6ba4fcc78b89e9184ff5f0a04b9d02790bcbc30e13c040d3973.exe Set value (str) \REGISTRY\USER\S-1-5-21-2654269261-3199571979-4291878722-1000\Control Panel\Desktop\WallpaperStyle = "10" _d715b248f71cd6ba4fcc78b89e9184ff5f0a04b9d02790bcbc30e13c040d3973.exe - Modifies registry class 5 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.9iA0IslMY\ = "9iA0IslMY" _d715b248f71cd6ba4fcc78b89e9184ff5f0a04b9d02790bcbc30e13c040d3973.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\9iA0IslMY\DefaultIcon _d715b248f71cd6ba4fcc78b89e9184ff5f0a04b9d02790bcbc30e13c040d3973.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\9iA0IslMY _d715b248f71cd6ba4fcc78b89e9184ff5f0a04b9d02790bcbc30e13c040d3973.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\9iA0IslMY\DefaultIcon\ = "C:\\ProgramData\\9iA0IslMY.ico" _d715b248f71cd6ba4fcc78b89e9184ff5f0a04b9d02790bcbc30e13c040d3973.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.9iA0IslMY _d715b248f71cd6ba4fcc78b89e9184ff5f0a04b9d02790bcbc30e13c040d3973.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2632 _d715b248f71cd6ba4fcc78b89e9184ff5f0a04b9d02790bcbc30e13c040d3973.exe 2632 _d715b248f71cd6ba4fcc78b89e9184ff5f0a04b9d02790bcbc30e13c040d3973.exe 2632 _d715b248f71cd6ba4fcc78b89e9184ff5f0a04b9d02790bcbc30e13c040d3973.exe 2632 _d715b248f71cd6ba4fcc78b89e9184ff5f0a04b9d02790bcbc30e13c040d3973.exe 2632 _d715b248f71cd6ba4fcc78b89e9184ff5f0a04b9d02790bcbc30e13c040d3973.exe 2632 _d715b248f71cd6ba4fcc78b89e9184ff5f0a04b9d02790bcbc30e13c040d3973.exe 2632 _d715b248f71cd6ba4fcc78b89e9184ff5f0a04b9d02790bcbc30e13c040d3973.exe 2632 _d715b248f71cd6ba4fcc78b89e9184ff5f0a04b9d02790bcbc30e13c040d3973.exe 2632 _d715b248f71cd6ba4fcc78b89e9184ff5f0a04b9d02790bcbc30e13c040d3973.exe 2632 _d715b248f71cd6ba4fcc78b89e9184ff5f0a04b9d02790bcbc30e13c040d3973.exe 2632 _d715b248f71cd6ba4fcc78b89e9184ff5f0a04b9d02790bcbc30e13c040d3973.exe 2632 _d715b248f71cd6ba4fcc78b89e9184ff5f0a04b9d02790bcbc30e13c040d3973.exe 2632 _d715b248f71cd6ba4fcc78b89e9184ff5f0a04b9d02790bcbc30e13c040d3973.exe 2632 _d715b248f71cd6ba4fcc78b89e9184ff5f0a04b9d02790bcbc30e13c040d3973.exe 2632 _d715b248f71cd6ba4fcc78b89e9184ff5f0a04b9d02790bcbc30e13c040d3973.exe 2632 _d715b248f71cd6ba4fcc78b89e9184ff5f0a04b9d02790bcbc30e13c040d3973.exe 2632 _d715b248f71cd6ba4fcc78b89e9184ff5f0a04b9d02790bcbc30e13c040d3973.exe 2632 _d715b248f71cd6ba4fcc78b89e9184ff5f0a04b9d02790bcbc30e13c040d3973.exe 2632 _d715b248f71cd6ba4fcc78b89e9184ff5f0a04b9d02790bcbc30e13c040d3973.exe 2632 _d715b248f71cd6ba4fcc78b89e9184ff5f0a04b9d02790bcbc30e13c040d3973.exe 2632 _d715b248f71cd6ba4fcc78b89e9184ff5f0a04b9d02790bcbc30e13c040d3973.exe 2632 _d715b248f71cd6ba4fcc78b89e9184ff5f0a04b9d02790bcbc30e13c040d3973.exe 2632 _d715b248f71cd6ba4fcc78b89e9184ff5f0a04b9d02790bcbc30e13c040d3973.exe 2632 _d715b248f71cd6ba4fcc78b89e9184ff5f0a04b9d02790bcbc30e13c040d3973.exe 2632 _d715b248f71cd6ba4fcc78b89e9184ff5f0a04b9d02790bcbc30e13c040d3973.exe 2632 _d715b248f71cd6ba4fcc78b89e9184ff5f0a04b9d02790bcbc30e13c040d3973.exe 2632 _d715b248f71cd6ba4fcc78b89e9184ff5f0a04b9d02790bcbc30e13c040d3973.exe 2632 _d715b248f71cd6ba4fcc78b89e9184ff5f0a04b9d02790bcbc30e13c040d3973.exe 2632 _d715b248f71cd6ba4fcc78b89e9184ff5f0a04b9d02790bcbc30e13c040d3973.exe 2632 _d715b248f71cd6ba4fcc78b89e9184ff5f0a04b9d02790bcbc30e13c040d3973.exe 2632 _d715b248f71cd6ba4fcc78b89e9184ff5f0a04b9d02790bcbc30e13c040d3973.exe 2632 _d715b248f71cd6ba4fcc78b89e9184ff5f0a04b9d02790bcbc30e13c040d3973.exe 2632 _d715b248f71cd6ba4fcc78b89e9184ff5f0a04b9d02790bcbc30e13c040d3973.exe 2632 _d715b248f71cd6ba4fcc78b89e9184ff5f0a04b9d02790bcbc30e13c040d3973.exe 2632 _d715b248f71cd6ba4fcc78b89e9184ff5f0a04b9d02790bcbc30e13c040d3973.exe 2632 _d715b248f71cd6ba4fcc78b89e9184ff5f0a04b9d02790bcbc30e13c040d3973.exe 2632 _d715b248f71cd6ba4fcc78b89e9184ff5f0a04b9d02790bcbc30e13c040d3973.exe 2632 _d715b248f71cd6ba4fcc78b89e9184ff5f0a04b9d02790bcbc30e13c040d3973.exe 2632 _d715b248f71cd6ba4fcc78b89e9184ff5f0a04b9d02790bcbc30e13c040d3973.exe 2632 _d715b248f71cd6ba4fcc78b89e9184ff5f0a04b9d02790bcbc30e13c040d3973.exe 2632 _d715b248f71cd6ba4fcc78b89e9184ff5f0a04b9d02790bcbc30e13c040d3973.exe 2632 _d715b248f71cd6ba4fcc78b89e9184ff5f0a04b9d02790bcbc30e13c040d3973.exe 2632 _d715b248f71cd6ba4fcc78b89e9184ff5f0a04b9d02790bcbc30e13c040d3973.exe 2632 _d715b248f71cd6ba4fcc78b89e9184ff5f0a04b9d02790bcbc30e13c040d3973.exe 2632 _d715b248f71cd6ba4fcc78b89e9184ff5f0a04b9d02790bcbc30e13c040d3973.exe 2632 _d715b248f71cd6ba4fcc78b89e9184ff5f0a04b9d02790bcbc30e13c040d3973.exe 2632 _d715b248f71cd6ba4fcc78b89e9184ff5f0a04b9d02790bcbc30e13c040d3973.exe 2632 _d715b248f71cd6ba4fcc78b89e9184ff5f0a04b9d02790bcbc30e13c040d3973.exe 2632 _d715b248f71cd6ba4fcc78b89e9184ff5f0a04b9d02790bcbc30e13c040d3973.exe 2632 _d715b248f71cd6ba4fcc78b89e9184ff5f0a04b9d02790bcbc30e13c040d3973.exe 2632 _d715b248f71cd6ba4fcc78b89e9184ff5f0a04b9d02790bcbc30e13c040d3973.exe 2632 _d715b248f71cd6ba4fcc78b89e9184ff5f0a04b9d02790bcbc30e13c040d3973.exe 2632 _d715b248f71cd6ba4fcc78b89e9184ff5f0a04b9d02790bcbc30e13c040d3973.exe 2632 _d715b248f71cd6ba4fcc78b89e9184ff5f0a04b9d02790bcbc30e13c040d3973.exe 2632 _d715b248f71cd6ba4fcc78b89e9184ff5f0a04b9d02790bcbc30e13c040d3973.exe 2632 _d715b248f71cd6ba4fcc78b89e9184ff5f0a04b9d02790bcbc30e13c040d3973.exe 2632 _d715b248f71cd6ba4fcc78b89e9184ff5f0a04b9d02790bcbc30e13c040d3973.exe 2632 _d715b248f71cd6ba4fcc78b89e9184ff5f0a04b9d02790bcbc30e13c040d3973.exe 2632 _d715b248f71cd6ba4fcc78b89e9184ff5f0a04b9d02790bcbc30e13c040d3973.exe 2632 _d715b248f71cd6ba4fcc78b89e9184ff5f0a04b9d02790bcbc30e13c040d3973.exe 2632 _d715b248f71cd6ba4fcc78b89e9184ff5f0a04b9d02790bcbc30e13c040d3973.exe 2632 _d715b248f71cd6ba4fcc78b89e9184ff5f0a04b9d02790bcbc30e13c040d3973.exe 2900 ONENOTE.EXE 2900 ONENOTE.EXE - Suspicious behavior: RenamesItself 26 IoCs
pid Process 992 A312.tmp 992 A312.tmp 992 A312.tmp 992 A312.tmp 992 A312.tmp 992 A312.tmp 992 A312.tmp 992 A312.tmp 992 A312.tmp 992 A312.tmp 992 A312.tmp 992 A312.tmp 992 A312.tmp 992 A312.tmp 992 A312.tmp 992 A312.tmp 992 A312.tmp 992 A312.tmp 992 A312.tmp 992 A312.tmp 992 A312.tmp 992 A312.tmp 992 A312.tmp 992 A312.tmp 992 A312.tmp 992 A312.tmp - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeAssignPrimaryTokenPrivilege 2632 _d715b248f71cd6ba4fcc78b89e9184ff5f0a04b9d02790bcbc30e13c040d3973.exe Token: SeBackupPrivilege 2632 _d715b248f71cd6ba4fcc78b89e9184ff5f0a04b9d02790bcbc30e13c040d3973.exe Token: SeDebugPrivilege 2632 _d715b248f71cd6ba4fcc78b89e9184ff5f0a04b9d02790bcbc30e13c040d3973.exe Token: 36 2632 _d715b248f71cd6ba4fcc78b89e9184ff5f0a04b9d02790bcbc30e13c040d3973.exe Token: SeImpersonatePrivilege 2632 _d715b248f71cd6ba4fcc78b89e9184ff5f0a04b9d02790bcbc30e13c040d3973.exe Token: SeIncBasePriorityPrivilege 2632 _d715b248f71cd6ba4fcc78b89e9184ff5f0a04b9d02790bcbc30e13c040d3973.exe Token: SeIncreaseQuotaPrivilege 2632 _d715b248f71cd6ba4fcc78b89e9184ff5f0a04b9d02790bcbc30e13c040d3973.exe Token: 33 2632 _d715b248f71cd6ba4fcc78b89e9184ff5f0a04b9d02790bcbc30e13c040d3973.exe Token: SeManageVolumePrivilege 2632 _d715b248f71cd6ba4fcc78b89e9184ff5f0a04b9d02790bcbc30e13c040d3973.exe Token: SeProfSingleProcessPrivilege 2632 _d715b248f71cd6ba4fcc78b89e9184ff5f0a04b9d02790bcbc30e13c040d3973.exe Token: SeRestorePrivilege 2632 _d715b248f71cd6ba4fcc78b89e9184ff5f0a04b9d02790bcbc30e13c040d3973.exe Token: SeSecurityPrivilege 2632 _d715b248f71cd6ba4fcc78b89e9184ff5f0a04b9d02790bcbc30e13c040d3973.exe Token: SeSystemProfilePrivilege 2632 _d715b248f71cd6ba4fcc78b89e9184ff5f0a04b9d02790bcbc30e13c040d3973.exe Token: SeTakeOwnershipPrivilege 2632 _d715b248f71cd6ba4fcc78b89e9184ff5f0a04b9d02790bcbc30e13c040d3973.exe Token: SeShutdownPrivilege 2632 _d715b248f71cd6ba4fcc78b89e9184ff5f0a04b9d02790bcbc30e13c040d3973.exe Token: SeDebugPrivilege 2632 _d715b248f71cd6ba4fcc78b89e9184ff5f0a04b9d02790bcbc30e13c040d3973.exe Token: SeBackupPrivilege 2632 _d715b248f71cd6ba4fcc78b89e9184ff5f0a04b9d02790bcbc30e13c040d3973.exe Token: SeBackupPrivilege 2632 _d715b248f71cd6ba4fcc78b89e9184ff5f0a04b9d02790bcbc30e13c040d3973.exe Token: SeSecurityPrivilege 2632 _d715b248f71cd6ba4fcc78b89e9184ff5f0a04b9d02790bcbc30e13c040d3973.exe Token: SeSecurityPrivilege 2632 _d715b248f71cd6ba4fcc78b89e9184ff5f0a04b9d02790bcbc30e13c040d3973.exe Token: SeBackupPrivilege 2632 _d715b248f71cd6ba4fcc78b89e9184ff5f0a04b9d02790bcbc30e13c040d3973.exe Token: SeBackupPrivilege 2632 _d715b248f71cd6ba4fcc78b89e9184ff5f0a04b9d02790bcbc30e13c040d3973.exe Token: SeSecurityPrivilege 2632 _d715b248f71cd6ba4fcc78b89e9184ff5f0a04b9d02790bcbc30e13c040d3973.exe Token: SeSecurityPrivilege 2632 _d715b248f71cd6ba4fcc78b89e9184ff5f0a04b9d02790bcbc30e13c040d3973.exe Token: SeBackupPrivilege 2632 _d715b248f71cd6ba4fcc78b89e9184ff5f0a04b9d02790bcbc30e13c040d3973.exe Token: SeBackupPrivilege 2632 _d715b248f71cd6ba4fcc78b89e9184ff5f0a04b9d02790bcbc30e13c040d3973.exe Token: SeSecurityPrivilege 2632 _d715b248f71cd6ba4fcc78b89e9184ff5f0a04b9d02790bcbc30e13c040d3973.exe Token: SeSecurityPrivilege 2632 _d715b248f71cd6ba4fcc78b89e9184ff5f0a04b9d02790bcbc30e13c040d3973.exe Token: SeBackupPrivilege 2632 _d715b248f71cd6ba4fcc78b89e9184ff5f0a04b9d02790bcbc30e13c040d3973.exe Token: SeBackupPrivilege 2632 _d715b248f71cd6ba4fcc78b89e9184ff5f0a04b9d02790bcbc30e13c040d3973.exe Token: SeSecurityPrivilege 2632 _d715b248f71cd6ba4fcc78b89e9184ff5f0a04b9d02790bcbc30e13c040d3973.exe Token: SeSecurityPrivilege 2632 _d715b248f71cd6ba4fcc78b89e9184ff5f0a04b9d02790bcbc30e13c040d3973.exe Token: SeBackupPrivilege 2632 _d715b248f71cd6ba4fcc78b89e9184ff5f0a04b9d02790bcbc30e13c040d3973.exe Token: SeBackupPrivilege 2632 _d715b248f71cd6ba4fcc78b89e9184ff5f0a04b9d02790bcbc30e13c040d3973.exe Token: SeSecurityPrivilege 2632 _d715b248f71cd6ba4fcc78b89e9184ff5f0a04b9d02790bcbc30e13c040d3973.exe Token: SeSecurityPrivilege 2632 _d715b248f71cd6ba4fcc78b89e9184ff5f0a04b9d02790bcbc30e13c040d3973.exe Token: SeBackupPrivilege 2632 _d715b248f71cd6ba4fcc78b89e9184ff5f0a04b9d02790bcbc30e13c040d3973.exe Token: SeBackupPrivilege 2632 _d715b248f71cd6ba4fcc78b89e9184ff5f0a04b9d02790bcbc30e13c040d3973.exe Token: SeSecurityPrivilege 2632 _d715b248f71cd6ba4fcc78b89e9184ff5f0a04b9d02790bcbc30e13c040d3973.exe Token: SeSecurityPrivilege 2632 _d715b248f71cd6ba4fcc78b89e9184ff5f0a04b9d02790bcbc30e13c040d3973.exe Token: SeBackupPrivilege 2632 _d715b248f71cd6ba4fcc78b89e9184ff5f0a04b9d02790bcbc30e13c040d3973.exe Token: SeBackupPrivilege 2632 _d715b248f71cd6ba4fcc78b89e9184ff5f0a04b9d02790bcbc30e13c040d3973.exe Token: SeSecurityPrivilege 2632 _d715b248f71cd6ba4fcc78b89e9184ff5f0a04b9d02790bcbc30e13c040d3973.exe Token: SeSecurityPrivilege 2632 _d715b248f71cd6ba4fcc78b89e9184ff5f0a04b9d02790bcbc30e13c040d3973.exe Token: SeBackupPrivilege 2632 _d715b248f71cd6ba4fcc78b89e9184ff5f0a04b9d02790bcbc30e13c040d3973.exe Token: SeBackupPrivilege 2632 _d715b248f71cd6ba4fcc78b89e9184ff5f0a04b9d02790bcbc30e13c040d3973.exe Token: SeSecurityPrivilege 2632 _d715b248f71cd6ba4fcc78b89e9184ff5f0a04b9d02790bcbc30e13c040d3973.exe Token: SeSecurityPrivilege 2632 _d715b248f71cd6ba4fcc78b89e9184ff5f0a04b9d02790bcbc30e13c040d3973.exe Token: SeBackupPrivilege 2632 _d715b248f71cd6ba4fcc78b89e9184ff5f0a04b9d02790bcbc30e13c040d3973.exe Token: SeBackupPrivilege 2632 _d715b248f71cd6ba4fcc78b89e9184ff5f0a04b9d02790bcbc30e13c040d3973.exe Token: SeSecurityPrivilege 2632 _d715b248f71cd6ba4fcc78b89e9184ff5f0a04b9d02790bcbc30e13c040d3973.exe Token: SeSecurityPrivilege 2632 _d715b248f71cd6ba4fcc78b89e9184ff5f0a04b9d02790bcbc30e13c040d3973.exe Token: SeBackupPrivilege 2632 _d715b248f71cd6ba4fcc78b89e9184ff5f0a04b9d02790bcbc30e13c040d3973.exe Token: SeBackupPrivilege 2632 _d715b248f71cd6ba4fcc78b89e9184ff5f0a04b9d02790bcbc30e13c040d3973.exe Token: SeSecurityPrivilege 2632 _d715b248f71cd6ba4fcc78b89e9184ff5f0a04b9d02790bcbc30e13c040d3973.exe Token: SeSecurityPrivilege 2632 _d715b248f71cd6ba4fcc78b89e9184ff5f0a04b9d02790bcbc30e13c040d3973.exe Token: SeBackupPrivilege 2632 _d715b248f71cd6ba4fcc78b89e9184ff5f0a04b9d02790bcbc30e13c040d3973.exe Token: SeBackupPrivilege 2632 _d715b248f71cd6ba4fcc78b89e9184ff5f0a04b9d02790bcbc30e13c040d3973.exe Token: SeSecurityPrivilege 2632 _d715b248f71cd6ba4fcc78b89e9184ff5f0a04b9d02790bcbc30e13c040d3973.exe Token: SeSecurityPrivilege 2632 _d715b248f71cd6ba4fcc78b89e9184ff5f0a04b9d02790bcbc30e13c040d3973.exe Token: SeBackupPrivilege 2632 _d715b248f71cd6ba4fcc78b89e9184ff5f0a04b9d02790bcbc30e13c040d3973.exe Token: SeBackupPrivilege 2632 _d715b248f71cd6ba4fcc78b89e9184ff5f0a04b9d02790bcbc30e13c040d3973.exe Token: SeSecurityPrivilege 2632 _d715b248f71cd6ba4fcc78b89e9184ff5f0a04b9d02790bcbc30e13c040d3973.exe Token: SeSecurityPrivilege 2632 _d715b248f71cd6ba4fcc78b89e9184ff5f0a04b9d02790bcbc30e13c040d3973.exe - Suspicious use of SetWindowsHookEx 13 IoCs
pid Process 2900 ONENOTE.EXE 2900 ONENOTE.EXE 2900 ONENOTE.EXE 2900 ONENOTE.EXE 2900 ONENOTE.EXE 2900 ONENOTE.EXE 2900 ONENOTE.EXE 2900 ONENOTE.EXE 2900 ONENOTE.EXE 2900 ONENOTE.EXE 2900 ONENOTE.EXE 2900 ONENOTE.EXE 2900 ONENOTE.EXE - Suspicious use of WriteProcessMemory 5 IoCs
description pid Process procid_target PID 2632 wrote to memory of 3752 2632 _d715b248f71cd6ba4fcc78b89e9184ff5f0a04b9d02790bcbc30e13c040d3973.exe 83 PID 4316 wrote to memory of 2900 4316 printfilterpipelinesvc.exe 86 PID 2632 wrote to memory of 992 2632 _d715b248f71cd6ba4fcc78b89e9184ff5f0a04b9d02790bcbc30e13c040d3973.exe 87 PID 2632 wrote to memory of 992 2632 _d715b248f71cd6ba4fcc78b89e9184ff5f0a04b9d02790bcbc30e13c040d3973.exe 87 PID 992 wrote to memory of 3972 992 A312.tmp 88
Processes
-
C:\Users\Admin\AppData\Local\Temp\_d715b248f71cd6ba4fcc78b89e9184ff5f0a04b9d02790bcbc30e13c040d3973.exe"C:\Users\Admin\AppData\Local\Temp\_d715b248f71cd6ba4fcc78b89e9184ff5f0a04b9d02790bcbc30e13c040d3973.exe"1⤵
- Drops desktop.ini file(s)
- Enumerates connected drives
- Sets desktop wallpaper using registry
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Modifies Control Panel
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2632 -
C:\Windows\splwow64.exeC:\Windows\splwow64.exe 122882⤵
- Drops file in System32 directory
PID:3752
-
-
C:\ProgramData\A312.tmp"C:\ProgramData\A312.tmp"2⤵
- Deletes itself
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:992 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C DEL /F /Q C:\PROGRA~3\A312.tmp >> NUL3⤵
- System Location Discovery: System Language Discovery
PID:3972
-
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k PrintWorkflow -s PrintWorkflowUserSvc1⤵PID:772
-
C:\Windows\system32\printfilterpipelinesvc.exeC:\Windows\system32\printfilterpipelinesvc.exe -Embedding1⤵
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:4316 -
C:\Program Files\Microsoft Office\root\Office16\ONENOTE.EXE/insertdoc "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\{21EC18B1-FCFB-4EBE-8FB3-CC7AF6A549F8}.xps" 1342453083536700002⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:2900
-
Network
MITRE ATT&CK Enterprise v16
Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\$Recycle.Bin\S-1-5-21-2654269261-3199571979-4291878722-1000\MMMMMMMMMMM
- Size 129B
- SHA256 90d52ffbe31fc494b470c2baf6c5897ccefee30e48dc5209f3786a8e75b2f24f
- MD5 1fdbbc9a5b713531d0428ae3ce39c42c
- SHA1 c40910716c0f17b8803186659e73cf073dcc80f7
- SHA512 8f79c1be3d927e3f358d2b60acc82260f3ae8b13dce28a132e48209d5406cd49d1a87995cdf18d92ccfb8f3660121eda573bd0856df73f9a683ff8361b61c4df
- TLSH T103B02B8655734214D0B4A23E14C86C9530A7CAF1E12C14016C70F304A0B14040CCA0DB
- MD5 SHA1 SHA512 TLSH
- Path C:\9iA0IslMY.README.txt
- Size 427B
- SHA256 29a544b27712da1f10bbf00378e7ccfd0ba5fdef465e221512cb9733ed31ff60
- MD5 e46429c9288ce455fcf5e80ecd99d2c8
- SHA1 76948e570ec0a492bbc71e5485d8fa744c846796
- SHA512 a4ef30a36f60e4788cdb26aaaecf3115ed44ff01d19773e3f2652e7817a85a5732c76806484460095550395db95ff29a6024d998fe7b9a14ec06c0897bde5455
- TLSH T170E0F19C61BF95C447120295393CDDB50669F112CAB8A4C6B8C124FB2FA9EF48360DAF
- MD5 SHA1 SHA512 TLSH
- Path C:\ProgramData\A312.tmp
- Size 14KB
- SHA256 917e115cc403e29b4388e0d175cbfac3e7e40ca1742299fbdb353847db2de7c2
- MD5 294e9f64cb1642dd89229fff0592856b
- SHA1 97b148c27f3da29ba7b18d6aee8a0db9102f47c9
- SHA512 b87d531890bf1577b9b4af41dddb2cdbbfa164cf197bd5987df3a3075983645a3acba443e289b7bfd338422978a104f55298fbfe346872de0895bde44adc89cf
- SSDEEP 384:5cFP7VtpK4p+31Mzh79W5vM+ZyUgGq4BtMvAxXCRsi:A7Vf9p+qQ02y5HW6kX
- TLSH T15A52BECB73E75FCAF03B43740857340AB795BB062B966A92EDC4091E1DE66440A8743B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\DDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDD
- Size 146KB
- SHA256 e490c9d27df945ef0041489ba3c607ef350a7bcfe494164bc5a5be18f142335d
- MD5 1b0461f3ffc8cd8a8a8cc0e361b128d8
- SHA1 4f15182d28c0e20426be3276015b4e71fb1d1a17
- SHA512 f0d4cd13cff8afa933d1605c8d455fecd41d6e516be79df7c50490a81f96759a148e51ca377533500ff5a4022db26e43b27633379525a16cd04ec013db4c4095
- SSDEEP 3072:MLgFsukQl+L25fmEBNdDuLgFsukQl+L25fmEBNdDuLgFsuf:MLIsup5fmETd6LIsup5fmETd6LIsuf
- TLSH T17AE302A68286EF0B3437B3AA0DBF1909DB450ED0FFF484D2783AC65C045964D62667F5
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\Documents\OneNote Notebooks\My Notebook\Open Notebook.onetoc2
- Size 4KB
- SHA256 cdfb3d0ddec5ca0c142d28665a5b5b7ea21caff69702d5275e2ed7e08c4855bd
- MD5 025c613f463bae0c75c2c1a4243b341a
- SHA1 4025a96de65c7c02641eb2fdb8e8ede32c26faa4
- SHA512 a6c86586859186452869a70d8d4b5745bff0360e4e5175a0ccc8ef346c0ea64c1c3aaba14ea050a3bda0910ccc8059e66d6d1ddd8520898490f16a574bd51f9b
- SSDEEP 12:Ra63YyfHj/UvEuPnJW6/qyNj0YIEIxA/L:YoYyfHYRlNoX1Aj
- TLSH T105A122C87344E04CE6F599789EC7C7AE9B72BC9E9C9107537AE4331E4D367816640620
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path F:\$RECYCLE.BIN\S-1-5-21-2654269261-3199571979-4291878722-1000\DDDDDDDDDDD
- Size 129B
- SHA256 fd946a03f7f4066b5ce2d1ddc85aa7c91e47dd986be02d7815dfa992726443f0
- MD5 829d3828988f7358e98da102988621a0
- SHA1 46764dbc02b40e3c854e2d9a8f8b6422cd2902c1
- SHA512 ef46e4f360c1b2eb0882ab1f75d86ee7e3c0fc42a90c282c40692c3f102bde14f1146b0a4c2fdaff153942cba9d648392588bf943801d6a63430cf9c44a1d90a
- TLSH T17DB02B1111C1883F400F030013094113EF4190F227F150D4CF02983180FE3948490130
- MD5 SHA1 SHA512 TLSH