Analysis
-
max time kernel
119s -
max time network
124s -
platform
windows10_x64 -
resource
win10v20210410 -
submitted
10-05-2021 10:53
Static task
static1
Behavioral task
behavioral1
Sample
bac7f1cb70a0fe909590f7b270248705d216b4abaf4e5dd4969fa4f1949badec.bin.exe
Resource
win7v20210408
Behavioral task
behavioral2
Sample
bac7f1cb70a0fe909590f7b270248705d216b4abaf4e5dd4969fa4f1949badec.bin.exe
Resource
win10v20210410
General
-
Target
bac7f1cb70a0fe909590f7b270248705d216b4abaf4e5dd4969fa4f1949badec.bin.exe
-
Size
56KB
-
MD5
b68be0dacf09904cd4a0fbe0aab3842e
-
SHA1
5212151679ce396651887edfe0e7d1f5eda4da29
-
SHA256
bac7f1cb70a0fe909590f7b270248705d216b4abaf4e5dd4969fa4f1949badec
-
SHA512
5a6466de3c48b5fb3b1c5b2360e144596cc981ce7ccb2b59034dd0724293bf31ff8297fb5b2033e891dfb64ad0b25627ec4690dfcde0d2b107aca3c54b10ad92
Malware Config
Extracted
C:\\README.aeef1a75.TXT
darkside
http://dark24zz36xm4y2phwe7yvnkkkkhxionhfrwp67awpb3r3bdcneivoqd.onion/0UGH4S3ASFAVY4P2TQZ6VNB0U65Y731LJ5SNZXC1AHEZFFY1JCIJV6PVHV0R0V2C
Signatures
-
DarkSide
Targeted ransomware first seen in August 2020. Operators steal data to use as leverage.
-
Modifies extensions of user files 9 IoCs
Ransomware generally changes the extension on encrypted files.
Processes:
bac7f1cb70a0fe909590f7b270248705d216b4abaf4e5dd4969fa4f1949badec.bin.exedescription ioc process File opened for modification C:\Users\Admin\Pictures\StepGet.tiff bac7f1cb70a0fe909590f7b270248705d216b4abaf4e5dd4969fa4f1949badec.bin.exe File renamed C:\Users\Admin\Pictures\StepGet.tiff => C:\Users\Admin\Pictures\StepGet.tiff.aeef1a75 bac7f1cb70a0fe909590f7b270248705d216b4abaf4e5dd4969fa4f1949badec.bin.exe File opened for modification C:\Users\Admin\Pictures\StepGet.tiff.aeef1a75 bac7f1cb70a0fe909590f7b270248705d216b4abaf4e5dd4969fa4f1949badec.bin.exe File renamed C:\Users\Admin\Pictures\CompleteSubmit.raw => C:\Users\Admin\Pictures\CompleteSubmit.raw.aeef1a75 bac7f1cb70a0fe909590f7b270248705d216b4abaf4e5dd4969fa4f1949badec.bin.exe File renamed C:\Users\Admin\Pictures\DebugUse.crw => C:\Users\Admin\Pictures\DebugUse.crw.aeef1a75 bac7f1cb70a0fe909590f7b270248705d216b4abaf4e5dd4969fa4f1949badec.bin.exe File renamed C:\Users\Admin\Pictures\MeasureUpdate.tif => C:\Users\Admin\Pictures\MeasureUpdate.tif.aeef1a75 bac7f1cb70a0fe909590f7b270248705d216b4abaf4e5dd4969fa4f1949badec.bin.exe File opened for modification C:\Users\Admin\Pictures\MeasureUpdate.tif.aeef1a75 bac7f1cb70a0fe909590f7b270248705d216b4abaf4e5dd4969fa4f1949badec.bin.exe File opened for modification C:\Users\Admin\Pictures\CompleteSubmit.raw.aeef1a75 bac7f1cb70a0fe909590f7b270248705d216b4abaf4e5dd4969fa4f1949badec.bin.exe File opened for modification C:\Users\Admin\Pictures\DebugUse.crw.aeef1a75 bac7f1cb70a0fe909590f7b270248705d216b4abaf4e5dd4969fa4f1949badec.bin.exe -
Enumerates connected drives 3 TTPs 2 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
Processes:
bac7f1cb70a0fe909590f7b270248705d216b4abaf4e5dd4969fa4f1949badec.bin.exebac7f1cb70a0fe909590f7b270248705d216b4abaf4e5dd4969fa4f1949badec.bin.exedescription ioc process File opened (read-only) \??\Z: bac7f1cb70a0fe909590f7b270248705d216b4abaf4e5dd4969fa4f1949badec.bin.exe File opened (read-only) \??\Z: bac7f1cb70a0fe909590f7b270248705d216b4abaf4e5dd4969fa4f1949badec.bin.exe -
Drops file in System32 directory 15 IoCs
Processes:
bac7f1cb70a0fe909590f7b270248705d216b4abaf4e5dd4969fa4f1949badec.bin.exedescription ioc process File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCookies bac7f1cb70a0fe909590f7b270248705d216b4abaf4e5dd4969fa4f1949badec.bin.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache bac7f1cb70a0fe909590f7b270248705d216b4abaf4e5dd4969fa4f1949badec.bin.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\644B8874112055B5E195ECB0E8F243A4 bac7f1cb70a0fe909590f7b270248705d216b4abaf4e5dd4969fa4f1949badec.bin.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft bac7f1cb70a0fe909590f7b270248705d216b4abaf4e5dd4969fa4f1949badec.bin.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\57C8EDB95DF3F0AD4EE2DC2B8CFD4157 bac7f1cb70a0fe909590f7b270248705d216b4abaf4e5dd4969fa4f1949badec.bin.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData bac7f1cb70a0fe909590f7b270248705d216b4abaf4e5dd4969fa4f1949badec.bin.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content bac7f1cb70a0fe909590f7b270248705d216b4abaf4e5dd4969fa4f1949badec.bin.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\57C8EDB95DF3F0AD4EE2DC2B8CFD4157 bac7f1cb70a0fe909590f7b270248705d216b4abaf4e5dd4969fa4f1949badec.bin.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\644B8874112055B5E195ECB0E8F243A4 bac7f1cb70a0fe909590f7b270248705d216b4abaf4e5dd4969fa4f1949badec.bin.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\BAB7F775BADE1EC8628B8D8B4C22C44D bac7f1cb70a0fe909590f7b270248705d216b4abaf4e5dd4969fa4f1949badec.bin.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\BAB7F775BADE1EC8628B8D8B4C22C44D bac7f1cb70a0fe909590f7b270248705d216b4abaf4e5dd4969fa4f1949badec.bin.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\counters2.dat bac7f1cb70a0fe909590f7b270248705d216b4abaf4e5dd4969fa4f1949badec.bin.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\Content.IE5 bac7f1cb70a0fe909590f7b270248705d216b4abaf4e5dd4969fa4f1949badec.bin.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE bac7f1cb70a0fe909590f7b270248705d216b4abaf4e5dd4969fa4f1949badec.bin.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5 bac7f1cb70a0fe909590f7b270248705d216b4abaf4e5dd4969fa4f1949badec.bin.exe -
Sets desktop wallpaper using registry 2 TTPs 1 IoCs
Processes:
bac7f1cb70a0fe909590f7b270248705d216b4abaf4e5dd4969fa4f1949badec.bin.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Control Panel\Desktop\WallPaper = "C:\\ProgramData\\aeef1a75.BMP" bac7f1cb70a0fe909590f7b270248705d216b4abaf4e5dd4969fa4f1949badec.bin.exe -
Modifies Control Panel 2 IoCs
Processes:
bac7f1cb70a0fe909590f7b270248705d216b4abaf4e5dd4969fa4f1949badec.bin.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Control Panel\Desktop bac7f1cb70a0fe909590f7b270248705d216b4abaf4e5dd4969fa4f1949badec.bin.exe Set value (str) \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Control Panel\Desktop\WallpaperStyle = "10" bac7f1cb70a0fe909590f7b270248705d216b4abaf4e5dd4969fa4f1949badec.bin.exe -
Modifies data under HKEY_USERS 32 IoCs
Processes:
bac7f1cb70a0fe909590f7b270248705d216b4abaf4e5dd4969fa4f1949badec.bin.exebac7f1cb70a0fe909590f7b270248705d216b4abaf4e5dd4969fa4f1949badec.bin.exedescription ioc process Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:" bac7f1cb70a0fe909590f7b270248705d216b4abaf4e5dd4969fa4f1949badec.bin.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1" bac7f1cb70a0fe909590f7b270248705d216b4abaf4e5dd4969fa4f1949badec.bin.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing bac7f1cb70a0fe909590f7b270248705d216b4abaf4e5dd4969fa4f1949badec.bin.exe Key created \REGISTRY\USER\.DEFAULT\Software bac7f1cb70a0fe909590f7b270248705d216b4abaf4e5dd4969fa4f1949badec.bin.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\RestartManager\Session0000\SessionHash = df85f9fa009b5a405527ec4d72a8a70c8348c904233fc079068e2a9e35460806 bac7f1cb70a0fe909590f7b270248705d216b4abaf4e5dd4969fa4f1949badec.bin.exe Set value (str) \REGISTRY\USER\.DEFAULT\Control Panel\Desktop\Wallpaper = "C:\\ProgramData\\aeef1a75.BMP" bac7f1cb70a0fe909590f7b270248705d216b4abaf4e5dd4969fa4f1949badec.bin.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix bac7f1cb70a0fe909590f7b270248705d216b4abaf4e5dd4969fa4f1949badec.bin.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1" bac7f1cb70a0fe909590f7b270248705d216b4abaf4e5dd4969fa4f1949badec.bin.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0" bac7f1cb70a0fe909590f7b270248705d216b4abaf4e5dd4969fa4f1949badec.bin.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\RestartManager\Session0000\RegFiles0000 = 5c005c003f005c0043003a005c00550073006500720073005c00410064006d0069006e005c006e00740075007300650072002e006400610074002e004c004f004700310000000000 bac7f1cb70a0fe909590f7b270248705d216b4abaf4e5dd4969fa4f1949badec.bin.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\RestartManager\Session0000\RegFiles0000 = 5c005c003f005c0043003a005c00550073006500720073005c00410064006d0069006e005c004e00540055005300450052002e004400410054007b00340065003000370034003600360038002d0030006300310063002d0031003100650037002d0061003900340033002d006500340031006400320064003700310038006100320030007d002e0054004d0043006f006e007400610069006e0065007200300030003000300030003000300030003000300030003000300030003000300030003000300031002e007200650067007400720061006e0073002d006d00730000000000 bac7f1cb70a0fe909590f7b270248705d216b4abaf4e5dd4969fa4f1949badec.bin.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\RestartManager\Session0000\SessionHash = d26de48070049888ef27ac734c2b8eac9048d1cb5905b6bf0fefd650ea119ed6 bac7f1cb70a0fe909590f7b270248705d216b4abaf4e5dd4969fa4f1949badec.bin.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000 bac7f1cb70a0fe909590f7b270248705d216b4abaf4e5dd4969fa4f1949badec.bin.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft bac7f1cb70a0fe909590f7b270248705d216b4abaf4e5dd4969fa4f1949badec.bin.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\RestartManager bac7f1cb70a0fe909590f7b270248705d216b4abaf4e5dd4969fa4f1949badec.bin.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1" bac7f1cb70a0fe909590f7b270248705d216b4abaf4e5dd4969fa4f1949badec.bin.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\RestartManager\Session0000\Owner = d00b00007893c03b8a45d701 bac7f1cb70a0fe909590f7b270248705d216b4abaf4e5dd4969fa4f1949badec.bin.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\RestartManager\Session0000\RegFiles0000 = 5c005c003f005c0043003a005c00550073006500720073005c00410064006d0069006e005c004e00540055005300450052002e004400410054007b00340065003000370034003600360038002d0030006300310063002d0031003100650037002d0061003900340033002d006500340031006400320064003700310038006100320030007d002e0054004d0043006f006e007400610069006e0065007200300030003000300030003000300030003000300030003000300030003000300030003000300032002e007200650067007400720061006e0073002d006d00730000000000 bac7f1cb70a0fe909590f7b270248705d216b4abaf4e5dd4969fa4f1949badec.bin.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\OnDemandInterfaceCache bac7f1cb70a0fe909590f7b270248705d216b4abaf4e5dd4969fa4f1949badec.bin.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\RestartManager\Session0000\RegFilesHash = d16f8680d326159457ce38c98d221fa054f55aef8ee050ea17d4af36da9fb58e bac7f1cb70a0fe909590f7b270248705d216b4abaf4e5dd4969fa4f1949badec.bin.exe Key deleted \REGISTRY\USER\.DEFAULT\Software\Microsoft\RestartManager\Session0000 bac7f1cb70a0fe909590f7b270248705d216b4abaf4e5dd4969fa4f1949badec.bin.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\RestartManager\Session0000\SessionHash = f3d2a8190a441aad5b0adb445c396d3a1bcf32e8e3386a19f0fe10280fbb336c bac7f1cb70a0fe909590f7b270248705d216b4abaf4e5dd4969fa4f1949badec.bin.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\RestartManager\Session0000\RegFilesHash = 4aebdd31d91bf4cc173544dcbdb91899281a07c1766c2c20154478737a5931c5 bac7f1cb70a0fe909590f7b270248705d216b4abaf4e5dd4969fa4f1949badec.bin.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\RestartManager\Session0000\RegFilesHash = c0ef8a4985d495815232c687659da108647ef8cca36e3a0874e07dac1cadad7f bac7f1cb70a0fe909590f7b270248705d216b4abaf4e5dd4969fa4f1949badec.bin.exe Key created \REGISTRY\USER\.DEFAULT\Control Panel\International bac7f1cb70a0fe909590f7b270248705d216b4abaf4e5dd4969fa4f1949badec.bin.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:" bac7f1cb70a0fe909590f7b270248705d216b4abaf4e5dd4969fa4f1949badec.bin.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ bac7f1cb70a0fe909590f7b270248705d216b4abaf4e5dd4969fa4f1949badec.bin.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\RestartManager\Session0000\Sequence = "1" bac7f1cb70a0fe909590f7b270248705d216b4abaf4e5dd4969fa4f1949badec.bin.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\RestartManager\Session0000\SessionHash = ef5a718e030bea0f4f6a9d6443e1f271e4b7b6bfddd526c76467420d88d1b82b bac7f1cb70a0fe909590f7b270248705d216b4abaf4e5dd4969fa4f1949badec.bin.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\RestartManager\Session0000\RegFiles0000 = 5c005c003f005c0043003a005c00550073006500720073005c00410064006d0069006e005c004e00540055005300450052002e004400410054007b00340065003000370034003600360038002d0030006300310063002d0031003100650037002d0061003900340033002d006500340031006400320064003700310038006100320030007d002e0054004d002e0062006c00660000000000 bac7f1cb70a0fe909590f7b270248705d216b4abaf4e5dd4969fa4f1949badec.bin.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\RestartManager\Session0000\RegFilesHash = 5d6a613d2e660a3c33bb14c1ff85de058b91bd0682fae0a1bf5614e52a724e56 bac7f1cb70a0fe909590f7b270248705d216b4abaf4e5dd4969fa4f1949badec.bin.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\RestartManager\Session0000 bac7f1cb70a0fe909590f7b270248705d216b4abaf4e5dd4969fa4f1949badec.bin.exe -
Modifies registry class 5 IoCs
Processes:
bac7f1cb70a0fe909590f7b270248705d216b4abaf4e5dd4969fa4f1949badec.bin.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.aeef1a75 bac7f1cb70a0fe909590f7b270248705d216b4abaf4e5dd4969fa4f1949badec.bin.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.aeef1a75\ = "aeef1a75" bac7f1cb70a0fe909590f7b270248705d216b4abaf4e5dd4969fa4f1949badec.bin.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\aeef1a75\DefaultIcon bac7f1cb70a0fe909590f7b270248705d216b4abaf4e5dd4969fa4f1949badec.bin.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\aeef1a75 bac7f1cb70a0fe909590f7b270248705d216b4abaf4e5dd4969fa4f1949badec.bin.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\aeef1a75\DefaultIcon\ = "C:\\ProgramData\\aeef1a75.ico" bac7f1cb70a0fe909590f7b270248705d216b4abaf4e5dd4969fa4f1949badec.bin.exe -
Suspicious behavior: EnumeratesProcesses 26 IoCs
Processes:
bac7f1cb70a0fe909590f7b270248705d216b4abaf4e5dd4969fa4f1949badec.bin.exebac7f1cb70a0fe909590f7b270248705d216b4abaf4e5dd4969fa4f1949badec.bin.exepid process 1292 bac7f1cb70a0fe909590f7b270248705d216b4abaf4e5dd4969fa4f1949badec.bin.exe 1292 bac7f1cb70a0fe909590f7b270248705d216b4abaf4e5dd4969fa4f1949badec.bin.exe 3024 bac7f1cb70a0fe909590f7b270248705d216b4abaf4e5dd4969fa4f1949badec.bin.exe 3024 bac7f1cb70a0fe909590f7b270248705d216b4abaf4e5dd4969fa4f1949badec.bin.exe 3024 bac7f1cb70a0fe909590f7b270248705d216b4abaf4e5dd4969fa4f1949badec.bin.exe 3024 bac7f1cb70a0fe909590f7b270248705d216b4abaf4e5dd4969fa4f1949badec.bin.exe 3024 bac7f1cb70a0fe909590f7b270248705d216b4abaf4e5dd4969fa4f1949badec.bin.exe 3024 bac7f1cb70a0fe909590f7b270248705d216b4abaf4e5dd4969fa4f1949badec.bin.exe 3024 bac7f1cb70a0fe909590f7b270248705d216b4abaf4e5dd4969fa4f1949badec.bin.exe 3024 bac7f1cb70a0fe909590f7b270248705d216b4abaf4e5dd4969fa4f1949badec.bin.exe 3024 bac7f1cb70a0fe909590f7b270248705d216b4abaf4e5dd4969fa4f1949badec.bin.exe 3024 bac7f1cb70a0fe909590f7b270248705d216b4abaf4e5dd4969fa4f1949badec.bin.exe 3024 bac7f1cb70a0fe909590f7b270248705d216b4abaf4e5dd4969fa4f1949badec.bin.exe 3024 bac7f1cb70a0fe909590f7b270248705d216b4abaf4e5dd4969fa4f1949badec.bin.exe 3024 bac7f1cb70a0fe909590f7b270248705d216b4abaf4e5dd4969fa4f1949badec.bin.exe 3024 bac7f1cb70a0fe909590f7b270248705d216b4abaf4e5dd4969fa4f1949badec.bin.exe 3024 bac7f1cb70a0fe909590f7b270248705d216b4abaf4e5dd4969fa4f1949badec.bin.exe 3024 bac7f1cb70a0fe909590f7b270248705d216b4abaf4e5dd4969fa4f1949badec.bin.exe 3024 bac7f1cb70a0fe909590f7b270248705d216b4abaf4e5dd4969fa4f1949badec.bin.exe 3024 bac7f1cb70a0fe909590f7b270248705d216b4abaf4e5dd4969fa4f1949badec.bin.exe 3024 bac7f1cb70a0fe909590f7b270248705d216b4abaf4e5dd4969fa4f1949badec.bin.exe 3024 bac7f1cb70a0fe909590f7b270248705d216b4abaf4e5dd4969fa4f1949badec.bin.exe 3024 bac7f1cb70a0fe909590f7b270248705d216b4abaf4e5dd4969fa4f1949badec.bin.exe 3024 bac7f1cb70a0fe909590f7b270248705d216b4abaf4e5dd4969fa4f1949badec.bin.exe 3024 bac7f1cb70a0fe909590f7b270248705d216b4abaf4e5dd4969fa4f1949badec.bin.exe 3024 bac7f1cb70a0fe909590f7b270248705d216b4abaf4e5dd4969fa4f1949badec.bin.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
vssvc.exedescription pid process Token: SeBackupPrivilege 2092 vssvc.exe Token: SeRestorePrivilege 2092 vssvc.exe Token: SeAuditPrivilege 2092 vssvc.exe -
Suspicious use of WriteProcessMemory 10 IoCs
Processes:
bac7f1cb70a0fe909590f7b270248705d216b4abaf4e5dd4969fa4f1949badec.bin.exebac7f1cb70a0fe909590f7b270248705d216b4abaf4e5dd4969fa4f1949badec.bin.exedescription pid process target process PID 1032 wrote to memory of 1292 1032 bac7f1cb70a0fe909590f7b270248705d216b4abaf4e5dd4969fa4f1949badec.bin.exe bac7f1cb70a0fe909590f7b270248705d216b4abaf4e5dd4969fa4f1949badec.bin.exe PID 1032 wrote to memory of 1292 1032 bac7f1cb70a0fe909590f7b270248705d216b4abaf4e5dd4969fa4f1949badec.bin.exe bac7f1cb70a0fe909590f7b270248705d216b4abaf4e5dd4969fa4f1949badec.bin.exe PID 1032 wrote to memory of 1292 1032 bac7f1cb70a0fe909590f7b270248705d216b4abaf4e5dd4969fa4f1949badec.bin.exe bac7f1cb70a0fe909590f7b270248705d216b4abaf4e5dd4969fa4f1949badec.bin.exe PID 1032 wrote to memory of 1292 1032 bac7f1cb70a0fe909590f7b270248705d216b4abaf4e5dd4969fa4f1949badec.bin.exe bac7f1cb70a0fe909590f7b270248705d216b4abaf4e5dd4969fa4f1949badec.bin.exe PID 1292 wrote to memory of 3024 1292 bac7f1cb70a0fe909590f7b270248705d216b4abaf4e5dd4969fa4f1949badec.bin.exe bac7f1cb70a0fe909590f7b270248705d216b4abaf4e5dd4969fa4f1949badec.bin.exe PID 1292 wrote to memory of 3024 1292 bac7f1cb70a0fe909590f7b270248705d216b4abaf4e5dd4969fa4f1949badec.bin.exe bac7f1cb70a0fe909590f7b270248705d216b4abaf4e5dd4969fa4f1949badec.bin.exe PID 1292 wrote to memory of 3024 1292 bac7f1cb70a0fe909590f7b270248705d216b4abaf4e5dd4969fa4f1949badec.bin.exe bac7f1cb70a0fe909590f7b270248705d216b4abaf4e5dd4969fa4f1949badec.bin.exe PID 1292 wrote to memory of 2692 1292 bac7f1cb70a0fe909590f7b270248705d216b4abaf4e5dd4969fa4f1949badec.bin.exe bac7f1cb70a0fe909590f7b270248705d216b4abaf4e5dd4969fa4f1949badec.bin.exe PID 1292 wrote to memory of 2692 1292 bac7f1cb70a0fe909590f7b270248705d216b4abaf4e5dd4969fa4f1949badec.bin.exe bac7f1cb70a0fe909590f7b270248705d216b4abaf4e5dd4969fa4f1949badec.bin.exe PID 1292 wrote to memory of 2692 1292 bac7f1cb70a0fe909590f7b270248705d216b4abaf4e5dd4969fa4f1949badec.bin.exe bac7f1cb70a0fe909590f7b270248705d216b4abaf4e5dd4969fa4f1949badec.bin.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\bac7f1cb70a0fe909590f7b270248705d216b4abaf4e5dd4969fa4f1949badec.bin.exe"C:\Users\Admin\AppData\Local\Temp\bac7f1cb70a0fe909590f7b270248705d216b4abaf4e5dd4969fa4f1949badec.bin.exe"1⤵
-
C:\Users\Admin\AppData\Local\Temp\bac7f1cb70a0fe909590f7b270248705d216b4abaf4e5dd4969fa4f1949badec.bin.exe"C:\Users\Admin\AppData\Local\Temp\bac7f1cb70a0fe909590f7b270248705d216b4abaf4e5dd4969fa4f1949badec.bin.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\bac7f1cb70a0fe909590f7b270248705d216b4abaf4e5dd4969fa4f1949badec.bin.exe"C:\Users\Admin\AppData\Local\Temp\bac7f1cb70a0fe909590f7b270248705d216b4abaf4e5dd4969fa4f1949badec.bin.exe"2⤵
- Enumerates connected drives
- Drops file in System32 directory
- Sets desktop wallpaper using registry
- Modifies Control Panel
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\bac7f1cb70a0fe909590f7b270248705d216b4abaf4e5dd4969fa4f1949badec.bin.exeC:\Users\Admin\AppData\Local\Temp\bac7f1cb70a0fe909590f7b270248705d216b4abaf4e5dd4969fa4f1949badec.bin.exe -work worker0 job0-12923⤵
- Modifies extensions of user files
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
-
C:\Users\Admin\AppData\Local\Temp\bac7f1cb70a0fe909590f7b270248705d216b4abaf4e5dd4969fa4f1949badec.bin.exeC:\Users\Admin\AppData\Local\Temp\bac7f1cb70a0fe909590f7b270248705d216b4abaf4e5dd4969fa4f1949badec.bin.exe -work worker1 job1-12923⤵
- Enumerates connected drives
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken