Overview
overview
10Static
static
81667e16357...43.exe
windows7_x64
31667e16357...43.exe
windows10_x64
317139a10fd...61.exe
windows7_x64
1017139a10fd...61.exe
windows10_x64
101cc7c198a8...cb.exe
windows7_x64
101cc7c198a8...cb.exe
windows10_x64
10243dff06fc...60.exe
windows7_x64
10243dff06fc...60.exe
windows10_x64
1027214dcb04...8f.exe
windows7_x64
1027214dcb04...8f.exe
windows10_x64
103dabd40d56...a6.exe
windows7_x64
33dabd40d56...a6.exe
windows10_x64
343e61519be...aa.exe
windows7_x64
1043e61519be...aa.exe
windows10_x64
1048a848bc9e...3a.exe
windows7_x64
1048a848bc9e...3a.exe
windows10_x64
10508dd6f7ed...dd.exe
windows7_x64
10508dd6f7ed...dd.exe
windows10_x64
10516664139b...4b.exe
windows7_x64
10516664139b...4b.exe
windows10_x64
10533672da9d...8d.exe
windows7_x64
10533672da9d...8d.exe
windows10_x64
106228f75f52...ff.exe
windows7_x64
106228f75f52...ff.exe
windows10_x64
106836ec8588...d8.exe
windows7_x64
36836ec8588...d8.exe
windows10_x64
368872cc22f...e7.exe
windows7_x64
1068872cc22f...e7.exe
windows10_x64
10691515a485...a5.exe
windows7_x64
10691515a485...a5.exe
windows10_x64
1078782fd324...34.exe
windows7_x64
1078782fd324...34.exe
windows10_x64
10Analysis
-
max time kernel
108s -
max time network
109s -
platform
windows7_x64 -
resource
win7v20210410 -
submitted
12-05-2021 19:34
Static task
static1
Behavioral task
behavioral1
Sample
1667e1635736f2b2ba9727457f995a67201ddcd818496c9296713ffa18e17a43.exe
Resource
win7v20210410
Behavioral task
behavioral2
Sample
1667e1635736f2b2ba9727457f995a67201ddcd818496c9296713ffa18e17a43.exe
Resource
win10v20210410
Behavioral task
behavioral3
Sample
17139a10fd226d01738fe9323918614aa913b2a50e1a516e95cced93fa151c61.exe
Resource
win7v20210410
Behavioral task
behavioral4
Sample
17139a10fd226d01738fe9323918614aa913b2a50e1a516e95cced93fa151c61.exe
Resource
win10v20210410
Behavioral task
behavioral5
Sample
1cc7c198a8a2c935fd6f07970479e544f5b35a8eb3173de0305ebdf76a0988cb.exe
Resource
win7v20210410
Behavioral task
behavioral6
Sample
1cc7c198a8a2c935fd6f07970479e544f5b35a8eb3173de0305ebdf76a0988cb.exe
Resource
win10v20210410
Behavioral task
behavioral7
Sample
243dff06fc80a049f4fb37292f8b8def0fce29768f345c88ee10699e22b0ae60.exe
Resource
win7v20210410
Behavioral task
behavioral8
Sample
243dff06fc80a049f4fb37292f8b8def0fce29768f345c88ee10699e22b0ae60.exe
Resource
win10v20210410
Behavioral task
behavioral9
Sample
27214dcb04310040c38f8d6a65fe03c14b18d4171390da271855fdd02e06768f.exe
Resource
win7v20210410
Behavioral task
behavioral10
Sample
27214dcb04310040c38f8d6a65fe03c14b18d4171390da271855fdd02e06768f.exe
Resource
win10v20210410
Behavioral task
behavioral11
Sample
3dabd40d564cf8a8163432abc38768b0a7d45f0fc1970d802dc33b9109feb6a6.exe
Resource
win7v20210410
Behavioral task
behavioral12
Sample
3dabd40d564cf8a8163432abc38768b0a7d45f0fc1970d802dc33b9109feb6a6.exe
Resource
win10v20210410
Behavioral task
behavioral13
Sample
43e61519be440115eeaa3738a0e4aa4bb3c8ac5f9bdfce1a896db17a374eb8aa.exe
Resource
win7v20210410
Behavioral task
behavioral14
Sample
43e61519be440115eeaa3738a0e4aa4bb3c8ac5f9bdfce1a896db17a374eb8aa.exe
Resource
win10v20210410
Behavioral task
behavioral15
Sample
48a848bc9e0f126b41e5ca196707412c7c40087404c0c8ed70e5cee4a418203a.exe
Resource
win7v20210410
Behavioral task
behavioral16
Sample
48a848bc9e0f126b41e5ca196707412c7c40087404c0c8ed70e5cee4a418203a.exe
Resource
win10v20210410
Behavioral task
behavioral17
Sample
508dd6f7ed6c143cf5e1ed6a4051dd8ee7b5bf4b7f55e0704d21ba785f2d5add.exe
Resource
win7v20210410
Behavioral task
behavioral18
Sample
508dd6f7ed6c143cf5e1ed6a4051dd8ee7b5bf4b7f55e0704d21ba785f2d5add.exe
Resource
win10v20210410
Behavioral task
behavioral19
Sample
516664139b0ddd044397a56482d7308d87c213c320a3151ccb9738e8f932654b.exe
Resource
win7v20210410
Behavioral task
behavioral20
Sample
516664139b0ddd044397a56482d7308d87c213c320a3151ccb9738e8f932654b.exe
Resource
win10v20210410
Behavioral task
behavioral21
Sample
533672da9d276012ebab3ce9f4cd09a7f537f65c6e4b63d43f0c1697e2f5e48d.exe
Resource
win7v20210410
Behavioral task
behavioral22
Sample
533672da9d276012ebab3ce9f4cd09a7f537f65c6e4b63d43f0c1697e2f5e48d.exe
Resource
win10v20210410
Behavioral task
behavioral23
Sample
6228f75f52fd69488419c0e0eb3617b5b894a566a93e52b99a9addced7364cff.exe
Resource
win7v20210410
Behavioral task
behavioral24
Sample
6228f75f52fd69488419c0e0eb3617b5b894a566a93e52b99a9addced7364cff.exe
Resource
win10v20210410
Behavioral task
behavioral25
Sample
6836ec8588b8049bcd57cd920b7a75f1e206e5e8bb316927784afadb634ea4d8.exe
Resource
win7v20210410
Behavioral task
behavioral26
Sample
6836ec8588b8049bcd57cd920b7a75f1e206e5e8bb316927784afadb634ea4d8.exe
Resource
win10v20210410
Behavioral task
behavioral27
Sample
68872cc22fbdf0c2f69c32ac878ba9a7b7cf61fe5dd0e3da200131b8b23438e7.exe
Resource
win7v20210410
Behavioral task
behavioral28
Sample
68872cc22fbdf0c2f69c32ac878ba9a7b7cf61fe5dd0e3da200131b8b23438e7.exe
Resource
win10v20210410
Behavioral task
behavioral29
Sample
691515a485b0b3989fb71c6807e640eeec1a0e30d90500db6414035d942f70a5.exe
Resource
win7v20210410
Behavioral task
behavioral30
Sample
691515a485b0b3989fb71c6807e640eeec1a0e30d90500db6414035d942f70a5.exe
Resource
win10v20210410
Behavioral task
behavioral31
Sample
78782fd324bc98a57274bd3fff8f756217c011484ebf6b614060115a699ee134.exe
Resource
win7v20210410
Behavioral task
behavioral32
Sample
78782fd324bc98a57274bd3fff8f756217c011484ebf6b614060115a699ee134.exe
Resource
win10v20210410
General
-
Target
516664139b0ddd044397a56482d7308d87c213c320a3151ccb9738e8f932654b.exe
-
Size
56KB
-
MD5
84c1567969b86089cc33dccf41562bcd
-
SHA1
53f2133cb25186e9fa6d4ea3b0e41eee5aba5ef2
-
SHA256
516664139b0ddd044397a56482d7308d87c213c320a3151ccb9738e8f932654b
-
SHA512
72a411cacd503b6fadb15dc90f1f9beb79ff79c620df76da381e5c780c53e11258aae72db2848c241ec55af403d67d62340e429e86c23bbf8a71287738de7eaa
Malware Config
Extracted
C:\\README.949640ab.TXT
darkside
http://dark24vx6fsmdrtbzdzjv6ckz4yqyued4uz455oqpctko7m6vbrzibad.onion/XES2TUV3A9QL89IS7QX91V7TYSF13ASPGB2TASQ68R9Z6QYH69OVY833QSRSFU4I
Signatures
-
DarkSide
Targeted ransomware first seen in August 2020. Operators steal data to use as leverage.
-
Modifies extensions of user files 2 IoCs
Ransomware generally changes the extension on encrypted files.
Processes:
516664139b0ddd044397a56482d7308d87c213c320a3151ccb9738e8f932654b.exedescription ioc process File renamed C:\Users\Admin\Pictures\SelectCheckpoint.crw => C:\Users\Admin\Pictures\SelectCheckpoint.crw.949640ab 516664139b0ddd044397a56482d7308d87c213c320a3151ccb9738e8f932654b.exe File opened for modification C:\Users\Admin\Pictures\SelectCheckpoint.crw.949640ab 516664139b0ddd044397a56482d7308d87c213c320a3151ccb9738e8f932654b.exe -
Drops file in System32 directory 1 IoCs
Processes:
516664139b0ddd044397a56482d7308d87c213c320a3151ccb9738e8f932654b.exedescription ioc process File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\counters.dat 516664139b0ddd044397a56482d7308d87c213c320a3151ccb9738e8f932654b.exe -
Sets desktop wallpaper using registry 2 TTPs 1 IoCs
Processes:
516664139b0ddd044397a56482d7308d87c213c320a3151ccb9738e8f932654b.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Control Panel\Desktop\WallPaper = "C:\\ProgramData\\949640ab.BMP" 516664139b0ddd044397a56482d7308d87c213c320a3151ccb9738e8f932654b.exe -
Modifies Control Panel 2 IoCs
Processes:
516664139b0ddd044397a56482d7308d87c213c320a3151ccb9738e8f932654b.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Control Panel\Desktop\WallpaperStyle = "10" 516664139b0ddd044397a56482d7308d87c213c320a3151ccb9738e8f932654b.exe Key created \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Control Panel\Desktop 516664139b0ddd044397a56482d7308d87c213c320a3151ccb9738e8f932654b.exe -
Modifies data under HKEY_USERS 45 IoCs
Processes:
516664139b0ddd044397a56482d7308d87c213c320a3151ccb9738e8f932654b.exe516664139b0ddd044397a56482d7308d87c213c320a3151ccb9738e8f932654b.exedescription ioc process Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\32-e2-17-db-d2-77\WpadDecisionTime = 3060a16c6547d701 516664139b0ddd044397a56482d7308d87c213c320a3151ccb9738e8f932654b.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\RestartManager\Session0000\SessionHash = 5ca815135c3c6ecb42be8d239ed306dbe8bc32c9c0c7f106db508cb37c427c0b 516664139b0ddd044397a56482d7308d87c213c320a3151ccb9738e8f932654b.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\RestartManager\Session0000\SessionHash = 7500ecaef1a0be9a0b927866b18dbb25d02b30d30d5a968463ee382ba1287cb2 516664139b0ddd044397a56482d7308d87c213c320a3151ccb9738e8f932654b.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 516664139b0ddd044397a56482d7308d87c213c320a3151ccb9738e8f932654b.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyEnable = "0" 516664139b0ddd044397a56482d7308d87c213c320a3151ccb9738e8f932654b.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\32-e2-17-db-d2-77\WpadDecisionReason = "1" 516664139b0ddd044397a56482d7308d87c213c320a3151ccb9738e8f932654b.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\RestartManager 516664139b0ddd044397a56482d7308d87c213c320a3151ccb9738e8f932654b.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\RestartManager\Session0000\Sequence = "1" 516664139b0ddd044397a56482d7308d87c213c320a3151ccb9738e8f932654b.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{2A905F01-0A57-4E51-8685-54144DDC3A32}\WpadDecisionReason = "1" 516664139b0ddd044397a56482d7308d87c213c320a3151ccb9738e8f932654b.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\32-e2-17-db-d2-77 516664139b0ddd044397a56482d7308d87c213c320a3151ccb9738e8f932654b.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\RestartManager\Session0000\RegFiles0000 = 5c005c003f005c0043003a005c00550073006500720073005c00410064006d0069006e005c004e00540055005300450052002e004400410054007b00300031003600380038003800620064002d0036006300360066002d0031003100640065002d0038006400310064002d003000300031006500300062006300640065003300650063007d002e0054004d002e0062006c00660000000000 516664139b0ddd044397a56482d7308d87c213c320a3151ccb9738e8f932654b.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections 516664139b0ddd044397a56482d7308d87c213c320a3151ccb9738e8f932654b.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings 516664139b0ddd044397a56482d7308d87c213c320a3151ccb9738e8f932654b.exe Key deleted \REGISTRY\USER\.DEFAULT\Software\Microsoft\RestartManager\Session0000 516664139b0ddd044397a56482d7308d87c213c320a3151ccb9738e8f932654b.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\RestartManager\Session0000\RegFilesHash = 07fd1ca3f52c403069405fb177518b7699824525eea25816a3635de44a723a31 516664139b0ddd044397a56482d7308d87c213c320a3151ccb9738e8f932654b.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad 516664139b0ddd044397a56482d7308d87c213c320a3151ccb9738e8f932654b.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\RestartManager\Session0000\Owner = 98060000f04ef26c6547d701 516664139b0ddd044397a56482d7308d87c213c320a3151ccb9738e8f932654b.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000003000000090000000000000000000000000000000400000000000000000000000000000000000000000000000000000001000000020000000a07000d000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 516664139b0ddd044397a56482d7308d87c213c320a3151ccb9738e8f932654b.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "0" 516664139b0ddd044397a56482d7308d87c213c320a3151ccb9738e8f932654b.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\RestartManager\Session0000\SessionHash = e858cde82179c1eac7f86ad30c8b9fde0a2c3d18beb1fbe3d972f35cfe9d32db 516664139b0ddd044397a56482d7308d87c213c320a3151ccb9738e8f932654b.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\RestartManager\Session0000\RegFiles0000 = 5c005c003f005c0043003a005c00550073006500720073005c00410064006d0069006e005c006e00740075007300650072002e006400610074002e004c004f004700310000000000 516664139b0ddd044397a56482d7308d87c213c320a3151ccb9738e8f932654b.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\RestartManager\Session0000\SessionHash = 2ddd2ebc2bde8e71cba4ce5181afa22d0a273df9b77b99839d295c74ca6e7405 516664139b0ddd044397a56482d7308d87c213c320a3151ccb9738e8f932654b.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\RestartManager\Session0000\RegFiles0000 = 5c005c003f005c0043003a005c00550073006500720073005c00410064006d0069006e005c004e00540055005300450052002e004400410054007b00300031003600380038003800620064002d0036006300360066002d0031003100640065002d0038006400310064002d003000300031006500300062006300640065003300650063007d002e0054004d0043006f006e007400610069006e0065007200300030003000300030003000300030003000300030003000300030003000300030003000300031002e007200650067007400720061006e0073002d006d00730000000000 516664139b0ddd044397a56482d7308d87c213c320a3151ccb9738e8f932654b.exe Key created \REGISTRY\USER\.DEFAULT\Control Panel\International 516664139b0ddd044397a56482d7308d87c213c320a3151ccb9738e8f932654b.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:" 516664139b0ddd044397a56482d7308d87c213c320a3151ccb9738e8f932654b.exe Set value (str) \REGISTRY\USER\.DEFAULT\Control Panel\Desktop\Wallpaper = "C:\\ProgramData\\949640ab.BMP" 516664139b0ddd044397a56482d7308d87c213c320a3151ccb9738e8f932654b.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ 516664139b0ddd044397a56482d7308d87c213c320a3151ccb9738e8f932654b.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{2A905F01-0A57-4E51-8685-54144DDC3A32} 516664139b0ddd044397a56482d7308d87c213c320a3151ccb9738e8f932654b.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\SavedLegacySettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 516664139b0ddd044397a56482d7308d87c213c320a3151ccb9738e8f932654b.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "1" 516664139b0ddd044397a56482d7308d87c213c320a3151ccb9738e8f932654b.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{2A905F01-0A57-4E51-8685-54144DDC3A32}\WpadDecisionTime = 3060a16c6547d701 516664139b0ddd044397a56482d7308d87c213c320a3151ccb9738e8f932654b.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{2A905F01-0A57-4E51-8685-54144DDC3A32}\WpadDecision = "0" 516664139b0ddd044397a56482d7308d87c213c320a3151ccb9738e8f932654b.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{2A905F01-0A57-4E51-8685-54144DDC3A32}\32-e2-17-db-d2-77 516664139b0ddd044397a56482d7308d87c213c320a3151ccb9738e8f932654b.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\32-e2-17-db-d2-77\WpadDecision = "0" 516664139b0ddd044397a56482d7308d87c213c320a3151ccb9738e8f932654b.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings 516664139b0ddd044397a56482d7308d87c213c320a3151ccb9738e8f932654b.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix 516664139b0ddd044397a56482d7308d87c213c320a3151ccb9738e8f932654b.exe Key created \REGISTRY\USER\.DEFAULT\Software 516664139b0ddd044397a56482d7308d87c213c320a3151ccb9738e8f932654b.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\RestartManager\Session0000 516664139b0ddd044397a56482d7308d87c213c320a3151ccb9738e8f932654b.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft 516664139b0ddd044397a56482d7308d87c213c320a3151ccb9738e8f932654b.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\RestartManager\Session0000\RegFilesHash = dbb1427e50eba91188fe286b3e2cca7e988a1e04daeca489ee37b780b5eaf444 516664139b0ddd044397a56482d7308d87c213c320a3151ccb9738e8f932654b.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\RestartManager\Session0000\RegFilesHash = e8e80edcb6f52a37b92c2e94b919bcd66310b95ec5d97bdf7ce2f854c6f23f4a 516664139b0ddd044397a56482d7308d87c213c320a3151ccb9738e8f932654b.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\RestartManager\Session0000\RegFiles0000 = 5c005c003f005c0043003a005c00550073006500720073005c00410064006d0069006e005c004e00540055005300450052002e004400410054007b00300031003600380038003800620064002d0036006300360066002d0031003100640065002d0038006400310064002d003000300031006500300062006300640065003300650063007d002e0054004d0043006f006e007400610069006e0065007200300030003000300030003000300030003000300030003000300030003000300030003000300032002e007200650067007400720061006e0073002d006d00730000000000 516664139b0ddd044397a56482d7308d87c213c320a3151ccb9738e8f932654b.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\RestartManager\Session0000\RegFilesHash = 4ca2617ebb40fd6c6cc967b0f73aaad701f0801452965e37021b5a07b6f77333 516664139b0ddd044397a56482d7308d87c213c320a3151ccb9738e8f932654b.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:" 516664139b0ddd044397a56482d7308d87c213c320a3151ccb9738e8f932654b.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{2A905F01-0A57-4E51-8685-54144DDC3A32}\WpadNetworkName = "Network" 516664139b0ddd044397a56482d7308d87c213c320a3151ccb9738e8f932654b.exe -
Modifies registry class 5 IoCs
Processes:
516664139b0ddd044397a56482d7308d87c213c320a3151ccb9738e8f932654b.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\949640ab 516664139b0ddd044397a56482d7308d87c213c320a3151ccb9738e8f932654b.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\949640ab\DefaultIcon\ = "C:\\ProgramData\\949640ab.ico" 516664139b0ddd044397a56482d7308d87c213c320a3151ccb9738e8f932654b.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.949640ab 516664139b0ddd044397a56482d7308d87c213c320a3151ccb9738e8f932654b.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.949640ab\ = "949640ab" 516664139b0ddd044397a56482d7308d87c213c320a3151ccb9738e8f932654b.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\949640ab\DefaultIcon 516664139b0ddd044397a56482d7308d87c213c320a3151ccb9738e8f932654b.exe -
Suspicious behavior: EnumeratesProcesses 26 IoCs
Processes:
516664139b0ddd044397a56482d7308d87c213c320a3151ccb9738e8f932654b.exe516664139b0ddd044397a56482d7308d87c213c320a3151ccb9738e8f932654b.exepid process 1100 516664139b0ddd044397a56482d7308d87c213c320a3151ccb9738e8f932654b.exe 1100 516664139b0ddd044397a56482d7308d87c213c320a3151ccb9738e8f932654b.exe 1688 516664139b0ddd044397a56482d7308d87c213c320a3151ccb9738e8f932654b.exe 1688 516664139b0ddd044397a56482d7308d87c213c320a3151ccb9738e8f932654b.exe 1688 516664139b0ddd044397a56482d7308d87c213c320a3151ccb9738e8f932654b.exe 1688 516664139b0ddd044397a56482d7308d87c213c320a3151ccb9738e8f932654b.exe 1688 516664139b0ddd044397a56482d7308d87c213c320a3151ccb9738e8f932654b.exe 1688 516664139b0ddd044397a56482d7308d87c213c320a3151ccb9738e8f932654b.exe 1688 516664139b0ddd044397a56482d7308d87c213c320a3151ccb9738e8f932654b.exe 1688 516664139b0ddd044397a56482d7308d87c213c320a3151ccb9738e8f932654b.exe 1688 516664139b0ddd044397a56482d7308d87c213c320a3151ccb9738e8f932654b.exe 1688 516664139b0ddd044397a56482d7308d87c213c320a3151ccb9738e8f932654b.exe 1688 516664139b0ddd044397a56482d7308d87c213c320a3151ccb9738e8f932654b.exe 1688 516664139b0ddd044397a56482d7308d87c213c320a3151ccb9738e8f932654b.exe 1688 516664139b0ddd044397a56482d7308d87c213c320a3151ccb9738e8f932654b.exe 1688 516664139b0ddd044397a56482d7308d87c213c320a3151ccb9738e8f932654b.exe 1688 516664139b0ddd044397a56482d7308d87c213c320a3151ccb9738e8f932654b.exe 1688 516664139b0ddd044397a56482d7308d87c213c320a3151ccb9738e8f932654b.exe 1688 516664139b0ddd044397a56482d7308d87c213c320a3151ccb9738e8f932654b.exe 1688 516664139b0ddd044397a56482d7308d87c213c320a3151ccb9738e8f932654b.exe 1688 516664139b0ddd044397a56482d7308d87c213c320a3151ccb9738e8f932654b.exe 1688 516664139b0ddd044397a56482d7308d87c213c320a3151ccb9738e8f932654b.exe 1688 516664139b0ddd044397a56482d7308d87c213c320a3151ccb9738e8f932654b.exe 1688 516664139b0ddd044397a56482d7308d87c213c320a3151ccb9738e8f932654b.exe 1688 516664139b0ddd044397a56482d7308d87c213c320a3151ccb9738e8f932654b.exe 1688 516664139b0ddd044397a56482d7308d87c213c320a3151ccb9738e8f932654b.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
vssvc.exedescription pid process Token: SeBackupPrivilege 800 vssvc.exe Token: SeRestorePrivilege 800 vssvc.exe Token: SeAuditPrivilege 800 vssvc.exe -
Suspicious use of WriteProcessMemory 9 IoCs
Processes:
516664139b0ddd044397a56482d7308d87c213c320a3151ccb9738e8f932654b.exe516664139b0ddd044397a56482d7308d87c213c320a3151ccb9738e8f932654b.exedescription pid process target process PID 2036 wrote to memory of 1100 2036 516664139b0ddd044397a56482d7308d87c213c320a3151ccb9738e8f932654b.exe 516664139b0ddd044397a56482d7308d87c213c320a3151ccb9738e8f932654b.exe PID 2036 wrote to memory of 1100 2036 516664139b0ddd044397a56482d7308d87c213c320a3151ccb9738e8f932654b.exe 516664139b0ddd044397a56482d7308d87c213c320a3151ccb9738e8f932654b.exe PID 2036 wrote to memory of 1100 2036 516664139b0ddd044397a56482d7308d87c213c320a3151ccb9738e8f932654b.exe 516664139b0ddd044397a56482d7308d87c213c320a3151ccb9738e8f932654b.exe PID 2036 wrote to memory of 1100 2036 516664139b0ddd044397a56482d7308d87c213c320a3151ccb9738e8f932654b.exe 516664139b0ddd044397a56482d7308d87c213c320a3151ccb9738e8f932654b.exe PID 2036 wrote to memory of 1100 2036 516664139b0ddd044397a56482d7308d87c213c320a3151ccb9738e8f932654b.exe 516664139b0ddd044397a56482d7308d87c213c320a3151ccb9738e8f932654b.exe PID 1100 wrote to memory of 1688 1100 516664139b0ddd044397a56482d7308d87c213c320a3151ccb9738e8f932654b.exe 516664139b0ddd044397a56482d7308d87c213c320a3151ccb9738e8f932654b.exe PID 1100 wrote to memory of 1688 1100 516664139b0ddd044397a56482d7308d87c213c320a3151ccb9738e8f932654b.exe 516664139b0ddd044397a56482d7308d87c213c320a3151ccb9738e8f932654b.exe PID 1100 wrote to memory of 1688 1100 516664139b0ddd044397a56482d7308d87c213c320a3151ccb9738e8f932654b.exe 516664139b0ddd044397a56482d7308d87c213c320a3151ccb9738e8f932654b.exe PID 1100 wrote to memory of 1688 1100 516664139b0ddd044397a56482d7308d87c213c320a3151ccb9738e8f932654b.exe 516664139b0ddd044397a56482d7308d87c213c320a3151ccb9738e8f932654b.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\516664139b0ddd044397a56482d7308d87c213c320a3151ccb9738e8f932654b.exe"C:\Users\Admin\AppData\Local\Temp\516664139b0ddd044397a56482d7308d87c213c320a3151ccb9738e8f932654b.exe"1⤵PID:1076
-
C:\Users\Admin\AppData\Local\Temp\516664139b0ddd044397a56482d7308d87c213c320a3151ccb9738e8f932654b.exe"C:\Users\Admin\AppData\Local\Temp\516664139b0ddd044397a56482d7308d87c213c320a3151ccb9738e8f932654b.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2036 -
C:\Users\Admin\AppData\Local\Temp\516664139b0ddd044397a56482d7308d87c213c320a3151ccb9738e8f932654b.exe"C:\Users\Admin\AppData\Local\Temp\516664139b0ddd044397a56482d7308d87c213c320a3151ccb9738e8f932654b.exe"2⤵
- Drops file in System32 directory
- Sets desktop wallpaper using registry
- Modifies Control Panel
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1100 -
C:\Users\Admin\AppData\Local\Temp\516664139b0ddd044397a56482d7308d87c213c320a3151ccb9738e8f932654b.exeC:\Users\Admin\AppData\Local\Temp\516664139b0ddd044397a56482d7308d87c213c320a3151ccb9738e8f932654b.exe -work worker0 job0-11003⤵
- Modifies extensions of user files
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
PID:1688
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
PID:800