Analysis Overview
SHA256
2de09a815efcc64810046de69b8e0aa1c9e9beee77b66560a0b15d737485e3c5
Threat Level: Known bad
The file 9b5350dd_by_Libranalysis was found to be: Known bad.
Malicious Activity Summary
DarkSide
Modifies extensions of user files
Enumerates connected drives
Sets desktop wallpaper using registry
Drops file in System32 directory
Modifies registry class
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Modifies data under HKEY_USERS
Suspicious use of WriteProcessMemory
Modifies Control Panel
MITRE ATT&CK
Enterprise Matrix V6
Analysis: static1
Detonation Overview
Reported
2021-05-19 10:03
Signatures
Analysis: behavioral1
Detonation Overview
Submitted
2021-05-19 10:03
Reported
2021-05-19 10:05
Platform
win7v20210408
Max time kernel
25s
Max time network
34s
Command Line
Signatures
Drops file in System32 directory
| Description | Indicator | Process | Target |
| File opened for modification | C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\counters.dat | C:\Users\Admin\AppData\Local\Temp\9b5350dd_by_Libranalysis.exe | N/A |
Modifies data under HKEY_USERS
| Description | Indicator | Process | Target |
| Set value (data) | \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{3A33DB50-CC69-497D-AB93-6EAB524EB9A7}\WpadDecisionTime = 30f5b176a64cd701 | C:\Users\Admin\AppData\Local\Temp\9b5350dd_by_Libranalysis.exe | N/A |
| Set value (int) | \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{3A33DB50-CC69-497D-AB93-6EAB524EB9A7}\WpadDecision = "0" | C:\Users\Admin\AppData\Local\Temp\9b5350dd_by_Libranalysis.exe | N/A |
| Set value (str) | \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{3A33DB50-CC69-497D-AB93-6EAB524EB9A7}\WpadNetworkName = "Network" | C:\Users\Admin\AppData\Local\Temp\9b5350dd_by_Libranalysis.exe | N/A |
| Key created | \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings | C:\Users\Admin\AppData\Local\Temp\9b5350dd_by_Libranalysis.exe | N/A |
| Set value (data) | \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 | C:\Users\Admin\AppData\Local\Temp\9b5350dd_by_Libranalysis.exe | N/A |
| Set value (str) | \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:" | C:\Users\Admin\AppData\Local\Temp\9b5350dd_by_Libranalysis.exe | N/A |
| Set value (int) | \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "0" | C:\Users\Admin\AppData\Local\Temp\9b5350dd_by_Libranalysis.exe | N/A |
| Set value (int) | \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{3A33DB50-CC69-497D-AB93-6EAB524EB9A7}\WpadDecisionReason = "1" | C:\Users\Admin\AppData\Local\Temp\9b5350dd_by_Libranalysis.exe | N/A |
| Key created | \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{3A33DB50-CC69-497D-AB93-6EAB524EB9A7}\ea-15-24-ab-67-32 | C:\Users\Admin\AppData\Local\Temp\9b5350dd_by_Libranalysis.exe | N/A |
| Set value (int) | \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\ea-15-24-ab-67-32\WpadDecision = "0" | C:\Users\Admin\AppData\Local\Temp\9b5350dd_by_Libranalysis.exe | N/A |
| Key created | \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{3A33DB50-CC69-497D-AB93-6EAB524EB9A7} | C:\Users\Admin\AppData\Local\Temp\9b5350dd_by_Libranalysis.exe | N/A |
| Set value (str) | \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix | C:\Users\Admin\AppData\Local\Temp\9b5350dd_by_Libranalysis.exe | N/A |
| Key created | \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings | C:\Users\Admin\AppData\Local\Temp\9b5350dd_by_Libranalysis.exe | N/A |
| Key created | \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad | C:\Users\Admin\AppData\Local\Temp\9b5350dd_by_Libranalysis.exe | N/A |
| Set value (int) | \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "1" | C:\Users\Admin\AppData\Local\Temp\9b5350dd_by_Libranalysis.exe | N/A |
| Set value (data) | \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000003000000090000000000000000000000000000000400000000000000000000000000000000000000000000000000000001000000020000000a07000e000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 | C:\Users\Admin\AppData\Local\Temp\9b5350dd_by_Libranalysis.exe | N/A |
| Key created | \REGISTRY\USER\.DEFAULT\Control Panel\International | C:\Users\Admin\AppData\Local\Temp\9b5350dd_by_Libranalysis.exe | N/A |
| Key created | \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\ea-15-24-ab-67-32 | C:\Users\Admin\AppData\Local\Temp\9b5350dd_by_Libranalysis.exe | N/A |
| Set value (int) | \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\ea-15-24-ab-67-32\WpadDecisionReason = "1" | C:\Users\Admin\AppData\Local\Temp\9b5350dd_by_Libranalysis.exe | N/A |
| Set value (data) | \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\ea-15-24-ab-67-32\WpadDecisionTime = 30f5b176a64cd701 | C:\Users\Admin\AppData\Local\Temp\9b5350dd_by_Libranalysis.exe | N/A |
| Key created | \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections | C:\Users\Admin\AppData\Local\Temp\9b5350dd_by_Libranalysis.exe | N/A |
| Set value (str) | \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:" | C:\Users\Admin\AppData\Local\Temp\9b5350dd_by_Libranalysis.exe | N/A |
| Set value (int) | \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyEnable = "0" | C:\Users\Admin\AppData\Local\Temp\9b5350dd_by_Libranalysis.exe | N/A |
| Set value (data) | \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\SavedLegacySettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 | C:\Users\Admin\AppData\Local\Temp\9b5350dd_by_Libranalysis.exe | N/A |
| Key created | \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ | C:\Users\Admin\AppData\Local\Temp\9b5350dd_by_Libranalysis.exe | N/A |
Modifies registry class
| Description | Indicator | Process | Target |
| Key created | \REGISTRY\MACHINE\SOFTWARE\Classes\.53411c86 | C:\Users\Admin\AppData\Local\Temp\9b5350dd_by_Libranalysis.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Classes\.53411c86\ = "53411c86" | C:\Users\Admin\AppData\Local\Temp\9b5350dd_by_Libranalysis.exe | N/A |
| Key created | \REGISTRY\MACHINE\SOFTWARE\Classes\53411c86\DefaultIcon | C:\Users\Admin\AppData\Local\Temp\9b5350dd_by_Libranalysis.exe | N/A |
| Key created | \REGISTRY\MACHINE\SOFTWARE\Classes\53411c86 | C:\Users\Admin\AppData\Local\Temp\9b5350dd_by_Libranalysis.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Classes\53411c86\DefaultIcon\ = "C:\\ProgramData\\53411c86.ico" | C:\Users\Admin\AppData\Local\Temp\9b5350dd_by_Libranalysis.exe | N/A |
Suspicious behavior: EnumeratesProcesses
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\9b5350dd_by_Libranalysis.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\9b5350dd_by_Libranalysis.exe | N/A |
Suspicious use of AdjustPrivilegeToken
| Description | Indicator | Process | Target |
| Token: SeBackupPrivilege | N/A | C:\Windows\system32\vssvc.exe | N/A |
| Token: SeRestorePrivilege | N/A | C:\Windows\system32\vssvc.exe | N/A |
| Token: SeAuditPrivilege | N/A | C:\Windows\system32\vssvc.exe | N/A |
Suspicious use of WriteProcessMemory
Processes
C:\Users\Admin\AppData\Local\Temp\9b5350dd_by_Libranalysis.exe
"C:\Users\Admin\AppData\Local\Temp\9b5350dd_by_Libranalysis.exe"
C:\Users\Admin\AppData\Local\Temp\9b5350dd_by_Libranalysis.exe
"C:\Users\Admin\AppData\Local\Temp\9b5350dd_by_Libranalysis.exe"
C:\Users\Admin\AppData\Local\Temp\9b5350dd_by_Libranalysis.exe
"C:\Users\Admin\AppData\Local\Temp\9b5350dd_by_Libranalysis.exe"
C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
C:\Users\Admin\AppData\Local\Temp\9b5350dd_by_libranalysis.exe
C:\Users\Admin\AppData\Local\Temp\9b5350dd_by_libranalysis.exe -work worker0 job0-1956
Network
| Country | Destination | Domain | Proto |
| N/A | 8.8.8.8:53 | baroquetees.com | udp |
Files
memory/1304-60-0x0000000075AD1000-0x0000000075AD3000-memory.dmp
memory/1956-62-0x0000000000000000-mapping.dmp
memory/1964-64-0x0000000000000000-mapping.dmp
Analysis: behavioral2
Detonation Overview
Submitted
2021-05-19 10:03
Reported
2021-05-19 10:05
Platform
win10v20210410
Max time kernel
58s
Max time network
113s
Command Line
Signatures
DarkSide
Modifies extensions of user files
| Description | Indicator | Process | Target |
| File renamed | C:\Users\Admin\Pictures\BackupStop.raw => C:\Users\Admin\Pictures\BackupStop.raw.aeef1a75 | C:\Users\Admin\AppData\Local\Temp\9b5350dd_by_libranalysis.exe | N/A |
| File opened for modification | C:\Users\Admin\Pictures\BackupStop.raw.aeef1a75 | C:\Users\Admin\AppData\Local\Temp\9b5350dd_by_libranalysis.exe | N/A |
| File renamed | C:\Users\Admin\Pictures\SelectMeasure.crw => C:\Users\Admin\Pictures\SelectMeasure.crw.aeef1a75 | C:\Users\Admin\AppData\Local\Temp\9b5350dd_by_libranalysis.exe | N/A |
| File opened for modification | C:\Users\Admin\Pictures\SelectMeasure.crw.aeef1a75 | C:\Users\Admin\AppData\Local\Temp\9b5350dd_by_libranalysis.exe | N/A |
Enumerates connected drives
| Description | Indicator | Process | Target |
| File opened (read-only) | \??\Z: | C:\Users\Admin\AppData\Local\Temp\9b5350dd_by_Libranalysis.exe | N/A |
| File opened (read-only) | \??\Z: | C:\Users\Admin\AppData\Local\Temp\9b5350dd_by_libranalysis.exe | N/A |
Drops file in System32 directory
| Description | Indicator | Process | Target |
| File opened for modification | C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCookies | C:\Users\Admin\AppData\Local\Temp\9b5350dd_by_Libranalysis.exe | N/A |
| File opened for modification | C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5 | C:\Users\Admin\AppData\Local\Temp\9b5350dd_by_Libranalysis.exe | N/A |
| File opened for modification | C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\counters2.dat | C:\Users\Admin\AppData\Local\Temp\9b5350dd_by_Libranalysis.exe | N/A |
| File opened for modification | C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\Content.IE5 | C:\Users\Admin\AppData\Local\Temp\9b5350dd_by_Libranalysis.exe | N/A |
| File opened for modification | C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE | C:\Users\Admin\AppData\Local\Temp\9b5350dd_by_Libranalysis.exe | N/A |
Sets desktop wallpaper using registry
| Description | Indicator | Process | Target |
| Set value (str) | \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Control Panel\Desktop\WallPaper = "C:\\ProgramData\\aeef1a75.BMP" | C:\Users\Admin\AppData\Local\Temp\9b5350dd_by_Libranalysis.exe | N/A |
Modifies Control Panel
| Description | Indicator | Process | Target |
| Key created | \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Control Panel\Desktop | C:\Users\Admin\AppData\Local\Temp\9b5350dd_by_Libranalysis.exe | N/A |
| Set value (str) | \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Control Panel\Desktop\WallpaperStyle = "10" | C:\Users\Admin\AppData\Local\Temp\9b5350dd_by_Libranalysis.exe | N/A |
Modifies data under HKEY_USERS
| Description | Indicator | Process | Target |
| Set value (data) | \REGISTRY\USER\.DEFAULT\Software\Microsoft\RestartManager\Session0000\RegFilesHash = 28e1d0ea387c59ed0a62f02c960afd841c6288b102d719fa1f7ca223b6d635db | C:\Users\Admin\AppData\Local\Temp\9b5350dd_by_libranalysis.exe | N/A |
| Set value (data) | \REGISTRY\USER\.DEFAULT\Software\Microsoft\RestartManager\Session0000\RegFilesHash = 8ce110ac2df5984dcb4af59e8ca95fe2877b249028d541b8e9f7fe2cb690c4b9 | C:\Users\Admin\AppData\Local\Temp\9b5350dd_by_libranalysis.exe | N/A |
| Key created | \REGISTRY\USER\.DEFAULT\Software\Microsoft\RestartManager | C:\Users\Admin\AppData\Local\Temp\9b5350dd_by_libranalysis.exe | N/A |
| Set value (data) | \REGISTRY\USER\.DEFAULT\Software\Microsoft\RestartManager\Session0000\RegFiles0000 = 5c005c003f005c0043003a005c00550073006500720073005c00410064006d0069006e005c004e00540055005300450052002e004400410054007b00340065003000370034003600360038002d0030006300310063002d0031003100650037002d0061003900340033002d006500340031006400320064003700310038006100320030007d002e0054004d002e0062006c00660000000000 | C:\Users\Admin\AppData\Local\Temp\9b5350dd_by_libranalysis.exe | N/A |
| Set value (int) | \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0" | C:\Users\Admin\AppData\Local\Temp\9b5350dd_by_Libranalysis.exe | N/A |
| Set value (int) | \REGISTRY\USER\.DEFAULT\Software\Microsoft\RestartManager\Session0000\Sequence = "1" | C:\Users\Admin\AppData\Local\Temp\9b5350dd_by_libranalysis.exe | N/A |
| Set value (data) | \REGISTRY\USER\.DEFAULT\Software\Microsoft\RestartManager\Session0000\SessionHash = fb948d709a95cda61386225b4040ebdc575f2caca4234e145bc5426cc2033f43 | C:\Users\Admin\AppData\Local\Temp\9b5350dd_by_libranalysis.exe | N/A |
| Set value (str) | \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix | C:\Users\Admin\AppData\Local\Temp\9b5350dd_by_Libranalysis.exe | N/A |
| Set value (int) | \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1" | C:\Users\Admin\AppData\Local\Temp\9b5350dd_by_Libranalysis.exe | N/A |
| Key created | \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ | C:\Users\Admin\AppData\Local\Temp\9b5350dd_by_Libranalysis.exe | N/A |
| Set value (data) | \REGISTRY\USER\.DEFAULT\Software\Microsoft\RestartManager\Session0000\SessionHash = 1ece2e0c8a289314f80d8c9e6fdca7c83e1239bdb10103ec80c8d5b78061589c | C:\Users\Admin\AppData\Local\Temp\9b5350dd_by_libranalysis.exe | N/A |
| Set value (data) | \REGISTRY\USER\.DEFAULT\Software\Microsoft\RestartManager\Session0000\RegFiles0000 = 5c005c003f005c0043003a005c00550073006500720073005c00410064006d0069006e005c006e00740075007300650072002e006400610074002e004c004f004700310000000000 | C:\Users\Admin\AppData\Local\Temp\9b5350dd_by_libranalysis.exe | N/A |
| Set value (str) | \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:" | C:\Users\Admin\AppData\Local\Temp\9b5350dd_by_Libranalysis.exe | N/A |
| Key created | \REGISTRY\USER\.DEFAULT\Software\Microsoft\RestartManager\Session0000 | C:\Users\Admin\AppData\Local\Temp\9b5350dd_by_libranalysis.exe | N/A |
| Set value (data) | \REGISTRY\USER\.DEFAULT\Software\Microsoft\RestartManager\Session0000\RegFiles0000 = 5c005c003f005c0043003a005c00550073006500720073005c00410064006d0069006e005c004e00540055005300450052002e004400410054007b00340065003000370034003600360038002d0030006300310063002d0031003100650037002d0061003900340033002d006500340031006400320064003700310038006100320030007d002e0054004d0043006f006e007400610069006e0065007200300030003000300030003000300030003000300030003000300030003000300030003000300031002e007200650067007400720061006e0073002d006d00730000000000 | C:\Users\Admin\AppData\Local\Temp\9b5350dd_by_libranalysis.exe | N/A |
| Set value (data) | \REGISTRY\USER\.DEFAULT\Software\Microsoft\RestartManager\Session0000\Owner = 740a0000babb3aaf964cd701 | C:\Users\Admin\AppData\Local\Temp\9b5350dd_by_libranalysis.exe | N/A |
| Set value (data) | \REGISTRY\USER\.DEFAULT\Software\Microsoft\RestartManager\Session0000\RegFilesHash = 0c8f5586fb0cc8f50a2d1d859a9ac5f05b5d2f9d39a6d82792052dd35dfbf8dc | C:\Users\Admin\AppData\Local\Temp\9b5350dd_by_libranalysis.exe | N/A |
| Set value (int) | \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1" | C:\Users\Admin\AppData\Local\Temp\9b5350dd_by_Libranalysis.exe | N/A |
| Key created | \REGISTRY\USER\.DEFAULT\Software\Microsoft | C:\Users\Admin\AppData\Local\Temp\9b5350dd_by_libranalysis.exe | N/A |
| Set value (data) | \REGISTRY\USER\.DEFAULT\Software\Microsoft\RestartManager\Session0000\SessionHash = 6f96001e5e8dcce4268e8c8b47523192110d12504c945ff3592e0da65baccf38 | C:\Users\Admin\AppData\Local\Temp\9b5350dd_by_libranalysis.exe | N/A |
| Set value (data) | \REGISTRY\USER\.DEFAULT\Software\Microsoft\RestartManager\Session0000\SessionHash = 5962cf2b75a087d79b8fca98d6c27f3ae918c2a78cf2db44f0a2265e7ed850ae | C:\Users\Admin\AppData\Local\Temp\9b5350dd_by_libranalysis.exe | N/A |
| Set value (str) | \REGISTRY\USER\.DEFAULT\Control Panel\Desktop\Wallpaper = "C:\\ProgramData\\aeef1a75.BMP" | C:\Users\Admin\AppData\Local\Temp\9b5350dd_by_Libranalysis.exe | N/A |
| Set value (str) | \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:" | C:\Users\Admin\AppData\Local\Temp\9b5350dd_by_Libranalysis.exe | N/A |
| Set value (int) | \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1" | C:\Users\Admin\AppData\Local\Temp\9b5350dd_by_Libranalysis.exe | N/A |
| Set value (data) | \REGISTRY\USER\.DEFAULT\Software\Microsoft\RestartManager\Session0000\RegFiles0000 = 5c005c003f005c0043003a005c00550073006500720073005c00410064006d0069006e005c004e00540055005300450052002e004400410054007b00340065003000370034003600360038002d0030006300310063002d0031003100650037002d0061003900340033002d006500340031006400320064003700310038006100320030007d002e0054004d0043006f006e007400610069006e0065007200300030003000300030003000300030003000300030003000300030003000300030003000300032002e007200650067007400720061006e0073002d006d00730000000000 | C:\Users\Admin\AppData\Local\Temp\9b5350dd_by_libranalysis.exe | N/A |
| Key created | \REGISTRY\USER\.DEFAULT\Control Panel\International | C:\Users\Admin\AppData\Local\Temp\9b5350dd_by_Libranalysis.exe | N/A |
| Key deleted | \REGISTRY\USER\.DEFAULT\Software\Microsoft\RestartManager\Session0000 | C:\Users\Admin\AppData\Local\Temp\9b5350dd_by_libranalysis.exe | N/A |
| Key created | \REGISTRY\USER\.DEFAULT\Software | C:\Users\Admin\AppData\Local\Temp\9b5350dd_by_libranalysis.exe | N/A |
| Set value (data) | \REGISTRY\USER\.DEFAULT\Software\Microsoft\RestartManager\Session0000\RegFilesHash = c1a53f7940c0cb79cc59cc96ab8396e5b921caf61356c66929b9705663208d97 | C:\Users\Admin\AppData\Local\Temp\9b5350dd_by_libranalysis.exe | N/A |
Modifies registry class
| Description | Indicator | Process | Target |
| Key created | \REGISTRY\MACHINE\SOFTWARE\Classes\aeef1a75 | C:\Users\Admin\AppData\Local\Temp\9b5350dd_by_Libranalysis.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Classes\aeef1a75\DefaultIcon\ = "C:\\ProgramData\\aeef1a75.ico" | C:\Users\Admin\AppData\Local\Temp\9b5350dd_by_Libranalysis.exe | N/A |
| Key created | \REGISTRY\MACHINE\SOFTWARE\Classes\.aeef1a75 | C:\Users\Admin\AppData\Local\Temp\9b5350dd_by_Libranalysis.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Classes\.aeef1a75\ = "aeef1a75" | C:\Users\Admin\AppData\Local\Temp\9b5350dd_by_Libranalysis.exe | N/A |
| Key created | \REGISTRY\MACHINE\SOFTWARE\Classes\aeef1a75\DefaultIcon | C:\Users\Admin\AppData\Local\Temp\9b5350dd_by_Libranalysis.exe | N/A |
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
| Description | Indicator | Process | Target |
| Token: SeBackupPrivilege | N/A | C:\Windows\system32\vssvc.exe | N/A |
| Token: SeRestorePrivilege | N/A | C:\Windows\system32\vssvc.exe | N/A |
| Token: SeAuditPrivilege | N/A | C:\Windows\system32\vssvc.exe | N/A |
Suspicious use of WriteProcessMemory
Processes
C:\Users\Admin\AppData\Local\Temp\9b5350dd_by_Libranalysis.exe
"C:\Users\Admin\AppData\Local\Temp\9b5350dd_by_Libranalysis.exe"
C:\Users\Admin\AppData\Local\Temp\9b5350dd_by_Libranalysis.exe
"C:\Users\Admin\AppData\Local\Temp\9b5350dd_by_Libranalysis.exe"
C:\Users\Admin\AppData\Local\Temp\9b5350dd_by_Libranalysis.exe
"C:\Users\Admin\AppData\Local\Temp\9b5350dd_by_Libranalysis.exe"
C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
C:\Users\Admin\AppData\Local\Temp\9b5350dd_by_libranalysis.exe
C:\Users\Admin\AppData\Local\Temp\9b5350dd_by_libranalysis.exe -work worker0 job0-1072
C:\Users\Admin\AppData\Local\Temp\9b5350dd_by_libranalysis.exe
C:\Users\Admin\AppData\Local\Temp\9b5350dd_by_libranalysis.exe -work worker1 job1-1072
Network
| Country | Destination | Domain | Proto |
| N/A | 8.8.8.8:53 | baroquetees.com | udp |
| N/A | 176.103.62.217:443 | baroquetees.com | tcp |
| N/A | 176.103.62.217:443 | baroquetees.com | tcp |
Files
memory/1072-114-0x0000000000000000-mapping.dmp
memory/2676-115-0x0000000000000000-mapping.dmp
memory/3076-116-0x0000000000000000-mapping.dmp