Analysis
-
max time kernel
36s -
max time network
64s -
platform
windows7_x64 -
resource
win7v20210408 -
submitted
19-05-2021 09:24
Static task
static1
Behavioral task
behavioral1
Sample
2de09a815efcc64810046de69b8e0aa1c9e9beee77b66560a0b15d737485e3c5.exe
Resource
win7v20210408
Behavioral task
behavioral2
Sample
2de09a815efcc64810046de69b8e0aa1c9e9beee77b66560a0b15d737485e3c5.exe
Resource
win10v20210410
General
-
Target
2de09a815efcc64810046de69b8e0aa1c9e9beee77b66560a0b15d737485e3c5.exe
-
Size
56KB
-
MD5
9b5350ddf895a5051b90a1cc563753df
-
SHA1
0e45a5f66f5ce300b8c7135450e76afaccc0d332
-
SHA256
2de09a815efcc64810046de69b8e0aa1c9e9beee77b66560a0b15d737485e3c5
-
SHA512
b96a1d383ca4721e3a0481399eb6dee0c1573e1c07140b7ec57c808b89cc6790937e6a7d49c960639a79c5a1bf1595e05834c6ae42c1c6933d2537fb38eaa190
Malware Config
Extracted
C:\\README.53411c86.TXT
darkside
http://dark24vx6fsmdrtbzdzjv6ckz4yqyued4uz455oqpctko7m6vbrzibad.onion/1SJ1TB6JTW4SEUG6GSN7IVSGERSM5H5M2VZOHQ4PSIVS2AGAQDMT3QVGIFMPM3K8
Signatures
-
DarkSide
Targeted ransomware first seen in August 2020. Operators steal data to use as leverage.
-
Modifies extensions of user files 10 IoCs
Ransomware generally changes the extension on encrypted files.
Processes:
2de09a815efcc64810046de69b8e0aa1c9e9beee77b66560a0b15d737485e3c5.exedescription ioc process File renamed C:\Users\Admin\Pictures\PushRedo.png => C:\Users\Admin\Pictures\PushRedo.png.53411c86 2de09a815efcc64810046de69b8e0aa1c9e9beee77b66560a0b15d737485e3c5.exe File opened for modification C:\Users\Admin\Pictures\RegisterRead.png.53411c86 2de09a815efcc64810046de69b8e0aa1c9e9beee77b66560a0b15d737485e3c5.exe File renamed C:\Users\Admin\Pictures\UninstallBlock.crw => C:\Users\Admin\Pictures\UninstallBlock.crw.53411c86 2de09a815efcc64810046de69b8e0aa1c9e9beee77b66560a0b15d737485e3c5.exe File renamed C:\Users\Admin\Pictures\MountSwitch.raw => C:\Users\Admin\Pictures\MountSwitch.raw.53411c86 2de09a815efcc64810046de69b8e0aa1c9e9beee77b66560a0b15d737485e3c5.exe File opened for modification C:\Users\Admin\Pictures\MountSwitch.raw.53411c86 2de09a815efcc64810046de69b8e0aa1c9e9beee77b66560a0b15d737485e3c5.exe File renamed C:\Users\Admin\Pictures\ResizeComplete.crw => C:\Users\Admin\Pictures\ResizeComplete.crw.53411c86 2de09a815efcc64810046de69b8e0aa1c9e9beee77b66560a0b15d737485e3c5.exe File opened for modification C:\Users\Admin\Pictures\ResizeComplete.crw.53411c86 2de09a815efcc64810046de69b8e0aa1c9e9beee77b66560a0b15d737485e3c5.exe File opened for modification C:\Users\Admin\Pictures\UninstallBlock.crw.53411c86 2de09a815efcc64810046de69b8e0aa1c9e9beee77b66560a0b15d737485e3c5.exe File opened for modification C:\Users\Admin\Pictures\PushRedo.png.53411c86 2de09a815efcc64810046de69b8e0aa1c9e9beee77b66560a0b15d737485e3c5.exe File renamed C:\Users\Admin\Pictures\RegisterRead.png => C:\Users\Admin\Pictures\RegisterRead.png.53411c86 2de09a815efcc64810046de69b8e0aa1c9e9beee77b66560a0b15d737485e3c5.exe -
Drops file in System32 directory 1 IoCs
Processes:
2de09a815efcc64810046de69b8e0aa1c9e9beee77b66560a0b15d737485e3c5.exedescription ioc process File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\counters.dat 2de09a815efcc64810046de69b8e0aa1c9e9beee77b66560a0b15d737485e3c5.exe -
Sets desktop wallpaper using registry 2 TTPs 1 IoCs
Processes:
2de09a815efcc64810046de69b8e0aa1c9e9beee77b66560a0b15d737485e3c5.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Control Panel\Desktop\WallPaper = "C:\\ProgramData\\53411c86.BMP" 2de09a815efcc64810046de69b8e0aa1c9e9beee77b66560a0b15d737485e3c5.exe -
Modifies Control Panel 2 IoCs
Processes:
2de09a815efcc64810046de69b8e0aa1c9e9beee77b66560a0b15d737485e3c5.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Control Panel\Desktop 2de09a815efcc64810046de69b8e0aa1c9e9beee77b66560a0b15d737485e3c5.exe Set value (str) \REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Control Panel\Desktop\WallpaperStyle = "10" 2de09a815efcc64810046de69b8e0aa1c9e9beee77b66560a0b15d737485e3c5.exe -
Modifies data under HKEY_USERS 46 IoCs
Processes:
2de09a815efcc64810046de69b8e0aa1c9e9beee77b66560a0b15d737485e3c5.exe2de09a815efcc64810046de69b8e0aa1c9e9beee77b66560a0b15d737485e3c5.exedescription ioc process Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\ea-d9-53-2b-a4-64\WpadDecisionReason = "1" 2de09a815efcc64810046de69b8e0aa1c9e9beee77b66560a0b15d737485e3c5.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\RestartManager\Session0000\SessionHash = 2c5880c008327702c71393b88218162a85e9dd58b2cdedb5a7cc5df4268407e9 2de09a815efcc64810046de69b8e0aa1c9e9beee77b66560a0b15d737485e3c5.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\RestartManager\Session0000\RegFiles0000 = 5c005c003f005c0043003a005c00550073006500720073005c00410064006d0069006e005c004e00540055005300450052002e004400410054007b00300031003600380038003800620064002d0036006300360066002d0031003100640065002d0038006400310064002d003000300031006500300062006300640065003300650063007d002e0054004d002e0062006c00660000000000 2de09a815efcc64810046de69b8e0aa1c9e9beee77b66560a0b15d737485e3c5.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\RestartManager\Session0000\RegFilesHash = fe4fe60c641dbc414469306fe409979e17ab165f9c5605741ddb6b7b39da349f 2de09a815efcc64810046de69b8e0aa1c9e9beee77b66560a0b15d737485e3c5.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\RestartManager\Session0000\SessionHash = 7ca29bcd5a32294f679a8b80b6360398061ffd3b7ce8a0217a9c43e513443610 2de09a815efcc64810046de69b8e0aa1c9e9beee77b66560a0b15d737485e3c5.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\RestartManager\Session0000\RegFiles0000 = 5c005c003f005c0043003a005c00550073006500720073005c00410064006d0069006e005c004e00540055005300450052002e004400410054007b00300031003600380038003800620064002d0036006300360066002d0031003100640065002d0038006400310064002d003000300031006500300062006300640065003300650063007d002e0054004d0043006f006e007400610069006e0065007200300030003000300030003000300030003000300030003000300030003000300030003000300031002e007200650067007400720061006e0073002d006d00730000000000 2de09a815efcc64810046de69b8e0aa1c9e9beee77b66560a0b15d737485e3c5.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings 2de09a815efcc64810046de69b8e0aa1c9e9beee77b66560a0b15d737485e3c5.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{3A33DB50-CC69-497D-AB93-6EAB524EB9A7}\WpadNetworkName = "Network" 2de09a815efcc64810046de69b8e0aa1c9e9beee77b66560a0b15d737485e3c5.exe Set value (str) \REGISTRY\USER\.DEFAULT\Control Panel\Desktop\Wallpaper = "C:\\ProgramData\\53411c86.BMP" 2de09a815efcc64810046de69b8e0aa1c9e9beee77b66560a0b15d737485e3c5.exe Key created \REGISTRY\USER\.DEFAULT\Software 2de09a815efcc64810046de69b8e0aa1c9e9beee77b66560a0b15d737485e3c5.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\RestartManager 2de09a815efcc64810046de69b8e0aa1c9e9beee77b66560a0b15d737485e3c5.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\RestartManager\Session0000\RegFiles0000 = 5c005c003f005c0043003a005c00550073006500720073005c00410064006d0069006e005c004e00540055005300450052002e004400410054007b00300031003600380038003800620064002d0036006300360066002d0031003100640065002d0038006400310064002d003000300031006500300062006300640065003300650063007d002e0054004d0043006f006e007400610069006e0065007200300030003000300030003000300030003000300030003000300030003000300030003000300032002e007200650067007400720061006e0073002d006d00730000000000 2de09a815efcc64810046de69b8e0aa1c9e9beee77b66560a0b15d737485e3c5.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\RestartManager\Session0000\RegFilesHash = 891ec3d6988f6dd4ff264988de1b0abc58778ca60058a051a2f2efd3731614bf 2de09a815efcc64810046de69b8e0aa1c9e9beee77b66560a0b15d737485e3c5.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections 2de09a815efcc64810046de69b8e0aa1c9e9beee77b66560a0b15d737485e3c5.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:" 2de09a815efcc64810046de69b8e0aa1c9e9beee77b66560a0b15d737485e3c5.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{3A33DB50-CC69-497D-AB93-6EAB524EB9A7}\WpadDecision = "0" 2de09a815efcc64810046de69b8e0aa1c9e9beee77b66560a0b15d737485e3c5.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\ea-d9-53-2b-a4-64\WpadDecision = "0" 2de09a815efcc64810046de69b8e0aa1c9e9beee77b66560a0b15d737485e3c5.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft 2de09a815efcc64810046de69b8e0aa1c9e9beee77b66560a0b15d737485e3c5.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\RestartManager\Session0000 2de09a815efcc64810046de69b8e0aa1c9e9beee77b66560a0b15d737485e3c5.exe Key deleted \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\RestartManager\Session0000 2de09a815efcc64810046de69b8e0aa1c9e9beee77b66560a0b15d737485e3c5.exe Key created \REGISTRY\USER\.DEFAULT\Control Panel\International 2de09a815efcc64810046de69b8e0aa1c9e9beee77b66560a0b15d737485e3c5.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:" 2de09a815efcc64810046de69b8e0aa1c9e9beee77b66560a0b15d737485e3c5.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\RestartManager\Session0000\RegFilesHash = b668eb99e23a9aa7d5da5e2164778ec40e0b63d3a1a4de1bfe7581dd1575c184 2de09a815efcc64810046de69b8e0aa1c9e9beee77b66560a0b15d737485e3c5.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\SavedLegacySettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 2de09a815efcc64810046de69b8e0aa1c9e9beee77b66560a0b15d737485e3c5.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "0" 2de09a815efcc64810046de69b8e0aa1c9e9beee77b66560a0b15d737485e3c5.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{3A33DB50-CC69-497D-AB93-6EAB524EB9A7}\WpadDecisionReason = "1" 2de09a815efcc64810046de69b8e0aa1c9e9beee77b66560a0b15d737485e3c5.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{3A33DB50-CC69-497D-AB93-6EAB524EB9A7}\WpadDecisionTime = 80024720a14cd701 2de09a815efcc64810046de69b8e0aa1c9e9beee77b66560a0b15d737485e3c5.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\RestartManager\Session0000 2de09a815efcc64810046de69b8e0aa1c9e9beee77b66560a0b15d737485e3c5.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\RestartManager\Session0000\SessionHash = dec6f08cccdbc936c0762932fe500f10e5a6da2be64f418d3c572c2fccb33aa4 2de09a815efcc64810046de69b8e0aa1c9e9beee77b66560a0b15d737485e3c5.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\RestartManager\Session0000\Sequence = "1" 2de09a815efcc64810046de69b8e0aa1c9e9beee77b66560a0b15d737485e3c5.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\RestartManager\Session0000\RegFilesHash = 83c4ac51321929a6b68a87f6bb12d8444ee781ca6a9790bfa882b8a70dc9e98d 2de09a815efcc64810046de69b8e0aa1c9e9beee77b66560a0b15d737485e3c5.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings 2de09a815efcc64810046de69b8e0aa1c9e9beee77b66560a0b15d737485e3c5.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{3A33DB50-CC69-497D-AB93-6EAB524EB9A7} 2de09a815efcc64810046de69b8e0aa1c9e9beee77b66560a0b15d737485e3c5.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ 2de09a815efcc64810046de69b8e0aa1c9e9beee77b66560a0b15d737485e3c5.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\RestartManager\Session0000\RegFiles0000 = 5c005c003f005c0043003a005c00550073006500720073005c00410064006d0069006e005c006e00740075007300650072002e006400610074002e004c004f004700310000000000 2de09a815efcc64810046de69b8e0aa1c9e9beee77b66560a0b15d737485e3c5.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 2de09a815efcc64810046de69b8e0aa1c9e9beee77b66560a0b15d737485e3c5.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad 2de09a815efcc64810046de69b8e0aa1c9e9beee77b66560a0b15d737485e3c5.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "1" 2de09a815efcc64810046de69b8e0aa1c9e9beee77b66560a0b15d737485e3c5.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{3A33DB50-CC69-497D-AB93-6EAB524EB9A7}\ea-d9-53-2b-a4-64 2de09a815efcc64810046de69b8e0aa1c9e9beee77b66560a0b15d737485e3c5.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\ea-d9-53-2b-a4-64\WpadDecisionTime = 80024720a14cd701 2de09a815efcc64810046de69b8e0aa1c9e9beee77b66560a0b15d737485e3c5.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\RestartManager\Session0000\Owner = 6003000050d4cc20a14cd701 2de09a815efcc64810046de69b8e0aa1c9e9beee77b66560a0b15d737485e3c5.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\RestartManager\Session0000\SessionHash = 547ae076c7f7210857c8446bcaf99032c8527be6ea9c0b589347a98d448d3194 2de09a815efcc64810046de69b8e0aa1c9e9beee77b66560a0b15d737485e3c5.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix 2de09a815efcc64810046de69b8e0aa1c9e9beee77b66560a0b15d737485e3c5.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyEnable = "0" 2de09a815efcc64810046de69b8e0aa1c9e9beee77b66560a0b15d737485e3c5.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000003000000090000000000000000000000000000000400000000000000000000000000000000000000000000000000000001000000020000000a070021000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 2de09a815efcc64810046de69b8e0aa1c9e9beee77b66560a0b15d737485e3c5.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\ea-d9-53-2b-a4-64 2de09a815efcc64810046de69b8e0aa1c9e9beee77b66560a0b15d737485e3c5.exe -
Modifies registry class 5 IoCs
Processes:
2de09a815efcc64810046de69b8e0aa1c9e9beee77b66560a0b15d737485e3c5.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\53411c86\DefaultIcon\ = "C:\\ProgramData\\53411c86.ico" 2de09a815efcc64810046de69b8e0aa1c9e9beee77b66560a0b15d737485e3c5.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.53411c86 2de09a815efcc64810046de69b8e0aa1c9e9beee77b66560a0b15d737485e3c5.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.53411c86\ = "53411c86" 2de09a815efcc64810046de69b8e0aa1c9e9beee77b66560a0b15d737485e3c5.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\53411c86\DefaultIcon 2de09a815efcc64810046de69b8e0aa1c9e9beee77b66560a0b15d737485e3c5.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\53411c86 2de09a815efcc64810046de69b8e0aa1c9e9beee77b66560a0b15d737485e3c5.exe -
Suspicious behavior: EnumeratesProcesses 26 IoCs
Processes:
2de09a815efcc64810046de69b8e0aa1c9e9beee77b66560a0b15d737485e3c5.exe2de09a815efcc64810046de69b8e0aa1c9e9beee77b66560a0b15d737485e3c5.exepid process 2028 2de09a815efcc64810046de69b8e0aa1c9e9beee77b66560a0b15d737485e3c5.exe 2028 2de09a815efcc64810046de69b8e0aa1c9e9beee77b66560a0b15d737485e3c5.exe 864 2de09a815efcc64810046de69b8e0aa1c9e9beee77b66560a0b15d737485e3c5.exe 864 2de09a815efcc64810046de69b8e0aa1c9e9beee77b66560a0b15d737485e3c5.exe 864 2de09a815efcc64810046de69b8e0aa1c9e9beee77b66560a0b15d737485e3c5.exe 864 2de09a815efcc64810046de69b8e0aa1c9e9beee77b66560a0b15d737485e3c5.exe 864 2de09a815efcc64810046de69b8e0aa1c9e9beee77b66560a0b15d737485e3c5.exe 864 2de09a815efcc64810046de69b8e0aa1c9e9beee77b66560a0b15d737485e3c5.exe 864 2de09a815efcc64810046de69b8e0aa1c9e9beee77b66560a0b15d737485e3c5.exe 864 2de09a815efcc64810046de69b8e0aa1c9e9beee77b66560a0b15d737485e3c5.exe 864 2de09a815efcc64810046de69b8e0aa1c9e9beee77b66560a0b15d737485e3c5.exe 864 2de09a815efcc64810046de69b8e0aa1c9e9beee77b66560a0b15d737485e3c5.exe 864 2de09a815efcc64810046de69b8e0aa1c9e9beee77b66560a0b15d737485e3c5.exe 864 2de09a815efcc64810046de69b8e0aa1c9e9beee77b66560a0b15d737485e3c5.exe 864 2de09a815efcc64810046de69b8e0aa1c9e9beee77b66560a0b15d737485e3c5.exe 864 2de09a815efcc64810046de69b8e0aa1c9e9beee77b66560a0b15d737485e3c5.exe 864 2de09a815efcc64810046de69b8e0aa1c9e9beee77b66560a0b15d737485e3c5.exe 864 2de09a815efcc64810046de69b8e0aa1c9e9beee77b66560a0b15d737485e3c5.exe 864 2de09a815efcc64810046de69b8e0aa1c9e9beee77b66560a0b15d737485e3c5.exe 864 2de09a815efcc64810046de69b8e0aa1c9e9beee77b66560a0b15d737485e3c5.exe 864 2de09a815efcc64810046de69b8e0aa1c9e9beee77b66560a0b15d737485e3c5.exe 864 2de09a815efcc64810046de69b8e0aa1c9e9beee77b66560a0b15d737485e3c5.exe 864 2de09a815efcc64810046de69b8e0aa1c9e9beee77b66560a0b15d737485e3c5.exe 864 2de09a815efcc64810046de69b8e0aa1c9e9beee77b66560a0b15d737485e3c5.exe 864 2de09a815efcc64810046de69b8e0aa1c9e9beee77b66560a0b15d737485e3c5.exe 864 2de09a815efcc64810046de69b8e0aa1c9e9beee77b66560a0b15d737485e3c5.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
vssvc.exedescription pid process Token: SeBackupPrivilege 788 vssvc.exe Token: SeRestorePrivilege 788 vssvc.exe Token: SeAuditPrivilege 788 vssvc.exe -
Suspicious use of WriteProcessMemory 9 IoCs
Processes:
2de09a815efcc64810046de69b8e0aa1c9e9beee77b66560a0b15d737485e3c5.exe2de09a815efcc64810046de69b8e0aa1c9e9beee77b66560a0b15d737485e3c5.exedescription pid process target process PID 2000 wrote to memory of 2028 2000 2de09a815efcc64810046de69b8e0aa1c9e9beee77b66560a0b15d737485e3c5.exe 2de09a815efcc64810046de69b8e0aa1c9e9beee77b66560a0b15d737485e3c5.exe PID 2000 wrote to memory of 2028 2000 2de09a815efcc64810046de69b8e0aa1c9e9beee77b66560a0b15d737485e3c5.exe 2de09a815efcc64810046de69b8e0aa1c9e9beee77b66560a0b15d737485e3c5.exe PID 2000 wrote to memory of 2028 2000 2de09a815efcc64810046de69b8e0aa1c9e9beee77b66560a0b15d737485e3c5.exe 2de09a815efcc64810046de69b8e0aa1c9e9beee77b66560a0b15d737485e3c5.exe PID 2000 wrote to memory of 2028 2000 2de09a815efcc64810046de69b8e0aa1c9e9beee77b66560a0b15d737485e3c5.exe 2de09a815efcc64810046de69b8e0aa1c9e9beee77b66560a0b15d737485e3c5.exe PID 2000 wrote to memory of 2028 2000 2de09a815efcc64810046de69b8e0aa1c9e9beee77b66560a0b15d737485e3c5.exe 2de09a815efcc64810046de69b8e0aa1c9e9beee77b66560a0b15d737485e3c5.exe PID 2028 wrote to memory of 864 2028 2de09a815efcc64810046de69b8e0aa1c9e9beee77b66560a0b15d737485e3c5.exe 2de09a815efcc64810046de69b8e0aa1c9e9beee77b66560a0b15d737485e3c5.exe PID 2028 wrote to memory of 864 2028 2de09a815efcc64810046de69b8e0aa1c9e9beee77b66560a0b15d737485e3c5.exe 2de09a815efcc64810046de69b8e0aa1c9e9beee77b66560a0b15d737485e3c5.exe PID 2028 wrote to memory of 864 2028 2de09a815efcc64810046de69b8e0aa1c9e9beee77b66560a0b15d737485e3c5.exe 2de09a815efcc64810046de69b8e0aa1c9e9beee77b66560a0b15d737485e3c5.exe PID 2028 wrote to memory of 864 2028 2de09a815efcc64810046de69b8e0aa1c9e9beee77b66560a0b15d737485e3c5.exe 2de09a815efcc64810046de69b8e0aa1c9e9beee77b66560a0b15d737485e3c5.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2de09a815efcc64810046de69b8e0aa1c9e9beee77b66560a0b15d737485e3c5.exe"C:\Users\Admin\AppData\Local\Temp\2de09a815efcc64810046de69b8e0aa1c9e9beee77b66560a0b15d737485e3c5.exe"1⤵
-
C:\Users\Admin\AppData\Local\Temp\2de09a815efcc64810046de69b8e0aa1c9e9beee77b66560a0b15d737485e3c5.exe"C:\Users\Admin\AppData\Local\Temp\2de09a815efcc64810046de69b8e0aa1c9e9beee77b66560a0b15d737485e3c5.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\2de09a815efcc64810046de69b8e0aa1c9e9beee77b66560a0b15d737485e3c5.exe"C:\Users\Admin\AppData\Local\Temp\2de09a815efcc64810046de69b8e0aa1c9e9beee77b66560a0b15d737485e3c5.exe"2⤵
- Drops file in System32 directory
- Sets desktop wallpaper using registry
- Modifies Control Panel
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\2de09a815efcc64810046de69b8e0aa1c9e9beee77b66560a0b15d737485e3c5.exeC:\Users\Admin\AppData\Local\Temp\2de09a815efcc64810046de69b8e0aa1c9e9beee77b66560a0b15d737485e3c5.exe -work worker0 job0-20283⤵
- Modifies extensions of user files
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken