Analysis Overview
SHA256
d3fa6ed8458e92bc814627d58d04d29b1e79b3ab9dcd90b50c87f9d4503ef9f0
Threat Level: Known bad
The file 2de09a815efcc64810046de69b8e0aa1c9e9beee77b66560a0b15d737485e3c5.zip was found to be: Known bad.
Malicious Activity Summary
DarkSide
Modifies extensions of user files
Enumerates connected drives
Drops file in System32 directory
Sets desktop wallpaper using registry
Modifies data under HKEY_USERS
Modifies registry class
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Modifies Control Panel
MITRE ATT&CK
Enterprise Matrix V6
Analysis: static1
Detonation Overview
Reported
2021-05-24 05:31
Signatures
Analysis: behavioral1
Detonation Overview
Submitted
2021-05-24 05:31
Reported
2021-05-24 05:40
Platform
win7v20210408
Max time kernel
35s
Max time network
80s
Command Line
Signatures
DarkSide
Modifies extensions of user files
Drops file in System32 directory
| Description | Indicator | Process | Target |
| File opened for modification | C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\counters.dat | C:\Users\Admin\AppData\Local\Temp\2de09a815efcc64810046de69b8e0aa1c9e9beee77b66560a0b15d737485e3c5.exe | N/A |
Sets desktop wallpaper using registry
| Description | Indicator | Process | Target |
| Set value (str) | \REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Control Panel\Desktop\WallPaper = "C:\\ProgramData\\53411c86.BMP" | C:\Users\Admin\AppData\Local\Temp\2de09a815efcc64810046de69b8e0aa1c9e9beee77b66560a0b15d737485e3c5.exe | N/A |
Modifies Control Panel
| Description | Indicator | Process | Target |
| Key created | \REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Control Panel\Desktop | C:\Users\Admin\AppData\Local\Temp\2de09a815efcc64810046de69b8e0aa1c9e9beee77b66560a0b15d737485e3c5.exe | N/A |
| Set value (str) | \REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Control Panel\Desktop\WallpaperStyle = "10" | C:\Users\Admin\AppData\Local\Temp\2de09a815efcc64810046de69b8e0aa1c9e9beee77b66560a0b15d737485e3c5.exe | N/A |
Modifies data under HKEY_USERS
| Description | Indicator | Process | Target |
| Set value (int) | \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "1" | C:\Users\Admin\AppData\Local\Temp\2de09a815efcc64810046de69b8e0aa1c9e9beee77b66560a0b15d737485e3c5.exe | N/A |
| Set value (data) | \REGISTRY\USER\.DEFAULT\Software\Microsoft\RestartManager\Session0000\SessionHash = d5ba64d5b442436a9eabf59549ac20c79bcba1cd3a147f38907ef08ee160d98b | C:\Users\Admin\AppData\Local\Temp\2de09a815efcc64810046de69b8e0aa1c9e9beee77b66560a0b15d737485e3c5.exe | N/A |
| Set value (data) | \REGISTRY\USER\.DEFAULT\Software\Microsoft\RestartManager\Session0000\RegFilesHash = d856182c1114398bf4c8d755366c195587208c11e15a4edeeecd27f3f1875e8f | C:\Users\Admin\AppData\Local\Temp\2de09a815efcc64810046de69b8e0aa1c9e9beee77b66560a0b15d737485e3c5.exe | N/A |
| Set value (data) | \REGISTRY\USER\.DEFAULT\Software\Microsoft\RestartManager\Session0000\SessionHash = 0cae043917d646ed1f0129f194d0468a88fe983a1706b0aa80f21d86fce3dd22 | C:\Users\Admin\AppData\Local\Temp\2de09a815efcc64810046de69b8e0aa1c9e9beee77b66560a0b15d737485e3c5.exe | N/A |
| Set value (data) | \REGISTRY\USER\.DEFAULT\Software\Microsoft\RestartManager\Session0000\RegFilesHash = 45c5c1d91e82427d6a4877516d3bfb8ec2f1314f787963d71dcd6b10cb9eda8e | C:\Users\Admin\AppData\Local\Temp\2de09a815efcc64810046de69b8e0aa1c9e9beee77b66560a0b15d737485e3c5.exe | N/A |
| Set value (str) | \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix | C:\Users\Admin\AppData\Local\Temp\2de09a815efcc64810046de69b8e0aa1c9e9beee77b66560a0b15d737485e3c5.exe | N/A |
| Key created | \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings | C:\Users\Admin\AppData\Local\Temp\2de09a815efcc64810046de69b8e0aa1c9e9beee77b66560a0b15d737485e3c5.exe | N/A |
| Set value (data) | \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\SavedLegacySettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 | C:\Users\Admin\AppData\Local\Temp\2de09a815efcc64810046de69b8e0aa1c9e9beee77b66560a0b15d737485e3c5.exe | N/A |
| Set value (data) | \REGISTRY\USER\.DEFAULT\Software\Microsoft\RestartManager\Session0000\RegFiles0000 = 5c005c003f005c0043003a005c00550073006500720073005c00410064006d0069006e005c004e00540055005300450052002e004400410054007b00300031003600380038003800620064002d0036006300360066002d0031003100640065002d0038006400310064002d003000300031006500300062006300640065003300650063007d002e0054004d0043006f006e007400610069006e0065007200300030003000300030003000300030003000300030003000300030003000300030003000300031002e007200650067007400720061006e0073002d006d00730000000000 | C:\Users\Admin\AppData\Local\Temp\2de09a815efcc64810046de69b8e0aa1c9e9beee77b66560a0b15d737485e3c5.exe | N/A |
| Set value (data) | \REGISTRY\USER\.DEFAULT\Software\Microsoft\RestartManager\Session0000\SessionHash = 47b97b10c13e649bbb13e7f94caa54af129634ae117aeccfc6fd71cca4ceda66 | C:\Users\Admin\AppData\Local\Temp\2de09a815efcc64810046de69b8e0aa1c9e9beee77b66560a0b15d737485e3c5.exe | N/A |
| Set value (str) | \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:" | C:\Users\Admin\AppData\Local\Temp\2de09a815efcc64810046de69b8e0aa1c9e9beee77b66560a0b15d737485e3c5.exe | N/A |
| Set value (str) | \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:" | C:\Users\Admin\AppData\Local\Temp\2de09a815efcc64810046de69b8e0aa1c9e9beee77b66560a0b15d737485e3c5.exe | N/A |
| Set value (int) | \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{3A33DB50-CC69-497D-AB93-6EAB524EB9A7}\WpadDecision = "0" | C:\Users\Admin\AppData\Local\Temp\2de09a815efcc64810046de69b8e0aa1c9e9beee77b66560a0b15d737485e3c5.exe | N/A |
| Key created | \REGISTRY\USER\.DEFAULT\Software | C:\Users\Admin\AppData\Local\Temp\2de09a815efcc64810046de69b8e0aa1c9e9beee77b66560a0b15d737485e3c5.exe | N/A |
| Key created | \REGISTRY\USER\.DEFAULT\Software\Microsoft\RestartManager | C:\Users\Admin\AppData\Local\Temp\2de09a815efcc64810046de69b8e0aa1c9e9beee77b66560a0b15d737485e3c5.exe | N/A |
| Set value (int) | \REGISTRY\USER\.DEFAULT\Software\Microsoft\RestartManager\Session0000\Sequence = "1" | C:\Users\Admin\AppData\Local\Temp\2de09a815efcc64810046de69b8e0aa1c9e9beee77b66560a0b15d737485e3c5.exe | N/A |
| Set value (data) | \REGISTRY\USER\.DEFAULT\Software\Microsoft\RestartManager\Session0000\RegFilesHash = 1dbe557cf8e6142c00ec9f1f80f7029e93d8e709bc8b227e3fd835628f87dd90 | C:\Users\Admin\AppData\Local\Temp\2de09a815efcc64810046de69b8e0aa1c9e9beee77b66560a0b15d737485e3c5.exe | N/A |
| Key created | \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{3A33DB50-CC69-497D-AB93-6EAB524EB9A7}\22-df-1a-4b-1f-d1 | C:\Users\Admin\AppData\Local\Temp\2de09a815efcc64810046de69b8e0aa1c9e9beee77b66560a0b15d737485e3c5.exe | N/A |
| Key created | \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections | C:\Users\Admin\AppData\Local\Temp\2de09a815efcc64810046de69b8e0aa1c9e9beee77b66560a0b15d737485e3c5.exe | N/A |
| Set value (int) | \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyEnable = "0" | C:\Users\Admin\AppData\Local\Temp\2de09a815efcc64810046de69b8e0aa1c9e9beee77b66560a0b15d737485e3c5.exe | N/A |
| Key created | \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad | C:\Users\Admin\AppData\Local\Temp\2de09a815efcc64810046de69b8e0aa1c9e9beee77b66560a0b15d737485e3c5.exe | N/A |
| Set value (data) | \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000003000000090000000000000000000000000000000400000000000000000000000000000000000000000000000000000001000000020000000a070023000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 | C:\Users\Admin\AppData\Local\Temp\2de09a815efcc64810046de69b8e0aa1c9e9beee77b66560a0b15d737485e3c5.exe | N/A |
| Key created | \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ | C:\Users\Admin\AppData\Local\Temp\2de09a815efcc64810046de69b8e0aa1c9e9beee77b66560a0b15d737485e3c5.exe | N/A |
| Set value (int) | \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "0" | C:\Users\Admin\AppData\Local\Temp\2de09a815efcc64810046de69b8e0aa1c9e9beee77b66560a0b15d737485e3c5.exe | N/A |
| Set value (data) | \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{3A33DB50-CC69-497D-AB93-6EAB524EB9A7}\WpadDecisionTime = 403a4e316f50d701 | C:\Users\Admin\AppData\Local\Temp\2de09a815efcc64810046de69b8e0aa1c9e9beee77b66560a0b15d737485e3c5.exe | N/A |
| Set value (data) | \REGISTRY\USER\.DEFAULT\Software\Microsoft\RestartManager\Session0000\Owner = 58020000206edf316f50d701 | C:\Users\Admin\AppData\Local\Temp\2de09a815efcc64810046de69b8e0aa1c9e9beee77b66560a0b15d737485e3c5.exe | N/A |
| Set value (data) | \REGISTRY\USER\.DEFAULT\Software\Microsoft\RestartManager\Session0000\RegFilesHash = ac4310457e416ee183cd0337e8db09ce13a7e9b932c8b71e8efd4e4b104457b3 | C:\Users\Admin\AppData\Local\Temp\2de09a815efcc64810046de69b8e0aa1c9e9beee77b66560a0b15d737485e3c5.exe | N/A |
| Set value (data) | \REGISTRY\USER\.DEFAULT\Software\Microsoft\RestartManager\Session0000\RegFiles0000 = 5c005c003f005c0043003a005c00550073006500720073005c00410064006d0069006e005c004e00540055005300450052002e004400410054007b00300031003600380038003800620064002d0036006300360066002d0031003100640065002d0038006400310064002d003000300031006500300062006300640065003300650063007d002e0054004d0043006f006e007400610069006e0065007200300030003000300030003000300030003000300030003000300030003000300030003000300032002e007200650067007400720061006e0073002d006d00730000000000 | C:\Users\Admin\AppData\Local\Temp\2de09a815efcc64810046de69b8e0aa1c9e9beee77b66560a0b15d737485e3c5.exe | N/A |
| Key created | \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{3A33DB50-CC69-497D-AB93-6EAB524EB9A7} | C:\Users\Admin\AppData\Local\Temp\2de09a815efcc64810046de69b8e0aa1c9e9beee77b66560a0b15d737485e3c5.exe | N/A |
| Key created | \REGISTRY\USER\.DEFAULT\Software\Microsoft\RestartManager\Session0000 | C:\Users\Admin\AppData\Local\Temp\2de09a815efcc64810046de69b8e0aa1c9e9beee77b66560a0b15d737485e3c5.exe | N/A |
| Key deleted | \REGISTRY\USER\.DEFAULT\Software\Microsoft\RestartManager\Session0000 | C:\Users\Admin\AppData\Local\Temp\2de09a815efcc64810046de69b8e0aa1c9e9beee77b66560a0b15d737485e3c5.exe | N/A |
| Set value (data) | \REGISTRY\USER\.DEFAULT\Software\Microsoft\RestartManager\Session0000\SessionHash = 612dbac4f60396cb937acab4a20d05e4d68808a3f936e6ba8db52d62429b01ab | C:\Users\Admin\AppData\Local\Temp\2de09a815efcc64810046de69b8e0aa1c9e9beee77b66560a0b15d737485e3c5.exe | N/A |
| Set value (int) | \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\22-df-1a-4b-1f-d1\WpadDecision = "0" | C:\Users\Admin\AppData\Local\Temp\2de09a815efcc64810046de69b8e0aa1c9e9beee77b66560a0b15d737485e3c5.exe | N/A |
| Key created | \REGISTRY\USER\.DEFAULT\Software\Microsoft | C:\Users\Admin\AppData\Local\Temp\2de09a815efcc64810046de69b8e0aa1c9e9beee77b66560a0b15d737485e3c5.exe | N/A |
| Key created | \REGISTRY\USER\.DEFAULT\Control Panel\International | C:\Users\Admin\AppData\Local\Temp\2de09a815efcc64810046de69b8e0aa1c9e9beee77b66560a0b15d737485e3c5.exe | N/A |
| Set value (int) | \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{3A33DB50-CC69-497D-AB93-6EAB524EB9A7}\WpadDecisionReason = "1" | C:\Users\Admin\AppData\Local\Temp\2de09a815efcc64810046de69b8e0aa1c9e9beee77b66560a0b15d737485e3c5.exe | N/A |
| Set value (str) | \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{3A33DB50-CC69-497D-AB93-6EAB524EB9A7}\WpadNetworkName = "Network" | C:\Users\Admin\AppData\Local\Temp\2de09a815efcc64810046de69b8e0aa1c9e9beee77b66560a0b15d737485e3c5.exe | N/A |
| Key created | \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\22-df-1a-4b-1f-d1 | C:\Users\Admin\AppData\Local\Temp\2de09a815efcc64810046de69b8e0aa1c9e9beee77b66560a0b15d737485e3c5.exe | N/A |
| Set value (int) | \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\22-df-1a-4b-1f-d1\WpadDecisionReason = "1" | C:\Users\Admin\AppData\Local\Temp\2de09a815efcc64810046de69b8e0aa1c9e9beee77b66560a0b15d737485e3c5.exe | N/A |
| Set value (data) | \REGISTRY\USER\.DEFAULT\Software\Microsoft\RestartManager\Session0000\RegFiles0000 = 5c005c003f005c0043003a005c00550073006500720073005c00410064006d0069006e005c006e00740075007300650072002e006400610074002e004c004f004700310000000000 | C:\Users\Admin\AppData\Local\Temp\2de09a815efcc64810046de69b8e0aa1c9e9beee77b66560a0b15d737485e3c5.exe | N/A |
| Set value (str) | \REGISTRY\USER\.DEFAULT\Control Panel\Desktop\Wallpaper = "C:\\ProgramData\\53411c86.BMP" | C:\Users\Admin\AppData\Local\Temp\2de09a815efcc64810046de69b8e0aa1c9e9beee77b66560a0b15d737485e3c5.exe | N/A |
| Key created | \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings | C:\Users\Admin\AppData\Local\Temp\2de09a815efcc64810046de69b8e0aa1c9e9beee77b66560a0b15d737485e3c5.exe | N/A |
| Set value (data) | \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 | C:\Users\Admin\AppData\Local\Temp\2de09a815efcc64810046de69b8e0aa1c9e9beee77b66560a0b15d737485e3c5.exe | N/A |
| Set value (data) | \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\22-df-1a-4b-1f-d1\WpadDecisionTime = 403a4e316f50d701 | C:\Users\Admin\AppData\Local\Temp\2de09a815efcc64810046de69b8e0aa1c9e9beee77b66560a0b15d737485e3c5.exe | N/A |
| Set value (data) | \REGISTRY\USER\.DEFAULT\Software\Microsoft\RestartManager\Session0000\RegFiles0000 = 5c005c003f005c0043003a005c00550073006500720073005c00410064006d0069006e005c004e00540055005300450052002e004400410054007b00300031003600380038003800620064002d0036006300360066002d0031003100640065002d0038006400310064002d003000300031006500300062006300640065003300650063007d002e0054004d002e0062006c00660000000000 | C:\Users\Admin\AppData\Local\Temp\2de09a815efcc64810046de69b8e0aa1c9e9beee77b66560a0b15d737485e3c5.exe | N/A |
Modifies registry class
| Description | Indicator | Process | Target |
| Key created | \REGISTRY\MACHINE\SOFTWARE\Classes\53411c86 | C:\Users\Admin\AppData\Local\Temp\2de09a815efcc64810046de69b8e0aa1c9e9beee77b66560a0b15d737485e3c5.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Classes\53411c86\DefaultIcon\ = "C:\\ProgramData\\53411c86.ico" | C:\Users\Admin\AppData\Local\Temp\2de09a815efcc64810046de69b8e0aa1c9e9beee77b66560a0b15d737485e3c5.exe | N/A |
| Key created | \REGISTRY\MACHINE\SOFTWARE\Classes\.53411c86 | C:\Users\Admin\AppData\Local\Temp\2de09a815efcc64810046de69b8e0aa1c9e9beee77b66560a0b15d737485e3c5.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Classes\.53411c86\ = "53411c86" | C:\Users\Admin\AppData\Local\Temp\2de09a815efcc64810046de69b8e0aa1c9e9beee77b66560a0b15d737485e3c5.exe | N/A |
| Key created | \REGISTRY\MACHINE\SOFTWARE\Classes\53411c86\DefaultIcon | C:\Users\Admin\AppData\Local\Temp\2de09a815efcc64810046de69b8e0aa1c9e9beee77b66560a0b15d737485e3c5.exe | N/A |
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
| Description | Indicator | Process | Target |
| Token: SeBackupPrivilege | N/A | C:\Windows\system32\vssvc.exe | N/A |
| Token: SeRestorePrivilege | N/A | C:\Windows\system32\vssvc.exe | N/A |
| Token: SeAuditPrivilege | N/A | C:\Windows\system32\vssvc.exe | N/A |
Suspicious use of WriteProcessMemory
Processes
C:\Users\Admin\AppData\Local\Temp\2de09a815efcc64810046de69b8e0aa1c9e9beee77b66560a0b15d737485e3c5.exe
"C:\Users\Admin\AppData\Local\Temp\2de09a815efcc64810046de69b8e0aa1c9e9beee77b66560a0b15d737485e3c5.exe"
C:\Users\Admin\AppData\Local\Temp\2de09a815efcc64810046de69b8e0aa1c9e9beee77b66560a0b15d737485e3c5.exe
"C:\Users\Admin\AppData\Local\Temp\2de09a815efcc64810046de69b8e0aa1c9e9beee77b66560a0b15d737485e3c5.exe"
C:\Users\Admin\AppData\Local\Temp\2de09a815efcc64810046de69b8e0aa1c9e9beee77b66560a0b15d737485e3c5.exe
"C:\Users\Admin\AppData\Local\Temp\2de09a815efcc64810046de69b8e0aa1c9e9beee77b66560a0b15d737485e3c5.exe"
C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
C:\Users\Admin\AppData\Local\Temp\2de09a815efcc64810046de69b8e0aa1c9e9beee77b66560a0b15d737485e3c5.exe
C:\Users\Admin\AppData\Local\Temp\2de09a815efcc64810046de69b8e0aa1c9e9beee77b66560a0b15d737485e3c5.exe -work worker0 job0-1792
Network
| Country | Destination | Domain | Proto |
| N/A | 8.8.8.8:53 | baroquetees.com | udp |
| N/A | 8.8.8.8:53 | baroquetees.com | udp |
Files
memory/1080-59-0x0000000075AF1000-0x0000000075AF3000-memory.dmp
memory/1792-61-0x0000000000000000-mapping.dmp
memory/600-63-0x0000000000000000-mapping.dmp
Analysis: behavioral2
Detonation Overview
Submitted
2021-05-24 05:31
Reported
2021-05-24 05:39
Platform
win10v20210408
Max time kernel
36s
Max time network
46s
Command Line
Signatures
DarkSide
Modifies extensions of user files
| Description | Indicator | Process | Target |
| File renamed | C:\Users\Admin\Pictures\InstallProtect.tif => C:\Users\Admin\Pictures\InstallProtect.tif.70d4d153 | C:\Users\Admin\AppData\Local\Temp\2de09a815efcc64810046de69b8e0aa1c9e9beee77b66560a0b15d737485e3c5.exe | N/A |
| File opened for modification | C:\Users\Admin\Pictures\InstallProtect.tif.70d4d153 | C:\Users\Admin\AppData\Local\Temp\2de09a815efcc64810046de69b8e0aa1c9e9beee77b66560a0b15d737485e3c5.exe | N/A |
| File renamed | C:\Users\Admin\Pictures\StopUninstall.tif => C:\Users\Admin\Pictures\StopUninstall.tif.70d4d153 | C:\Users\Admin\AppData\Local\Temp\2de09a815efcc64810046de69b8e0aa1c9e9beee77b66560a0b15d737485e3c5.exe | N/A |
| File opened for modification | C:\Users\Admin\Pictures\StopUninstall.tif.70d4d153 | C:\Users\Admin\AppData\Local\Temp\2de09a815efcc64810046de69b8e0aa1c9e9beee77b66560a0b15d737485e3c5.exe | N/A |
Enumerates connected drives
| Description | Indicator | Process | Target |
| File opened (read-only) | \??\Z: | C:\Users\Admin\AppData\Local\Temp\2de09a815efcc64810046de69b8e0aa1c9e9beee77b66560a0b15d737485e3c5.exe | N/A |
| File opened (read-only) | \??\Z: | C:\Users\Admin\AppData\Local\Temp\2de09a815efcc64810046de69b8e0aa1c9e9beee77b66560a0b15d737485e3c5.exe | N/A |
Drops file in System32 directory
| Description | Indicator | Process | Target |
| File opened for modification | C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\counters2.dat | C:\Users\Admin\AppData\Local\Temp\2de09a815efcc64810046de69b8e0aa1c9e9beee77b66560a0b15d737485e3c5.exe | N/A |
| File opened for modification | C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\Content.IE5 | C:\Users\Admin\AppData\Local\Temp\2de09a815efcc64810046de69b8e0aa1c9e9beee77b66560a0b15d737485e3c5.exe | N/A |
| File opened for modification | C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE | C:\Users\Admin\AppData\Local\Temp\2de09a815efcc64810046de69b8e0aa1c9e9beee77b66560a0b15d737485e3c5.exe | N/A |
| File opened for modification | C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCookies | C:\Users\Admin\AppData\Local\Temp\2de09a815efcc64810046de69b8e0aa1c9e9beee77b66560a0b15d737485e3c5.exe | N/A |
| File opened for modification | C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5 | C:\Users\Admin\AppData\Local\Temp\2de09a815efcc64810046de69b8e0aa1c9e9beee77b66560a0b15d737485e3c5.exe | N/A |
Sets desktop wallpaper using registry
| Description | Indicator | Process | Target |
| Set value (str) | \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Control Panel\Desktop\WallPaper = "C:\\ProgramData\\70d4d153.BMP" | C:\Users\Admin\AppData\Local\Temp\2de09a815efcc64810046de69b8e0aa1c9e9beee77b66560a0b15d737485e3c5.exe | N/A |
Modifies Control Panel
| Description | Indicator | Process | Target |
| Key created | \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Control Panel\Desktop | C:\Users\Admin\AppData\Local\Temp\2de09a815efcc64810046de69b8e0aa1c9e9beee77b66560a0b15d737485e3c5.exe | N/A |
| Set value (str) | \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Control Panel\Desktop\WallpaperStyle = "10" | C:\Users\Admin\AppData\Local\Temp\2de09a815efcc64810046de69b8e0aa1c9e9beee77b66560a0b15d737485e3c5.exe | N/A |
Modifies data under HKEY_USERS
| Description | Indicator | Process | Target |
| Set value (str) | \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix | C:\Users\Admin\AppData\Local\Temp\2de09a815efcc64810046de69b8e0aa1c9e9beee77b66560a0b15d737485e3c5.exe | N/A |
| Key created | \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ | C:\Users\Admin\AppData\Local\Temp\2de09a815efcc64810046de69b8e0aa1c9e9beee77b66560a0b15d737485e3c5.exe | N/A |
| Set value (int) | \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1" | C:\Users\Admin\AppData\Local\Temp\2de09a815efcc64810046de69b8e0aa1c9e9beee77b66560a0b15d737485e3c5.exe | N/A |
| Set value (int) | \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0" | C:\Users\Admin\AppData\Local\Temp\2de09a815efcc64810046de69b8e0aa1c9e9beee77b66560a0b15d737485e3c5.exe | N/A |
| Key created | \REGISTRY\USER\.DEFAULT\Software | C:\Users\Admin\AppData\Local\Temp\2de09a815efcc64810046de69b8e0aa1c9e9beee77b66560a0b15d737485e3c5.exe | N/A |
| Set value (data) | \REGISTRY\USER\.DEFAULT\Software\Microsoft\RestartManager\Session0000\RegFiles0000 = 5c005c003f005c0043003a005c00550073006500720073005c00410064006d0069006e005c004e00540055005300450052002e004400410054007b00340065003000370034003600360038002d0030006300310063002d0031003100650037002d0061003900340033002d006500340031006400320064003700310038006100320030007d002e0054004d002e0062006c00660000000000 | C:\Users\Admin\AppData\Local\Temp\2de09a815efcc64810046de69b8e0aa1c9e9beee77b66560a0b15d737485e3c5.exe | N/A |
| Set value (int) | \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1" | C:\Users\Admin\AppData\Local\Temp\2de09a815efcc64810046de69b8e0aa1c9e9beee77b66560a0b15d737485e3c5.exe | N/A |
| Set value (data) | \REGISTRY\USER\.DEFAULT\Software\Microsoft\RestartManager\Session0000\RegFiles0000 = 5c005c003f005c0043003a005c00550073006500720073005c00410064006d0069006e005c006e00740075007300650072002e006400610074002e004c004f004700310000000000 | C:\Users\Admin\AppData\Local\Temp\2de09a815efcc64810046de69b8e0aa1c9e9beee77b66560a0b15d737485e3c5.exe | N/A |
| Key deleted | \REGISTRY\USER\.DEFAULT\Software\Microsoft\RestartManager\Session0000 | C:\Users\Admin\AppData\Local\Temp\2de09a815efcc64810046de69b8e0aa1c9e9beee77b66560a0b15d737485e3c5.exe | N/A |
| Set value (data) | \REGISTRY\USER\.DEFAULT\Software\Microsoft\RestartManager\Session0000\SessionHash = 314eabb3378a91b0a7c4c761c633be21626e047243b7c79b3c00e05105106483 | C:\Users\Admin\AppData\Local\Temp\2de09a815efcc64810046de69b8e0aa1c9e9beee77b66560a0b15d737485e3c5.exe | N/A |
| Set value (data) | \REGISTRY\USER\.DEFAULT\Software\Microsoft\RestartManager\Session0000\RegFilesHash = ba1a034009b4fdc382c24202a6720f353da37091a76c8998be705dbd758c5d71 | C:\Users\Admin\AppData\Local\Temp\2de09a815efcc64810046de69b8e0aa1c9e9beee77b66560a0b15d737485e3c5.exe | N/A |
| Key created | \REGISTRY\USER\.DEFAULT\Software\Microsoft | C:\Users\Admin\AppData\Local\Temp\2de09a815efcc64810046de69b8e0aa1c9e9beee77b66560a0b15d737485e3c5.exe | N/A |
| Set value (data) | \REGISTRY\USER\.DEFAULT\Software\Microsoft\RestartManager\Session0000\Owner = 680c0000e7f408166f50d701 | C:\Users\Admin\AppData\Local\Temp\2de09a815efcc64810046de69b8e0aa1c9e9beee77b66560a0b15d737485e3c5.exe | N/A |
| Set value (data) | \REGISTRY\USER\.DEFAULT\Software\Microsoft\RestartManager\Session0000\SessionHash = 0c79c8fda07d27cb1623c1bc25d8548673e51d9f5a501c473aa88ee3f5fded93 | C:\Users\Admin\AppData\Local\Temp\2de09a815efcc64810046de69b8e0aa1c9e9beee77b66560a0b15d737485e3c5.exe | N/A |
| Set value (data) | \REGISTRY\USER\.DEFAULT\Software\Microsoft\RestartManager\Session0000\RegFiles0000 = 5c005c003f005c0043003a005c00550073006500720073005c00410064006d0069006e005c004e00540055005300450052002e004400410054007b00340065003000370034003600360038002d0030006300310063002d0031003100650037002d0061003900340033002d006500340031006400320064003700310038006100320030007d002e0054004d0043006f006e007400610069006e0065007200300030003000300030003000300030003000300030003000300030003000300030003000300032002e007200650067007400720061006e0073002d006d00730000000000 | C:\Users\Admin\AppData\Local\Temp\2de09a815efcc64810046de69b8e0aa1c9e9beee77b66560a0b15d737485e3c5.exe | N/A |
| Set value (str) | \REGISTRY\USER\.DEFAULT\Control Panel\Desktop\Wallpaper = "C:\\ProgramData\\70d4d153.BMP" | C:\Users\Admin\AppData\Local\Temp\2de09a815efcc64810046de69b8e0aa1c9e9beee77b66560a0b15d737485e3c5.exe | N/A |
| Set value (int) | \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1" | C:\Users\Admin\AppData\Local\Temp\2de09a815efcc64810046de69b8e0aa1c9e9beee77b66560a0b15d737485e3c5.exe | N/A |
| Set value (data) | \REGISTRY\USER\.DEFAULT\Software\Microsoft\RestartManager\Session0000\RegFilesHash = 5d3b714cfd356d0b13b4da54aa70bf28a8a84c788088281968af6094412502f1 | C:\Users\Admin\AppData\Local\Temp\2de09a815efcc64810046de69b8e0aa1c9e9beee77b66560a0b15d737485e3c5.exe | N/A |
| Key created | \REGISTRY\USER\.DEFAULT\Control Panel\International | C:\Users\Admin\AppData\Local\Temp\2de09a815efcc64810046de69b8e0aa1c9e9beee77b66560a0b15d737485e3c5.exe | N/A |
| Key created | \REGISTRY\USER\.DEFAULT\Software\Microsoft\RestartManager | C:\Users\Admin\AppData\Local\Temp\2de09a815efcc64810046de69b8e0aa1c9e9beee77b66560a0b15d737485e3c5.exe | N/A |
| Set value (int) | \REGISTRY\USER\.DEFAULT\Software\Microsoft\RestartManager\Session0000\Sequence = "1" | C:\Users\Admin\AppData\Local\Temp\2de09a815efcc64810046de69b8e0aa1c9e9beee77b66560a0b15d737485e3c5.exe | N/A |
| Set value (data) | \REGISTRY\USER\.DEFAULT\Software\Microsoft\RestartManager\Session0000\RegFilesHash = 3d922e80837c80e8865da14358a2711e896bfec301569f29c8a8a97c6e11a8f7 | C:\Users\Admin\AppData\Local\Temp\2de09a815efcc64810046de69b8e0aa1c9e9beee77b66560a0b15d737485e3c5.exe | N/A |
| Set value (str) | \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:" | C:\Users\Admin\AppData\Local\Temp\2de09a815efcc64810046de69b8e0aa1c9e9beee77b66560a0b15d737485e3c5.exe | N/A |
| Set value (data) | \REGISTRY\USER\.DEFAULT\Software\Microsoft\RestartManager\Session0000\SessionHash = 9ad590fb10da69ee6d025c8d40008c284ed8c7543b9e477dcc12092c99d409ab | C:\Users\Admin\AppData\Local\Temp\2de09a815efcc64810046de69b8e0aa1c9e9beee77b66560a0b15d737485e3c5.exe | N/A |
| Set value (str) | \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:" | C:\Users\Admin\AppData\Local\Temp\2de09a815efcc64810046de69b8e0aa1c9e9beee77b66560a0b15d737485e3c5.exe | N/A |
| Key created | \REGISTRY\USER\.DEFAULT\Software\Microsoft\RestartManager\Session0000 | C:\Users\Admin\AppData\Local\Temp\2de09a815efcc64810046de69b8e0aa1c9e9beee77b66560a0b15d737485e3c5.exe | N/A |
| Set value (data) | \REGISTRY\USER\.DEFAULT\Software\Microsoft\RestartManager\Session0000\RegFilesHash = eb5baeedae06c29d0a554cdd93b1d730021806eea6f673cc058c85d2ab380353 | C:\Users\Admin\AppData\Local\Temp\2de09a815efcc64810046de69b8e0aa1c9e9beee77b66560a0b15d737485e3c5.exe | N/A |
| Set value (data) | \REGISTRY\USER\.DEFAULT\Software\Microsoft\RestartManager\Session0000\RegFiles0000 = 5c005c003f005c0043003a005c00550073006500720073005c00410064006d0069006e005c004e00540055005300450052002e004400410054007b00340065003000370034003600360038002d0030006300310063002d0031003100650037002d0061003900340033002d006500340031006400320064003700310038006100320030007d002e0054004d0043006f006e007400610069006e0065007200300030003000300030003000300030003000300030003000300030003000300030003000300031002e007200650067007400720061006e0073002d006d00730000000000 | C:\Users\Admin\AppData\Local\Temp\2de09a815efcc64810046de69b8e0aa1c9e9beee77b66560a0b15d737485e3c5.exe | N/A |
| Set value (data) | \REGISTRY\USER\.DEFAULT\Software\Microsoft\RestartManager\Session0000\SessionHash = 64d6fc1fc52198be505e416c1db563c32eb355af8632388c451109991cafd680 | C:\Users\Admin\AppData\Local\Temp\2de09a815efcc64810046de69b8e0aa1c9e9beee77b66560a0b15d737485e3c5.exe | N/A |
Modifies registry class
| Description | Indicator | Process | Target |
| Key created | \REGISTRY\MACHINE\SOFTWARE\Classes\.70d4d153 | C:\Users\Admin\AppData\Local\Temp\2de09a815efcc64810046de69b8e0aa1c9e9beee77b66560a0b15d737485e3c5.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Classes\.70d4d153\ = "70d4d153" | C:\Users\Admin\AppData\Local\Temp\2de09a815efcc64810046de69b8e0aa1c9e9beee77b66560a0b15d737485e3c5.exe | N/A |
| Key created | \REGISTRY\MACHINE\SOFTWARE\Classes\70d4d153\DefaultIcon | C:\Users\Admin\AppData\Local\Temp\2de09a815efcc64810046de69b8e0aa1c9e9beee77b66560a0b15d737485e3c5.exe | N/A |
| Key created | \REGISTRY\MACHINE\SOFTWARE\Classes\70d4d153 | C:\Users\Admin\AppData\Local\Temp\2de09a815efcc64810046de69b8e0aa1c9e9beee77b66560a0b15d737485e3c5.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Classes\70d4d153\DefaultIcon\ = "C:\\ProgramData\\70d4d153.ico" | C:\Users\Admin\AppData\Local\Temp\2de09a815efcc64810046de69b8e0aa1c9e9beee77b66560a0b15d737485e3c5.exe | N/A |
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
| Description | Indicator | Process | Target |
| Token: SeBackupPrivilege | N/A | C:\Windows\system32\vssvc.exe | N/A |
| Token: SeRestorePrivilege | N/A | C:\Windows\system32\vssvc.exe | N/A |
| Token: SeAuditPrivilege | N/A | C:\Windows\system32\vssvc.exe | N/A |
Suspicious use of WriteProcessMemory
Processes
C:\Users\Admin\AppData\Local\Temp\2de09a815efcc64810046de69b8e0aa1c9e9beee77b66560a0b15d737485e3c5.exe
"C:\Users\Admin\AppData\Local\Temp\2de09a815efcc64810046de69b8e0aa1c9e9beee77b66560a0b15d737485e3c5.exe"
C:\Users\Admin\AppData\Local\Temp\2de09a815efcc64810046de69b8e0aa1c9e9beee77b66560a0b15d737485e3c5.exe
"C:\Users\Admin\AppData\Local\Temp\2de09a815efcc64810046de69b8e0aa1c9e9beee77b66560a0b15d737485e3c5.exe"
C:\Users\Admin\AppData\Local\Temp\2de09a815efcc64810046de69b8e0aa1c9e9beee77b66560a0b15d737485e3c5.exe
"C:\Users\Admin\AppData\Local\Temp\2de09a815efcc64810046de69b8e0aa1c9e9beee77b66560a0b15d737485e3c5.exe"
C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
C:\Users\Admin\AppData\Local\Temp\2de09a815efcc64810046de69b8e0aa1c9e9beee77b66560a0b15d737485e3c5.exe
C:\Users\Admin\AppData\Local\Temp\2de09a815efcc64810046de69b8e0aa1c9e9beee77b66560a0b15d737485e3c5.exe -work worker0 job0-2624
C:\Users\Admin\AppData\Local\Temp\2de09a815efcc64810046de69b8e0aa1c9e9beee77b66560a0b15d737485e3c5.exe
C:\Users\Admin\AppData\Local\Temp\2de09a815efcc64810046de69b8e0aa1c9e9beee77b66560a0b15d737485e3c5.exe -work worker1 job1-2624
Network
| Country | Destination | Domain | Proto |
| N/A | 8.8.8.8:53 | baroquetees.com | udp |
| N/A | 8.8.8.8:53 | baroquetees.com | udp |
Files
memory/2624-114-0x0000000000000000-mapping.dmp
memory/3176-115-0x0000000000000000-mapping.dmp
memory/3620-116-0x0000000000000000-mapping.dmp