darkside | f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4

General

Target

f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4.exe
Size

56KB
MD5

3f2cb535fc5bc296aa5b0d2897c265d0
SHA1

c30358563fa940eb5cd6064d4d16defee43b0310
SHA256

f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4
SHA512

6fc3a98f16f4fbd2e6bd4211c35b403ed565d6b30f803e6da04e14efe018aca09719256f1e8a2c8a5763a7bac08de3be964eb6251d858df0f6261f82b3f2f7a2

Score

10^/10

darkside ransomware

Malware Config

Extracted

Path

C:\\README.949640ab.TXT

Family

darkside

Ransom Note

----------- [ Welcome to DarkSide ] -------------> What happend? ---------------------------------------------- Your computers and servers are encrypted, backups are deleted. We use strong encryption algorithms, so you cannot decrypt your data. But you can restore everything by purchasing a special program from us - universal decryptor. This program will restore all your network. Follow our instructions below and you will recover all your data. Data leak ---------------------------------------------- First of all we have downloaded more then 500GB data from your network. Included: -Accounting data -Finance data -HR -Employees confidential data(photos, benefits, taxes, etc) -Marketing -Budgets -Taxes(sales tax compliance, property, income and franchise taxes, etc) -Payrolls -Banking data -Arbitration -Scans -Insurance -Reconciliations -Reports(monthly bank inventory, monthly financial, claims reports, etc) -Audits(DHG, insurance audits, etc) -B2B clients config data -Confidentiality 2020 -2020, 2021 Business plans -2019, 2020, 2021 years Closing (full dumps) -and a lot of other sensitive data Your personal leak page: http://darksidc3iux462n6yunevoag52ntvwp6wulaz3zirkmh4cnz6hhj7id.onion/162/thedixiegroup/LCfyHRcwffrYTblpZvoPO3XDbrYPcNu0wVAsH5p49LSjBfzTmtdXT48azXFlMu7q On the page you will find examples of files that have been downloaded. The data is preloaded and will be automatically published if you do not pay. After publication, your data will be available for at least 6 months on our tor cdn servers. We are ready: - To provide you the evidence of stolen data - To delete all the stolen data. What guarantees? ---------------------------------------------- We value our reputation. If we do not do our work and liabilities, nobody will pay us. This is not in our interests. All our decryption software is perfectly tested and will decrypt your data. We will also provide support in case of problems. We guarantee to decrypt one file for free. Go to the site and contact us. How to get access on website? ---------------------------------------------- Using a TOR browser: 1) Download and install TOR browser from this site: https://torproject.org/ 2) Open our website: http://dark24zz36xm4y2phwe7yvnkkkkhxionhfrwp67awpb3r3bdcneivoqd.onion/W57MRI9C7YZJUZEABBBYRQLSUTG22JZ9MAH0WT1ISHC405KP7Z2UWY3AI3J68DNM When you open our website, put the following data in the input form: Key: ug8lgpX3WrFzlEJ6HBWlwJnf7jemhfnlxBw9porj1uuYFTgKbxJQJLYiteQS7DwgZn7dH0fs7qPPWmZ6inPv5GTmSJZNAjGLVIjd4SoiyTdGyophf0zPBxx6uEAOJxM0Woo4ZGeKVoUDHtZsqZNnhMF7aPh54VnKpIJXiZDbZZw4P06xTuw1UMeiTE7wdg7HWZMepAVTzEI2W04RbkPFQHfUgEDcslDxbr83BvopYTYGKFRmtNUMH8OsOZQrOtv50xWDaOfbqxbzfHMJm30QGaGpgylJHQZsscz3XBnwIdvlwBJ9KN4DVgFgziRdvwJrfCP6YN1CYTOQgw1rzqmIU4G1xGYv7rE3jiBY1s4D3Y26SbppTceAVMu1mKx5CFIE3EbtcAsNtEqLHDbPnMCvU6Apwp17TXGob8xXJpEDBZhIzdTaCuybcprwcFNTOzccjbIH81W39MrcJi9mNO3kHRe5fxmIFKvc9v8aQDihGyC65DtdabyBjidXI1NyNONT4PTyrxYqgffPsNDFuzz2yMrXiTAwtAQPqny5BBJQsfVhpLXTtnLvWg1 !!! DANGER !!! DO NOT MODIFY or try to RECOVER any files yourself. We WILL NOT be able to RESTORE them. !!! DANGER !!!

URLs

http://darksidc3iux462n6yunevoag52ntvwp6wulaz3zirkmh4cnz6hhj7id.onion/162/thedixiegroup/LCfyHRcwffrYTblpZvoPO3XDbrYPcNu0wVAsH5p49LSjBfzTmtdXT48azXFlMu7q

http://dark24zz36xm4y2phwe7yvnkkkkhxionhfrwp67awpb3r3bdcneivoqd.onion/W57MRI9C7YZJUZEABBBYRQLSUTG22JZ9MAH0WT1ISHC405KP7Z2UWY3AI3J68DNM

Signatures

DarkSide
Targeted ransomware first seen in August 2020. Operators steal data to use as leverage.
ransomware darkside

Modifies extensions of user files 8 IoCs

Ransomware generally changes the extension on encrypted files.

ransomware

Processes:

f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4.exe

description	ioc	process
File renamed	C:\Users\Admin\Pictures\SelectOpen.crw => C:\Users\Admin\Pictures\SelectOpen.crw.949640ab	f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4.exe
File opened for modification	C:\Users\Admin\Pictures\SelectOpen.crw.949640ab	f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4.exe
File renamed	C:\Users\Admin\Pictures\SendMove.tif => C:\Users\Admin\Pictures\SendMove.tif.949640ab	f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4.exe
File opened for modification	C:\Users\Admin\Pictures\SendMove.tif.949640ab	f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4.exe
File renamed	C:\Users\Admin\Pictures\BackupClear.crw => C:\Users\Admin\Pictures\BackupClear.crw.949640ab	f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4.exe
File opened for modification	C:\Users\Admin\Pictures\BackupClear.crw.949640ab	f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4.exe
File renamed	C:\Users\Admin\Pictures\RedoTest.tif => C:\Users\Admin\Pictures\RedoTest.tif.949640ab	f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4.exe
File opened for modification	C:\Users\Admin\Pictures\RedoTest.tif.949640ab	f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4.exe

Drops file in System32 directory 1 IoCs

Processes:

f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4.exe

description	ioc	process
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\counters.dat	f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4.exe

Sets desktop wallpaper using registry 2 TTPs 1 IoCs

ransomware

Defacement

T1491

Modify Registry

T1112

Processes:

f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Control Panel\Desktop\WallPaper = "C:\\ProgramData\\949640ab.BMP"	f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4.exe

Modifies Control Panel 2 IoCs

evasion

Processes:

f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Control Panel\Desktop\WallpaperStyle = "10"	f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4.exe
Key created	\REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Control Panel\Desktop	f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4.exe

Modifies data under HKEY_USERS 46 IoCs

Processes:

f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4.exef3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4.exe

description	ioc	process
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings	f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\RestartManager\Session0000\SessionHash = 68f4123e54699a58d13d8eaff4d8f14362107aec9c202e1297f271e390c5166f	f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections	f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft	f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\RestartManager	f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\RestartManager\Session0000\Sequence = "1"	f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\RestartManager\Session0000\RegFilesHash = 4d213a251ab42b4047f9c252f0be50b820f807165aabb43ad298013c4bb456aa	f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\RestartManager\Session0000\RegFiles0000 = 5c005c003f005c0043003a005c00550073006500720073005c00410064006d0069006e005c004e00540055005300450052002e004400410054007b00300031003600380038003800620064002d0036006300360066002d0031003100640065002d0038006400310064002d003000300031006500300062006300640065003300650063007d002e0054004d002e0062006c00660000000000	f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\RestartManager\Session0000\SessionHash = 66a83cc6106dda5f427a050377b0cec9218cc4a46ad66973e60a710c78b2a947	f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\RestartManager\Session0000\RegFiles0000 = 5c005c003f005c0043003a005c00550073006500720073005c00410064006d0069006e005c004e00540055005300450052002e004400410054007b00300031003600380038003800620064002d0036006300360066002d0031003100640065002d0038006400310064002d003000300031006500300062006300640065003300650063007d002e0054004d0043006f006e007400610069006e0065007200300030003000300030003000300030003000300030003000300030003000300030003000300032002e007200650067007400720061006e0073002d006d00730000000000	f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\RestartManager\Session0000\RegFilesHash = 770d5d7aca33be9ac7db3f738f4c7834e3f560549124544c57b7acaf1872208b	f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{2A905F01-0A57-4E51-8685-54144DDC3A32}	f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{2A905F01-0A57-4E51-8685-54144DDC3A32}\WpadNetworkName = "Network"	f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\RestartManager\Session0000\SessionHash = 23b1a3d9a16c3e0eab9d240fdb02562f3c1b7a0a5b01c9294c3acda1e914b8c9	f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\RestartManager\Session0000\RegFiles0000 = 5c005c003f005c0043003a005c00550073006500720073005c00410064006d0069006e005c006e00740075007300650072002e006400610074002e004c004f004700310000000000	f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\RestartManager\Session0000\RegFilesHash = 96c613bf3eb836c09b68ff18ef69c0a121878235cc20a67dbc6e62473fba83d3	f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\RestartManager\Session0000\SessionHash = af93aed81cb5e8da821090b37a32ab243c9157563bbc85e54ec430b1f88a1440	f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyEnable = "0"	f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\SavedLegacySettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "0"	f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{2A905F01-0A57-4E51-8685-54144DDC3A32}\WpadDecisionReason = "1"	f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\16-d8-fc-12-6a-1a\WpadDecision = "0"	f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\RestartManager\Session0000	f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad	f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4.exe
Key created	\REGISTRY\USER\.DEFAULT\Control Panel\International	f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "1"	f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\16-d8-fc-12-6a-1a	f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\16-d8-fc-12-6a-1a\WpadDecisionReason = "1"	f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\RestartManager\Session0000\RegFiles0000 = 5c005c003f005c0043003a005c00550073006500720073005c00410064006d0069006e005c004e00540055005300450052002e004400410054007b00300031003600380038003800620064002d0036006300360066002d0031003100640065002d0038006400310064002d003000300031006500300062006300640065003300650063007d002e0054004d0043006f006e007400610069006e0065007200300030003000300030003000300030003000300030003000300030003000300030003000300031002e007200650067007400720061006e0073002d006d00730000000000	f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\RestartManager\Session0000	f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings	f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000003000000090000000000000000000000000000000400000000000000000000000000000000000000000000000000000001000000020000000a070026000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{2A905F01-0A57-4E51-8685-54144DDC3A32}\WpadDecisionTime = 2092eebd8e68d701	f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{2A905F01-0A57-4E51-8685-54144DDC3A32}\WpadDecision = "0"	f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{2A905F01-0A57-4E51-8685-54144DDC3A32}\16-d8-fc-12-6a-1a	f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\RestartManager\Session0000\Owner = 2c040000a0acf4bd8e68d701	f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Control Panel\Desktop\Wallpaper = "C:\\ProgramData\\949640ab.BMP"	f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\16-d8-fc-12-6a-1a\WpadDecisionTime = 2092eebd8e68d701	f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\RestartManager\Session0000	f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\RestartManager\Session0000\RegFilesHash = e3653154db6024bb872ed38af4255ab2a3480b905c588cdaf92c6a932437b736	f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4.exe

Modifies registry class 5 IoCs

Processes:

f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\949640ab\DefaultIcon	f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\949640ab	f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\949640ab\DefaultIcon\ = "C:\\ProgramData\\949640ab.ico"	f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.949640ab	f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.949640ab\ = "949640ab"	f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4.exe

Suspicious behavior: EnumeratesProcesses 26 IoCs

Processes:

f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4.exef3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4.exe

pid	process
1996	f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4.exe
1996	f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4.exe
1068	f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4.exe
1068	f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4.exe
1068	f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4.exe
1068	f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4.exe
1068	f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4.exe
1068	f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4.exe
1068	f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4.exe
1068	f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4.exe
1068	f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4.exe
1068	f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4.exe
1068	f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4.exe
1068	f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4.exe
1068	f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4.exe
1068	f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4.exe
1068	f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4.exe
1068	f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4.exe
1068	f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4.exe
1068	f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4.exe
1068	f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4.exe
1068	f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4.exe
1068	f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4.exe
1068	f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4.exe
1068	f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4.exe
1068	f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

vssvc.exe

description pid process

Token: SeBackupPrivilege 332 vssvc.exe
Token: SeRestorePrivilege 332 vssvc.exe
Token: SeAuditPrivilege 332 vssvc.exe

description	pid	process
Token: SeBackupPrivilege	332	vssvc.exe
Token: SeRestorePrivilege	332	vssvc.exe
Token: SeAuditPrivilege	332	vssvc.exe

Suspicious use of WriteProcessMemory 9 IoCs

Processes:

f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4.exef3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4.exe

description	pid	process	target process
PID 2008 wrote to memory of 1996	2008	f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4.exe	f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4.exe
PID 2008 wrote to memory of 1996	2008	f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4.exe	f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4.exe
PID 2008 wrote to memory of 1996	2008	f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4.exe	f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4.exe
PID 2008 wrote to memory of 1996	2008	f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4.exe	f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4.exe
PID 2008 wrote to memory of 1996	2008	f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4.exe	f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4.exe
PID 1996 wrote to memory of 1068	1996	f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4.exe	f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4.exe
PID 1996 wrote to memory of 1068	1996	f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4.exe	f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4.exe
PID 1996 wrote to memory of 1068	1996	f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4.exe	f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4.exe
PID 1996 wrote to memory of 1068	1996	f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4.exe	f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4.exe

C:\Users\Admin\AppData\Local\Temp\f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4.exe
"C:\Users\Admin\AppData\Local\Temp\f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4.exe"
1⤵
PID:1036

C:\Users\Admin\AppData\Local\Temp\f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4.exe
"C:\Users\Admin\AppData\Local\Temp\f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2008
- C:\Users\Admin\AppData\Local\Temp\f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4.exe
  "C:\Users\Admin\AppData\Local\Temp\f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4.exe"
  2⤵
  - Drops file in System32 directory
  - Sets desktop wallpaper using registry
  - Modifies Control Panel
  - Modifies data under HKEY_USERS
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:1996
- - C:\Users\Admin\AppData\Local\Temp\f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4.exe
    C:\Users\Admin\AppData\Local\Temp\f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4.exe -work worker0 job0-1996
    3⤵
    - Modifies extensions of user files
    - Modifies data under HKEY_USERS
    - Suspicious behavior: EnumeratesProcesses
    PID:1068

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:332

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Defacement

1

T1491

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1036-59-0x0000000075721000-0x0000000075723000-memory.dmp

Filesize
8KB

Download
memory/1068-63-0x0000000000000000-mapping.dmp

Download
memory/1996-61-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads