Analysis
-
max time kernel
48s -
max time network
38s -
platform
windows7_x64 -
resource
win7v20210408 -
submitted
24-06-2021 00:09
Static task
static1
Behavioral task
behavioral1
Sample
f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4.exe
Resource
win7v20210408
Behavioral task
behavioral2
Sample
f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4.exe
Resource
win10v20210410
General
-
Target
f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4.exe
-
Size
56KB
-
MD5
3f2cb535fc5bc296aa5b0d2897c265d0
-
SHA1
c30358563fa940eb5cd6064d4d16defee43b0310
-
SHA256
f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4
-
SHA512
6fc3a98f16f4fbd2e6bd4211c35b403ed565d6b30f803e6da04e14efe018aca09719256f1e8a2c8a5763a7bac08de3be964eb6251d858df0f6261f82b3f2f7a2
Malware Config
Extracted
C:\\README.53411c86.TXT
darkside
http://darksidc3iux462n6yunevoag52ntvwp6wulaz3zirkmh4cnz6hhj7id.onion/162/thedixiegroup/LCfyHRcwffrYTblpZvoPO3XDbrYPcNu0wVAsH5p49LSjBfzTmtdXT48azXFlMu7q
http://dark24zz36xm4y2phwe7yvnkkkkhxionhfrwp67awpb3r3bdcneivoqd.onion/W57MRI9C7YZJUZEABBBYRQLSUTG22JZ9MAH0WT1ISHC405KP7Z2UWY3AI3J68DNM
Signatures
-
DarkSide
Targeted ransomware first seen in August 2020. Operators steal data to use as leverage.
-
Modifies extensions of user files 19 IoCs
Ransomware generally changes the extension on encrypted files.
Processes:
f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4.exedescription ioc process File renamed C:\Users\Admin\Pictures\ConvertToUnregister.tif => C:\Users\Admin\Pictures\ConvertToUnregister.tif.53411c86 f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4.exe File opened for modification C:\Users\Admin\Pictures\DisconnectTrace.raw.53411c86 f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4.exe File renamed C:\Users\Admin\Pictures\MergeClear.tif => C:\Users\Admin\Pictures\MergeClear.tif.53411c86 f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4.exe File opened for modification C:\Users\Admin\Pictures\RepairGrant.tiff f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4.exe File renamed C:\Users\Admin\Pictures\RepairGrant.tiff => C:\Users\Admin\Pictures\RepairGrant.tiff.53411c86 f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4.exe File opened for modification C:\Users\Admin\Pictures\RepairGrant.tiff.53411c86 f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4.exe File renamed C:\Users\Admin\Pictures\ResolveRead.tiff => C:\Users\Admin\Pictures\ResolveRead.tiff.53411c86 f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4.exe File opened for modification C:\Users\Admin\Pictures\ResolveRead.tiff.53411c86 f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4.exe File renamed C:\Users\Admin\Pictures\CompressSplit.tiff => C:\Users\Admin\Pictures\CompressSplit.tiff.53411c86 f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4.exe File opened for modification C:\Users\Admin\Pictures\CompressSplit.tiff.53411c86 f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4.exe File renamed C:\Users\Admin\Pictures\DisconnectTrace.raw => C:\Users\Admin\Pictures\DisconnectTrace.raw.53411c86 f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4.exe File renamed C:\Users\Admin\Pictures\GrantCompress.png => C:\Users\Admin\Pictures\GrantCompress.png.53411c86 f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4.exe File opened for modification C:\Users\Admin\Pictures\GrantCompress.png.53411c86 f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4.exe File opened for modification C:\Users\Admin\Pictures\InstallDismount.crw.53411c86 f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4.exe File opened for modification C:\Users\Admin\Pictures\CompressSplit.tiff f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4.exe File opened for modification C:\Users\Admin\Pictures\ConvertToUnregister.tif.53411c86 f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4.exe File renamed C:\Users\Admin\Pictures\InstallDismount.crw => C:\Users\Admin\Pictures\InstallDismount.crw.53411c86 f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4.exe File opened for modification C:\Users\Admin\Pictures\MergeClear.tif.53411c86 f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4.exe File opened for modification C:\Users\Admin\Pictures\ResolveRead.tiff f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4.exe -
Drops file in System32 directory 1 IoCs
Processes:
f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4.exedescription ioc process File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\counters.dat f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4.exe -
Sets desktop wallpaper using registry 2 TTPs 1 IoCs
Processes:
f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Control Panel\Desktop\WallPaper = "C:\\ProgramData\\53411c86.BMP" f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4.exe -
Modifies Control Panel 2 IoCs
Processes:
f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Control Panel\Desktop\WallpaperStyle = "10" f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4.exe Key created \REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Control Panel\Desktop f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4.exe -
Modifies data under HKEY_USERS 46 IoCs
Processes:
f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4.exef3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4.exedescription ioc process Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\RestartManager\Session0000\Owner = cc050000802f69729d68d701 f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\RestartManager\Session0000\RegFilesHash = 0834a1c04c02c3c122c8dd5b1a90252d92d55a25bc6f90bdd38bdedb58f5aea6 f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:" f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\5a-2c-ab-76-63-f3\WpadDecisionTime = 001b68719d68d701 f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\RestartManager f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\RestartManager\Session0000\RegFilesHash = ad968d38fcb2edb3b93a58258fee49a4e39849d30926d1e0d75ba6d73ca9ac91 f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{3A33DB50-CC69-497D-AB93-6EAB524EB9A7}\5a-2c-ab-76-63-f3 f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\5a-2c-ab-76-63-f3\WpadDecision = "0" f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\RestartManager\Session0000\RegFilesHash = 98824473638fc485a78853ee14058a90b4b90406fef1b3dd3d998e0f89ebe6f1 f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4.exe Key created \REGISTRY\USER\.DEFAULT\Control Panel\International f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:" f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyEnable = "0" f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "1" f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\RestartManager\Session0000\RegFiles0000 = 5c005c003f005c0043003a005c00550073006500720073005c00410064006d0069006e005c004e00540055005300450052002e004400410054007b00300031003600380038003800620064002d0036006300360066002d0031003100640065002d0038006400310064002d003000300031006500300062006300640065003300650063007d002e0054004d0043006f006e007400610069006e0065007200300030003000300030003000300030003000300030003000300030003000300030003000300032002e007200650067007400720061006e0073002d006d00730000000000 f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\RestartManager\Session0000\RegFilesHash = 49c6781be208e5d7abb5640a86a582dc1295f45dadee148dbc94e16f7b267d77 f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "0" f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{3A33DB50-CC69-497D-AB93-6EAB524EB9A7}\WpadNetworkName = "Network" f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\5a-2c-ab-76-63-f3 f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\RestartManager\Session0000\RegFiles0000 = 5c005c003f005c0043003a005c00550073006500720073005c00410064006d0069006e005c006e00740075007300650072002e006400610074002e004c004f004700310000000000 f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{3A33DB50-CC69-497D-AB93-6EAB524EB9A7}\WpadDecision = "0" f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\5a-2c-ab-76-63-f3\WpadDecisionReason = "1" f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4.exe Key created \REGISTRY\USER\.DEFAULT\Software f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\RestartManager\Session0000\SessionHash = e56d6a555766451b0e228681b889b540984716777e7231fe2ec3e428f06e43b6 f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{3A33DB50-CC69-497D-AB93-6EAB524EB9A7} f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\RestartManager\Session0000 f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\RestartManager\Session0000 f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\RestartManager\Session0000\Sequence = "1" f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000003000000090000000000000000000000000000000400000000000000000000000000000000000000000000000000000001000000020000000a07000d000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{3A33DB50-CC69-497D-AB93-6EAB524EB9A7}\WpadDecisionReason = "1" f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{3A33DB50-CC69-497D-AB93-6EAB524EB9A7}\WpadDecisionTime = 001b68719d68d701 f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\RestartManager\Session0000\SessionHash = 1876a26649a990d3e5c6ddadda5555ed3d2be9a48672457a07214fdc3b7ae923 f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\RestartManager\Session0000\RegFiles0000 = 5c005c003f005c0043003a005c00550073006500720073005c00410064006d0069006e005c004e00540055005300450052002e004400410054007b00300031003600380038003800620064002d0036006300360066002d0031003100640065002d0038006400310064002d003000300031006500300062006300640065003300650063007d002e0054004d0043006f006e007400610069006e0065007200300030003000300030003000300030003000300030003000300030003000300030003000300031002e007200650067007400720061006e0073002d006d00730000000000 f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\RestartManager\Session0000\SessionHash = 3e335168481883df38bb88b11045b0fee8774820ebc26e612be77566db78daef f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\RestartManager\Session0000\SessionHash = 342e82b10b7b9559bca79c8e3c1a2ae676edaaa52bba8f0e959580bdb7a10e68 f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4.exe Set value (str) \REGISTRY\USER\.DEFAULT\Control Panel\Desktop\Wallpaper = "C:\\ProgramData\\53411c86.BMP" f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\SavedLegacySettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4.exe Key deleted \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\RestartManager\Session0000 f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\RestartManager\Session0000\RegFiles0000 = 5c005c003f005c0043003a005c00550073006500720073005c00410064006d0069006e005c004e00540055005300450052002e004400410054007b00300031003600380038003800620064002d0036006300360066002d0031003100640065002d0038006400310064002d003000300031006500300062006300640065003300650063007d002e0054004d002e0062006c00660000000000 f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4.exe -
Modifies registry class 5 IoCs
Processes:
f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\53411c86\DefaultIcon f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\53411c86 f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\53411c86\DefaultIcon\ = "C:\\ProgramData\\53411c86.ico" f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.53411c86 f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.53411c86\ = "53411c86" f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4.exe -
Suspicious behavior: EnumeratesProcesses 26 IoCs
Processes:
f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4.exef3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4.exepid process 2012 f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4.exe 2012 f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4.exe 1484 f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4.exe 1484 f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4.exe 1484 f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4.exe 1484 f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4.exe 1484 f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4.exe 1484 f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4.exe 1484 f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4.exe 1484 f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4.exe 1484 f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4.exe 1484 f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4.exe 1484 f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4.exe 1484 f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4.exe 1484 f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4.exe 1484 f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4.exe 1484 f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4.exe 1484 f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4.exe 1484 f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4.exe 1484 f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4.exe 1484 f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4.exe 1484 f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4.exe 1484 f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4.exe 1484 f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4.exe 1484 f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4.exe 1484 f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
vssvc.exedescription pid process Token: SeBackupPrivilege 1360 vssvc.exe Token: SeRestorePrivilege 1360 vssvc.exe Token: SeAuditPrivilege 1360 vssvc.exe -
Suspicious use of WriteProcessMemory 9 IoCs
Processes:
f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4.exef3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4.exedescription pid process target process PID 1984 wrote to memory of 2012 1984 f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4.exe f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4.exe PID 1984 wrote to memory of 2012 1984 f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4.exe f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4.exe PID 1984 wrote to memory of 2012 1984 f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4.exe f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4.exe PID 1984 wrote to memory of 2012 1984 f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4.exe f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4.exe PID 1984 wrote to memory of 2012 1984 f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4.exe f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4.exe PID 2012 wrote to memory of 1484 2012 f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4.exe f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4.exe PID 2012 wrote to memory of 1484 2012 f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4.exe f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4.exe PID 2012 wrote to memory of 1484 2012 f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4.exe f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4.exe PID 2012 wrote to memory of 1484 2012 f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4.exe f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4.exe"C:\Users\Admin\AppData\Local\Temp\f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4.exe"1⤵PID:684
-
C:\Users\Admin\AppData\Local\Temp\f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4.exe"C:\Users\Admin\AppData\Local\Temp\f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1984 -
C:\Users\Admin\AppData\Local\Temp\f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4.exe"C:\Users\Admin\AppData\Local\Temp\f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4.exe"2⤵
- Drops file in System32 directory
- Sets desktop wallpaper using registry
- Modifies Control Panel
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2012 -
C:\Users\Admin\AppData\Local\Temp\f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4.exeC:\Users\Admin\AppData\Local\Temp\f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4.exe -work worker0 job0-20123⤵
- Modifies extensions of user files
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
PID:1484
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1360