darkside | bac7f1cb70a0fe909590f7b270248705d216b4abaf4e5dd4969fa4f1949badec

General

Target

bac7f1cb70a0fe909590f7b270248705d216b4abaf4e5dd4969fa4f1949badec.sample.exe
Size

56KB
MD5

b68be0dacf09904cd4a0fbe0aab3842e
SHA1

5212151679ce396651887edfe0e7d1f5eda4da29
SHA256

bac7f1cb70a0fe909590f7b270248705d216b4abaf4e5dd4969fa4f1949badec
SHA512

5a6466de3c48b5fb3b1c5b2360e144596cc981ce7ccb2b59034dd0724293bf31ff8297fb5b2033e891dfb64ad0b25627ec4690dfcde0d2b107aca3c54b10ad92

Score

10^/10

darkside ransomware

Malware Config

Extracted

Path

C:\\README.53411c86.TXT

Family

darkside

Ransom Note

----------- [ Welcome to DarkSide ] -------------> What happend? ---------------------------------------------- Your computers and servers are encrypted, backups are deleted. We use strong encryption algorithms, so you cannot decrypt your data. But you can restore everything by purchasing a special program from us - universal decryptor. This program will restore all your network. Follow our instructions below and you will recover all your data. What guarantees? ---------------------------------------------- We value our reputation. If we do not do our work and liabilities, nobody will pay us. This is not in our interests. All our decryption software is perfectly tested and will decrypt your data. We will also provide support in case of problems. We guarantee to decrypt one file for free. Go to the site and contact us. How to get access on website? ---------------------------------------------- Using a TOR browser: 1) Download and install TOR browser from this site: https://torproject.org/ 2) Open our website: http://dark24zz36xm4y2phwe7yvnkkkkhxionhfrwp67awpb3r3bdcneivoqd.onion/0UGH4S3ASFAVY4P2TQZ6VNB0U65Y731LJ5SNZXC1AHEZFFY1JCIJV6PVHV0R0V2C When you open our website, put the following data in the input form: Key: ujoNuLSl1oCjV8rkvAVuQ96Iw9kjGo0rCElelGl4rtQfuXUS8S5CWdzuQevZ2hfaFRE8zNlJiG928SnuWHcfZgjizliwCaCJMJEcdE1Ww55XHABdt3mecg3dCVXJcTCHHsubWNe2trrl3HK5VkYG0sVb1j8p6zChQY3tIc66AXClhRclxbxwBG7jyAqW35ozWYkI9JjpcqxJuF3UB6dicpYf3IwUaqXZL7SjCEx5yItLgwjUvm2r83M5C8sNQJSEXPCP49c5TepQDjo1cOuqZ0f4GHHlkmwW19az6ns7PSpS2o4SScUyuoYB0DkZRylbkazPf10b7aXqM5Z4Le45T0la7QmkIj8or61xPokGgsHyiDbXOgigOkHH4aQecaO1CA6xko4YiaAXJUFfQEn60YMyklHAvBshmCFTMXSa2K0zQ2hvDrUiP9gIqnpXqhpjJAdFo41MGuZSnpPka09tmflNRO7OGBF4Q18s1laCatkc6GLkt35LFErit6Lfj2cHxiEFKY3D6ku28Yikk28sITqXiSTPjiTyEqtP2vOj8ZPJ0GCOXfAq2LC !!! DANGER !!! DO NOT MODIFY or try to RECOVER any files yourself. We WILL NOT be able to RESTORE them. !!! DANGER !!!

URLs

http://dark24zz36xm4y2phwe7yvnkkkkhxionhfrwp67awpb3r3bdcneivoqd.onion/0UGH4S3ASFAVY4P2TQZ6VNB0U65Y731LJ5SNZXC1AHEZFFY1JCIJV6PVHV0R0V2C

Signatures

DarkSide
Targeted ransomware first seen in August 2020. Operators steal data to use as leverage.
ransomware darkside

Modifies extensions of user files 19 IoCs

Ransomware generally changes the extension on encrypted files.

ransomware

Processes:

bac7f1cb70a0fe909590f7b270248705d216b4abaf4e5dd4969fa4f1949badec.sample.exe

description	ioc	process
File opened for modification	C:\Users\Admin\Pictures\ResolveSave.tiff.53411c86	bac7f1cb70a0fe909590f7b270248705d216b4abaf4e5dd4969fa4f1949badec.sample.exe
File renamed	C:\Users\Admin\Pictures\SearchSet.raw => C:\Users\Admin\Pictures\SearchSet.raw.53411c86	bac7f1cb70a0fe909590f7b270248705d216b4abaf4e5dd4969fa4f1949badec.sample.exe
File opened for modification	C:\Users\Admin\Pictures\SearchSet.raw.53411c86	bac7f1cb70a0fe909590f7b270248705d216b4abaf4e5dd4969fa4f1949badec.sample.exe
File opened for modification	C:\Users\Admin\Pictures\SendJoin.tiff	bac7f1cb70a0fe909590f7b270248705d216b4abaf4e5dd4969fa4f1949badec.sample.exe
File opened for modification	C:\Users\Admin\Pictures\SendJoin.tiff.53411c86	bac7f1cb70a0fe909590f7b270248705d216b4abaf4e5dd4969fa4f1949badec.sample.exe
File opened for modification	C:\Users\Admin\Pictures\ResolveSave.tiff	bac7f1cb70a0fe909590f7b270248705d216b4abaf4e5dd4969fa4f1949badec.sample.exe
File opened for modification	C:\Users\Admin\Pictures\UseNew.tiff	bac7f1cb70a0fe909590f7b270248705d216b4abaf4e5dd4969fa4f1949badec.sample.exe
File opened for modification	C:\Users\Admin\Pictures\UseNew.tiff.53411c86	bac7f1cb70a0fe909590f7b270248705d216b4abaf4e5dd4969fa4f1949badec.sample.exe
File opened for modification	C:\Users\Admin\Pictures\ExitTest.tif.53411c86	bac7f1cb70a0fe909590f7b270248705d216b4abaf4e5dd4969fa4f1949badec.sample.exe
File opened for modification	C:\Users\Admin\Pictures\RevokeSave.raw.53411c86	bac7f1cb70a0fe909590f7b270248705d216b4abaf4e5dd4969fa4f1949badec.sample.exe
File renamed	C:\Users\Admin\Pictures\UseNew.tiff => C:\Users\Admin\Pictures\UseNew.tiff.53411c86	bac7f1cb70a0fe909590f7b270248705d216b4abaf4e5dd4969fa4f1949badec.sample.exe
File renamed	C:\Users\Admin\Pictures\GetWrite.png => C:\Users\Admin\Pictures\GetWrite.png.53411c86	bac7f1cb70a0fe909590f7b270248705d216b4abaf4e5dd4969fa4f1949badec.sample.exe
File opened for modification	C:\Users\Admin\Pictures\CompleteDeny.tif.53411c86	bac7f1cb70a0fe909590f7b270248705d216b4abaf4e5dd4969fa4f1949badec.sample.exe
File renamed	C:\Users\Admin\Pictures\ExitTest.tif => C:\Users\Admin\Pictures\ExitTest.tif.53411c86	bac7f1cb70a0fe909590f7b270248705d216b4abaf4e5dd4969fa4f1949badec.sample.exe
File opened for modification	C:\Users\Admin\Pictures\GetWrite.png.53411c86	bac7f1cb70a0fe909590f7b270248705d216b4abaf4e5dd4969fa4f1949badec.sample.exe
File renamed	C:\Users\Admin\Pictures\ResolveSave.tiff => C:\Users\Admin\Pictures\ResolveSave.tiff.53411c86	bac7f1cb70a0fe909590f7b270248705d216b4abaf4e5dd4969fa4f1949badec.sample.exe
File renamed	C:\Users\Admin\Pictures\RevokeSave.raw => C:\Users\Admin\Pictures\RevokeSave.raw.53411c86	bac7f1cb70a0fe909590f7b270248705d216b4abaf4e5dd4969fa4f1949badec.sample.exe
File renamed	C:\Users\Admin\Pictures\SendJoin.tiff => C:\Users\Admin\Pictures\SendJoin.tiff.53411c86	bac7f1cb70a0fe909590f7b270248705d216b4abaf4e5dd4969fa4f1949badec.sample.exe
File renamed	C:\Users\Admin\Pictures\CompleteDeny.tif => C:\Users\Admin\Pictures\CompleteDeny.tif.53411c86	bac7f1cb70a0fe909590f7b270248705d216b4abaf4e5dd4969fa4f1949badec.sample.exe

Drops file in System32 directory 1 IoCs

Processes:

bac7f1cb70a0fe909590f7b270248705d216b4abaf4e5dd4969fa4f1949badec.sample.exe

description	ioc	process
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\counters.dat	bac7f1cb70a0fe909590f7b270248705d216b4abaf4e5dd4969fa4f1949badec.sample.exe

Sets desktop wallpaper using registry 2 TTPs 1 IoCs

ransomware

Defacement

T1491

Modify Registry

T1112

Processes:

bac7f1cb70a0fe909590f7b270248705d216b4abaf4e5dd4969fa4f1949badec.sample.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Control Panel\Desktop\WallPaper = "C:\\ProgramData\\53411c86.BMP"	bac7f1cb70a0fe909590f7b270248705d216b4abaf4e5dd4969fa4f1949badec.sample.exe

Modifies Control Panel 2 IoCs

evasion

Processes:

bac7f1cb70a0fe909590f7b270248705d216b4abaf4e5dd4969fa4f1949badec.sample.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Control Panel\Desktop\WallpaperStyle = "10"	bac7f1cb70a0fe909590f7b270248705d216b4abaf4e5dd4969fa4f1949badec.sample.exe
Key created	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Control Panel\Desktop	bac7f1cb70a0fe909590f7b270248705d216b4abaf4e5dd4969fa4f1949badec.sample.exe

Modifies data under HKEY_USERS 46 IoCs

Processes:

bac7f1cb70a0fe909590f7b270248705d216b4abaf4e5dd4969fa4f1949badec.sample.exebac7f1cb70a0fe909590f7b270248705d216b4abaf4e5dd4969fa4f1949badec.sample.exe

description	ioc	process
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{3A33DB50-CC69-497D-AB93-6EAB524EB9A7}\WpadDecisionTime = f02b4cfd2c82d701	bac7f1cb70a0fe909590f7b270248705d216b4abaf4e5dd4969fa4f1949badec.sample.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\fe-bd-9c-c7-67-42\WpadDecisionTime = f02b4cfd2c82d701	bac7f1cb70a0fe909590f7b270248705d216b4abaf4e5dd4969fa4f1949badec.sample.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\RestartManager\Session0000	bac7f1cb70a0fe909590f7b270248705d216b4abaf4e5dd4969fa4f1949badec.sample.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\RestartManager\Session0000\SessionHash = 30b7997a1db42859db2cd8496fdb304ae79d7736a8bc89009e729206618a81d2	bac7f1cb70a0fe909590f7b270248705d216b4abaf4e5dd4969fa4f1949badec.sample.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\RestartManager\Session0000\RegFilesHash = 9fe74cc18acf617ff616cf8672cb054349a08e8b78d64321b88c7228278a7756	bac7f1cb70a0fe909590f7b270248705d216b4abaf4e5dd4969fa4f1949badec.sample.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	bac7f1cb70a0fe909590f7b270248705d216b4abaf4e5dd4969fa4f1949badec.sample.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{3A33DB50-CC69-497D-AB93-6EAB524EB9A7}\WpadDecision = "0"	bac7f1cb70a0fe909590f7b270248705d216b4abaf4e5dd4969fa4f1949badec.sample.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\RestartManager\Session0000\RegFilesHash = 2b72ad195476ffd8c65f58cb00297ff09dc139a051452e163cecaa3afdfad7a3	bac7f1cb70a0fe909590f7b270248705d216b4abaf4e5dd4969fa4f1949badec.sample.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\RestartManager\Session0000\RegFilesHash = 89392fc5ed46eaad3f53bc2f881814822cc9d90bb7227ab34f7ef1bbb109d478	bac7f1cb70a0fe909590f7b270248705d216b4abaf4e5dd4969fa4f1949badec.sample.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\RestartManager\Session0000	bac7f1cb70a0fe909590f7b270248705d216b4abaf4e5dd4969fa4f1949badec.sample.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\RestartManager\Session0000	bac7f1cb70a0fe909590f7b270248705d216b4abaf4e5dd4969fa4f1949badec.sample.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\RestartManager\Session0000\Owner = 50020000b0439fff2c82d701	bac7f1cb70a0fe909590f7b270248705d216b4abaf4e5dd4969fa4f1949badec.sample.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections	bac7f1cb70a0fe909590f7b270248705d216b4abaf4e5dd4969fa4f1949badec.sample.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	bac7f1cb70a0fe909590f7b270248705d216b4abaf4e5dd4969fa4f1949badec.sample.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings	bac7f1cb70a0fe909590f7b270248705d216b4abaf4e5dd4969fa4f1949badec.sample.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyEnable = "0"	bac7f1cb70a0fe909590f7b270248705d216b4abaf4e5dd4969fa4f1949badec.sample.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\fe-bd-9c-c7-67-42\WpadDecision = "0"	bac7f1cb70a0fe909590f7b270248705d216b4abaf4e5dd4969fa4f1949badec.sample.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\RestartManager\Session0000\Sequence = "1"	bac7f1cb70a0fe909590f7b270248705d216b4abaf4e5dd4969fa4f1949badec.sample.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\RestartManager\Session0000\SessionHash = 1551a641e608448b3218878505abbdc83b2e9347dc08c1852a4b0295496ba2d0	bac7f1cb70a0fe909590f7b270248705d216b4abaf4e5dd4969fa4f1949badec.sample.exe
Key created	\REGISTRY\USER\.DEFAULT\Control Panel\International	bac7f1cb70a0fe909590f7b270248705d216b4abaf4e5dd4969fa4f1949badec.sample.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings	bac7f1cb70a0fe909590f7b270248705d216b4abaf4e5dd4969fa4f1949badec.sample.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\SavedLegacySettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	bac7f1cb70a0fe909590f7b270248705d216b4abaf4e5dd4969fa4f1949badec.sample.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\fe-bd-9c-c7-67-42	bac7f1cb70a0fe909590f7b270248705d216b4abaf4e5dd4969fa4f1949badec.sample.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	bac7f1cb70a0fe909590f7b270248705d216b4abaf4e5dd4969fa4f1949badec.sample.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\RestartManager	bac7f1cb70a0fe909590f7b270248705d216b4abaf4e5dd4969fa4f1949badec.sample.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\RestartManager\Session0000\RegFilesHash = 73188d2773b54ba628f9aa953b72ab25a21a0032e4030fb4de09bbcedf32507f	bac7f1cb70a0fe909590f7b270248705d216b4abaf4e5dd4969fa4f1949badec.sample.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad	bac7f1cb70a0fe909590f7b270248705d216b4abaf4e5dd4969fa4f1949badec.sample.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{3A33DB50-CC69-497D-AB93-6EAB524EB9A7}\fe-bd-9c-c7-67-42	bac7f1cb70a0fe909590f7b270248705d216b4abaf4e5dd4969fa4f1949badec.sample.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\fe-bd-9c-c7-67-42\WpadDecisionReason = "1"	bac7f1cb70a0fe909590f7b270248705d216b4abaf4e5dd4969fa4f1949badec.sample.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	bac7f1cb70a0fe909590f7b270248705d216b4abaf4e5dd4969fa4f1949badec.sample.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft	bac7f1cb70a0fe909590f7b270248705d216b4abaf4e5dd4969fa4f1949badec.sample.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Control Panel\Desktop\Wallpaper = "C:\\ProgramData\\53411c86.BMP"	bac7f1cb70a0fe909590f7b270248705d216b4abaf4e5dd4969fa4f1949badec.sample.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\RestartManager\Session0000\RegFiles0000 = 5c005c003f005c0043003a005c00550073006500720073005c00410064006d0069006e005c004e00540055005300450052002e004400410054007b00300031003600380038003800620064002d0036006300360066002d0031003100640065002d0038006400310064002d003000300031006500300062006300640065003300650063007d002e0054004d0043006f006e007400610069006e0065007200300030003000300030003000300030003000300030003000300030003000300030003000300032002e007200650067007400720061006e0073002d006d00730000000000	bac7f1cb70a0fe909590f7b270248705d216b4abaf4e5dd4969fa4f1949badec.sample.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{3A33DB50-CC69-497D-AB93-6EAB524EB9A7}	bac7f1cb70a0fe909590f7b270248705d216b4abaf4e5dd4969fa4f1949badec.sample.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{3A33DB50-CC69-497D-AB93-6EAB524EB9A7}\WpadDecisionReason = "1"	bac7f1cb70a0fe909590f7b270248705d216b4abaf4e5dd4969fa4f1949badec.sample.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "1"	bac7f1cb70a0fe909590f7b270248705d216b4abaf4e5dd4969fa4f1949badec.sample.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\RestartManager\Session0000\RegFiles0000 = 5c005c003f005c0043003a005c00550073006500720073005c00410064006d0069006e005c004e00540055005300450052002e004400410054007b00300031003600380038003800620064002d0036006300360066002d0031003100640065002d0038006400310064002d003000300031006500300062006300640065003300650063007d002e0054004d002e0062006c00660000000000	bac7f1cb70a0fe909590f7b270248705d216b4abaf4e5dd4969fa4f1949badec.sample.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\RestartManager\Session0000\RegFiles0000 = 5c005c003f005c0043003a005c00550073006500720073005c00410064006d0069006e005c004e00540055005300450052002e004400410054007b00300031003600380038003800620064002d0036006300360066002d0031003100640065002d0038006400310064002d003000300031006500300062006300640065003300650063007d002e0054004d0043006f006e007400610069006e0065007200300030003000300030003000300030003000300030003000300030003000300030003000300031002e007200650067007400720061006e0073002d006d00730000000000	bac7f1cb70a0fe909590f7b270248705d216b4abaf4e5dd4969fa4f1949badec.sample.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\RestartManager\Session0000\SessionHash = 1e23d4a5a8a010d78ebedd29e9662bdf2d16009580b08cd89da4e933826edc4f	bac7f1cb70a0fe909590f7b270248705d216b4abaf4e5dd4969fa4f1949badec.sample.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\RestartManager\Session0000\RegFiles0000 = 5c005c003f005c0043003a005c00550073006500720073005c00410064006d0069006e005c006e00740075007300650072002e006400610074002e004c004f004700310000000000	bac7f1cb70a0fe909590f7b270248705d216b4abaf4e5dd4969fa4f1949badec.sample.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\RestartManager\Session0000\SessionHash = 75c7d6439c499a06133865994d7b5c6ce8c58e9cf2240126f3ebc9a06a98ba68	bac7f1cb70a0fe909590f7b270248705d216b4abaf4e5dd4969fa4f1949badec.sample.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	bac7f1cb70a0fe909590f7b270248705d216b4abaf4e5dd4969fa4f1949badec.sample.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	bac7f1cb70a0fe909590f7b270248705d216b4abaf4e5dd4969fa4f1949badec.sample.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000003000000090000000000000000000000000000000400000000000000000000000000000000000000000000000000000001000000020000000a070025000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	bac7f1cb70a0fe909590f7b270248705d216b4abaf4e5dd4969fa4f1949badec.sample.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{3A33DB50-CC69-497D-AB93-6EAB524EB9A7}\WpadNetworkName = "Network"	bac7f1cb70a0fe909590f7b270248705d216b4abaf4e5dd4969fa4f1949badec.sample.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "0"	bac7f1cb70a0fe909590f7b270248705d216b4abaf4e5dd4969fa4f1949badec.sample.exe

Modifies registry class 5 IoCs

Processes:

bac7f1cb70a0fe909590f7b270248705d216b4abaf4e5dd4969fa4f1949badec.sample.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.53411c86	bac7f1cb70a0fe909590f7b270248705d216b4abaf4e5dd4969fa4f1949badec.sample.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.53411c86\ = "53411c86"	bac7f1cb70a0fe909590f7b270248705d216b4abaf4e5dd4969fa4f1949badec.sample.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\53411c86\DefaultIcon	bac7f1cb70a0fe909590f7b270248705d216b4abaf4e5dd4969fa4f1949badec.sample.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\53411c86	bac7f1cb70a0fe909590f7b270248705d216b4abaf4e5dd4969fa4f1949badec.sample.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\53411c86\DefaultIcon\ = "C:\\ProgramData\\53411c86.ico"	bac7f1cb70a0fe909590f7b270248705d216b4abaf4e5dd4969fa4f1949badec.sample.exe

Suspicious behavior: EnumeratesProcesses 26 IoCs

Processes:

bac7f1cb70a0fe909590f7b270248705d216b4abaf4e5dd4969fa4f1949badec.sample.exebac7f1cb70a0fe909590f7b270248705d216b4abaf4e5dd4969fa4f1949badec.sample.exe

pid	process
840	bac7f1cb70a0fe909590f7b270248705d216b4abaf4e5dd4969fa4f1949badec.sample.exe
840	bac7f1cb70a0fe909590f7b270248705d216b4abaf4e5dd4969fa4f1949badec.sample.exe
592	bac7f1cb70a0fe909590f7b270248705d216b4abaf4e5dd4969fa4f1949badec.sample.exe
592	bac7f1cb70a0fe909590f7b270248705d216b4abaf4e5dd4969fa4f1949badec.sample.exe
592	bac7f1cb70a0fe909590f7b270248705d216b4abaf4e5dd4969fa4f1949badec.sample.exe
592	bac7f1cb70a0fe909590f7b270248705d216b4abaf4e5dd4969fa4f1949badec.sample.exe
592	bac7f1cb70a0fe909590f7b270248705d216b4abaf4e5dd4969fa4f1949badec.sample.exe
592	bac7f1cb70a0fe909590f7b270248705d216b4abaf4e5dd4969fa4f1949badec.sample.exe
592	bac7f1cb70a0fe909590f7b270248705d216b4abaf4e5dd4969fa4f1949badec.sample.exe
592	bac7f1cb70a0fe909590f7b270248705d216b4abaf4e5dd4969fa4f1949badec.sample.exe
592	bac7f1cb70a0fe909590f7b270248705d216b4abaf4e5dd4969fa4f1949badec.sample.exe
592	bac7f1cb70a0fe909590f7b270248705d216b4abaf4e5dd4969fa4f1949badec.sample.exe
592	bac7f1cb70a0fe909590f7b270248705d216b4abaf4e5dd4969fa4f1949badec.sample.exe
592	bac7f1cb70a0fe909590f7b270248705d216b4abaf4e5dd4969fa4f1949badec.sample.exe
592	bac7f1cb70a0fe909590f7b270248705d216b4abaf4e5dd4969fa4f1949badec.sample.exe
592	bac7f1cb70a0fe909590f7b270248705d216b4abaf4e5dd4969fa4f1949badec.sample.exe
592	bac7f1cb70a0fe909590f7b270248705d216b4abaf4e5dd4969fa4f1949badec.sample.exe
592	bac7f1cb70a0fe909590f7b270248705d216b4abaf4e5dd4969fa4f1949badec.sample.exe
592	bac7f1cb70a0fe909590f7b270248705d216b4abaf4e5dd4969fa4f1949badec.sample.exe
592	bac7f1cb70a0fe909590f7b270248705d216b4abaf4e5dd4969fa4f1949badec.sample.exe
592	bac7f1cb70a0fe909590f7b270248705d216b4abaf4e5dd4969fa4f1949badec.sample.exe
592	bac7f1cb70a0fe909590f7b270248705d216b4abaf4e5dd4969fa4f1949badec.sample.exe
592	bac7f1cb70a0fe909590f7b270248705d216b4abaf4e5dd4969fa4f1949badec.sample.exe
592	bac7f1cb70a0fe909590f7b270248705d216b4abaf4e5dd4969fa4f1949badec.sample.exe
592	bac7f1cb70a0fe909590f7b270248705d216b4abaf4e5dd4969fa4f1949badec.sample.exe
592	bac7f1cb70a0fe909590f7b270248705d216b4abaf4e5dd4969fa4f1949badec.sample.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

vssvc.exe

description pid process

Token: SeBackupPrivilege 996 vssvc.exe
Token: SeRestorePrivilege 996 vssvc.exe
Token: SeAuditPrivilege 996 vssvc.exe

description	pid	process
Token: SeBackupPrivilege	996	vssvc.exe
Token: SeRestorePrivilege	996	vssvc.exe
Token: SeAuditPrivilege	996	vssvc.exe

Suspicious use of WriteProcessMemory 9 IoCs

Processes:

bac7f1cb70a0fe909590f7b270248705d216b4abaf4e5dd4969fa4f1949badec.sample.exebac7f1cb70a0fe909590f7b270248705d216b4abaf4e5dd4969fa4f1949badec.sample.exe

description	pid	process	target process
PID 1264 wrote to memory of 840	1264	bac7f1cb70a0fe909590f7b270248705d216b4abaf4e5dd4969fa4f1949badec.sample.exe	bac7f1cb70a0fe909590f7b270248705d216b4abaf4e5dd4969fa4f1949badec.sample.exe
PID 1264 wrote to memory of 840	1264	bac7f1cb70a0fe909590f7b270248705d216b4abaf4e5dd4969fa4f1949badec.sample.exe	bac7f1cb70a0fe909590f7b270248705d216b4abaf4e5dd4969fa4f1949badec.sample.exe
PID 1264 wrote to memory of 840	1264	bac7f1cb70a0fe909590f7b270248705d216b4abaf4e5dd4969fa4f1949badec.sample.exe	bac7f1cb70a0fe909590f7b270248705d216b4abaf4e5dd4969fa4f1949badec.sample.exe
PID 1264 wrote to memory of 840	1264	bac7f1cb70a0fe909590f7b270248705d216b4abaf4e5dd4969fa4f1949badec.sample.exe	bac7f1cb70a0fe909590f7b270248705d216b4abaf4e5dd4969fa4f1949badec.sample.exe
PID 1264 wrote to memory of 840	1264	bac7f1cb70a0fe909590f7b270248705d216b4abaf4e5dd4969fa4f1949badec.sample.exe	bac7f1cb70a0fe909590f7b270248705d216b4abaf4e5dd4969fa4f1949badec.sample.exe
PID 840 wrote to memory of 592	840	bac7f1cb70a0fe909590f7b270248705d216b4abaf4e5dd4969fa4f1949badec.sample.exe	bac7f1cb70a0fe909590f7b270248705d216b4abaf4e5dd4969fa4f1949badec.sample.exe
PID 840 wrote to memory of 592	840	bac7f1cb70a0fe909590f7b270248705d216b4abaf4e5dd4969fa4f1949badec.sample.exe	bac7f1cb70a0fe909590f7b270248705d216b4abaf4e5dd4969fa4f1949badec.sample.exe
PID 840 wrote to memory of 592	840	bac7f1cb70a0fe909590f7b270248705d216b4abaf4e5dd4969fa4f1949badec.sample.exe	bac7f1cb70a0fe909590f7b270248705d216b4abaf4e5dd4969fa4f1949badec.sample.exe
PID 840 wrote to memory of 592	840	bac7f1cb70a0fe909590f7b270248705d216b4abaf4e5dd4969fa4f1949badec.sample.exe	bac7f1cb70a0fe909590f7b270248705d216b4abaf4e5dd4969fa4f1949badec.sample.exe

C:\Users\Admin\AppData\Local\Temp\bac7f1cb70a0fe909590f7b270248705d216b4abaf4e5dd4969fa4f1949badec.sample.exe
"C:\Users\Admin\AppData\Local\Temp\bac7f1cb70a0fe909590f7b270248705d216b4abaf4e5dd4969fa4f1949badec.sample.exe"
1⤵
PID:1920

C:\Users\Admin\AppData\Local\Temp\bac7f1cb70a0fe909590f7b270248705d216b4abaf4e5dd4969fa4f1949badec.sample.exe
"C:\Users\Admin\AppData\Local\Temp\bac7f1cb70a0fe909590f7b270248705d216b4abaf4e5dd4969fa4f1949badec.sample.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1264

C:\Users\Admin\AppData\Local\Temp\bac7f1cb70a0fe909590f7b270248705d216b4abaf4e5dd4969fa4f1949badec.sample.exe
"C:\Users\Admin\AppData\Local\Temp\bac7f1cb70a0fe909590f7b270248705d216b4abaf4e5dd4969fa4f1949badec.sample.exe"
2⤵
- Drops file in System32 directory
- Sets desktop wallpaper using registry
- Modifies Control Panel
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:840

C:\Users\Admin\AppData\Local\Temp\bac7f1cb70a0fe909590f7b270248705d216b4abaf4e5dd4969fa4f1949badec.sample.exe
C:\Users\Admin\AppData\Local\Temp\bac7f1cb70a0fe909590f7b270248705d216b4abaf4e5dd4969fa4f1949badec.sample.exe -work worker0 job0-840
3⤵
- Modifies extensions of user files
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
PID:592

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:996

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Defacement

1

T1491

Replay Monitor

Loading Replay Monitor...

Downloads

memory/592-64-0x0000000000000000-mapping.dmp

Download
memory/840-62-0x0000000000000000-mapping.dmp

Download
memory/1920-60-0x0000000076691000-0x0000000076693000-memory.dmp

Filesize
8KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads