darkside | bac7f1cb70a0fe909590f7b270248705d216b4abaf4e5dd4969fa4f1949badec

General

Target

bac7f1cb70a0fe909590f7b270248705d216b4abaf4e5dd4969fa4f1949badec.sample.exe
Size

56KB
MD5

b68be0dacf09904cd4a0fbe0aab3842e
SHA1

5212151679ce396651887edfe0e7d1f5eda4da29
SHA256

bac7f1cb70a0fe909590f7b270248705d216b4abaf4e5dd4969fa4f1949badec
SHA512

5a6466de3c48b5fb3b1c5b2360e144596cc981ce7ccb2b59034dd0724293bf31ff8297fb5b2033e891dfb64ad0b25627ec4690dfcde0d2b107aca3c54b10ad92

Score

10^/10

darkside ransomware

Malware Config

Extracted

Path

C:\\README.70d4d153.TXT

Family

darkside

Ransom Note

----------- [ Welcome to DarkSide ] -------------> What happend? ---------------------------------------------- Your computers and servers are encrypted, backups are deleted. We use strong encryption algorithms, so you cannot decrypt your data. But you can restore everything by purchasing a special program from us - universal decryptor. This program will restore all your network. Follow our instructions below and you will recover all your data. What guarantees? ---------------------------------------------- We value our reputation. If we do not do our work and liabilities, nobody will pay us. This is not in our interests. All our decryption software is perfectly tested and will decrypt your data. We will also provide support in case of problems. We guarantee to decrypt one file for free. Go to the site and contact us. How to get access on website? ---------------------------------------------- Using a TOR browser: 1) Download and install TOR browser from this site: https://torproject.org/ 2) Open our website: http://dark24zz36xm4y2phwe7yvnkkkkhxionhfrwp67awpb3r3bdcneivoqd.onion/0UGH4S3ASFAVY4P2TQZ6VNB0U65Y731LJ5SNZXC1AHEZFFY1JCIJV6PVHV0R0V2C When you open our website, put the following data in the input form: Key: ujoNuLSl1oCjV8rkvAVuQ96Iw9kjGo0rCElelGl4rtQfuXUS8S5CWdzuQevZ2hfaFRE8zNlJiG928SnuWHcfZgjizliwCaCJMJEcdE1Ww55XHABdt3mecg3dCVXJcTCHHsubWNe2trrl3HK5VkYG0sVb1j8p6zChQY3tIc66AXClhRclxbxwBG7jyAqW35ozWYkI9JjpcqxJuF3UB6dicpYf3IwUaqXZL7SjCEx5yItLgwjUvm2r83M5C8sNQJSEXPCP49c5TepQDjo1cOuqZ0f4GHHlkmwW19az6ns7PSpS2o4SScUyuoYB0DkZRylbkazPf10b7aXqM5Z4Le45T0la7QmkIj8or61xPokGgsHyiDbXOgigOkHH4aQecaO1CA6xko4YiaAXJUFfQEn60YMyklHAvBshmCFTMXSa2K0zQ2hvDrUiP9gIqnpXqhpjJAdFo41MGuZSnpPka09tmflNRO7OGBF4Q18s1laCatkc6GLkt35LFErit6Lfj2cHxiEFKY3D6ku28Yikk28sITqXiSTPjiTyEqtP2vOj8ZPJ0GCOXfAq2LC !!! DANGER !!! DO NOT MODIFY or try to RECOVER any files yourself. We WILL NOT be able to RESTORE them. !!! DANGER !!!

URLs

http://dark24zz36xm4y2phwe7yvnkkkkhxionhfrwp67awpb3r3bdcneivoqd.onion/0UGH4S3ASFAVY4P2TQZ6VNB0U65Y731LJ5SNZXC1AHEZFFY1JCIJV6PVHV0R0V2C

Signatures

DarkSide
Targeted ransomware first seen in August 2020. Operators steal data to use as leverage.
ransomware darkside

Modifies extensions of user files 2 IoCs

Ransomware generally changes the extension on encrypted files.

ransomware

Processes:

bac7f1cb70a0fe909590f7b270248705d216b4abaf4e5dd4969fa4f1949badec.sample.exe

description	ioc	process
File renamed	C:\Users\Admin\Pictures\SendRemove.crw => C:\Users\Admin\Pictures\SendRemove.crw.70d4d153	bac7f1cb70a0fe909590f7b270248705d216b4abaf4e5dd4969fa4f1949badec.sample.exe
File opened for modification	C:\Users\Admin\Pictures\SendRemove.crw.70d4d153	bac7f1cb70a0fe909590f7b270248705d216b4abaf4e5dd4969fa4f1949badec.sample.exe

Enumerates connected drives 3 TTPs 2 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

bac7f1cb70a0fe909590f7b270248705d216b4abaf4e5dd4969fa4f1949badec.sample.exebac7f1cb70a0fe909590f7b270248705d216b4abaf4e5dd4969fa4f1949badec.sample.exe

description	ioc	process
File opened (read-only)	\??\Z:	bac7f1cb70a0fe909590f7b270248705d216b4abaf4e5dd4969fa4f1949badec.sample.exe
File opened (read-only)	\??\Z:	bac7f1cb70a0fe909590f7b270248705d216b4abaf4e5dd4969fa4f1949badec.sample.exe

Drops file in System32 directory 5 IoCs

Processes:

bac7f1cb70a0fe909590f7b270248705d216b4abaf4e5dd4969fa4f1949badec.sample.exe

description	ioc	process
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5	bac7f1cb70a0fe909590f7b270248705d216b4abaf4e5dd4969fa4f1949badec.sample.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\counters2.dat	bac7f1cb70a0fe909590f7b270248705d216b4abaf4e5dd4969fa4f1949badec.sample.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\Content.IE5	bac7f1cb70a0fe909590f7b270248705d216b4abaf4e5dd4969fa4f1949badec.sample.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE	bac7f1cb70a0fe909590f7b270248705d216b4abaf4e5dd4969fa4f1949badec.sample.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCookies	bac7f1cb70a0fe909590f7b270248705d216b4abaf4e5dd4969fa4f1949badec.sample.exe

Sets desktop wallpaper using registry 2 TTPs 1 IoCs

ransomware

Defacement

T1491

Modify Registry

T1112

Processes:

bac7f1cb70a0fe909590f7b270248705d216b4abaf4e5dd4969fa4f1949badec.sample.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Control Panel\Desktop\WallPaper = "C:\\ProgramData\\70d4d153.BMP"	bac7f1cb70a0fe909590f7b270248705d216b4abaf4e5dd4969fa4f1949badec.sample.exe

Modifies Control Panel 2 IoCs

evasion

Processes:

bac7f1cb70a0fe909590f7b270248705d216b4abaf4e5dd4969fa4f1949badec.sample.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Control Panel\Desktop	bac7f1cb70a0fe909590f7b270248705d216b4abaf4e5dd4969fa4f1949badec.sample.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Control Panel\Desktop\WallpaperStyle = "10"	bac7f1cb70a0fe909590f7b270248705d216b4abaf4e5dd4969fa4f1949badec.sample.exe

Modifies data under HKEY_USERS 29 IoCs

Processes:

bac7f1cb70a0fe909590f7b270248705d216b4abaf4e5dd4969fa4f1949badec.sample.exebac7f1cb70a0fe909590f7b270248705d216b4abaf4e5dd4969fa4f1949badec.sample.exe

description	ioc	process
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\RestartManager\Session0000\Owner = f80f00006c24c7fd2c82d701	bac7f1cb70a0fe909590f7b270248705d216b4abaf4e5dd4969fa4f1949badec.sample.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\RestartManager\Session0000\RegFiles0000 = 5c005c003f005c0043003a005c00550073006500720073005c00410064006d0069006e005c004e00540055005300450052002e004400410054007b00340065003000370034003600360038002d0030006300310063002d0031003100650037002d0061003900340033002d006500340031006400320064003700310038006100320030007d002e0054004d0043006f006e007400610069006e0065007200300030003000300030003000300030003000300030003000300030003000300030003000300031002e007200650067007400720061006e0073002d006d00730000000000	bac7f1cb70a0fe909590f7b270248705d216b4abaf4e5dd4969fa4f1949badec.sample.exe
Key created	\REGISTRY\USER\.DEFAULT\Control Panel\International	bac7f1cb70a0fe909590f7b270248705d216b4abaf4e5dd4969fa4f1949badec.sample.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	bac7f1cb70a0fe909590f7b270248705d216b4abaf4e5dd4969fa4f1949badec.sample.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	bac7f1cb70a0fe909590f7b270248705d216b4abaf4e5dd4969fa4f1949badec.sample.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	bac7f1cb70a0fe909590f7b270248705d216b4abaf4e5dd4969fa4f1949badec.sample.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	bac7f1cb70a0fe909590f7b270248705d216b4abaf4e5dd4969fa4f1949badec.sample.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\RestartManager\Session0000	bac7f1cb70a0fe909590f7b270248705d216b4abaf4e5dd4969fa4f1949badec.sample.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	bac7f1cb70a0fe909590f7b270248705d216b4abaf4e5dd4969fa4f1949badec.sample.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Control Panel\Desktop\Wallpaper = "C:\\ProgramData\\70d4d153.BMP"	bac7f1cb70a0fe909590f7b270248705d216b4abaf4e5dd4969fa4f1949badec.sample.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	bac7f1cb70a0fe909590f7b270248705d216b4abaf4e5dd4969fa4f1949badec.sample.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	bac7f1cb70a0fe909590f7b270248705d216b4abaf4e5dd4969fa4f1949badec.sample.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	bac7f1cb70a0fe909590f7b270248705d216b4abaf4e5dd4969fa4f1949badec.sample.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\RestartManager\Session0000\Sequence = "1"	bac7f1cb70a0fe909590f7b270248705d216b4abaf4e5dd4969fa4f1949badec.sample.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\RestartManager\Session0000\RegFiles0000 = 5c005c003f005c0043003a005c00550073006500720073005c00410064006d0069006e005c004e00540055005300450052002e004400410054007b00340065003000370034003600360038002d0030006300310063002d0031003100650037002d0061003900340033002d006500340031006400320064003700310038006100320030007d002e0054004d002e0062006c00660000000000	bac7f1cb70a0fe909590f7b270248705d216b4abaf4e5dd4969fa4f1949badec.sample.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\RestartManager\Session0000\RegFilesHash = 8fd9d18b40b36a81d4418304c70b0fa4401b80af5ff34b751829118199859462	bac7f1cb70a0fe909590f7b270248705d216b4abaf4e5dd4969fa4f1949badec.sample.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\RestartManager\Session0000\RegFilesHash = 8357a1c89673dc1a4fbe18e14fc52f1404e32fad6e9b4134f85d0c7353bc6782	bac7f1cb70a0fe909590f7b270248705d216b4abaf4e5dd4969fa4f1949badec.sample.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\RestartManager\Session0000\RegFiles0000 = 5c005c003f005c0043003a005c00550073006500720073005c00410064006d0069006e005c006e00740075007300650072002e006400610074002e004c004f004700310000000000	bac7f1cb70a0fe909590f7b270248705d216b4abaf4e5dd4969fa4f1949badec.sample.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Microsoft\RestartManager\Session0000	bac7f1cb70a0fe909590f7b270248705d216b4abaf4e5dd4969fa4f1949badec.sample.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\RestartManager\Session0000\RegFilesHash = 230e875cd328e0ae55e4711e3442de70383d0ac816cedddba0e46e9fd8baa6da	bac7f1cb70a0fe909590f7b270248705d216b4abaf4e5dd4969fa4f1949badec.sample.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\RestartManager\Session0000\SessionHash = dfc99d826a84b37cd837f3be4c7367aca087dc91f1bfe5772eaf1649f2a1b903	bac7f1cb70a0fe909590f7b270248705d216b4abaf4e5dd4969fa4f1949badec.sample.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\RestartManager\Session0000\SessionHash = d8e990993a01b281bdd9f7d6442bf3c1ad6defc51384919cb184d41ad9d0fe21	bac7f1cb70a0fe909590f7b270248705d216b4abaf4e5dd4969fa4f1949badec.sample.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\RestartManager\Session0000\SessionHash = 5076586bf531205a07b8c3d9152cad5caa762cad2b324ea353cdd28462b3f772	bac7f1cb70a0fe909590f7b270248705d216b4abaf4e5dd4969fa4f1949badec.sample.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\RestartManager\Session0000\SessionHash = 9e4e96175bed7212c190622d043bf401d594ac76346a500cbc82668ef68d9453	bac7f1cb70a0fe909590f7b270248705d216b4abaf4e5dd4969fa4f1949badec.sample.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\RestartManager\Session0000\RegFiles0000 = 5c005c003f005c0043003a005c00550073006500720073005c00410064006d0069006e005c004e00540055005300450052002e004400410054007b00340065003000370034003600360038002d0030006300310063002d0031003100650037002d0061003900340033002d006500340031006400320064003700310038006100320030007d002e0054004d0043006f006e007400610069006e0065007200300030003000300030003000300030003000300030003000300030003000300030003000300032002e007200650067007400720061006e0073002d006d00730000000000	bac7f1cb70a0fe909590f7b270248705d216b4abaf4e5dd4969fa4f1949badec.sample.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	bac7f1cb70a0fe909590f7b270248705d216b4abaf4e5dd4969fa4f1949badec.sample.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	bac7f1cb70a0fe909590f7b270248705d216b4abaf4e5dd4969fa4f1949badec.sample.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\RestartManager	bac7f1cb70a0fe909590f7b270248705d216b4abaf4e5dd4969fa4f1949badec.sample.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\RestartManager\Session0000\RegFilesHash = a2d2140254912e5d6776caaaef18bb2d20f61ad54cda8f452fccb0684eb18811	bac7f1cb70a0fe909590f7b270248705d216b4abaf4e5dd4969fa4f1949badec.sample.exe

Modifies registry class 5 IoCs

Processes:

bac7f1cb70a0fe909590f7b270248705d216b4abaf4e5dd4969fa4f1949badec.sample.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.70d4d153	bac7f1cb70a0fe909590f7b270248705d216b4abaf4e5dd4969fa4f1949badec.sample.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.70d4d153\ = "70d4d153"	bac7f1cb70a0fe909590f7b270248705d216b4abaf4e5dd4969fa4f1949badec.sample.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\70d4d153\DefaultIcon	bac7f1cb70a0fe909590f7b270248705d216b4abaf4e5dd4969fa4f1949badec.sample.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\70d4d153	bac7f1cb70a0fe909590f7b270248705d216b4abaf4e5dd4969fa4f1949badec.sample.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\70d4d153\DefaultIcon\ = "C:\\ProgramData\\70d4d153.ico"	bac7f1cb70a0fe909590f7b270248705d216b4abaf4e5dd4969fa4f1949badec.sample.exe

Suspicious behavior: EnumeratesProcesses 26 IoCs

Processes:

bac7f1cb70a0fe909590f7b270248705d216b4abaf4e5dd4969fa4f1949badec.sample.exebac7f1cb70a0fe909590f7b270248705d216b4abaf4e5dd4969fa4f1949badec.sample.exe

pid	process
2144	bac7f1cb70a0fe909590f7b270248705d216b4abaf4e5dd4969fa4f1949badec.sample.exe
2144	bac7f1cb70a0fe909590f7b270248705d216b4abaf4e5dd4969fa4f1949badec.sample.exe
4088	bac7f1cb70a0fe909590f7b270248705d216b4abaf4e5dd4969fa4f1949badec.sample.exe
4088	bac7f1cb70a0fe909590f7b270248705d216b4abaf4e5dd4969fa4f1949badec.sample.exe
4088	bac7f1cb70a0fe909590f7b270248705d216b4abaf4e5dd4969fa4f1949badec.sample.exe
4088	bac7f1cb70a0fe909590f7b270248705d216b4abaf4e5dd4969fa4f1949badec.sample.exe
4088	bac7f1cb70a0fe909590f7b270248705d216b4abaf4e5dd4969fa4f1949badec.sample.exe
4088	bac7f1cb70a0fe909590f7b270248705d216b4abaf4e5dd4969fa4f1949badec.sample.exe
4088	bac7f1cb70a0fe909590f7b270248705d216b4abaf4e5dd4969fa4f1949badec.sample.exe
4088	bac7f1cb70a0fe909590f7b270248705d216b4abaf4e5dd4969fa4f1949badec.sample.exe
4088	bac7f1cb70a0fe909590f7b270248705d216b4abaf4e5dd4969fa4f1949badec.sample.exe
4088	bac7f1cb70a0fe909590f7b270248705d216b4abaf4e5dd4969fa4f1949badec.sample.exe
4088	bac7f1cb70a0fe909590f7b270248705d216b4abaf4e5dd4969fa4f1949badec.sample.exe
4088	bac7f1cb70a0fe909590f7b270248705d216b4abaf4e5dd4969fa4f1949badec.sample.exe
4088	bac7f1cb70a0fe909590f7b270248705d216b4abaf4e5dd4969fa4f1949badec.sample.exe
4088	bac7f1cb70a0fe909590f7b270248705d216b4abaf4e5dd4969fa4f1949badec.sample.exe
4088	bac7f1cb70a0fe909590f7b270248705d216b4abaf4e5dd4969fa4f1949badec.sample.exe
4088	bac7f1cb70a0fe909590f7b270248705d216b4abaf4e5dd4969fa4f1949badec.sample.exe
4088	bac7f1cb70a0fe909590f7b270248705d216b4abaf4e5dd4969fa4f1949badec.sample.exe
4088	bac7f1cb70a0fe909590f7b270248705d216b4abaf4e5dd4969fa4f1949badec.sample.exe
4088	bac7f1cb70a0fe909590f7b270248705d216b4abaf4e5dd4969fa4f1949badec.sample.exe
4088	bac7f1cb70a0fe909590f7b270248705d216b4abaf4e5dd4969fa4f1949badec.sample.exe
4088	bac7f1cb70a0fe909590f7b270248705d216b4abaf4e5dd4969fa4f1949badec.sample.exe
4088	bac7f1cb70a0fe909590f7b270248705d216b4abaf4e5dd4969fa4f1949badec.sample.exe
4088	bac7f1cb70a0fe909590f7b270248705d216b4abaf4e5dd4969fa4f1949badec.sample.exe
4088	bac7f1cb70a0fe909590f7b270248705d216b4abaf4e5dd4969fa4f1949badec.sample.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

vssvc.exe

description pid process

Token: SeBackupPrivilege 2808 vssvc.exe
Token: SeRestorePrivilege 2808 vssvc.exe
Token: SeAuditPrivilege 2808 vssvc.exe

description	pid	process
Token: SeBackupPrivilege	2808	vssvc.exe
Token: SeRestorePrivilege	2808	vssvc.exe
Token: SeAuditPrivilege	2808	vssvc.exe

Suspicious use of WriteProcessMemory 10 IoCs

Processes:

bac7f1cb70a0fe909590f7b270248705d216b4abaf4e5dd4969fa4f1949badec.sample.exebac7f1cb70a0fe909590f7b270248705d216b4abaf4e5dd4969fa4f1949badec.sample.exe

description	pid	process	target process
PID 1500 wrote to memory of 2144	1500	bac7f1cb70a0fe909590f7b270248705d216b4abaf4e5dd4969fa4f1949badec.sample.exe	bac7f1cb70a0fe909590f7b270248705d216b4abaf4e5dd4969fa4f1949badec.sample.exe
PID 1500 wrote to memory of 2144	1500	bac7f1cb70a0fe909590f7b270248705d216b4abaf4e5dd4969fa4f1949badec.sample.exe	bac7f1cb70a0fe909590f7b270248705d216b4abaf4e5dd4969fa4f1949badec.sample.exe
PID 1500 wrote to memory of 2144	1500	bac7f1cb70a0fe909590f7b270248705d216b4abaf4e5dd4969fa4f1949badec.sample.exe	bac7f1cb70a0fe909590f7b270248705d216b4abaf4e5dd4969fa4f1949badec.sample.exe
PID 1500 wrote to memory of 2144	1500	bac7f1cb70a0fe909590f7b270248705d216b4abaf4e5dd4969fa4f1949badec.sample.exe	bac7f1cb70a0fe909590f7b270248705d216b4abaf4e5dd4969fa4f1949badec.sample.exe
PID 2144 wrote to memory of 4088	2144	bac7f1cb70a0fe909590f7b270248705d216b4abaf4e5dd4969fa4f1949badec.sample.exe	bac7f1cb70a0fe909590f7b270248705d216b4abaf4e5dd4969fa4f1949badec.sample.exe
PID 2144 wrote to memory of 4088	2144	bac7f1cb70a0fe909590f7b270248705d216b4abaf4e5dd4969fa4f1949badec.sample.exe	bac7f1cb70a0fe909590f7b270248705d216b4abaf4e5dd4969fa4f1949badec.sample.exe
PID 2144 wrote to memory of 4088	2144	bac7f1cb70a0fe909590f7b270248705d216b4abaf4e5dd4969fa4f1949badec.sample.exe	bac7f1cb70a0fe909590f7b270248705d216b4abaf4e5dd4969fa4f1949badec.sample.exe
PID 2144 wrote to memory of 2036	2144	bac7f1cb70a0fe909590f7b270248705d216b4abaf4e5dd4969fa4f1949badec.sample.exe	bac7f1cb70a0fe909590f7b270248705d216b4abaf4e5dd4969fa4f1949badec.sample.exe
PID 2144 wrote to memory of 2036	2144	bac7f1cb70a0fe909590f7b270248705d216b4abaf4e5dd4969fa4f1949badec.sample.exe	bac7f1cb70a0fe909590f7b270248705d216b4abaf4e5dd4969fa4f1949badec.sample.exe
PID 2144 wrote to memory of 2036	2144	bac7f1cb70a0fe909590f7b270248705d216b4abaf4e5dd4969fa4f1949badec.sample.exe	bac7f1cb70a0fe909590f7b270248705d216b4abaf4e5dd4969fa4f1949badec.sample.exe

C:\Users\Admin\AppData\Local\Temp\bac7f1cb70a0fe909590f7b270248705d216b4abaf4e5dd4969fa4f1949badec.sample.exe
"C:\Users\Admin\AppData\Local\Temp\bac7f1cb70a0fe909590f7b270248705d216b4abaf4e5dd4969fa4f1949badec.sample.exe"
1⤵
PID:568

C:\Users\Admin\AppData\Local\Temp\bac7f1cb70a0fe909590f7b270248705d216b4abaf4e5dd4969fa4f1949badec.sample.exe
"C:\Users\Admin\AppData\Local\Temp\bac7f1cb70a0fe909590f7b270248705d216b4abaf4e5dd4969fa4f1949badec.sample.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1500

C:\Users\Admin\AppData\Local\Temp\bac7f1cb70a0fe909590f7b270248705d216b4abaf4e5dd4969fa4f1949badec.sample.exe
"C:\Users\Admin\AppData\Local\Temp\bac7f1cb70a0fe909590f7b270248705d216b4abaf4e5dd4969fa4f1949badec.sample.exe"
2⤵
- Enumerates connected drives
- Drops file in System32 directory
- Sets desktop wallpaper using registry
- Modifies Control Panel
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2144

C:\Users\Admin\AppData\Local\Temp\bac7f1cb70a0fe909590f7b270248705d216b4abaf4e5dd4969fa4f1949badec.sample.exe
C:\Users\Admin\AppData\Local\Temp\bac7f1cb70a0fe909590f7b270248705d216b4abaf4e5dd4969fa4f1949badec.sample.exe -work worker0 job0-2144
3⤵
- Modifies extensions of user files
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
PID:4088

C:\Users\Admin\AppData\Local\Temp\bac7f1cb70a0fe909590f7b270248705d216b4abaf4e5dd4969fa4f1949badec.sample.exe
C:\Users\Admin\AppData\Local\Temp\bac7f1cb70a0fe909590f7b270248705d216b4abaf4e5dd4969fa4f1949badec.sample.exe -work worker1 job1-2144
3⤵
- Enumerates connected drives
PID:2036