Analysis Overview
SHA256
f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4
Threat Level: Known bad
The file binaries/Darkside/f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4.exe was found to be: Known bad.
Malicious Activity Summary
DarkSide
Modifies extensions of user files
Enumerates connected drives
Drops file in System32 directory
Sets desktop wallpaper using registry
Modifies registry class
Suspicious behavior: EnumeratesProcesses
Suspicious use of WriteProcessMemory
Suspicious use of AdjustPrivilegeToken
Modifies Control Panel
Modifies data under HKEY_USERS
MITRE ATT&CK
Enterprise Matrix V6
Analysis: static1
Detonation Overview
Reported
2021-08-31 22:14
Signatures
Analysis: behavioral1
Detonation Overview
Submitted
2021-08-31 22:14
Reported
2021-08-31 22:17
Platform
win7v20210408
Max time kernel
125s
Max time network
162s
Command Line
Signatures
DarkSide
Modifies extensions of user files
Drops file in System32 directory
| Description | Indicator | Process | Target |
| File opened for modification | C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\counters.dat | C:\Users\Admin\AppData\Local\Temp\binaries\Darkside\f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4.exe | N/A |
Sets desktop wallpaper using registry
| Description | Indicator | Process | Target |
| Set value (str) | \REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Control Panel\Desktop\WallPaper = "C:\\ProgramData\\53411c86.BMP" | C:\Users\Admin\AppData\Local\Temp\binaries\Darkside\f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4.exe | N/A |
Modifies Control Panel
| Description | Indicator | Process | Target |
| Key created | \REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Control Panel\Desktop | C:\Users\Admin\AppData\Local\Temp\binaries\Darkside\f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4.exe | N/A |
| Set value (str) | \REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Control Panel\Desktop\WallpaperStyle = "10" | C:\Users\Admin\AppData\Local\Temp\binaries\Darkside\f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4.exe | N/A |
Modifies data under HKEY_USERS
| Description | Indicator | Process | Target |
| Set value (int) | \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyEnable = "0" | C:\Users\Admin\AppData\Local\Temp\binaries\Darkside\f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4.exe | N/A |
| Key created | \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad | C:\Users\Admin\AppData\Local\Temp\binaries\Darkside\f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4.exe | N/A |
| Set value (int) | \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{3A33DB50-CC69-497D-AB93-6EAB524EB9A7}\WpadDecisionReason = "1" | C:\Users\Admin\AppData\Local\Temp\binaries\Darkside\f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4.exe | N/A |
| Set value (str) | \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{3A33DB50-CC69-497D-AB93-6EAB524EB9A7}\WpadNetworkName = "Network" | C:\Users\Admin\AppData\Local\Temp\binaries\Darkside\f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4.exe | N/A |
| Set value (data) | \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\RestartManager\Session0000\SessionHash = 1e7c7694f3fa856b892a1a2b450742d45c1e68ddac2ff1fb21110f998f08939a | C:\Users\Admin\AppData\Local\Temp\binaries\Darkside\f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4.exe | N/A |
| Set value (data) | \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\RestartManager\Session0000\RegFilesHash = df9d649fbd4e5f6e9bac8e2e29493836cb273294f7d3a395d88deba439a3a3f7 | C:\Users\Admin\AppData\Local\Temp\binaries\Darkside\f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4.exe | N/A |
| Set value (data) | \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\RestartManager\Session0000\RegFiles0000 = 5c005c003f005c0043003a005c00550073006500720073005c00410064006d0069006e005c004e00540055005300450052002e004400410054007b00300031003600380038003800620064002d0036006300360066002d0031003100640065002d0038006400310064002d003000300031006500300062006300640065003300650063007d002e0054004d0043006f006e007400610069006e0065007200300030003000300030003000300030003000300030003000300030003000300030003000300031002e007200650067007400720061006e0073002d006d00730000000000 | C:\Users\Admin\AppData\Local\Temp\binaries\Darkside\f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4.exe | N/A |
| Set value (data) | \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\RestartManager\Session0000\RegFilesHash = 7ed80a3218d4de384e918d7ce2c2a91e9716f04a840356a240502f53c052e59b | C:\Users\Admin\AppData\Local\Temp\binaries\Darkside\f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4.exe | N/A |
| Set value (data) | \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\RestartManager\Session0000\SessionHash = 4c2444d248309d3a5428043ce300303109fd2ee49b223598d9c343d1f7927d01 | C:\Users\Admin\AppData\Local\Temp\binaries\Darkside\f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4.exe | N/A |
| Set value (data) | \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000003000000090000000000000000000000000000000400000000000000000000000000000000000000000000000000000001000000020000000a07001b000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 | C:\Users\Admin\AppData\Local\Temp\binaries\Darkside\f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4.exe | N/A |
| Set value (int) | \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\16-9e-1c-4b-ba-31\WpadDecisionReason = "1" | C:\Users\Admin\AppData\Local\Temp\binaries\Darkside\f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4.exe | N/A |
| Set value (str) | \REGISTRY\USER\.DEFAULT\Control Panel\Desktop\Wallpaper = "C:\\ProgramData\\53411c86.BMP" | C:\Users\Admin\AppData\Local\Temp\binaries\Darkside\f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4.exe | N/A |
| Set value (str) | \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:" | C:\Users\Admin\AppData\Local\Temp\binaries\Darkside\f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4.exe | N/A |
| Set value (data) | \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\SavedLegacySettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 | C:\Users\Admin\AppData\Local\Temp\binaries\Darkside\f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4.exe | N/A |
| Set value (data) | \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{3A33DB50-CC69-497D-AB93-6EAB524EB9A7}\WpadDecisionTime = 804d7feec69ed701 | C:\Users\Admin\AppData\Local\Temp\binaries\Darkside\f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4.exe | N/A |
| Set value (int) | \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{3A33DB50-CC69-497D-AB93-6EAB524EB9A7}\WpadDecision = "0" | C:\Users\Admin\AppData\Local\Temp\binaries\Darkside\f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4.exe | N/A |
| Set value (int) | \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\16-9e-1c-4b-ba-31\WpadDecision = "0" | C:\Users\Admin\AppData\Local\Temp\binaries\Darkside\f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4.exe | N/A |
| Key created | \REGISTRY\USER\.DEFAULT\Software | C:\Users\Admin\AppData\Local\Temp\binaries\Darkside\f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4.exe | N/A |
| Set value (data) | \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\RestartManager\Session0000\SessionHash = db435005d98ffcf6142a2a71bce2b88964ea4d59bad188e4e8ac0f8761dfbe65 | C:\Users\Admin\AppData\Local\Temp\binaries\Darkside\f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4.exe | N/A |
| Set value (data) | \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\RestartManager\Session0000\SessionHash = 96e8a06b03bf0827d4c6e9c28bf9bd251b0d61b0e091b05c70d9785f7cafa86e | C:\Users\Admin\AppData\Local\Temp\binaries\Darkside\f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4.exe | N/A |
| Key created | \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings | C:\Users\Admin\AppData\Local\Temp\binaries\Darkside\f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4.exe | N/A |
| Set value (str) | \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix | C:\Users\Admin\AppData\Local\Temp\binaries\Darkside\f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4.exe | N/A |
| Set value (int) | \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "1" | C:\Users\Admin\AppData\Local\Temp\binaries\Darkside\f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4.exe | N/A |
| Set value (data) | \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\RestartManager\Session0000\Owner = 90030000200a6cf0c69ed701 | C:\Users\Admin\AppData\Local\Temp\binaries\Darkside\f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4.exe | N/A |
| Set value (int) | \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\RestartManager\Session0000\Sequence = "1" | C:\Users\Admin\AppData\Local\Temp\binaries\Darkside\f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4.exe | N/A |
| Key created | \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings | C:\Users\Admin\AppData\Local\Temp\binaries\Darkside\f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4.exe | N/A |
| Key created | \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ | C:\Users\Admin\AppData\Local\Temp\binaries\Darkside\f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4.exe | N/A |
| Set value (int) | \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "0" | C:\Users\Admin\AppData\Local\Temp\binaries\Darkside\f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4.exe | N/A |
| Key created | \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\16-9e-1c-4b-ba-31 | C:\Users\Admin\AppData\Local\Temp\binaries\Darkside\f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4.exe | N/A |
| Key created | \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft | C:\Users\Admin\AppData\Local\Temp\binaries\Darkside\f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4.exe | N/A |
| Set value (data) | \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\RestartManager\Session0000\RegFiles0000 = 5c005c003f005c0043003a005c00550073006500720073005c00410064006d0069006e005c006e00740075007300650072002e006400610074002e004c004f004700310000000000 | C:\Users\Admin\AppData\Local\Temp\binaries\Darkside\f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4.exe | N/A |
| Set value (data) | \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 | C:\Users\Admin\AppData\Local\Temp\binaries\Darkside\f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4.exe | N/A |
| Key created | \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{3A33DB50-CC69-497D-AB93-6EAB524EB9A7} | C:\Users\Admin\AppData\Local\Temp\binaries\Darkside\f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4.exe | N/A |
| Set value (data) | \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\RestartManager\Session0000\RegFiles0000 = 5c005c003f005c0043003a005c00550073006500720073005c00410064006d0069006e005c004e00540055005300450052002e004400410054007b00300031003600380038003800620064002d0036006300360066002d0031003100640065002d0038006400310064002d003000300031006500300062006300640065003300650063007d002e0054004d002e0062006c00660000000000 | C:\Users\Admin\AppData\Local\Temp\binaries\Darkside\f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4.exe | N/A |
| Key created | \REGISTRY\USER\.DEFAULT\Control Panel\International | C:\Users\Admin\AppData\Local\Temp\binaries\Darkside\f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4.exe | N/A |
| Key created | \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections | C:\Users\Admin\AppData\Local\Temp\binaries\Darkside\f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4.exe | N/A |
| Set value (str) | \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:" | C:\Users\Admin\AppData\Local\Temp\binaries\Darkside\f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4.exe | N/A |
| Key created | \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{3A33DB50-CC69-497D-AB93-6EAB524EB9A7}\16-9e-1c-4b-ba-31 | C:\Users\Admin\AppData\Local\Temp\binaries\Darkside\f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4.exe | N/A |
| Key created | \REGISTRY\USER\.DEFAULT\Software\Microsoft\RestartManager\Session0000 | C:\Users\Admin\AppData\Local\Temp\binaries\Darkside\f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4.exe | N/A |
| Key created | \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\RestartManager | C:\Users\Admin\AppData\Local\Temp\binaries\Darkside\f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4.exe | N/A |
| Key deleted | \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\RestartManager\Session0000 | C:\Users\Admin\AppData\Local\Temp\binaries\Darkside\f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4.exe | N/A |
| Set value (data) | \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\RestartManager\Session0000\RegFiles0000 = 5c005c003f005c0043003a005c00550073006500720073005c00410064006d0069006e005c004e00540055005300450052002e004400410054007b00300031003600380038003800620064002d0036006300360066002d0031003100640065002d0038006400310064002d003000300031006500300062006300640065003300650063007d002e0054004d0043006f006e007400610069006e0065007200300030003000300030003000300030003000300030003000300030003000300030003000300032002e007200650067007400720061006e0073002d006d00730000000000 | C:\Users\Admin\AppData\Local\Temp\binaries\Darkside\f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4.exe | N/A |
| Set value (data) | \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\16-9e-1c-4b-ba-31\WpadDecisionTime = 804d7feec69ed701 | C:\Users\Admin\AppData\Local\Temp\binaries\Darkside\f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4.exe | N/A |
| Key created | \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\RestartManager\Session0000 | C:\Users\Admin\AppData\Local\Temp\binaries\Darkside\f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4.exe | N/A |
| Set value (data) | \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\RestartManager\Session0000\RegFilesHash = 3c60593d1f30d5db56bf3d1ac176c7dd193c40ffa7fb45dd7d72225d02e0dc2f | C:\Users\Admin\AppData\Local\Temp\binaries\Darkside\f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4.exe | N/A |
| Set value (data) | \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\RestartManager\Session0000\RegFilesHash = 623fc09ffe4a7bc6872356a1f31f52d1cf6bedbf587f0b8b4d081b8f38617b53 | C:\Users\Admin\AppData\Local\Temp\binaries\Darkside\f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4.exe | N/A |
Modifies registry class
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
| Description | Indicator | Process | Target |
| Token: SeBackupPrivilege | N/A | C:\Windows\system32\vssvc.exe | N/A |
| Token: SeRestorePrivilege | N/A | C:\Windows\system32\vssvc.exe | N/A |
| Token: SeAuditPrivilege | N/A | C:\Windows\system32\vssvc.exe | N/A |
Suspicious use of WriteProcessMemory
Processes
C:\Users\Admin\AppData\Local\Temp\binaries\Darkside\f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4.exe
"C:\Users\Admin\AppData\Local\Temp\binaries\Darkside\f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4.exe"
C:\Users\Admin\AppData\Local\Temp\binaries\Darkside\f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4.exe
"C:\Users\Admin\AppData\Local\Temp\binaries\Darkside\f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4.exe"
C:\Users\Admin\AppData\Local\Temp\binaries\Darkside\f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4.exe
"C:\Users\Admin\AppData\Local\Temp\binaries\Darkside\f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4.exe"
C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
C:\Users\Admin\AppData\Local\Temp\binaries\Darkside\f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4.exe
C:\Users\Admin\AppData\Local\Temp\binaries\Darkside\f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4.exe -work worker0 job0-596
Network
| Country | Destination | Domain | Proto |
| N/A | 8.8.8.8:53 | baroquetees.com | udp |
Files
memory/1832-60-0x00000000762C1000-0x00000000762C3000-memory.dmp
memory/596-62-0x0000000000000000-mapping.dmp
memory/912-64-0x0000000000000000-mapping.dmp
Analysis: behavioral2
Detonation Overview
Submitted
2021-08-31 22:14
Reported
2021-08-31 22:17
Platform
win10v20210410
Max time kernel
13s
Max time network
114s
Command Line
Signatures
DarkSide
Modifies extensions of user files
Enumerates connected drives
| Description | Indicator | Process | Target |
| File opened (read-only) | \??\Z: | C:\Users\Admin\AppData\Local\Temp\binaries\Darkside\f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4.exe | N/A |
| File opened (read-only) | \??\Z: | C:\Users\Admin\AppData\Local\Temp\binaries\Darkside\f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4.exe | N/A |
Drops file in System32 directory
| Description | Indicator | Process | Target |
| File opened for modification | C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE | C:\Users\Admin\AppData\Local\Temp\binaries\Darkside\f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4.exe | N/A |
| File opened for modification | C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCookies | C:\Users\Admin\AppData\Local\Temp\binaries\Darkside\f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4.exe | N/A |
| File opened for modification | C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5 | C:\Users\Admin\AppData\Local\Temp\binaries\Darkside\f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4.exe | N/A |
| File opened for modification | C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\counters2.dat | C:\Users\Admin\AppData\Local\Temp\binaries\Darkside\f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4.exe | N/A |
| File opened for modification | C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\Content.IE5 | C:\Users\Admin\AppData\Local\Temp\binaries\Darkside\f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4.exe | N/A |
Sets desktop wallpaper using registry
| Description | Indicator | Process | Target |
| Set value (str) | \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Control Panel\Desktop\WallPaper = "C:\\ProgramData\\aeef1a75.BMP" | C:\Users\Admin\AppData\Local\Temp\binaries\Darkside\f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4.exe | N/A |
Modifies Control Panel
| Description | Indicator | Process | Target |
| Key created | \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Control Panel\Desktop | C:\Users\Admin\AppData\Local\Temp\binaries\Darkside\f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4.exe | N/A |
| Set value (str) | \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Control Panel\Desktop\WallpaperStyle = "10" | C:\Users\Admin\AppData\Local\Temp\binaries\Darkside\f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4.exe | N/A |
Modifies data under HKEY_USERS
| Description | Indicator | Process | Target |
| Set value (data) | \REGISTRY\USER\.DEFAULT\Software\Microsoft\RestartManager\Session0000\RegFilesHash = 3c99bda098c70bc4a7a3471a1e1e68a24fd731c4d0271459172422575eec1a45 | C:\Users\Admin\AppData\Local\Temp\binaries\Darkside\f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4.exe | N/A |
| Set value (data) | \REGISTRY\USER\.DEFAULT\Software\Microsoft\RestartManager\Session0000\SessionHash = 0d87ac1880cd4f9161ef83eae922d198bffcffd31067f9af5627755104a88867 | C:\Users\Admin\AppData\Local\Temp\binaries\Darkside\f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4.exe | N/A |
| Set value (data) | \REGISTRY\USER\.DEFAULT\Software\Microsoft\RestartManager\Session0000\RegFilesHash = 027d52d9b8ca723d9c16f24414399a922d379a0f49fac8c3d91dde0fe865172e | C:\Users\Admin\AppData\Local\Temp\binaries\Darkside\f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4.exe | N/A |
| Set value (data) | \REGISTRY\USER\.DEFAULT\Software\Microsoft\RestartManager\Session0000\SessionHash = d887e53c42253d7ec3ee349876414af0adb0cb74ac0d306af7c8f16adf6dbd54 | C:\Users\Admin\AppData\Local\Temp\binaries\Darkside\f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4.exe | N/A |
| Set value (int) | \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1" | C:\Users\Admin\AppData\Local\Temp\binaries\Darkside\f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4.exe | N/A |
| Set value (int) | \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1" | C:\Users\Admin\AppData\Local\Temp\binaries\Darkside\f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4.exe | N/A |
| Set value (data) | \REGISTRY\USER\.DEFAULT\Software\Microsoft\RestartManager\Session0000\SessionHash = 755b5a49cdd17126829ddebf1706df719bc4cc97e25b0ac0573a10d103d523ea | C:\Users\Admin\AppData\Local\Temp\binaries\Darkside\f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4.exe | N/A |
| Set value (int) | \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0" | C:\Users\Admin\AppData\Local\Temp\binaries\Darkside\f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4.exe | N/A |
| Set value (data) | \REGISTRY\USER\.DEFAULT\Software\Microsoft\RestartManager\Session0000\RegFiles0000 = 5c005c003f005c0043003a005c00550073006500720073005c00410064006d0069006e005c006e00740075007300650072002e006400610074002e004c004f004700310000000000 | C:\Users\Admin\AppData\Local\Temp\binaries\Darkside\f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4.exe | N/A |
| Set value (data) | \REGISTRY\USER\.DEFAULT\Software\Microsoft\RestartManager\Session0000\RegFilesHash = 33adcd2d99169f73f873335750e31832ba4795d98513a7d33d2a8bb67775cc86 | C:\Users\Admin\AppData\Local\Temp\binaries\Darkside\f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4.exe | N/A |
| Set value (str) | \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix | C:\Users\Admin\AppData\Local\Temp\binaries\Darkside\f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4.exe | N/A |
| Set value (str) | \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:" | C:\Users\Admin\AppData\Local\Temp\binaries\Darkside\f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4.exe | N/A |
| Set value (data) | \REGISTRY\USER\.DEFAULT\Software\Microsoft\RestartManager\Session0000\RegFiles0000 = 5c005c003f005c0043003a005c00550073006500720073005c00410064006d0069006e005c004e00540055005300450052002e004400410054007b00340065003000370034003600360038002d0030006300310063002d0031003100650037002d0061003900340033002d006500340031006400320064003700310038006100320030007d002e0054004d0043006f006e007400610069006e0065007200300030003000300030003000300030003000300030003000300030003000300030003000300032002e007200650067007400720061006e0073002d006d00730000000000 | C:\Users\Admin\AppData\Local\Temp\binaries\Darkside\f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4.exe | N/A |
| Set value (data) | \REGISTRY\USER\.DEFAULT\Software\Microsoft\RestartManager\Session0000\SessionHash = 2fe1b8dfc4e2b1bbf32e9d7d5983509fe9c4f570dd2e82bbaee698d8bf5a597a | C:\Users\Admin\AppData\Local\Temp\binaries\Darkside\f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4.exe | N/A |
| Set value (str) | \REGISTRY\USER\.DEFAULT\Control Panel\Desktop\Wallpaper = "C:\\ProgramData\\aeef1a75.BMP" | C:\Users\Admin\AppData\Local\Temp\binaries\Darkside\f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4.exe | N/A |
| Set value (str) | \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:" | C:\Users\Admin\AppData\Local\Temp\binaries\Darkside\f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4.exe | N/A |
| Key created | \REGISTRY\USER\.DEFAULT\Software | C:\Users\Admin\AppData\Local\Temp\binaries\Darkside\f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4.exe | N/A |
| Key created | \REGISTRY\USER\.DEFAULT\Software\Microsoft | C:\Users\Admin\AppData\Local\Temp\binaries\Darkside\f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4.exe | N/A |
| Key created | \REGISTRY\USER\.DEFAULT\Control Panel\International | C:\Users\Admin\AppData\Local\Temp\binaries\Darkside\f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4.exe | N/A |
| Set value (data) | \REGISTRY\USER\.DEFAULT\Software\Microsoft\RestartManager\Session0000\RegFiles0000 = 5c005c003f005c0043003a005c00550073006500720073005c00410064006d0069006e005c004e00540055005300450052002e004400410054007b00340065003000370034003600360038002d0030006300310063002d0031003100650037002d0061003900340033002d006500340031006400320064003700310038006100320030007d002e0054004d0043006f006e007400610069006e0065007200300030003000300030003000300030003000300030003000300030003000300030003000300031002e007200650067007400720061006e0073002d006d00730000000000 | C:\Users\Admin\AppData\Local\Temp\binaries\Darkside\f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4.exe | N/A |
| Key created | \REGISTRY\USER\.DEFAULT\Software\Microsoft\RestartManager | C:\Users\Admin\AppData\Local\Temp\binaries\Darkside\f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4.exe | N/A |
| Set value (int) | \REGISTRY\USER\.DEFAULT\Software\Microsoft\RestartManager\Session0000\Sequence = "1" | C:\Users\Admin\AppData\Local\Temp\binaries\Darkside\f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4.exe | N/A |
| Set value (data) | \REGISTRY\USER\.DEFAULT\Software\Microsoft\RestartManager\Session0000\RegFiles0000 = 5c005c003f005c0043003a005c00550073006500720073005c00410064006d0069006e005c004e00540055005300450052002e004400410054007b00340065003000370034003600360038002d0030006300310063002d0031003100650037002d0061003900340033002d006500340031006400320064003700310038006100320030007d002e0054004d002e0062006c00660000000000 | C:\Users\Admin\AppData\Local\Temp\binaries\Darkside\f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4.exe | N/A |
| Set value (data) | \REGISTRY\USER\.DEFAULT\Software\Microsoft\RestartManager\Session0000\RegFilesHash = e5de9cab6010ec974001efdb47bc674567ec74f51a093cbfc7d0fec4a4f2372d | C:\Users\Admin\AppData\Local\Temp\binaries\Darkside\f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4.exe | N/A |
| Key deleted | \REGISTRY\USER\.DEFAULT\Software\Microsoft\RestartManager\Session0000 | C:\Users\Admin\AppData\Local\Temp\binaries\Darkside\f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4.exe | N/A |
| Set value (int) | \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1" | C:\Users\Admin\AppData\Local\Temp\binaries\Darkside\f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4.exe | N/A |
| Key created | \REGISTRY\USER\.DEFAULT\Software\Microsoft\RestartManager\Session0000 | C:\Users\Admin\AppData\Local\Temp\binaries\Darkside\f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4.exe | N/A |
| Set value (data) | \REGISTRY\USER\.DEFAULT\Software\Microsoft\RestartManager\Session0000\Owner = 3c0c0000ab829313b59ed701 | C:\Users\Admin\AppData\Local\Temp\binaries\Darkside\f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4.exe | N/A |
| Key created | \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ | C:\Users\Admin\AppData\Local\Temp\binaries\Darkside\f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4.exe | N/A |
Modifies registry class
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
| Description | Indicator | Process | Target |
| Token: SeBackupPrivilege | N/A | C:\Windows\system32\vssvc.exe | N/A |
| Token: SeRestorePrivilege | N/A | C:\Windows\system32\vssvc.exe | N/A |
| Token: SeAuditPrivilege | N/A | C:\Windows\system32\vssvc.exe | N/A |
Suspicious use of WriteProcessMemory
Processes
C:\Users\Admin\AppData\Local\Temp\binaries\Darkside\f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4.exe
"C:\Users\Admin\AppData\Local\Temp\binaries\Darkside\f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4.exe"
C:\Users\Admin\AppData\Local\Temp\binaries\Darkside\f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4.exe
"C:\Users\Admin\AppData\Local\Temp\binaries\Darkside\f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4.exe"
C:\Users\Admin\AppData\Local\Temp\binaries\Darkside\f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4.exe
"C:\Users\Admin\AppData\Local\Temp\binaries\Darkside\f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4.exe"
C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
C:\Users\Admin\AppData\Local\Temp\binaries\Darkside\f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4.exe
C:\Users\Admin\AppData\Local\Temp\binaries\Darkside\f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4.exe -work worker0 job0-4784
C:\Users\Admin\AppData\Local\Temp\binaries\Darkside\f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4.exe
C:\Users\Admin\AppData\Local\Temp\binaries\Darkside\f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4.exe -work worker1 job1-4784
Network
| Country | Destination | Domain | Proto |
| N/A | 8.8.8.8:53 | baroquetees.com | udp |
Files
memory/4784-114-0x0000000000000000-mapping.dmp
memory/3132-115-0x0000000000000000-mapping.dmp
memory/4028-116-0x0000000000000000-mapping.dmp