Malware Analysis Report

2024-10-16 03:29

Sample ID 210901-gccbmqaw72
Target mhcomputing.net_f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4_zor0jtoj.exe
SHA256 f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4
Tags
darkside ransomware
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V6

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4

Threat Level: Known bad

The file mhcomputing.net_f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4_zor0jtoj.exe was found to be: Known bad.

Malicious Activity Summary

darkside ransomware

DarkSide

Modifies extensions of user files

Enumerates connected drives

Drops file in System32 directory

Sets desktop wallpaper using registry

Suspicious behavior: EnumeratesProcesses

Modifies data under HKEY_USERS

Modifies registry class

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

Modifies Control Panel

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2021-09-01 06:23

Signatures

N/A

Analysis: behavioral1

Detonation Overview

Submitted

2021-09-01 06:23

Reported

2021-09-01 06:26

Platform

win7v20210408

Max time kernel

16s

Max time network

40s

Command Line

"C:\Users\Admin\AppData\Local\Temp\mhcomputing.net_f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4_zor0jtoj.exe"

Signatures

DarkSide

ransomware darkside

Modifies extensions of user files

ransomware
Description Indicator Process Target
File renamed C:\Users\Admin\Pictures\SubmitCheckpoint.raw => C:\Users\Admin\Pictures\SubmitCheckpoint.raw.53411c86 C:\Users\Admin\AppData\Local\Temp\mhcomputing.net_f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4_zor0jtoj.exe N/A
File opened for modification C:\Users\Admin\Pictures\ConvertToUnregister.raw.53411c86 C:\Users\Admin\AppData\Local\Temp\mhcomputing.net_f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4_zor0jtoj.exe N/A
File renamed C:\Users\Admin\Pictures\DisableApprove.tif => C:\Users\Admin\Pictures\DisableApprove.tif.53411c86 C:\Users\Admin\AppData\Local\Temp\mhcomputing.net_f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4_zor0jtoj.exe N/A
File renamed C:\Users\Admin\Pictures\ExitUnpublish.crw => C:\Users\Admin\Pictures\ExitUnpublish.crw.53411c86 C:\Users\Admin\AppData\Local\Temp\mhcomputing.net_f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4_zor0jtoj.exe N/A
File opened for modification C:\Users\Admin\Pictures\ProtectGet.tiff.53411c86 C:\Users\Admin\AppData\Local\Temp\mhcomputing.net_f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4_zor0jtoj.exe N/A
File renamed C:\Users\Admin\Pictures\RestoreGrant.raw => C:\Users\Admin\Pictures\RestoreGrant.raw.53411c86 C:\Users\Admin\AppData\Local\Temp\mhcomputing.net_f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4_zor0jtoj.exe N/A
File opened for modification C:\Users\Admin\Pictures\ExitUnpublish.crw.53411c86 C:\Users\Admin\AppData\Local\Temp\mhcomputing.net_f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4_zor0jtoj.exe N/A
File opened for modification C:\Users\Admin\Pictures\DisableApprove.tif.53411c86 C:\Users\Admin\AppData\Local\Temp\mhcomputing.net_f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4_zor0jtoj.exe N/A
File opened for modification C:\Users\Admin\Pictures\ProtectGet.tiff C:\Users\Admin\AppData\Local\Temp\mhcomputing.net_f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4_zor0jtoj.exe N/A
File renamed C:\Users\Admin\Pictures\ProtectGet.tiff => C:\Users\Admin\Pictures\ProtectGet.tiff.53411c86 C:\Users\Admin\AppData\Local\Temp\mhcomputing.net_f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4_zor0jtoj.exe N/A
File opened for modification C:\Users\Admin\Pictures\RestoreGrant.raw.53411c86 C:\Users\Admin\AppData\Local\Temp\mhcomputing.net_f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4_zor0jtoj.exe N/A
File renamed C:\Users\Admin\Pictures\ConvertToUnregister.raw => C:\Users\Admin\Pictures\ConvertToUnregister.raw.53411c86 C:\Users\Admin\AppData\Local\Temp\mhcomputing.net_f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4_zor0jtoj.exe N/A
File renamed C:\Users\Admin\Pictures\DisconnectWait.crw => C:\Users\Admin\Pictures\DisconnectWait.crw.53411c86 C:\Users\Admin\AppData\Local\Temp\mhcomputing.net_f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4_zor0jtoj.exe N/A
File opened for modification C:\Users\Admin\Pictures\DisconnectWait.crw.53411c86 C:\Users\Admin\AppData\Local\Temp\mhcomputing.net_f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4_zor0jtoj.exe N/A
File opened for modification C:\Users\Admin\Pictures\SubmitCheckpoint.raw.53411c86 C:\Users\Admin\AppData\Local\Temp\mhcomputing.net_f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4_zor0jtoj.exe N/A

Drops file in System32 directory

Description Indicator Process Target
File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\counters.dat C:\Users\Admin\AppData\Local\Temp\mhcomputing.net_f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4_zor0jtoj.exe N/A

Sets desktop wallpaper using registry

ransomware
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Control Panel\Desktop\WallPaper = "C:\\ProgramData\\53411c86.BMP" C:\Users\Admin\AppData\Local\Temp\mhcomputing.net_f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4_zor0jtoj.exe N/A

Modifies Control Panel

evasion
Description Indicator Process Target
Key created \REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Control Panel\Desktop C:\Users\Admin\AppData\Local\Temp\mhcomputing.net_f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4_zor0jtoj.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Control Panel\Desktop\WallpaperStyle = "10" C:\Users\Admin\AppData\Local\Temp\mhcomputing.net_f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4_zor0jtoj.exe N/A

Modifies data under HKEY_USERS

Description Indicator Process Target
Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\RestartManager\Session0000\SessionHash = 307f5d8b1665300f4b0579518044800c12374be5c7158d445254face31fa5c4c C:\Users\Admin\AppData\Local\Temp\mhcomputing.net_f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4_zor0jtoj.exe N/A
Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\RestartManager\Session0000\RegFiles0000 = 5c005c003f005c0043003a005c00550073006500720073005c00410064006d0069006e005c006e00740075007300650072002e006400610074002e004c004f004700310000000000 C:\Users\Admin\AppData\Local\Temp\mhcomputing.net_f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4_zor0jtoj.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Control Panel\International C:\Users\Admin\AppData\Local\Temp\mhcomputing.net_f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4_zor0jtoj.exe N/A
Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 C:\Users\Admin\AppData\Local\Temp\mhcomputing.net_f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4_zor0jtoj.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:" C:\Users\Admin\AppData\Local\Temp\mhcomputing.net_f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4_zor0jtoj.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings C:\Users\Admin\AppData\Local\Temp\mhcomputing.net_f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4_zor0jtoj.exe N/A
Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\SavedLegacySettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 C:\Users\Admin\AppData\Local\Temp\mhcomputing.net_f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4_zor0jtoj.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\RestartManager C:\Users\Admin\AppData\Local\Temp\mhcomputing.net_f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4_zor0jtoj.exe N/A
Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\RestartManager\Session0000\RegFilesHash = c154b93f93f85a8d6915c1066db4d774c173fae38a83ea44061616c1a95ebc77 C:\Users\Admin\AppData\Local\Temp\mhcomputing.net_f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4_zor0jtoj.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "0" C:\Users\Admin\AppData\Local\Temp\mhcomputing.net_f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4_zor0jtoj.exe N/A
Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{3A33DB50-CC69-497D-AB93-6EAB524EB9A7}\WpadDecisionTime = 20e2082d0a9fd701 C:\Users\Admin\AppData\Local\Temp\mhcomputing.net_f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4_zor0jtoj.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\be-da-80-3a-ee-b6\WpadDecision = "0" C:\Users\Admin\AppData\Local\Temp\mhcomputing.net_f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4_zor0jtoj.exe N/A
Key deleted \REGISTRY\USER\.DEFAULT\Software\Microsoft\RestartManager\Session0000 C:\Users\Admin\AppData\Local\Temp\mhcomputing.net_f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4_zor0jtoj.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections C:\Users\Admin\AppData\Local\Temp\mhcomputing.net_f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4_zor0jtoj.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad C:\Users\Admin\AppData\Local\Temp\mhcomputing.net_f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4_zor0jtoj.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "1" C:\Users\Admin\AppData\Local\Temp\mhcomputing.net_f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4_zor0jtoj.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\RestartManager\Session0000 C:\Users\Admin\AppData\Local\Temp\mhcomputing.net_f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4_zor0jtoj.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft C:\Users\Admin\AppData\Local\Temp\mhcomputing.net_f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4_zor0jtoj.exe N/A
Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\RestartManager\Session0000\SessionHash = 87adff1334cdc6d306e44ad01430f95eddff01ab8de3d5a43fe01a544ab1280b C:\Users\Admin\AppData\Local\Temp\mhcomputing.net_f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4_zor0jtoj.exe N/A
Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\RestartManager\Session0000\RegFilesHash = 49210588f3ab63134ed572ae017e14068ab9580ae1391c79c7e61601358df481 C:\Users\Admin\AppData\Local\Temp\mhcomputing.net_f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4_zor0jtoj.exe N/A
Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\RestartManager\Session0000\RegFiles0000 = 5c005c003f005c0043003a005c00550073006500720073005c00410064006d0069006e005c004e00540055005300450052002e004400410054007b00300031003600380038003800620064002d0036006300360066002d0031003100640065002d0038006400310064002d003000300031006500300062006300640065003300650063007d002e0054004d0043006f006e007400610069006e0065007200300030003000300030003000300030003000300030003000300030003000300030003000300031002e007200650067007400720061006e0073002d006d00730000000000 C:\Users\Admin\AppData\Local\Temp\mhcomputing.net_f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4_zor0jtoj.exe N/A
Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings C:\Users\Admin\AppData\Local\Temp\mhcomputing.net_f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4_zor0jtoj.exe N/A
Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000003000000090000000000000000000000000000000400000000000000000000000000000000000000000000000000000001000000020000000a07000c000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 C:\Users\Admin\AppData\Local\Temp\mhcomputing.net_f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4_zor0jtoj.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{3A33DB50-CC69-497D-AB93-6EAB524EB9A7}\WpadDecisionReason = "1" C:\Users\Admin\AppData\Local\Temp\mhcomputing.net_f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4_zor0jtoj.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\be-da-80-3a-ee-b6 C:\Users\Admin\AppData\Local\Temp\mhcomputing.net_f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4_zor0jtoj.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{3A33DB50-CC69-497D-AB93-6EAB524EB9A7}\be-da-80-3a-ee-b6 C:\Users\Admin\AppData\Local\Temp\mhcomputing.net_f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4_zor0jtoj.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software C:\Users\Admin\AppData\Local\Temp\mhcomputing.net_f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4_zor0jtoj.exe N/A
Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\RestartManager\Session0000\RegFilesHash = c08d72e1a4b3ddc91089af6b6ddb91bf2c5652be2887923a9eb0028fc90e41c5 C:\Users\Admin\AppData\Local\Temp\mhcomputing.net_f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4_zor0jtoj.exe N/A
Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\RestartManager\Session0000\SessionHash = fd001c757cd998e6d943a5934fae67558eaeaf45d3be4484a96ab8929c13cec1 C:\Users\Admin\AppData\Local\Temp\mhcomputing.net_f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4_zor0jtoj.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{3A33DB50-CC69-497D-AB93-6EAB524EB9A7}\WpadNetworkName = "Network" C:\Users\Admin\AppData\Local\Temp\mhcomputing.net_f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4_zor0jtoj.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\be-da-80-3a-ee-b6\WpadDecisionReason = "1" C:\Users\Admin\AppData\Local\Temp\mhcomputing.net_f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4_zor0jtoj.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\RestartManager\Session0000\Sequence = "1" C:\Users\Admin\AppData\Local\Temp\mhcomputing.net_f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4_zor0jtoj.exe N/A
Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\RestartManager\Session0000\RegFiles0000 = 5c005c003f005c0043003a005c00550073006500720073005c00410064006d0069006e005c004e00540055005300450052002e004400410054007b00300031003600380038003800620064002d0036006300360066002d0031003100640065002d0038006400310064002d003000300031006500300062006300640065003300650063007d002e0054004d002e0062006c00660000000000 C:\Users\Admin\AppData\Local\Temp\mhcomputing.net_f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4_zor0jtoj.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Control Panel\Desktop\Wallpaper = "C:\\ProgramData\\53411c86.BMP" C:\Users\Admin\AppData\Local\Temp\mhcomputing.net_f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4_zor0jtoj.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:" C:\Users\Admin\AppData\Local\Temp\mhcomputing.net_f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4_zor0jtoj.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyEnable = "0" C:\Users\Admin\AppData\Local\Temp\mhcomputing.net_f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4_zor0jtoj.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ C:\Users\Admin\AppData\Local\Temp\mhcomputing.net_f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4_zor0jtoj.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{3A33DB50-CC69-497D-AB93-6EAB524EB9A7} C:\Users\Admin\AppData\Local\Temp\mhcomputing.net_f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4_zor0jtoj.exe N/A
Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\be-da-80-3a-ee-b6\WpadDecisionTime = 20e2082d0a9fd701 C:\Users\Admin\AppData\Local\Temp\mhcomputing.net_f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4_zor0jtoj.exe N/A
Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\RestartManager\Session0000\RegFiles0000 = 5c005c003f005c0043003a005c00550073006500720073005c00410064006d0069006e005c004e00540055005300450052002e004400410054007b00300031003600380038003800620064002d0036006300360066002d0031003100640065002d0038006400310064002d003000300031006500300062006300640065003300650063007d002e0054004d0043006f006e007400610069006e0065007200300030003000300030003000300030003000300030003000300030003000300030003000300032002e007200650067007400720061006e0073002d006d00730000000000 C:\Users\Admin\AppData\Local\Temp\mhcomputing.net_f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4_zor0jtoj.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix C:\Users\Admin\AppData\Local\Temp\mhcomputing.net_f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4_zor0jtoj.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{3A33DB50-CC69-497D-AB93-6EAB524EB9A7}\WpadDecision = "0" C:\Users\Admin\AppData\Local\Temp\mhcomputing.net_f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4_zor0jtoj.exe N/A
Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\RestartManager\Session0000\Owner = 8005000000e7032f0a9fd701 C:\Users\Admin\AppData\Local\Temp\mhcomputing.net_f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4_zor0jtoj.exe N/A
Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\RestartManager\Session0000\SessionHash = 13473ab4dd0a4a5b7e9ebe86f8c6f5eb95adc83231bdc23b159b28f0dcc72634 C:\Users\Admin\AppData\Local\Temp\mhcomputing.net_f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4_zor0jtoj.exe N/A
Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\RestartManager\Session0000\RegFilesHash = b1e7109daf1061b5f05f46583683bf7254b3c451aa324d419060b39eabe08d82 C:\Users\Admin\AppData\Local\Temp\mhcomputing.net_f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4_zor0jtoj.exe N/A

Modifies registry class

Description Indicator Process Target
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.53411c86 C:\Users\Admin\AppData\Local\Temp\mhcomputing.net_f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4_zor0jtoj.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.53411c86\ = "53411c86" C:\Users\Admin\AppData\Local\Temp\mhcomputing.net_f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4_zor0jtoj.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\53411c86\DefaultIcon C:\Users\Admin\AppData\Local\Temp\mhcomputing.net_f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4_zor0jtoj.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\53411c86 C:\Users\Admin\AppData\Local\Temp\mhcomputing.net_f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4_zor0jtoj.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\53411c86\DefaultIcon\ = "C:\\ProgramData\\53411c86.ico" C:\Users\Admin\AppData\Local\Temp\mhcomputing.net_f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4_zor0jtoj.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\mhcomputing.net_f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4_zor0jtoj.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\mhcomputing.net_f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4_zor0jtoj.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\mhcomputing.net_f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4_zor0jtoj.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\mhcomputing.net_f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4_zor0jtoj.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\mhcomputing.net_f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4_zor0jtoj.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\mhcomputing.net_f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4_zor0jtoj.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\mhcomputing.net_f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4_zor0jtoj.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\mhcomputing.net_f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4_zor0jtoj.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\mhcomputing.net_f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4_zor0jtoj.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\mhcomputing.net_f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4_zor0jtoj.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\mhcomputing.net_f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4_zor0jtoj.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\mhcomputing.net_f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4_zor0jtoj.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\mhcomputing.net_f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4_zor0jtoj.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\mhcomputing.net_f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4_zor0jtoj.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\mhcomputing.net_f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4_zor0jtoj.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\mhcomputing.net_f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4_zor0jtoj.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\mhcomputing.net_f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4_zor0jtoj.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\mhcomputing.net_f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4_zor0jtoj.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\mhcomputing.net_f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4_zor0jtoj.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\mhcomputing.net_f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4_zor0jtoj.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\mhcomputing.net_f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4_zor0jtoj.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\mhcomputing.net_f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4_zor0jtoj.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\mhcomputing.net_f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4_zor0jtoj.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\mhcomputing.net_f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4_zor0jtoj.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\mhcomputing.net_f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4_zor0jtoj.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\mhcomputing.net_f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4_zor0jtoj.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeBackupPrivilege N/A C:\Windows\system32\vssvc.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\vssvc.exe N/A
Token: SeAuditPrivilege N/A C:\Windows\system32\vssvc.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 1168 wrote to memory of 548 N/A C:\Users\Admin\AppData\Local\Temp\mhcomputing.net_f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4_zor0jtoj.exe C:\Users\Admin\AppData\Local\Temp\mhcomputing.net_f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4_zor0jtoj.exe
PID 1168 wrote to memory of 548 N/A C:\Users\Admin\AppData\Local\Temp\mhcomputing.net_f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4_zor0jtoj.exe C:\Users\Admin\AppData\Local\Temp\mhcomputing.net_f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4_zor0jtoj.exe
PID 1168 wrote to memory of 548 N/A C:\Users\Admin\AppData\Local\Temp\mhcomputing.net_f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4_zor0jtoj.exe C:\Users\Admin\AppData\Local\Temp\mhcomputing.net_f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4_zor0jtoj.exe
PID 1168 wrote to memory of 548 N/A C:\Users\Admin\AppData\Local\Temp\mhcomputing.net_f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4_zor0jtoj.exe C:\Users\Admin\AppData\Local\Temp\mhcomputing.net_f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4_zor0jtoj.exe
PID 1168 wrote to memory of 548 N/A C:\Users\Admin\AppData\Local\Temp\mhcomputing.net_f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4_zor0jtoj.exe C:\Users\Admin\AppData\Local\Temp\mhcomputing.net_f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4_zor0jtoj.exe
PID 548 wrote to memory of 1408 N/A C:\Users\Admin\AppData\Local\Temp\mhcomputing.net_f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4_zor0jtoj.exe C:\Users\Admin\AppData\Local\Temp\mhcomputing.net_f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4_zor0jtoj.exe
PID 548 wrote to memory of 1408 N/A C:\Users\Admin\AppData\Local\Temp\mhcomputing.net_f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4_zor0jtoj.exe C:\Users\Admin\AppData\Local\Temp\mhcomputing.net_f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4_zor0jtoj.exe
PID 548 wrote to memory of 1408 N/A C:\Users\Admin\AppData\Local\Temp\mhcomputing.net_f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4_zor0jtoj.exe C:\Users\Admin\AppData\Local\Temp\mhcomputing.net_f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4_zor0jtoj.exe
PID 548 wrote to memory of 1408 N/A C:\Users\Admin\AppData\Local\Temp\mhcomputing.net_f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4_zor0jtoj.exe C:\Users\Admin\AppData\Local\Temp\mhcomputing.net_f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4_zor0jtoj.exe

Processes

C:\Users\Admin\AppData\Local\Temp\mhcomputing.net_f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4_zor0jtoj.exe

"C:\Users\Admin\AppData\Local\Temp\mhcomputing.net_f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4_zor0jtoj.exe"

C:\Users\Admin\AppData\Local\Temp\mhcomputing.net_f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4_zor0jtoj.exe

"C:\Users\Admin\AppData\Local\Temp\mhcomputing.net_f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4_zor0jtoj.exe"

C:\Users\Admin\AppData\Local\Temp\mhcomputing.net_f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4_zor0jtoj.exe

"C:\Users\Admin\AppData\Local\Temp\mhcomputing.net_f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4_zor0jtoj.exe"

C:\Windows\system32\vssvc.exe

C:\Windows\system32\vssvc.exe

C:\Users\Admin\AppData\Local\Temp\mhcomputing.net_f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4_zor0jtoj.exe

C:\Users\Admin\AppData\Local\Temp\mhcomputing.net_f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4_zor0jtoj.exe -work worker0 job0-548

Network

Country Destination Domain Proto
N/A 8.8.8.8:53 baroquetees.com udp

Files

memory/2040-60-0x00000000760B1000-0x00000000760B3000-memory.dmp

memory/548-62-0x0000000000000000-mapping.dmp

memory/1408-64-0x0000000000000000-mapping.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2021-09-01 06:23

Reported

2021-09-01 06:25

Platform

win10v20210408

Max time kernel

23s

Max time network

114s

Command Line

"C:\Users\Admin\AppData\Local\Temp\mhcomputing.net_f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4_zor0jtoj.exe"

Signatures

DarkSide

ransomware darkside

Modifies extensions of user files

ransomware
Description Indicator Process Target
File opened for modification C:\Users\Admin\Pictures\StopUninstall.tiff C:\Users\Admin\AppData\Local\Temp\mhcomputing.net_f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4_zor0jtoj.exe N/A
File opened for modification C:\Users\Admin\Pictures\TraceSet.tif.70d4d153 C:\Users\Admin\AppData\Local\Temp\mhcomputing.net_f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4_zor0jtoj.exe N/A
File renamed C:\Users\Admin\Pictures\EnterExport.raw => C:\Users\Admin\Pictures\EnterExport.raw.70d4d153 C:\Users\Admin\AppData\Local\Temp\mhcomputing.net_f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4_zor0jtoj.exe N/A
File opened for modification C:\Users\Admin\Pictures\EnterExport.raw.70d4d153 C:\Users\Admin\AppData\Local\Temp\mhcomputing.net_f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4_zor0jtoj.exe N/A
File renamed C:\Users\Admin\Pictures\ReadOptimize.raw => C:\Users\Admin\Pictures\ReadOptimize.raw.70d4d153 C:\Users\Admin\AppData\Local\Temp\mhcomputing.net_f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4_zor0jtoj.exe N/A
File opened for modification C:\Users\Admin\Pictures\ReadOptimize.raw.70d4d153 C:\Users\Admin\AppData\Local\Temp\mhcomputing.net_f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4_zor0jtoj.exe N/A
File opened for modification C:\Users\Admin\Pictures\RequestAdd.tiff C:\Users\Admin\AppData\Local\Temp\mhcomputing.net_f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4_zor0jtoj.exe N/A
File renamed C:\Users\Admin\Pictures\UnregisterMerge.raw => C:\Users\Admin\Pictures\UnregisterMerge.raw.70d4d153 C:\Users\Admin\AppData\Local\Temp\mhcomputing.net_f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4_zor0jtoj.exe N/A
File opened for modification C:\Users\Admin\Pictures\UnregisterMerge.raw.70d4d153 C:\Users\Admin\AppData\Local\Temp\mhcomputing.net_f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4_zor0jtoj.exe N/A
File opened for modification C:\Users\Admin\Pictures\RequestAdd.tiff.70d4d153 C:\Users\Admin\AppData\Local\Temp\mhcomputing.net_f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4_zor0jtoj.exe N/A
File opened for modification C:\Users\Admin\Pictures\StopUninstall.tiff.70d4d153 C:\Users\Admin\AppData\Local\Temp\mhcomputing.net_f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4_zor0jtoj.exe N/A
File renamed C:\Users\Admin\Pictures\RequestAdd.tiff => C:\Users\Admin\Pictures\RequestAdd.tiff.70d4d153 C:\Users\Admin\AppData\Local\Temp\mhcomputing.net_f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4_zor0jtoj.exe N/A
File renamed C:\Users\Admin\Pictures\StopUninstall.tiff => C:\Users\Admin\Pictures\StopUninstall.tiff.70d4d153 C:\Users\Admin\AppData\Local\Temp\mhcomputing.net_f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4_zor0jtoj.exe N/A
File renamed C:\Users\Admin\Pictures\TraceSet.tif => C:\Users\Admin\Pictures\TraceSet.tif.70d4d153 C:\Users\Admin\AppData\Local\Temp\mhcomputing.net_f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4_zor0jtoj.exe N/A

Drops file in System32 directory

Description Indicator Process Target
File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\counters2.dat C:\Users\Admin\AppData\Local\Temp\mhcomputing.net_f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4_zor0jtoj.exe N/A
File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\Content.IE5 C:\Users\Admin\AppData\Local\Temp\mhcomputing.net_f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4_zor0jtoj.exe N/A
File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE C:\Users\Admin\AppData\Local\Temp\mhcomputing.net_f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4_zor0jtoj.exe N/A
File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCookies C:\Users\Admin\AppData\Local\Temp\mhcomputing.net_f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4_zor0jtoj.exe N/A
File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5 C:\Users\Admin\AppData\Local\Temp\mhcomputing.net_f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4_zor0jtoj.exe N/A

Sets desktop wallpaper using registry

ransomware
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Control Panel\Desktop\WallPaper = "C:\\ProgramData\\70d4d153.BMP" C:\Users\Admin\AppData\Local\Temp\mhcomputing.net_f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4_zor0jtoj.exe N/A

Modifies Control Panel

evasion
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Control Panel\Desktop\WallpaperStyle = "10" C:\Users\Admin\AppData\Local\Temp\mhcomputing.net_f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4_zor0jtoj.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Control Panel\Desktop C:\Users\Admin\AppData\Local\Temp\mhcomputing.net_f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4_zor0jtoj.exe N/A

Modifies data under HKEY_USERS

Description Indicator Process Target
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:" C:\Users\Admin\AppData\Local\Temp\mhcomputing.net_f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4_zor0jtoj.exe N/A
Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\RestartManager\Session0000\SessionHash = 23fbaab0eebeb4d327cdd340cf9131b9a65dcda60fd390d58195139fe32cc6f7 C:\Users\Admin\AppData\Local\Temp\mhcomputing.net_f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4_zor0jtoj.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\RestartManager\Session0000\Sequence = "1" C:\Users\Admin\AppData\Local\Temp\mhcomputing.net_f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4_zor0jtoj.exe N/A
Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\RestartManager\Session0000\SessionHash = 4cb47595a5ddf6519122604b1ee05c7043e69b14cedb0bbb5168786ab7f82044 C:\Users\Admin\AppData\Local\Temp\mhcomputing.net_f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4_zor0jtoj.exe N/A
Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\RestartManager\Session0000\RegFiles0000 = 5c005c003f005c0043003a005c00550073006500720073005c00410064006d0069006e005c004e00540055005300450052002e004400410054007b00340065003000370034003600360038002d0030006300310063002d0031003100650037002d0061003900340033002d006500340031006400320064003700310038006100320030007d002e0054004d0043006f006e007400610069006e0065007200300030003000300030003000300030003000300030003000300030003000300030003000300032002e007200650067007400720061006e0073002d006d00730000000000 C:\Users\Admin\AppData\Local\Temp\mhcomputing.net_f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4_zor0jtoj.exe N/A
Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\RestartManager\Session0000\RegFilesHash = 9aebe078ddd792d6d9f74d4809ab061248db7646051436ce827df41df606fa26 C:\Users\Admin\AppData\Local\Temp\mhcomputing.net_f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4_zor0jtoj.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Control Panel\Desktop\Wallpaper = "C:\\ProgramData\\70d4d153.BMP" C:\Users\Admin\AppData\Local\Temp\mhcomputing.net_f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4_zor0jtoj.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1" C:\Users\Admin\AppData\Local\Temp\mhcomputing.net_f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4_zor0jtoj.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\RestartManager C:\Users\Admin\AppData\Local\Temp\mhcomputing.net_f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4_zor0jtoj.exe N/A
Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\RestartManager\Session0000\RegFilesHash = 6ffdcbc3f9f1cb891389a9fa5bd63a4931263932ff05b75b7f24de195b372e51 C:\Users\Admin\AppData\Local\Temp\mhcomputing.net_f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4_zor0jtoj.exe N/A
Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\RestartManager\Session0000\SessionHash = 2d04f57ba82e318f96508b25dfa27bbafaf8cfd1647194121c8761793c5cccd5 C:\Users\Admin\AppData\Local\Temp\mhcomputing.net_f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4_zor0jtoj.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Control Panel\International C:\Users\Admin\AppData\Local\Temp\mhcomputing.net_f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4_zor0jtoj.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:" C:\Users\Admin\AppData\Local\Temp\mhcomputing.net_f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4_zor0jtoj.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ C:\Users\Admin\AppData\Local\Temp\mhcomputing.net_f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4_zor0jtoj.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software C:\Users\Admin\AppData\Local\Temp\mhcomputing.net_f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4_zor0jtoj.exe N/A
Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\RestartManager\Session0000\RegFiles0000 = 5c005c003f005c0043003a005c00550073006500720073005c00410064006d0069006e005c006e00740075007300650072002e006400610074002e004c004f004700310000000000 C:\Users\Admin\AppData\Local\Temp\mhcomputing.net_f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4_zor0jtoj.exe N/A
Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\RestartManager\Session0000\RegFiles0000 = 5c005c003f005c0043003a005c00550073006500720073005c00410064006d0069006e005c004e00540055005300450052002e004400410054007b00340065003000370034003600360038002d0030006300310063002d0031003100650037002d0061003900340033002d006500340031006400320064003700310038006100320030007d002e0054004d002e0062006c00660000000000 C:\Users\Admin\AppData\Local\Temp\mhcomputing.net_f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4_zor0jtoj.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1" C:\Users\Admin\AppData\Local\Temp\mhcomputing.net_f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4_zor0jtoj.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0" C:\Users\Admin\AppData\Local\Temp\mhcomputing.net_f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4_zor0jtoj.exe N/A
Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\RestartManager\Session0000\Owner = ec08000075f9da1c0a9fd701 C:\Users\Admin\AppData\Local\Temp\mhcomputing.net_f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4_zor0jtoj.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix C:\Users\Admin\AppData\Local\Temp\mhcomputing.net_f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4_zor0jtoj.exe N/A
Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\RestartManager\Session0000\RegFilesHash = d7158bd8cd0fe0139f858002636a4751accaf1341e9e7bd10a70f3cc3928ff70 C:\Users\Admin\AppData\Local\Temp\mhcomputing.net_f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4_zor0jtoj.exe N/A
Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\RestartManager\Session0000\RegFiles0000 = 5c005c003f005c0043003a005c00550073006500720073005c00410064006d0069006e005c004e00540055005300450052002e004400410054007b00340065003000370034003600360038002d0030006300310063002d0031003100650037002d0061003900340033002d006500340031006400320064003700310038006100320030007d002e0054004d0043006f006e007400610069006e0065007200300030003000300030003000300030003000300030003000300030003000300030003000300031002e007200650067007400720061006e0073002d006d00730000000000 C:\Users\Admin\AppData\Local\Temp\mhcomputing.net_f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4_zor0jtoj.exe N/A
Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\RestartManager\Session0000\SessionHash = eb2398ca1db38873eca3f05c4d9c231172099624ccde986f1dccb427fedb8c1d C:\Users\Admin\AppData\Local\Temp\mhcomputing.net_f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4_zor0jtoj.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1" C:\Users\Admin\AppData\Local\Temp\mhcomputing.net_f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4_zor0jtoj.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\RestartManager\Session0000 C:\Users\Admin\AppData\Local\Temp\mhcomputing.net_f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4_zor0jtoj.exe N/A
Key deleted \REGISTRY\USER\.DEFAULT\Software\Microsoft\RestartManager\Session0000 C:\Users\Admin\AppData\Local\Temp\mhcomputing.net_f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4_zor0jtoj.exe N/A
Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\RestartManager\Session0000\RegFilesHash = 00e232188d35a4fce6436fd80edd447f52f603ad70e2b7ce4b04187afc4392d7 C:\Users\Admin\AppData\Local\Temp\mhcomputing.net_f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4_zor0jtoj.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft C:\Users\Admin\AppData\Local\Temp\mhcomputing.net_f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4_zor0jtoj.exe N/A

Modifies registry class

Description Indicator Process Target
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\70d4d153 C:\Users\Admin\AppData\Local\Temp\mhcomputing.net_f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4_zor0jtoj.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\70d4d153\DefaultIcon\ = "C:\\ProgramData\\70d4d153.ico" C:\Users\Admin\AppData\Local\Temp\mhcomputing.net_f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4_zor0jtoj.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.70d4d153 C:\Users\Admin\AppData\Local\Temp\mhcomputing.net_f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4_zor0jtoj.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.70d4d153\ = "70d4d153" C:\Users\Admin\AppData\Local\Temp\mhcomputing.net_f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4_zor0jtoj.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\70d4d153\DefaultIcon C:\Users\Admin\AppData\Local\Temp\mhcomputing.net_f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4_zor0jtoj.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\mhcomputing.net_f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4_zor0jtoj.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\mhcomputing.net_f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4_zor0jtoj.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\mhcomputing.net_f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4_zor0jtoj.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\mhcomputing.net_f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4_zor0jtoj.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\mhcomputing.net_f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4_zor0jtoj.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\mhcomputing.net_f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4_zor0jtoj.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\mhcomputing.net_f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4_zor0jtoj.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\mhcomputing.net_f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4_zor0jtoj.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\mhcomputing.net_f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4_zor0jtoj.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\mhcomputing.net_f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4_zor0jtoj.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\mhcomputing.net_f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4_zor0jtoj.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\mhcomputing.net_f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4_zor0jtoj.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\mhcomputing.net_f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4_zor0jtoj.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\mhcomputing.net_f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4_zor0jtoj.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\mhcomputing.net_f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4_zor0jtoj.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\mhcomputing.net_f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4_zor0jtoj.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\mhcomputing.net_f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4_zor0jtoj.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\mhcomputing.net_f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4_zor0jtoj.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\mhcomputing.net_f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4_zor0jtoj.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\mhcomputing.net_f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4_zor0jtoj.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\mhcomputing.net_f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4_zor0jtoj.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\mhcomputing.net_f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4_zor0jtoj.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\mhcomputing.net_f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4_zor0jtoj.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\mhcomputing.net_f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4_zor0jtoj.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\mhcomputing.net_f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4_zor0jtoj.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\mhcomputing.net_f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4_zor0jtoj.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeBackupPrivilege N/A C:\Windows\system32\vssvc.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\vssvc.exe N/A
Token: SeAuditPrivilege N/A C:\Windows\system32\vssvc.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 3160 wrote to memory of 576 N/A C:\Users\Admin\AppData\Local\Temp\mhcomputing.net_f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4_zor0jtoj.exe C:\Users\Admin\AppData\Local\Temp\mhcomputing.net_f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4_zor0jtoj.exe
PID 3160 wrote to memory of 576 N/A C:\Users\Admin\AppData\Local\Temp\mhcomputing.net_f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4_zor0jtoj.exe C:\Users\Admin\AppData\Local\Temp\mhcomputing.net_f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4_zor0jtoj.exe
PID 3160 wrote to memory of 576 N/A C:\Users\Admin\AppData\Local\Temp\mhcomputing.net_f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4_zor0jtoj.exe C:\Users\Admin\AppData\Local\Temp\mhcomputing.net_f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4_zor0jtoj.exe
PID 3160 wrote to memory of 576 N/A C:\Users\Admin\AppData\Local\Temp\mhcomputing.net_f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4_zor0jtoj.exe C:\Users\Admin\AppData\Local\Temp\mhcomputing.net_f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4_zor0jtoj.exe
PID 576 wrote to memory of 2284 N/A C:\Users\Admin\AppData\Local\Temp\mhcomputing.net_f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4_zor0jtoj.exe C:\Users\Admin\AppData\Local\Temp\mhcomputing.net_f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4_zor0jtoj.exe
PID 576 wrote to memory of 2284 N/A C:\Users\Admin\AppData\Local\Temp\mhcomputing.net_f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4_zor0jtoj.exe C:\Users\Admin\AppData\Local\Temp\mhcomputing.net_f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4_zor0jtoj.exe
PID 576 wrote to memory of 2284 N/A C:\Users\Admin\AppData\Local\Temp\mhcomputing.net_f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4_zor0jtoj.exe C:\Users\Admin\AppData\Local\Temp\mhcomputing.net_f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4_zor0jtoj.exe
PID 576 wrote to memory of 3296 N/A C:\Users\Admin\AppData\Local\Temp\mhcomputing.net_f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4_zor0jtoj.exe C:\Users\Admin\AppData\Local\Temp\mhcomputing.net_f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4_zor0jtoj.exe
PID 576 wrote to memory of 3296 N/A C:\Users\Admin\AppData\Local\Temp\mhcomputing.net_f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4_zor0jtoj.exe C:\Users\Admin\AppData\Local\Temp\mhcomputing.net_f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4_zor0jtoj.exe
PID 576 wrote to memory of 3296 N/A C:\Users\Admin\AppData\Local\Temp\mhcomputing.net_f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4_zor0jtoj.exe C:\Users\Admin\AppData\Local\Temp\mhcomputing.net_f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4_zor0jtoj.exe

Processes

C:\Users\Admin\AppData\Local\Temp\mhcomputing.net_f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4_zor0jtoj.exe

"C:\Users\Admin\AppData\Local\Temp\mhcomputing.net_f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4_zor0jtoj.exe"

C:\Users\Admin\AppData\Local\Temp\mhcomputing.net_f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4_zor0jtoj.exe

"C:\Users\Admin\AppData\Local\Temp\mhcomputing.net_f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4_zor0jtoj.exe"

C:\Users\Admin\AppData\Local\Temp\mhcomputing.net_f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4_zor0jtoj.exe

"C:\Users\Admin\AppData\Local\Temp\mhcomputing.net_f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4_zor0jtoj.exe"

C:\Windows\system32\vssvc.exe

C:\Windows\system32\vssvc.exe

C:\Users\Admin\AppData\Local\Temp\mhcomputing.net_f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4_zor0jtoj.exe

C:\Users\Admin\AppData\Local\Temp\mhcomputing.net_f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4_zor0jtoj.exe -work worker0 job0-576

C:\Users\Admin\AppData\Local\Temp\mhcomputing.net_f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4_zor0jtoj.exe

C:\Users\Admin\AppData\Local\Temp\mhcomputing.net_f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4_zor0jtoj.exe -work worker1 job1-576

Network

Country Destination Domain Proto
N/A 8.8.8.8:53 baroquetees.com udp

Files

memory/576-114-0x0000000000000000-mapping.dmp

memory/2284-115-0x0000000000000000-mapping.dmp

memory/3296-116-0x0000000000000000-mapping.dmp