Analysis
-
max time kernel
119s -
max time network
122s -
platform
windows7_x64 -
resource
win7v20210410 -
submitted
01-09-2021 06:10
Static task
static1
Behavioral task
behavioral1
Sample
mhcomputing.net_f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4_19n_yl17.exe
Resource
win7v20210410
Behavioral task
behavioral2
Sample
mhcomputing.net_f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4_19n_yl17.exe
Resource
win10v20210408
General
-
Target
mhcomputing.net_f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4_19n_yl17.exe
-
Size
56KB
-
MD5
3f2cb535fc5bc296aa5b0d2897c265d0
-
SHA1
c30358563fa940eb5cd6064d4d16defee43b0310
-
SHA256
f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4
-
SHA512
6fc3a98f16f4fbd2e6bd4211c35b403ed565d6b30f803e6da04e14efe018aca09719256f1e8a2c8a5763a7bac08de3be964eb6251d858df0f6261f82b3f2f7a2
Malware Config
Extracted
C:\\README.949640ab.TXT
darkside
http://darksidc3iux462n6yunevoag52ntvwp6wulaz3zirkmh4cnz6hhj7id.onion/162/thedixiegroup/LCfyHRcwffrYTblpZvoPO3XDbrYPcNu0wVAsH5p49LSjBfzTmtdXT48azXFlMu7q
http://dark24zz36xm4y2phwe7yvnkkkkhxionhfrwp67awpb3r3bdcneivoqd.onion/W57MRI9C7YZJUZEABBBYRQLSUTG22JZ9MAH0WT1ISHC405KP7Z2UWY3AI3J68DNM
Signatures
-
DarkSide
Targeted ransomware first seen in August 2020. Operators steal data to use as leverage.
-
Modifies extensions of user files 8 IoCs
Ransomware generally changes the extension on encrypted files.
Processes:
mhcomputing.net_f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4_19n_yl17.exedescription ioc process File opened for modification C:\Users\Admin\Pictures\RedoTest.tif.949640ab mhcomputing.net_f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4_19n_yl17.exe File renamed C:\Users\Admin\Pictures\SelectOpen.crw => C:\Users\Admin\Pictures\SelectOpen.crw.949640ab mhcomputing.net_f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4_19n_yl17.exe File opened for modification C:\Users\Admin\Pictures\SelectOpen.crw.949640ab mhcomputing.net_f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4_19n_yl17.exe File renamed C:\Users\Admin\Pictures\SendMove.tif => C:\Users\Admin\Pictures\SendMove.tif.949640ab mhcomputing.net_f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4_19n_yl17.exe File opened for modification C:\Users\Admin\Pictures\SendMove.tif.949640ab mhcomputing.net_f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4_19n_yl17.exe File renamed C:\Users\Admin\Pictures\BackupClear.crw => C:\Users\Admin\Pictures\BackupClear.crw.949640ab mhcomputing.net_f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4_19n_yl17.exe File opened for modification C:\Users\Admin\Pictures\BackupClear.crw.949640ab mhcomputing.net_f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4_19n_yl17.exe File renamed C:\Users\Admin\Pictures\RedoTest.tif => C:\Users\Admin\Pictures\RedoTest.tif.949640ab mhcomputing.net_f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4_19n_yl17.exe -
Drops file in System32 directory 1 IoCs
Processes:
mhcomputing.net_f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4_19n_yl17.exedescription ioc process File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\counters.dat mhcomputing.net_f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4_19n_yl17.exe -
Sets desktop wallpaper using registry 2 TTPs 1 IoCs
Processes:
mhcomputing.net_f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4_19n_yl17.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Control Panel\Desktop\WallPaper = "C:\\ProgramData\\949640ab.BMP" mhcomputing.net_f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4_19n_yl17.exe -
Modifies Control Panel 2 IoCs
Processes:
mhcomputing.net_f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4_19n_yl17.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Control Panel\Desktop mhcomputing.net_f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4_19n_yl17.exe Set value (str) \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Control Panel\Desktop\WallpaperStyle = "10" mhcomputing.net_f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4_19n_yl17.exe -
Modifies data under HKEY_USERS 46 IoCs
Processes:
mhcomputing.net_f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4_19n_yl17.exemhcomputing.net_f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4_19n_yl17.exedescription ioc process Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\16-d8-fc-12-6a-1a\WpadDecisionTime = 20a1b196f89ed701 mhcomputing.net_f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4_19n_yl17.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "1" mhcomputing.net_f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4_19n_yl17.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\RestartManager\Session0000\RegFiles0000 = 5c005c003f005c0043003a005c00550073006500720073005c00410064006d0069006e005c004e00540055005300450052002e004400410054007b00300031003600380038003800620064002d0036006300360066002d0031003100640065002d0038006400310064002d003000300031006500300062006300640065003300650063007d002e0054004d0043006f006e007400610069006e0065007200300030003000300030003000300030003000300030003000300030003000300030003000300031002e007200650067007400720061006e0073002d006d00730000000000 mhcomputing.net_f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4_19n_yl17.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\RestartManager\Session0000\SessionHash = 66ac054cdd65182f8cdf8f5e64069c5a2d74d2f2267f277ce18c14bbc2fb65c6 mhcomputing.net_f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4_19n_yl17.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\RestartManager\Session0000\RegFilesHash = c491fa7399d088c6ab9b9b7eeefc0b673a374a7f8eba265b1b6ebadf9bc67de5 mhcomputing.net_f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4_19n_yl17.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000003000000090000000000000000000000000000000400000000000000000000000000000000000000000000000000000001000000020000000a070026000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 mhcomputing.net_f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4_19n_yl17.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix mhcomputing.net_f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4_19n_yl17.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\RestartManager\Session0000 mhcomputing.net_f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4_19n_yl17.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\RestartManager\Session0000\SessionHash = 02e062834ba89cd7658f69e6a61b3230297760300956af0587b884a84000757f mhcomputing.net_f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4_19n_yl17.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\RestartManager\Session0000\RegFilesHash = 85981a5ccad5b3f39a3f2e4a69579fe26b6d3359cbd0d42b3a152d3bf5c1faac mhcomputing.net_f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4_19n_yl17.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\RestartManager\Session0000\RegFiles0000 = 5c005c003f005c0043003a005c00550073006500720073005c00410064006d0069006e005c004e00540055005300450052002e004400410054007b00300031003600380038003800620064002d0036006300360066002d0031003100640065002d0038006400310064002d003000300031006500300062006300640065003300650063007d002e0054004d002e0062006c00660000000000 mhcomputing.net_f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4_19n_yl17.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings mhcomputing.net_f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4_19n_yl17.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad mhcomputing.net_f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4_19n_yl17.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{2A905F01-0A57-4E51-8685-54144DDC3A32}\WpadNetworkName = "Network" mhcomputing.net_f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4_19n_yl17.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\RestartManager mhcomputing.net_f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4_19n_yl17.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\RestartManager\Session0000\RegFilesHash = fe4728eeaa2ca77f97e8aa3c76c2bd5690472fb13b2b1de3d3f6e0323d698ad8 mhcomputing.net_f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4_19n_yl17.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\RestartManager\Session0000\RegFiles0000 = 5c005c003f005c0043003a005c00550073006500720073005c00410064006d0069006e005c004e00540055005300450052002e004400410054007b00300031003600380038003800620064002d0036006300360066002d0031003100640065002d0038006400310064002d003000300031006500300062006300640065003300650063007d002e0054004d0043006f006e007400610069006e0065007200300030003000300030003000300030003000300030003000300030003000300030003000300032002e007200650067007400720061006e0073002d006d00730000000000 mhcomputing.net_f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4_19n_yl17.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:" mhcomputing.net_f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4_19n_yl17.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{2A905F01-0A57-4E51-8685-54144DDC3A32}\WpadDecisionReason = "1" mhcomputing.net_f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4_19n_yl17.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{2A905F01-0A57-4E51-8685-54144DDC3A32}\WpadDecisionTime = 20a1b196f89ed701 mhcomputing.net_f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4_19n_yl17.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\16-d8-fc-12-6a-1a mhcomputing.net_f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4_19n_yl17.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft mhcomputing.net_f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4_19n_yl17.exe Set value (str) \REGISTRY\USER\.DEFAULT\Control Panel\Desktop\Wallpaper = "C:\\ProgramData\\949640ab.BMP" mhcomputing.net_f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4_19n_yl17.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings mhcomputing.net_f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4_19n_yl17.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyEnable = "0" mhcomputing.net_f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4_19n_yl17.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{2A905F01-0A57-4E51-8685-54144DDC3A32} mhcomputing.net_f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4_19n_yl17.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{2A905F01-0A57-4E51-8685-54144DDC3A32}\WpadDecision = "0" mhcomputing.net_f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4_19n_yl17.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{2A905F01-0A57-4E51-8685-54144DDC3A32}\16-d8-fc-12-6a-1a mhcomputing.net_f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4_19n_yl17.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\16-d8-fc-12-6a-1a\WpadDecision = "0" mhcomputing.net_f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4_19n_yl17.exe Key created \REGISTRY\USER\.DEFAULT\Software mhcomputing.net_f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4_19n_yl17.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\RestartManager\Session0000\Owner = cc03000080707297f89ed701 mhcomputing.net_f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4_19n_yl17.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections mhcomputing.net_f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4_19n_yl17.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\SavedLegacySettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 mhcomputing.net_f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4_19n_yl17.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ mhcomputing.net_f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4_19n_yl17.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\16-d8-fc-12-6a-1a\WpadDecisionReason = "1" mhcomputing.net_f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4_19n_yl17.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "0" mhcomputing.net_f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4_19n_yl17.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 mhcomputing.net_f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4_19n_yl17.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\RestartManager\Session0000\RegFiles0000 = 5c005c003f005c0043003a005c00550073006500720073005c00410064006d0069006e005c006e00740075007300650072002e006400610074002e004c004f004700310000000000 mhcomputing.net_f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4_19n_yl17.exe Key deleted \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\RestartManager\Session0000 mhcomputing.net_f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4_19n_yl17.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\RestartManager\Session0000\SessionHash = ed5ec3aca774586707380b6abd5cfb86c44cc35273f997fde71e19019972cf23 mhcomputing.net_f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4_19n_yl17.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\RestartManager\Session0000\SessionHash = c16ab8243f2bc8227c41d05b00090edded4c5def2c1c7f83a3b3e36032dd9a4d mhcomputing.net_f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4_19n_yl17.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\RestartManager\Session0000\Sequence = "1" mhcomputing.net_f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4_19n_yl17.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:" mhcomputing.net_f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4_19n_yl17.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\RestartManager\Session0000 mhcomputing.net_f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4_19n_yl17.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\RestartManager\Session0000\RegFilesHash = f9ed21bf7adc6707fe8ab5665fe2af39359ff23a0cdf3599c91fedfe56fa04dc mhcomputing.net_f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4_19n_yl17.exe Key created \REGISTRY\USER\.DEFAULT\Control Panel\International mhcomputing.net_f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4_19n_yl17.exe -
Modifies registry class 5 IoCs
Processes:
mhcomputing.net_f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4_19n_yl17.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\949640ab\DefaultIcon mhcomputing.net_f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4_19n_yl17.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\949640ab mhcomputing.net_f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4_19n_yl17.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\949640ab\DefaultIcon\ = "C:\\ProgramData\\949640ab.ico" mhcomputing.net_f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4_19n_yl17.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.949640ab mhcomputing.net_f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4_19n_yl17.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.949640ab\ = "949640ab" mhcomputing.net_f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4_19n_yl17.exe -
Suspicious behavior: EnumeratesProcesses 26 IoCs
Processes:
mhcomputing.net_f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4_19n_yl17.exemhcomputing.net_f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4_19n_yl17.exepid process 1744 mhcomputing.net_f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4_19n_yl17.exe 1744 mhcomputing.net_f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4_19n_yl17.exe 972 mhcomputing.net_f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4_19n_yl17.exe 972 mhcomputing.net_f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4_19n_yl17.exe 972 mhcomputing.net_f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4_19n_yl17.exe 972 mhcomputing.net_f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4_19n_yl17.exe 972 mhcomputing.net_f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4_19n_yl17.exe 972 mhcomputing.net_f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4_19n_yl17.exe 972 mhcomputing.net_f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4_19n_yl17.exe 972 mhcomputing.net_f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4_19n_yl17.exe 972 mhcomputing.net_f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4_19n_yl17.exe 972 mhcomputing.net_f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4_19n_yl17.exe 972 mhcomputing.net_f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4_19n_yl17.exe 972 mhcomputing.net_f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4_19n_yl17.exe 972 mhcomputing.net_f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4_19n_yl17.exe 972 mhcomputing.net_f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4_19n_yl17.exe 972 mhcomputing.net_f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4_19n_yl17.exe 972 mhcomputing.net_f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4_19n_yl17.exe 972 mhcomputing.net_f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4_19n_yl17.exe 972 mhcomputing.net_f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4_19n_yl17.exe 972 mhcomputing.net_f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4_19n_yl17.exe 972 mhcomputing.net_f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4_19n_yl17.exe 972 mhcomputing.net_f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4_19n_yl17.exe 972 mhcomputing.net_f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4_19n_yl17.exe 972 mhcomputing.net_f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4_19n_yl17.exe 972 mhcomputing.net_f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4_19n_yl17.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
vssvc.exedescription pid process Token: SeBackupPrivilege 1528 vssvc.exe Token: SeRestorePrivilege 1528 vssvc.exe Token: SeAuditPrivilege 1528 vssvc.exe -
Suspicious use of WriteProcessMemory 9 IoCs
Processes:
mhcomputing.net_f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4_19n_yl17.exemhcomputing.net_f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4_19n_yl17.exedescription pid process target process PID 1964 wrote to memory of 1744 1964 mhcomputing.net_f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4_19n_yl17.exe mhcomputing.net_f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4_19n_yl17.exe PID 1964 wrote to memory of 1744 1964 mhcomputing.net_f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4_19n_yl17.exe mhcomputing.net_f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4_19n_yl17.exe PID 1964 wrote to memory of 1744 1964 mhcomputing.net_f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4_19n_yl17.exe mhcomputing.net_f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4_19n_yl17.exe PID 1964 wrote to memory of 1744 1964 mhcomputing.net_f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4_19n_yl17.exe mhcomputing.net_f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4_19n_yl17.exe PID 1964 wrote to memory of 1744 1964 mhcomputing.net_f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4_19n_yl17.exe mhcomputing.net_f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4_19n_yl17.exe PID 1744 wrote to memory of 972 1744 mhcomputing.net_f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4_19n_yl17.exe mhcomputing.net_f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4_19n_yl17.exe PID 1744 wrote to memory of 972 1744 mhcomputing.net_f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4_19n_yl17.exe mhcomputing.net_f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4_19n_yl17.exe PID 1744 wrote to memory of 972 1744 mhcomputing.net_f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4_19n_yl17.exe mhcomputing.net_f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4_19n_yl17.exe PID 1744 wrote to memory of 972 1744 mhcomputing.net_f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4_19n_yl17.exe mhcomputing.net_f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4_19n_yl17.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\mhcomputing.net_f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4_19n_yl17.exe"C:\Users\Admin\AppData\Local\Temp\mhcomputing.net_f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4_19n_yl17.exe"1⤵
-
C:\Users\Admin\AppData\Local\Temp\mhcomputing.net_f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4_19n_yl17.exe"C:\Users\Admin\AppData\Local\Temp\mhcomputing.net_f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4_19n_yl17.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\mhcomputing.net_f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4_19n_yl17.exe"C:\Users\Admin\AppData\Local\Temp\mhcomputing.net_f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4_19n_yl17.exe"2⤵
- Drops file in System32 directory
- Sets desktop wallpaper using registry
- Modifies Control Panel
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\mhcomputing.net_f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4_19n_yl17.exeC:\Users\Admin\AppData\Local\Temp\mhcomputing.net_f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4_19n_yl17.exe -work worker0 job0-17443⤵
- Modifies extensions of user files
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken