Analysis
-
max time kernel
16s -
max time network
114s -
platform
windows10_x64 -
resource
win10v20210410 -
submitted
01-09-2021 06:14
Static task
static1
Behavioral task
behavioral1
Sample
mhcomputing.net_f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4_umwwkg7w.exe
Resource
win7v20210408
Behavioral task
behavioral2
Sample
mhcomputing.net_f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4_umwwkg7w.exe
Resource
win10v20210410
General
-
Target
mhcomputing.net_f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4_umwwkg7w.exe
-
Size
56KB
-
MD5
3f2cb535fc5bc296aa5b0d2897c265d0
-
SHA1
c30358563fa940eb5cd6064d4d16defee43b0310
-
SHA256
f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4
-
SHA512
6fc3a98f16f4fbd2e6bd4211c35b403ed565d6b30f803e6da04e14efe018aca09719256f1e8a2c8a5763a7bac08de3be964eb6251d858df0f6261f82b3f2f7a2
Malware Config
Extracted
C:\\README.aeef1a75.TXT
darkside
http://darksidc3iux462n6yunevoag52ntvwp6wulaz3zirkmh4cnz6hhj7id.onion/162/thedixiegroup/LCfyHRcwffrYTblpZvoPO3XDbrYPcNu0wVAsH5p49LSjBfzTmtdXT48azXFlMu7q
http://dark24zz36xm4y2phwe7yvnkkkkhxionhfrwp67awpb3r3bdcneivoqd.onion/W57MRI9C7YZJUZEABBBYRQLSUTG22JZ9MAH0WT1ISHC405KP7Z2UWY3AI3J68DNM
Signatures
-
DarkSide
Targeted ransomware first seen in August 2020. Operators steal data to use as leverage.
-
Modifies extensions of user files 14 IoCs
Ransomware generally changes the extension on encrypted files.
Processes:
mhcomputing.net_f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4_umwwkg7w.exedescription ioc process File opened for modification C:\Users\Admin\Pictures\MountExport.tiff.aeef1a75 mhcomputing.net_f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4_umwwkg7w.exe File opened for modification C:\Users\Admin\Pictures\ExpandGroup.tif.aeef1a75 mhcomputing.net_f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4_umwwkg7w.exe File opened for modification C:\Users\Admin\Pictures\OutCheckpoint.tiff.aeef1a75 mhcomputing.net_f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4_umwwkg7w.exe File renamed C:\Users\Admin\Pictures\UnblockRestore.tif => C:\Users\Admin\Pictures\UnblockRestore.tif.aeef1a75 mhcomputing.net_f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4_umwwkg7w.exe File opened for modification C:\Users\Admin\Pictures\UnblockRestore.tif.aeef1a75 mhcomputing.net_f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4_umwwkg7w.exe File renamed C:\Users\Admin\Pictures\ExpandGroup.tif => C:\Users\Admin\Pictures\ExpandGroup.tif.aeef1a75 mhcomputing.net_f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4_umwwkg7w.exe File renamed C:\Users\Admin\Pictures\OutCheckpoint.tiff => C:\Users\Admin\Pictures\OutCheckpoint.tiff.aeef1a75 mhcomputing.net_f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4_umwwkg7w.exe File renamed C:\Users\Admin\Pictures\RemoveConvertFrom.raw => C:\Users\Admin\Pictures\RemoveConvertFrom.raw.aeef1a75 mhcomputing.net_f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4_umwwkg7w.exe File opened for modification C:\Users\Admin\Pictures\RevokeDeny.crw.aeef1a75 mhcomputing.net_f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4_umwwkg7w.exe File opened for modification C:\Users\Admin\Pictures\MountExport.tiff mhcomputing.net_f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4_umwwkg7w.exe File opened for modification C:\Users\Admin\Pictures\OutCheckpoint.tiff mhcomputing.net_f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4_umwwkg7w.exe File opened for modification C:\Users\Admin\Pictures\RemoveConvertFrom.raw.aeef1a75 mhcomputing.net_f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4_umwwkg7w.exe File renamed C:\Users\Admin\Pictures\RevokeDeny.crw => C:\Users\Admin\Pictures\RevokeDeny.crw.aeef1a75 mhcomputing.net_f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4_umwwkg7w.exe File renamed C:\Users\Admin\Pictures\MountExport.tiff => C:\Users\Admin\Pictures\MountExport.tiff.aeef1a75 mhcomputing.net_f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4_umwwkg7w.exe -
Enumerates connected drives 3 TTPs 2 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
Processes:
mhcomputing.net_f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4_umwwkg7w.exemhcomputing.net_f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4_umwwkg7w.exedescription ioc process File opened (read-only) \??\Z: mhcomputing.net_f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4_umwwkg7w.exe File opened (read-only) \??\Z: mhcomputing.net_f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4_umwwkg7w.exe -
Drops file in System32 directory 5 IoCs
Processes:
mhcomputing.net_f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4_umwwkg7w.exedescription ioc process File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCookies mhcomputing.net_f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4_umwwkg7w.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5 mhcomputing.net_f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4_umwwkg7w.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\counters2.dat mhcomputing.net_f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4_umwwkg7w.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\Content.IE5 mhcomputing.net_f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4_umwwkg7w.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE mhcomputing.net_f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4_umwwkg7w.exe -
Sets desktop wallpaper using registry 2 TTPs 1 IoCs
Processes:
mhcomputing.net_f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4_umwwkg7w.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Control Panel\Desktop\WallPaper = "C:\\ProgramData\\aeef1a75.BMP" mhcomputing.net_f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4_umwwkg7w.exe -
Modifies Control Panel 2 IoCs
Processes:
mhcomputing.net_f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4_umwwkg7w.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Control Panel\Desktop mhcomputing.net_f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4_umwwkg7w.exe Set value (str) \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Control Panel\Desktop\WallpaperStyle = "10" mhcomputing.net_f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4_umwwkg7w.exe -
Modifies data under HKEY_USERS 29 IoCs
Processes:
mhcomputing.net_f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4_umwwkg7w.exemhcomputing.net_f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4_umwwkg7w.exedescription ioc process Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\RestartManager\Session0000\SessionHash = 5287e103af8062e19180d1cd79a87770253a9c3f33f53e81fd127723057292f0 mhcomputing.net_f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4_umwwkg7w.exe Key created \REGISTRY\USER\.DEFAULT\Control Panel\International mhcomputing.net_f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4_umwwkg7w.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:" mhcomputing.net_f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4_umwwkg7w.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:" mhcomputing.net_f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4_umwwkg7w.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1" mhcomputing.net_f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4_umwwkg7w.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1" mhcomputing.net_f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4_umwwkg7w.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\RestartManager\Session0000\SessionHash = 90b95df2794178d414be9aafeccdaeb738ca0a8b3851f7e4b13b828d0460a626 mhcomputing.net_f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4_umwwkg7w.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\RestartManager\Session0000\RegFiles0000 = 5c005c003f005c0043003a005c00550073006500720073005c00410064006d0069006e005c004e00540055005300450052002e004400410054007b00340065003000370034003600360038002d0030006300310063002d0031003100650037002d0061003900340033002d006500340031006400320064003700310038006100320030007d002e0054004d0043006f006e007400610069006e0065007200300030003000300030003000300030003000300030003000300030003000300030003000300032002e007200650067007400720061006e0073002d006d00730000000000 mhcomputing.net_f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4_umwwkg7w.exe Set value (str) \REGISTRY\USER\.DEFAULT\Control Panel\Desktop\Wallpaper = "C:\\ProgramData\\aeef1a75.BMP" mhcomputing.net_f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4_umwwkg7w.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft mhcomputing.net_f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4_umwwkg7w.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\RestartManager mhcomputing.net_f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4_umwwkg7w.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\RestartManager\Session0000\RegFilesHash = 08ceafdf4d86c9072612e3910fdd6f02dba2c51fea439842677cf98961e6f84a mhcomputing.net_f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4_umwwkg7w.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\RestartManager\Session0000\RegFilesHash = eeffff2ce2111b290e3f5f3edc86416354350ba7648ac33022b65ea85c979b55 mhcomputing.net_f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4_umwwkg7w.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\RestartManager\Session0000 mhcomputing.net_f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4_umwwkg7w.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\RestartManager\Session0000\Sequence = "1" mhcomputing.net_f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4_umwwkg7w.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\RestartManager\Session0000\RegFiles0000 = 5c005c003f005c0043003a005c00550073006500720073005c00410064006d0069006e005c006e00740075007300650072002e006400610074002e004c004f004700310000000000 mhcomputing.net_f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4_umwwkg7w.exe Key deleted \REGISTRY\USER\.DEFAULT\Software\Microsoft\RestartManager\Session0000 mhcomputing.net_f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4_umwwkg7w.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ mhcomputing.net_f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4_umwwkg7w.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\RestartManager\Session0000\RegFiles0000 = 5c005c003f005c0043003a005c00550073006500720073005c00410064006d0069006e005c004e00540055005300450052002e004400410054007b00340065003000370034003600360038002d0030006300310063002d0031003100650037002d0061003900340033002d006500340031006400320064003700310038006100320030007d002e0054004d002e0062006c00660000000000 mhcomputing.net_f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4_umwwkg7w.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\RestartManager\Session0000\SessionHash = 07b3942941ee708b467bd0a4bc56e28daa2309163c4a84025bb4f993dcf38d1c mhcomputing.net_f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4_umwwkg7w.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix mhcomputing.net_f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4_umwwkg7w.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0" mhcomputing.net_f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4_umwwkg7w.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\RestartManager\Session0000\RegFilesHash = 2028a6312b5454eaef5fd8d282df90da187088d4c7dc0338adc14cd7ac0d717c mhcomputing.net_f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4_umwwkg7w.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1" mhcomputing.net_f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4_umwwkg7w.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\RestartManager\Session0000\Owner = 440e0000a1076b1af89ed701 mhcomputing.net_f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4_umwwkg7w.exe Key created \REGISTRY\USER\.DEFAULT\Software mhcomputing.net_f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4_umwwkg7w.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\RestartManager\Session0000\SessionHash = 8b15ed8615ff287d2abe7ebb085488161716d6f3a9c1b49cf7facc7a734cb2fa mhcomputing.net_f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4_umwwkg7w.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\RestartManager\Session0000\RegFiles0000 = 5c005c003f005c0043003a005c00550073006500720073005c00410064006d0069006e005c004e00540055005300450052002e004400410054007b00340065003000370034003600360038002d0030006300310063002d0031003100650037002d0061003900340033002d006500340031006400320064003700310038006100320030007d002e0054004d0043006f006e007400610069006e0065007200300030003000300030003000300030003000300030003000300030003000300030003000300031002e007200650067007400720061006e0073002d006d00730000000000 mhcomputing.net_f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4_umwwkg7w.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\RestartManager\Session0000\RegFilesHash = 1896c18a731b28240143ba305e21014e4cc8ae2935ce0c89460d00d655cc93a6 mhcomputing.net_f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4_umwwkg7w.exe -
Modifies registry class 5 IoCs
Processes:
mhcomputing.net_f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4_umwwkg7w.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.aeef1a75 mhcomputing.net_f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4_umwwkg7w.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.aeef1a75\ = "aeef1a75" mhcomputing.net_f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4_umwwkg7w.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\aeef1a75\DefaultIcon mhcomputing.net_f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4_umwwkg7w.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\aeef1a75 mhcomputing.net_f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4_umwwkg7w.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\aeef1a75\DefaultIcon\ = "C:\\ProgramData\\aeef1a75.ico" mhcomputing.net_f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4_umwwkg7w.exe -
Suspicious behavior: EnumeratesProcesses 26 IoCs
Processes:
mhcomputing.net_f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4_umwwkg7w.exemhcomputing.net_f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4_umwwkg7w.exepid process 1156 mhcomputing.net_f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4_umwwkg7w.exe 1156 mhcomputing.net_f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4_umwwkg7w.exe 3652 mhcomputing.net_f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4_umwwkg7w.exe 3652 mhcomputing.net_f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4_umwwkg7w.exe 3652 mhcomputing.net_f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4_umwwkg7w.exe 3652 mhcomputing.net_f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4_umwwkg7w.exe 3652 mhcomputing.net_f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4_umwwkg7w.exe 3652 mhcomputing.net_f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4_umwwkg7w.exe 3652 mhcomputing.net_f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4_umwwkg7w.exe 3652 mhcomputing.net_f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4_umwwkg7w.exe 3652 mhcomputing.net_f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4_umwwkg7w.exe 3652 mhcomputing.net_f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4_umwwkg7w.exe 3652 mhcomputing.net_f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4_umwwkg7w.exe 3652 mhcomputing.net_f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4_umwwkg7w.exe 3652 mhcomputing.net_f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4_umwwkg7w.exe 3652 mhcomputing.net_f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4_umwwkg7w.exe 3652 mhcomputing.net_f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4_umwwkg7w.exe 3652 mhcomputing.net_f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4_umwwkg7w.exe 3652 mhcomputing.net_f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4_umwwkg7w.exe 3652 mhcomputing.net_f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4_umwwkg7w.exe 3652 mhcomputing.net_f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4_umwwkg7w.exe 3652 mhcomputing.net_f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4_umwwkg7w.exe 3652 mhcomputing.net_f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4_umwwkg7w.exe 3652 mhcomputing.net_f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4_umwwkg7w.exe 3652 mhcomputing.net_f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4_umwwkg7w.exe 3652 mhcomputing.net_f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4_umwwkg7w.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
vssvc.exedescription pid process Token: SeBackupPrivilege 1916 vssvc.exe Token: SeRestorePrivilege 1916 vssvc.exe Token: SeAuditPrivilege 1916 vssvc.exe -
Suspicious use of WriteProcessMemory 10 IoCs
Processes:
mhcomputing.net_f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4_umwwkg7w.exemhcomputing.net_f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4_umwwkg7w.exedescription pid process target process PID 1028 wrote to memory of 1156 1028 mhcomputing.net_f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4_umwwkg7w.exe mhcomputing.net_f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4_umwwkg7w.exe PID 1028 wrote to memory of 1156 1028 mhcomputing.net_f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4_umwwkg7w.exe mhcomputing.net_f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4_umwwkg7w.exe PID 1028 wrote to memory of 1156 1028 mhcomputing.net_f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4_umwwkg7w.exe mhcomputing.net_f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4_umwwkg7w.exe PID 1028 wrote to memory of 1156 1028 mhcomputing.net_f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4_umwwkg7w.exe mhcomputing.net_f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4_umwwkg7w.exe PID 1156 wrote to memory of 3652 1156 mhcomputing.net_f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4_umwwkg7w.exe mhcomputing.net_f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4_umwwkg7w.exe PID 1156 wrote to memory of 3652 1156 mhcomputing.net_f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4_umwwkg7w.exe mhcomputing.net_f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4_umwwkg7w.exe PID 1156 wrote to memory of 3652 1156 mhcomputing.net_f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4_umwwkg7w.exe mhcomputing.net_f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4_umwwkg7w.exe PID 1156 wrote to memory of 3964 1156 mhcomputing.net_f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4_umwwkg7w.exe mhcomputing.net_f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4_umwwkg7w.exe PID 1156 wrote to memory of 3964 1156 mhcomputing.net_f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4_umwwkg7w.exe mhcomputing.net_f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4_umwwkg7w.exe PID 1156 wrote to memory of 3964 1156 mhcomputing.net_f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4_umwwkg7w.exe mhcomputing.net_f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4_umwwkg7w.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\mhcomputing.net_f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4_umwwkg7w.exe"C:\Users\Admin\AppData\Local\Temp\mhcomputing.net_f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4_umwwkg7w.exe"1⤵
-
C:\Users\Admin\AppData\Local\Temp\mhcomputing.net_f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4_umwwkg7w.exe"C:\Users\Admin\AppData\Local\Temp\mhcomputing.net_f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4_umwwkg7w.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\mhcomputing.net_f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4_umwwkg7w.exe"C:\Users\Admin\AppData\Local\Temp\mhcomputing.net_f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4_umwwkg7w.exe"2⤵
- Enumerates connected drives
- Drops file in System32 directory
- Sets desktop wallpaper using registry
- Modifies Control Panel
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\mhcomputing.net_f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4_umwwkg7w.exeC:\Users\Admin\AppData\Local\Temp\mhcomputing.net_f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4_umwwkg7w.exe -work worker0 job0-11563⤵
- Modifies extensions of user files
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
-
C:\Users\Admin\AppData\Local\Temp\mhcomputing.net_f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4_umwwkg7w.exeC:\Users\Admin\AppData\Local\Temp\mhcomputing.net_f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4_umwwkg7w.exe -work worker1 job1-11563⤵
- Enumerates connected drives
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken