darkside | d97c0b6ee613e03aa3256fcdd3757e54ba4c7bb5910887247dc857f2701f9a46

General

Target

d97c0b6ee613e03aa3256fcdd3757e54ba4c7bb5910887247dc857f2701f9a46.exe
Size

56KB
MD5

248cecd1ffa1f5de46d8643a1e96e9a8
SHA1

8da9d2c2a06720daec54a2490e1f6942177d1de4
SHA256

d97c0b6ee613e03aa3256fcdd3757e54ba4c7bb5910887247dc857f2701f9a46
SHA512

7d55504c652fffdf2ebeb392c855882035fae71a8ab936ba859bcd69163567c35d60fabfca271890213c1779284bc41bdbf771e10cbf5661008a7c45e3973703

Score

10^/10

darkside ransomware

Malware Config

Extracted

Path

C:\\README.a97d73e3.TXT

Family

darkside

Ransom Note

----------- [ Welcome to DarkSide ] -------------> What happend? ---------------------------------------------- Your computers and servers are encrypted, backups are deleted. We use strong encryption algorithms, so you cannot decrypt your data. But you can restore everything by purchasing a special program from us - universal decryptor. This program will restore all your network. Follow our instructions below and you will recover all your data. Data leak ---------------------------------------------- First of all we have downloaded more then 500GB data from your network. Included: -Accounting data -Finance data -HR -Employees confidential data(photos, benefits, taxes, etc) -Marketing -Budgets -Taxes(sales tax compliance, property, income and franchise taxes, etc) -Payrolls -Banking data -Arbitration -Scans -Insurance -Reconciliations -Reports(monthly bank inventory, monthly financial, claims reports, etc) -Audits(DHG, insurance audits, etc) -B2B clients config data -Confidentiality 2020 -2020, 2021 Business plans -2019, 2020, 2021 years Closing (full dumps) -and a lot of other sensitive data Your personal leak page: http://darksidc3iux462n6yunevoag52ntvwp6wulaz3zirkmh4cnz6hhj7id.onion/162/thedixiegroup/LCfyHRcwffrYTblpZvoPO3XDbrYPcNu0wVAsH5p49LSjBfzTmtdXT48azXFlMu7q On the page you will find examples of files that have been downloaded. The data is preloaded and will be automatically published if you do not pay. After publication, your data will be available for at least 6 months on our tor cdn servers. We are ready: - To provide you the evidence of stolen data - To delete all the stolen data. What guarantees? ---------------------------------------------- We value our reputation. If we do not do our work and liabilities, nobody will pay us. This is not in our interests. All our decryption software is perfectly tested and will decrypt your data. We will also provide support in case of problems. We guarantee to decrypt one file for free. Go to the site and contact us. How to get access on website? ---------------------------------------------- Using a TOR browser: 1) Download and install TOR browser from this site: https://torproject.org/ 2) Open our website: http://dark24zz36xm4y2phwe7yvnkkkkhxionhfrwp67awpb3r3bdcneivoqd.onion/W57MRI9C7YZJUZEABBBYRQLSUTG22JZ9MAH0WT1ISHC405KP7Z2UWY3AI3J68DNM When you open our website, put the following data in the input form: Key: ug8lgpX3WrFzlEJ6HBWlwJnf7jemhfnlxBw9porj1uuYFTgKbxJQJLYiteQS7DwgZn7dH0fs7qPPWmZ6inPv5GTmSJZNAjGLVIjd4SoiyTdGyophf0zPBxx6uEAOJxM0Woo4ZGeKVoUDHtZsqZNnhMF7aPh54VnKpIJXiZDbZZw4P06xTuw1UMeiTE7wdg7HWZMepAVTzEI2W04RbkPFQHfUgEDcslDxbr83BvopYTYGKFRmtNUMH8OsOZQrOtv50xWDaOfbqxbzfHMJm30QGaGpgylJHQZsscz3XBnwIdvlwBJ9KN4DVgFgziRdvwJrfCP6YN1CYTOQgw1rzqmIU4G1xGYv7rE3jiBY1s4D3Y26SbppTceAVMu1mKx5CFIE3EbtcAsNtEqLHDbPnMCvU6Apwp17TXGob8xXJpEDBZhIzdTaCuybcprwcFNTOzccjbIH81W39MrcJi9mNO3kHRe5fxmIFKvc9v8aQDihGyC65DtdabyBjidXI1NyNONT4PTyrxYqgffPsNDFuzz2yMrXiTAwtAQPqny5BBJQsfVhpLXTtnLvWg1 !!! DANGER !!! DO NOT MODIFY or try to RECOVER any files yourself. We WILL NOT be able to RESTORE them. !!! DANGER !!!

URLs

http://darksidc3iux462n6yunevoag52ntvwp6wulaz3zirkmh4cnz6hhj7id.onion/162/thedixiegroup/LCfyHRcwffrYTblpZvoPO3XDbrYPcNu0wVAsH5p49LSjBfzTmtdXT48azXFlMu7q

http://dark24zz36xm4y2phwe7yvnkkkkhxionhfrwp67awpb3r3bdcneivoqd.onion/W57MRI9C7YZJUZEABBBYRQLSUTG22JZ9MAH0WT1ISHC405KP7Z2UWY3AI3J68DNM

Signatures

DarkSide
Targeted ransomware first seen in August 2020. Operators steal data to use as leverage.
ransomware darkside

Modifies extensions of user files 5 IoCs

Ransomware generally changes the extension on encrypted files.

ransomware

Processes:

d97c0b6ee613e03aa3256fcdd3757e54ba4c7bb5910887247dc857f2701f9a46.exe

description	ioc	process
File renamed	C:\Users\Admin\Pictures\ExitGroup.tif => C:\Users\Admin\Pictures\ExitGroup.tif.a97d73e3	d97c0b6ee613e03aa3256fcdd3757e54ba4c7bb5910887247dc857f2701f9a46.exe
File opened for modification	C:\Users\Admin\Pictures\ExitGroup.tif.a97d73e3	d97c0b6ee613e03aa3256fcdd3757e54ba4c7bb5910887247dc857f2701f9a46.exe
File opened for modification	C:\Users\Admin\Pictures\LimitWait.tiff	d97c0b6ee613e03aa3256fcdd3757e54ba4c7bb5910887247dc857f2701f9a46.exe
File renamed	C:\Users\Admin\Pictures\LimitWait.tiff => C:\Users\Admin\Pictures\LimitWait.tiff.a97d73e3	d97c0b6ee613e03aa3256fcdd3757e54ba4c7bb5910887247dc857f2701f9a46.exe
File opened for modification	C:\Users\Admin\Pictures\LimitWait.tiff.a97d73e3	d97c0b6ee613e03aa3256fcdd3757e54ba4c7bb5910887247dc857f2701f9a46.exe

Drops file in System32 directory 5 IoCs

Processes:

d97c0b6ee613e03aa3256fcdd3757e54ba4c7bb5910887247dc857f2701f9a46.exe

description	ioc	process
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\Content.IE5	d97c0b6ee613e03aa3256fcdd3757e54ba4c7bb5910887247dc857f2701f9a46.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE	d97c0b6ee613e03aa3256fcdd3757e54ba4c7bb5910887247dc857f2701f9a46.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCookies	d97c0b6ee613e03aa3256fcdd3757e54ba4c7bb5910887247dc857f2701f9a46.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5	d97c0b6ee613e03aa3256fcdd3757e54ba4c7bb5910887247dc857f2701f9a46.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\counters2.dat	d97c0b6ee613e03aa3256fcdd3757e54ba4c7bb5910887247dc857f2701f9a46.exe

Sets desktop wallpaper using registry 2 TTPs 1 IoCs

ransomware

Defacement

T1491

Modify Registry

T1112

Processes:

d97c0b6ee613e03aa3256fcdd3757e54ba4c7bb5910887247dc857f2701f9a46.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-369956170-74428499-1628131376-1000\Control Panel\Desktop\WallPaper = "C:\\ProgramData\\a97d73e3.BMP"	d97c0b6ee613e03aa3256fcdd3757e54ba4c7bb5910887247dc857f2701f9a46.exe

Modifies Control Panel 2 IoCs

evasion

Processes:

d97c0b6ee613e03aa3256fcdd3757e54ba4c7bb5910887247dc857f2701f9a46.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-369956170-74428499-1628131376-1000\Control Panel\Desktop	d97c0b6ee613e03aa3256fcdd3757e54ba4c7bb5910887247dc857f2701f9a46.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-369956170-74428499-1628131376-1000\Control Panel\Desktop\WallpaperStyle = "10"	d97c0b6ee613e03aa3256fcdd3757e54ba4c7bb5910887247dc857f2701f9a46.exe

Modifies data under HKEY_USERS 32 IoCs

Processes:

d97c0b6ee613e03aa3256fcdd3757e54ba4c7bb5910887247dc857f2701f9a46.exed97c0b6ee613e03aa3256fcdd3757e54ba4c7bb5910887247dc857f2701f9a46.exe

description	ioc	process
Key created	\REGISTRY\USER\.DEFAULT\Software	d97c0b6ee613e03aa3256fcdd3757e54ba4c7bb5910887247dc857f2701f9a46.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\RestartManager	d97c0b6ee613e03aa3256fcdd3757e54ba4c7bb5910887247dc857f2701f9a46.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Control Panel\Desktop\Wallpaper = "C:\\ProgramData\\a97d73e3.BMP"	d97c0b6ee613e03aa3256fcdd3757e54ba4c7bb5910887247dc857f2701f9a46.exe
Key created	\REGISTRY\USER\.DEFAULT\Control Panel\International	d97c0b6ee613e03aa3256fcdd3757e54ba4c7bb5910887247dc857f2701f9a46.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	d97c0b6ee613e03aa3256fcdd3757e54ba4c7bb5910887247dc857f2701f9a46.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\RestartManager\Session0000\RegFilesHash = 8873ac9f4757f40e4069fb58b2eee0d04159b175076b3ed657cabd1ef632785e	d97c0b6ee613e03aa3256fcdd3757e54ba4c7bb5910887247dc857f2701f9a46.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	d97c0b6ee613e03aa3256fcdd3757e54ba4c7bb5910887247dc857f2701f9a46.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\RestartManager\Session0000\SessionHash = 0996bafdb42eb718197da5d20ac0109e31d7e10232d7b4f0f56229b46c37deb5	d97c0b6ee613e03aa3256fcdd3757e54ba4c7bb5910887247dc857f2701f9a46.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\RestartManager\Session0000	d97c0b6ee613e03aa3256fcdd3757e54ba4c7bb5910887247dc857f2701f9a46.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\RestartManager\Session0000\Owner = 400200001e96fbfe1413d801	d97c0b6ee613e03aa3256fcdd3757e54ba4c7bb5910887247dc857f2701f9a46.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\RestartManager\Session0000\SessionHash = d1adc61626356fdb5834148397239cd479dccdff86a03d26400ff9fb3a422692	d97c0b6ee613e03aa3256fcdd3757e54ba4c7bb5910887247dc857f2701f9a46.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\RestartManager\Session0000\SessionHash = fceb6f852d40f2499cf921c4eef373ea9dcf06dfe3460c999962ff2576ef27fd	d97c0b6ee613e03aa3256fcdd3757e54ba4c7bb5910887247dc857f2701f9a46.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\RestartManager\Session0000\SessionHash = 3a2086e1b5014eb3233f418106b026fe670181f3b9fc37d5b5027e984b81c246	d97c0b6ee613e03aa3256fcdd3757e54ba4c7bb5910887247dc857f2701f9a46.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\RestartManager\Session0000\RegFilesHash = e6a031903368746582300a7c93c400b262cce3102c21b52b1d89db11bab4e0b1	d97c0b6ee613e03aa3256fcdd3757e54ba4c7bb5910887247dc857f2701f9a46.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	d97c0b6ee613e03aa3256fcdd3757e54ba4c7bb5910887247dc857f2701f9a46.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	d97c0b6ee613e03aa3256fcdd3757e54ba4c7bb5910887247dc857f2701f9a46.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	d97c0b6ee613e03aa3256fcdd3757e54ba4c7bb5910887247dc857f2701f9a46.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	d97c0b6ee613e03aa3256fcdd3757e54ba4c7bb5910887247dc857f2701f9a46.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\RestartManager\Session0000\RegFiles0000 = 5c005c003f005c0043003a005c00550073006500720073005c00410064006d0069006e005c006e00740075007300650072002e006400610074002e004c004f004700310000000000	d97c0b6ee613e03aa3256fcdd3757e54ba4c7bb5910887247dc857f2701f9a46.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\RestartManager\Session0000\RegFilesHash = be5adbfb880d22cd24cbf4cb2c6e1afd267d909649e67cc8b1137acc673d9000	d97c0b6ee613e03aa3256fcdd3757e54ba4c7bb5910887247dc857f2701f9a46.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\RestartManager\Session0000\RegFiles0000 = 5c005c003f005c0043003a005c00550073006500720073005c00410064006d0069006e005c006e00740075007300650072002e006400610074002e004c004f004700320000000000	d97c0b6ee613e03aa3256fcdd3757e54ba4c7bb5910887247dc857f2701f9a46.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\RestartManager\Session0000\RegFilesHash = 9785bfa8863115e3a291881fccc7f49464906bb7ec9f3df08291812af854f476	d97c0b6ee613e03aa3256fcdd3757e54ba4c7bb5910887247dc857f2701f9a46.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\RestartManager\Session0000\RegFiles0000 = 5c005c003f005c0043003a005c00550073006500720073005c00410064006d0069006e005c004e00540055005300450052002e004400410054007b00340065003000370034003600360038002d0030006300310063002d0031003100650037002d0061003900340033002d006500340031006400320064003700310038006100320030007d002e0054004d0043006f006e007400610069006e0065007200300030003000300030003000300030003000300030003000300030003000300030003000300031002e007200650067007400720061006e0073002d006d00730000000000	d97c0b6ee613e03aa3256fcdd3757e54ba4c7bb5910887247dc857f2701f9a46.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	d97c0b6ee613e03aa3256fcdd3757e54ba4c7bb5910887247dc857f2701f9a46.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\RestartManager\Session0000\Sequence = "1"	d97c0b6ee613e03aa3256fcdd3757e54ba4c7bb5910887247dc857f2701f9a46.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\RestartManager\Session0000\RegFilesHash = eb6175c0b25b0ede41321ceafbb0c40904d04e5ba4c16ba0b41d38f9b93f9e26	d97c0b6ee613e03aa3256fcdd3757e54ba4c7bb5910887247dc857f2701f9a46.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Microsoft\RestartManager\Session0000	d97c0b6ee613e03aa3256fcdd3757e54ba4c7bb5910887247dc857f2701f9a46.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\RestartManager\Session0000\SessionHash = 639cde1934881d991df9ec7158de58b03c25afc56fb5907d7709b5d63d16c693	d97c0b6ee613e03aa3256fcdd3757e54ba4c7bb5910887247dc857f2701f9a46.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	d97c0b6ee613e03aa3256fcdd3757e54ba4c7bb5910887247dc857f2701f9a46.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	d97c0b6ee613e03aa3256fcdd3757e54ba4c7bb5910887247dc857f2701f9a46.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\RestartManager\Session0000\RegFiles0000 = 5c005c003f005c0043003a005c00550073006500720073005c00410064006d0069006e005c004e00540055005300450052002e004400410054007b00340065003000370034003600360038002d0030006300310063002d0031003100650037002d0061003900340033002d006500340031006400320064003700310038006100320030007d002e0054004d002e0062006c00660000000000	d97c0b6ee613e03aa3256fcdd3757e54ba4c7bb5910887247dc857f2701f9a46.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\RestartManager\Session0000\RegFiles0000 = 5c005c003f005c0043003a005c00550073006500720073005c00410064006d0069006e005c004e00540055005300450052002e004400410054007b00340065003000370034003600360038002d0030006300310063002d0031003100650037002d0061003900340033002d006500340031006400320064003700310038006100320030007d002e0054004d0043006f006e007400610069006e0065007200300030003000300030003000300030003000300030003000300030003000300030003000300032002e007200650067007400720061006e0073002d006d00730000000000	d97c0b6ee613e03aa3256fcdd3757e54ba4c7bb5910887247dc857f2701f9a46.exe

Modifies registry class 5 IoCs

Processes:

d97c0b6ee613e03aa3256fcdd3757e54ba4c7bb5910887247dc857f2701f9a46.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.a97d73e3	d97c0b6ee613e03aa3256fcdd3757e54ba4c7bb5910887247dc857f2701f9a46.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.a97d73e3\ = "a97d73e3"	d97c0b6ee613e03aa3256fcdd3757e54ba4c7bb5910887247dc857f2701f9a46.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\a97d73e3\DefaultIcon	d97c0b6ee613e03aa3256fcdd3757e54ba4c7bb5910887247dc857f2701f9a46.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\a97d73e3	d97c0b6ee613e03aa3256fcdd3757e54ba4c7bb5910887247dc857f2701f9a46.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\a97d73e3\DefaultIcon\ = "C:\\ProgramData\\a97d73e3.ico"	d97c0b6ee613e03aa3256fcdd3757e54ba4c7bb5910887247dc857f2701f9a46.exe

Suspicious behavior: EnumeratesProcesses 32 IoCs

Processes:

d97c0b6ee613e03aa3256fcdd3757e54ba4c7bb5910887247dc857f2701f9a46.exed97c0b6ee613e03aa3256fcdd3757e54ba4c7bb5910887247dc857f2701f9a46.exe

pid	process
3748	d97c0b6ee613e03aa3256fcdd3757e54ba4c7bb5910887247dc857f2701f9a46.exe
3748	d97c0b6ee613e03aa3256fcdd3757e54ba4c7bb5910887247dc857f2701f9a46.exe
576	d97c0b6ee613e03aa3256fcdd3757e54ba4c7bb5910887247dc857f2701f9a46.exe
576	d97c0b6ee613e03aa3256fcdd3757e54ba4c7bb5910887247dc857f2701f9a46.exe
576	d97c0b6ee613e03aa3256fcdd3757e54ba4c7bb5910887247dc857f2701f9a46.exe
576	d97c0b6ee613e03aa3256fcdd3757e54ba4c7bb5910887247dc857f2701f9a46.exe
576	d97c0b6ee613e03aa3256fcdd3757e54ba4c7bb5910887247dc857f2701f9a46.exe
576	d97c0b6ee613e03aa3256fcdd3757e54ba4c7bb5910887247dc857f2701f9a46.exe
576	d97c0b6ee613e03aa3256fcdd3757e54ba4c7bb5910887247dc857f2701f9a46.exe
576	d97c0b6ee613e03aa3256fcdd3757e54ba4c7bb5910887247dc857f2701f9a46.exe
576	d97c0b6ee613e03aa3256fcdd3757e54ba4c7bb5910887247dc857f2701f9a46.exe
576	d97c0b6ee613e03aa3256fcdd3757e54ba4c7bb5910887247dc857f2701f9a46.exe
576	d97c0b6ee613e03aa3256fcdd3757e54ba4c7bb5910887247dc857f2701f9a46.exe
576	d97c0b6ee613e03aa3256fcdd3757e54ba4c7bb5910887247dc857f2701f9a46.exe
576	d97c0b6ee613e03aa3256fcdd3757e54ba4c7bb5910887247dc857f2701f9a46.exe
576	d97c0b6ee613e03aa3256fcdd3757e54ba4c7bb5910887247dc857f2701f9a46.exe
576	d97c0b6ee613e03aa3256fcdd3757e54ba4c7bb5910887247dc857f2701f9a46.exe
576	d97c0b6ee613e03aa3256fcdd3757e54ba4c7bb5910887247dc857f2701f9a46.exe
576	d97c0b6ee613e03aa3256fcdd3757e54ba4c7bb5910887247dc857f2701f9a46.exe
576	d97c0b6ee613e03aa3256fcdd3757e54ba4c7bb5910887247dc857f2701f9a46.exe
576	d97c0b6ee613e03aa3256fcdd3757e54ba4c7bb5910887247dc857f2701f9a46.exe
576	d97c0b6ee613e03aa3256fcdd3757e54ba4c7bb5910887247dc857f2701f9a46.exe
576	d97c0b6ee613e03aa3256fcdd3757e54ba4c7bb5910887247dc857f2701f9a46.exe
576	d97c0b6ee613e03aa3256fcdd3757e54ba4c7bb5910887247dc857f2701f9a46.exe
576	d97c0b6ee613e03aa3256fcdd3757e54ba4c7bb5910887247dc857f2701f9a46.exe
576	d97c0b6ee613e03aa3256fcdd3757e54ba4c7bb5910887247dc857f2701f9a46.exe
576	d97c0b6ee613e03aa3256fcdd3757e54ba4c7bb5910887247dc857f2701f9a46.exe
576	d97c0b6ee613e03aa3256fcdd3757e54ba4c7bb5910887247dc857f2701f9a46.exe
576	d97c0b6ee613e03aa3256fcdd3757e54ba4c7bb5910887247dc857f2701f9a46.exe
576	d97c0b6ee613e03aa3256fcdd3757e54ba4c7bb5910887247dc857f2701f9a46.exe
576	d97c0b6ee613e03aa3256fcdd3757e54ba4c7bb5910887247dc857f2701f9a46.exe
576	d97c0b6ee613e03aa3256fcdd3757e54ba4c7bb5910887247dc857f2701f9a46.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

vssvc.exe

description pid process

Token: SeBackupPrivilege 1308 vssvc.exe
Token: SeRestorePrivilege 1308 vssvc.exe
Token: SeAuditPrivilege 1308 vssvc.exe

description	pid	process
Token: SeBackupPrivilege	1308	vssvc.exe
Token: SeRestorePrivilege	1308	vssvc.exe
Token: SeAuditPrivilege	1308	vssvc.exe

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

d97c0b6ee613e03aa3256fcdd3757e54ba4c7bb5910887247dc857f2701f9a46.exed97c0b6ee613e03aa3256fcdd3757e54ba4c7bb5910887247dc857f2701f9a46.exe

description	pid	process	target process
PID 3052 wrote to memory of 3748	3052	d97c0b6ee613e03aa3256fcdd3757e54ba4c7bb5910887247dc857f2701f9a46.exe	d97c0b6ee613e03aa3256fcdd3757e54ba4c7bb5910887247dc857f2701f9a46.exe
PID 3052 wrote to memory of 3748	3052	d97c0b6ee613e03aa3256fcdd3757e54ba4c7bb5910887247dc857f2701f9a46.exe	d97c0b6ee613e03aa3256fcdd3757e54ba4c7bb5910887247dc857f2701f9a46.exe
PID 3052 wrote to memory of 3748	3052	d97c0b6ee613e03aa3256fcdd3757e54ba4c7bb5910887247dc857f2701f9a46.exe	d97c0b6ee613e03aa3256fcdd3757e54ba4c7bb5910887247dc857f2701f9a46.exe
PID 3052 wrote to memory of 3748	3052	d97c0b6ee613e03aa3256fcdd3757e54ba4c7bb5910887247dc857f2701f9a46.exe	d97c0b6ee613e03aa3256fcdd3757e54ba4c7bb5910887247dc857f2701f9a46.exe
PID 3748 wrote to memory of 576	3748	d97c0b6ee613e03aa3256fcdd3757e54ba4c7bb5910887247dc857f2701f9a46.exe	d97c0b6ee613e03aa3256fcdd3757e54ba4c7bb5910887247dc857f2701f9a46.exe
PID 3748 wrote to memory of 576	3748	d97c0b6ee613e03aa3256fcdd3757e54ba4c7bb5910887247dc857f2701f9a46.exe	d97c0b6ee613e03aa3256fcdd3757e54ba4c7bb5910887247dc857f2701f9a46.exe
PID 3748 wrote to memory of 576	3748	d97c0b6ee613e03aa3256fcdd3757e54ba4c7bb5910887247dc857f2701f9a46.exe	d97c0b6ee613e03aa3256fcdd3757e54ba4c7bb5910887247dc857f2701f9a46.exe

C:\Users\Admin\AppData\Local\Temp\d97c0b6ee613e03aa3256fcdd3757e54ba4c7bb5910887247dc857f2701f9a46.exe
"C:\Users\Admin\AppData\Local\Temp\d97c0b6ee613e03aa3256fcdd3757e54ba4c7bb5910887247dc857f2701f9a46.exe"
1⤵
PID:2716

C:\Users\Admin\AppData\Local\Temp\d97c0b6ee613e03aa3256fcdd3757e54ba4c7bb5910887247dc857f2701f9a46.exe
"C:\Users\Admin\AppData\Local\Temp\d97c0b6ee613e03aa3256fcdd3757e54ba4c7bb5910887247dc857f2701f9a46.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3052

C:\Users\Admin\AppData\Local\Temp\d97c0b6ee613e03aa3256fcdd3757e54ba4c7bb5910887247dc857f2701f9a46.exe
"C:\Users\Admin\AppData\Local\Temp\d97c0b6ee613e03aa3256fcdd3757e54ba4c7bb5910887247dc857f2701f9a46.exe"
2⤵
- Drops file in System32 directory
- Sets desktop wallpaper using registry
- Modifies Control Panel
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3748

C:\Users\Admin\AppData\Local\Temp\d97c0b6ee613e03aa3256fcdd3757e54ba4c7bb5910887247dc857f2701f9a46.exe
C:\Users\Admin\AppData\Local\Temp\d97c0b6ee613e03aa3256fcdd3757e54ba4c7bb5910887247dc857f2701f9a46.exe -work worker0 job0-3748
3⤵
- Modifies extensions of user files
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
PID:576

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1308

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Defacement

1

T1491

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads