Resubmissions
27-01-2024 19:37
240127-yb9zasafd8 1027-01-2024 19:36
240127-ybp9wsafb7 1001-05-2021 01:07
210501-shjstql5m2 10Analysis
-
max time kernel
137s -
max time network
148s -
platform
windows10-1703_x64 -
resource
win10-20231220-en -
resource tags
arch:x64arch:x86image:win10-20231220-enlocale:en-usos:windows10-1703-x64system -
submitted
27-01-2024 19:36
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
516664139b0ddd044397a56482d7308d87c213c320a3151ccb9738e8f932654b.exe
Resource
win7-20231215-en
windows7-x64
7 signatures
150 seconds
Behavioral task
behavioral2
Sample
516664139b0ddd044397a56482d7308d87c213c320a3151ccb9738e8f932654b.exe
Resource
win10-20231220-en
windows10-1703-x64
12 signatures
150 seconds
Behavioral task
behavioral3
Sample
516664139b0ddd044397a56482d7308d87c213c320a3151ccb9738e8f932654b.exe
Resource
win10v2004-20231215-en
windows10-2004-x64
12 signatures
150 seconds
Behavioral task
behavioral4
Sample
516664139b0ddd044397a56482d7308d87c213c320a3151ccb9738e8f932654b.exe
Resource
win11-20231215-en
windows11-21h2-x64
12 signatures
150 seconds
General
-
Target
516664139b0ddd044397a56482d7308d87c213c320a3151ccb9738e8f932654b.exe
-
Size
56KB
-
MD5
84c1567969b86089cc33dccf41562bcd
-
SHA1
53f2133cb25186e9fa6d4ea3b0e41eee5aba5ef2
-
SHA256
516664139b0ddd044397a56482d7308d87c213c320a3151ccb9738e8f932654b
-
SHA512
72a411cacd503b6fadb15dc90f1f9beb79ff79c620df76da381e5c780c53e11258aae72db2848c241ec55af403d67d62340e429e86c23bbf8a71287738de7eaa
-
SSDEEP
768:AiN4q1eksgR4SiI+rxQ3rjFrXRRWxXyw/Afy81XweyetnR9Wsf5AyT9G3kZ:r4HHerjZX7pLken5nWXWi
Score
10/10
Malware Config
Extracted
Path
C:\README.f6e0f448.TXT
Family
darkside
Ransom Note
----------- [ Welcome to DarkSide ] ------------->
What happend?
----------------------------------------------
Your computers and servers are encrypted, backups are deleted. We use strong encryption algorithms, so you cannot decrypt your data.
But you can restore everything by purchasing a special program from us - universal decryptor. This program will restore all your network.
Follow our instructions below and you will recover all your data.
Data leak
----------------------------------------------
First of all we have uploaded more then 500GB data.
The data is preloaded and will be automatically published if you do not pay.
After publication, your data will be available for at least 6 months on our tor cdn servers.
We are ready:
- To provide you the evidence of stolen data
- To delete all the stolen data.
What guarantees?
----------------------------------------------
We value our reputation. If we do not do our work and liabilities, nobody will pay us. This is not in our interests.
All our decryption software is perfectly tested and will decrypt your data. We will also provide support in case of problems.
We guarantee to decrypt one file for free. Go to the site and contact us.
How to get access on website?
----------------------------------------------
Using a TOR browser:
1) Download and install TOR browser from this site: https://torproject.org/
2) Open our website: http://dark24vx6fsmdrtbzdzjv6ckz4yqyued4uz455oqpctko7m6vbrzibad.onion/XES2TUV3A9QL89IS7QX91V7TYSF13ASPGB2TASQ68R9Z6QYH69OVY833QSRSFU4I
When you open our website, put the following data in the input form:
Key:
I3tBdXvJ3pOvnhgmupZAJ7BpD5IVUftr7deEdtoxwK0QcbZciUXfs5ChjD0Yj8H2wUXfctFHYShVQHWhwi1CBDRQVPgXqnCgVRQql7B1tS8Q6TSdHq5o0UxOaDrdKCoMCdrMZiw0RTbfpDpuRwLI52rP5YaqZx492wErocN9C7PE6eFQEcqwqiFNA1FwVD3fogTJqOdTJI84FnlCBuRd1ippdTk8y2x16ukfPvVHi4MhyU8i4K1Q25a7wXQUPXhIffgZBnTimLzalSGyaI3f2MlQeYbpFG2o4nfnZCHDMAZAUY6CaiR0eAYVEvesreMmimT1EOyGYjNVtGHrJYXuRI4tYZIVlsHm6Ord42NV9s9PftLGkO8NBScZ9dBTNtz0xw9tpgu8GegVTlMesg6xkUAQWJcy6MNt9nJ7lHydpu27bA1GL8MX8lWAldnClSoUrDYRc8RAZ1oUfMfbtmvMDBGVENh8kMUYaxOt7hD1HxKFn0p5XcCDzWRSWkKUTtt7C6OiIpNOUAYYJ3UvC5S3uoXmt4iokkGq1SSMnr7sXmnekmh9oNwJgh7
!!! DANGER !!!
DO NOT MODIFY or try to RECOVER any files yourself. We WILL NOT be able to RESTORE them.
!!! DANGER !!!
URLs
http://dark24vx6fsmdrtbzdzjv6ckz4yqyued4uz455oqpctko7m6vbrzibad.onion/XES2TUV3A9QL89IS7QX91V7TYSF13ASPGB2TASQ68R9Z6QYH69OVY833QSRSFU4I
Signatures
-
DarkSide
Targeted ransomware first seen in August 2020. Operators steal data to use as leverage.
-
Renames multiple (141) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Enumerates connected drives 3 TTPs 1 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\F: 516664139b0ddd044397a56482d7308d87c213c320a3151ccb9738e8f932654b.exe -
Drops file in System32 directory 21 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCookies\C5V6D4YN.cookie 516664139b0ddd044397a56482d7308d87c213c320a3151ccb9738e8f932654b.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5 516664139b0ddd044397a56482d7308d87c213c320a3151ccb9738e8f932654b.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\103621DE9CD5414CC2538780B4B75751 516664139b0ddd044397a56482d7308d87c213c320a3151ccb9738e8f932654b.exe File created C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCookies\5M8P5LQG.cookie 516664139b0ddd044397a56482d7308d87c213c320a3151ccb9738e8f932654b.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft 516664139b0ddd044397a56482d7308d87c213c320a3151ccb9738e8f932654b.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\57C8EDB95DF3F0AD4EE2DC2B8CFD4157 516664139b0ddd044397a56482d7308d87c213c320a3151ccb9738e8f932654b.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\103621DE9CD5414CC2538780B4B75751 516664139b0ddd044397a56482d7308d87c213c320a3151ccb9738e8f932654b.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\71DC818AAEA1211A26ACC273B35C74BA 516664139b0ddd044397a56482d7308d87c213c320a3151ccb9738e8f932654b.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCookies\5M8P5LQG.cookie 516664139b0ddd044397a56482d7308d87c213c320a3151ccb9738e8f932654b.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\Content.IE5 516664139b0ddd044397a56482d7308d87c213c320a3151ccb9738e8f932654b.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE 516664139b0ddd044397a56482d7308d87c213c320a3151ccb9738e8f932654b.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCookies 516664139b0ddd044397a56482d7308d87c213c320a3151ccb9738e8f932654b.exe File created C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCookies\C5V6D4YN.cookie 516664139b0ddd044397a56482d7308d87c213c320a3151ccb9738e8f932654b.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\57C8EDB95DF3F0AD4EE2DC2B8CFD4157 516664139b0ddd044397a56482d7308d87c213c320a3151ccb9738e8f932654b.exe File created C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCookies\1EX8G5ID.cookie 516664139b0ddd044397a56482d7308d87c213c320a3151ccb9738e8f932654b.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\counters2.dat 516664139b0ddd044397a56482d7308d87c213c320a3151ccb9738e8f932654b.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData 516664139b0ddd044397a56482d7308d87c213c320a3151ccb9738e8f932654b.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content 516664139b0ddd044397a56482d7308d87c213c320a3151ccb9738e8f932654b.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache 516664139b0ddd044397a56482d7308d87c213c320a3151ccb9738e8f932654b.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\71DC818AAEA1211A26ACC273B35C74BA 516664139b0ddd044397a56482d7308d87c213c320a3151ccb9738e8f932654b.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCookies\1EX8G5ID.cookie 516664139b0ddd044397a56482d7308d87c213c320a3151ccb9738e8f932654b.exe -
Sets desktop wallpaper using registry 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-1775739321-368907234-981748298-1000\Control Panel\Desktop\WallPaper = "C:\\ProgramData\\f6e0f448.BMP" 516664139b0ddd044397a56482d7308d87c213c320a3151ccb9738e8f932654b.exe -
Modifies Control Panel 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-1775739321-368907234-981748298-1000\Control Panel\Desktop 516664139b0ddd044397a56482d7308d87c213c320a3151ccb9738e8f932654b.exe Set value (str) \REGISTRY\USER\S-1-5-21-1775739321-368907234-981748298-1000\Control Panel\Desktop\WallpaperStyle = "10" 516664139b0ddd044397a56482d7308d87c213c320a3151ccb9738e8f932654b.exe -
Modifies data under HKEY_USERS 35 IoCs
description ioc Process Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\RestartManager\Session0000\Owner = 141000007ddeaf365851da01 516664139b0ddd044397a56482d7308d87c213c320a3151ccb9738e8f932654b.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\RestartManager\Session0000\Sequence = "1" 516664139b0ddd044397a56482d7308d87c213c320a3151ccb9738e8f932654b.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\RestartManager\Session0000\RegFilesHash = 5d411c64f7653496ddd282097f0f50ad87d6ef8d827ba474f9076a35341ccac0 516664139b0ddd044397a56482d7308d87c213c320a3151ccb9738e8f932654b.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000 516664139b0ddd044397a56482d7308d87c213c320a3151ccb9738e8f932654b.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix 516664139b0ddd044397a56482d7308d87c213c320a3151ccb9738e8f932654b.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1" 516664139b0ddd044397a56482d7308d87c213c320a3151ccb9738e8f932654b.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft 516664139b0ddd044397a56482d7308d87c213c320a3151ccb9738e8f932654b.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\RestartManager\Session0000\RegFiles0000 = 5c005c003f005c0043003a005c00550073006500720073005c00410064006d0069006e005c004e00540055005300450052002e004400410054007b00340065003000370034003600360038002d0030006300310063002d0031003100650037002d0061003900340033002d006500340031006400320064003700310038006100320030007d002e0054004d0043006f006e007400610069006e0065007200300030003000300030003000300030003000300030003000300030003000300030003000300031002e007200650067007400720061006e0073002d006d00730000000000 516664139b0ddd044397a56482d7308d87c213c320a3151ccb9738e8f932654b.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\RestartManager\Session0000\SessionHash = f95026d8bbb1e7d122fdde4fd2b42d5c9360f2c7216b776f51f4ddc2ca291366 516664139b0ddd044397a56482d7308d87c213c320a3151ccb9738e8f932654b.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\RestartManager\Session0000\RegFilesHash = e82f476772d39febe66a356d7e37585a4d1d0e0a9f090ae460766e950dd1b112 516664139b0ddd044397a56482d7308d87c213c320a3151ccb9738e8f932654b.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\RestartManager\Session0000\SessionHash = 3327237af85c8a5532417ef707095db56e61758b393f2bcac1d59ef2467e8ae2 516664139b0ddd044397a56482d7308d87c213c320a3151ccb9738e8f932654b.exe Set value (str) \REGISTRY\USER\.DEFAULT\Control Panel\Desktop\Wallpaper = "C:\\ProgramData\\f6e0f448.BMP" 516664139b0ddd044397a56482d7308d87c213c320a3151ccb9738e8f932654b.exe Key created \REGISTRY\USER\.DEFAULT\Control Panel\International 516664139b0ddd044397a56482d7308d87c213c320a3151ccb9738e8f932654b.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1" 516664139b0ddd044397a56482d7308d87c213c320a3151ccb9738e8f932654b.exe Key created \REGISTRY\USER\.DEFAULT\Software 516664139b0ddd044397a56482d7308d87c213c320a3151ccb9738e8f932654b.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing 516664139b0ddd044397a56482d7308d87c213c320a3151ccb9738e8f932654b.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\RestartManager\Session0000\RegFilesHash = 8515c5ab43a270715bd06e9df9a82968a86d101c5db2129ec89eb7497e4070b2 516664139b0ddd044397a56482d7308d87c213c320a3151ccb9738e8f932654b.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0" 516664139b0ddd044397a56482d7308d87c213c320a3151ccb9738e8f932654b.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\RestartManager\Session0000\RegFiles0000 = 5c005c003f005c0043003a005c00550073006500720073005c00410064006d0069006e005c006e00740075007300650072002e006400610074002e004c004f004700310000000000 516664139b0ddd044397a56482d7308d87c213c320a3151ccb9738e8f932654b.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\RestartManager\Session0000\SessionHash = 7319c873fe8568c14ca86ae452265c9dfecbae7ea721cdca43d3ddf629ae4f71 516664139b0ddd044397a56482d7308d87c213c320a3151ccb9738e8f932654b.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\RestartManager\Session0000\RegFiles0000 = 5c005c003f005c0043003a005c00550073006500720073005c00410064006d0069006e005c004e00540055005300450052002e004400410054007b00340065003000370034003600360038002d0030006300310063002d0031003100650037002d0061003900340033002d006500340031006400320064003700310038006100320030007d002e0054004d0043006f006e007400610069006e0065007200300030003000300030003000300030003000300030003000300030003000300030003000300032002e007200650067007400720061006e0073002d006d00730000000000 516664139b0ddd044397a56482d7308d87c213c320a3151ccb9738e8f932654b.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\RestartManager\Session0000\RegFilesHash = 4b46131c6bcae79c6e1718d2b17976a8884167a86d4ce36048ffc054eb828a5b 516664139b0ddd044397a56482d7308d87c213c320a3151ccb9738e8f932654b.exe Key deleted \REGISTRY\USER\.DEFAULT\Software\Microsoft\RestartManager\Session0000 516664139b0ddd044397a56482d7308d87c213c320a3151ccb9738e8f932654b.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\RestartManager\Session0000\SessionHash = 55aa4d1f98bf70b0c149fe804442e357e5ec615cf43c541bad9449cdd3900e8c 516664139b0ddd044397a56482d7308d87c213c320a3151ccb9738e8f932654b.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\RestartManager\Session0000\RegFilesHash = e552c536b7d50e2a6e5c3d7666f9682b09f2ffd72d7c0190f5c9285c57ae9c3e 516664139b0ddd044397a56482d7308d87c213c320a3151ccb9738e8f932654b.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\RestartManager\Session0000\RegFiles0000 = 5c005c003f005c0043003a005c00550073006500720073005c00410064006d0069006e005c004e00540055005300450052002e004400410054007b00340065003000370034003600360038002d0030006300310063002d0031003100650037002d0061003900340033002d006500340031006400320064003700310038006100320030007d002e0054004d002e0062006c00660000000000 516664139b0ddd044397a56482d7308d87c213c320a3151ccb9738e8f932654b.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:" 516664139b0ddd044397a56482d7308d87c213c320a3151ccb9738e8f932654b.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\RestartManager\Session0000 516664139b0ddd044397a56482d7308d87c213c320a3151ccb9738e8f932654b.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\RestartManager\Session0000\SessionHash = eeb418ab941898cc2d3c0ce2479e2c81db5c75bcddfb9cb6a5a4873df9de82fc 516664139b0ddd044397a56482d7308d87c213c320a3151ccb9738e8f932654b.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\RestartManager\Session0000\RegFiles0000 = 5c005c003f005c0043003a005c00550073006500720073005c00410064006d0069006e005c006e00740075007300650072002e006400610074002e004c004f004700320000000000 516664139b0ddd044397a56482d7308d87c213c320a3151ccb9738e8f932654b.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ 516664139b0ddd044397a56482d7308d87c213c320a3151ccb9738e8f932654b.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1" 516664139b0ddd044397a56482d7308d87c213c320a3151ccb9738e8f932654b.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\RestartManager 516664139b0ddd044397a56482d7308d87c213c320a3151ccb9738e8f932654b.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\OnDemandInterfaceCache 516664139b0ddd044397a56482d7308d87c213c320a3151ccb9738e8f932654b.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:" 516664139b0ddd044397a56482d7308d87c213c320a3151ccb9738e8f932654b.exe -
Modifies registry class 5 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.f6e0f448\ = "f6e0f448" 516664139b0ddd044397a56482d7308d87c213c320a3151ccb9738e8f932654b.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\f6e0f448\DefaultIcon 516664139b0ddd044397a56482d7308d87c213c320a3151ccb9738e8f932654b.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\f6e0f448 516664139b0ddd044397a56482d7308d87c213c320a3151ccb9738e8f932654b.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\f6e0f448\DefaultIcon\ = "C:\\ProgramData\\f6e0f448.ico" 516664139b0ddd044397a56482d7308d87c213c320a3151ccb9738e8f932654b.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.f6e0f448 516664139b0ddd044397a56482d7308d87c213c320a3151ccb9738e8f932654b.exe -
Suspicious behavior: EnumeratesProcesses 32 IoCs
pid Process 2812 516664139b0ddd044397a56482d7308d87c213c320a3151ccb9738e8f932654b.exe 2812 516664139b0ddd044397a56482d7308d87c213c320a3151ccb9738e8f932654b.exe 4116 516664139b0ddd044397a56482d7308d87c213c320a3151ccb9738e8f932654b.exe 4116 516664139b0ddd044397a56482d7308d87c213c320a3151ccb9738e8f932654b.exe 4116 516664139b0ddd044397a56482d7308d87c213c320a3151ccb9738e8f932654b.exe 4116 516664139b0ddd044397a56482d7308d87c213c320a3151ccb9738e8f932654b.exe 4116 516664139b0ddd044397a56482d7308d87c213c320a3151ccb9738e8f932654b.exe 4116 516664139b0ddd044397a56482d7308d87c213c320a3151ccb9738e8f932654b.exe 4116 516664139b0ddd044397a56482d7308d87c213c320a3151ccb9738e8f932654b.exe 4116 516664139b0ddd044397a56482d7308d87c213c320a3151ccb9738e8f932654b.exe 4116 516664139b0ddd044397a56482d7308d87c213c320a3151ccb9738e8f932654b.exe 4116 516664139b0ddd044397a56482d7308d87c213c320a3151ccb9738e8f932654b.exe 4116 516664139b0ddd044397a56482d7308d87c213c320a3151ccb9738e8f932654b.exe 4116 516664139b0ddd044397a56482d7308d87c213c320a3151ccb9738e8f932654b.exe 4116 516664139b0ddd044397a56482d7308d87c213c320a3151ccb9738e8f932654b.exe 4116 516664139b0ddd044397a56482d7308d87c213c320a3151ccb9738e8f932654b.exe 4116 516664139b0ddd044397a56482d7308d87c213c320a3151ccb9738e8f932654b.exe 4116 516664139b0ddd044397a56482d7308d87c213c320a3151ccb9738e8f932654b.exe 4116 516664139b0ddd044397a56482d7308d87c213c320a3151ccb9738e8f932654b.exe 4116 516664139b0ddd044397a56482d7308d87c213c320a3151ccb9738e8f932654b.exe 4116 516664139b0ddd044397a56482d7308d87c213c320a3151ccb9738e8f932654b.exe 4116 516664139b0ddd044397a56482d7308d87c213c320a3151ccb9738e8f932654b.exe 4116 516664139b0ddd044397a56482d7308d87c213c320a3151ccb9738e8f932654b.exe 4116 516664139b0ddd044397a56482d7308d87c213c320a3151ccb9738e8f932654b.exe 4116 516664139b0ddd044397a56482d7308d87c213c320a3151ccb9738e8f932654b.exe 4116 516664139b0ddd044397a56482d7308d87c213c320a3151ccb9738e8f932654b.exe 4116 516664139b0ddd044397a56482d7308d87c213c320a3151ccb9738e8f932654b.exe 4116 516664139b0ddd044397a56482d7308d87c213c320a3151ccb9738e8f932654b.exe 4116 516664139b0ddd044397a56482d7308d87c213c320a3151ccb9738e8f932654b.exe 4116 516664139b0ddd044397a56482d7308d87c213c320a3151ccb9738e8f932654b.exe 4116 516664139b0ddd044397a56482d7308d87c213c320a3151ccb9738e8f932654b.exe 4116 516664139b0ddd044397a56482d7308d87c213c320a3151ccb9738e8f932654b.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
description pid Process Token: SeBackupPrivilege 1336 vssvc.exe Token: SeRestorePrivilege 1336 vssvc.exe Token: SeAuditPrivilege 1336 vssvc.exe -
Suspicious use of WriteProcessMemory 10 IoCs
description pid Process procid_target PID 2996 wrote to memory of 2812 2996 516664139b0ddd044397a56482d7308d87c213c320a3151ccb9738e8f932654b.exe 75 PID 2996 wrote to memory of 2812 2996 516664139b0ddd044397a56482d7308d87c213c320a3151ccb9738e8f932654b.exe 75 PID 2996 wrote to memory of 2812 2996 516664139b0ddd044397a56482d7308d87c213c320a3151ccb9738e8f932654b.exe 75 PID 2996 wrote to memory of 2812 2996 516664139b0ddd044397a56482d7308d87c213c320a3151ccb9738e8f932654b.exe 75 PID 2812 wrote to memory of 4116 2812 516664139b0ddd044397a56482d7308d87c213c320a3151ccb9738e8f932654b.exe 80 PID 2812 wrote to memory of 4116 2812 516664139b0ddd044397a56482d7308d87c213c320a3151ccb9738e8f932654b.exe 80 PID 2812 wrote to memory of 4116 2812 516664139b0ddd044397a56482d7308d87c213c320a3151ccb9738e8f932654b.exe 80 PID 2812 wrote to memory of 3376 2812 516664139b0ddd044397a56482d7308d87c213c320a3151ccb9738e8f932654b.exe 81 PID 2812 wrote to memory of 3376 2812 516664139b0ddd044397a56482d7308d87c213c320a3151ccb9738e8f932654b.exe 81 PID 2812 wrote to memory of 3376 2812 516664139b0ddd044397a56482d7308d87c213c320a3151ccb9738e8f932654b.exe 81 -
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\516664139b0ddd044397a56482d7308d87c213c320a3151ccb9738e8f932654b.exe"C:\Users\Admin\AppData\Local\Temp\516664139b0ddd044397a56482d7308d87c213c320a3151ccb9738e8f932654b.exe"1⤵PID:2136
-
C:\Users\Admin\AppData\Local\Temp\516664139b0ddd044397a56482d7308d87c213c320a3151ccb9738e8f932654b.exe"C:\Users\Admin\AppData\Local\Temp\516664139b0ddd044397a56482d7308d87c213c320a3151ccb9738e8f932654b.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2996 -
C:\Users\Admin\AppData\Local\Temp\516664139b0ddd044397a56482d7308d87c213c320a3151ccb9738e8f932654b.exe"C:\Users\Admin\AppData\Local\Temp\516664139b0ddd044397a56482d7308d87c213c320a3151ccb9738e8f932654b.exe"2⤵
- Drops file in System32 directory
- Sets desktop wallpaper using registry
- Modifies Control Panel
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2812 -
C:\Users\Admin\AppData\Local\Temp\516664139b0ddd044397a56482d7308d87c213c320a3151ccb9738e8f932654b.exeC:\Users\Admin\AppData\Local\Temp\516664139b0ddd044397a56482d7308d87c213c320a3151ccb9738e8f932654b.exe -work worker0 job0-28123⤵
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
PID:4116
-
-
C:\Users\Admin\AppData\Local\Temp\516664139b0ddd044397a56482d7308d87c213c320a3151ccb9738e8f932654b.exeC:\Users\Admin\AppData\Local\Temp\516664139b0ddd044397a56482d7308d87c213c320a3151ccb9738e8f932654b.exe -work worker1 job1-28123⤵
- Enumerates connected drives
PID:3376
-
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1336
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2KB
MD5cc9673216d53012c400856b86968c4a2
SHA180945bfdc6f2b30fd7b47e92ae762ab4ad792659
SHA2565dfc11166e6b0e978aa5b95aaf2a51733033379b7e7980f5fa1d42b6333cf9e0
SHA512f556026b31927923f385325adb493934e45750f401bf4787a0f0602f8309f520c967da72b9924f1872895718a5376eb8c433084496f5903670ad1e1d47cc4266