Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Resubmissions
27/01/2024, 19:37
240127-yb9zasafd8 1027/01/2024, 19:36
240127-ybp9wsafb7 1001/05/2021, 01:07
210501-shjstql5m2 10Analysis
-
max time kernel
141s -
max time network
158s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
27/01/2024, 19:36
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
516664139b0ddd044397a56482d7308d87c213c320a3151ccb9738e8f932654b.exe
Resource
win7-20231215-en
windows7-x64
7 signatures
150 seconds
Behavioral task
behavioral2
Sample
516664139b0ddd044397a56482d7308d87c213c320a3151ccb9738e8f932654b.exe
Resource
win10-20231220-en
windows10-1703-x64
12 signatures
150 seconds
Behavioral task
behavioral3
Sample
516664139b0ddd044397a56482d7308d87c213c320a3151ccb9738e8f932654b.exe
Resource
win10v2004-20231215-en
windows10-2004-x64
12 signatures
150 seconds
Behavioral task
behavioral4
Sample
516664139b0ddd044397a56482d7308d87c213c320a3151ccb9738e8f932654b.exe
Resource
win11-20231215-en
windows11-21h2-x64
12 signatures
150 seconds
General
-
Target
516664139b0ddd044397a56482d7308d87c213c320a3151ccb9738e8f932654b.exe
-
Size
56KB
-
MD5
84c1567969b86089cc33dccf41562bcd
-
SHA1
53f2133cb25186e9fa6d4ea3b0e41eee5aba5ef2
-
SHA256
516664139b0ddd044397a56482d7308d87c213c320a3151ccb9738e8f932654b
-
SHA512
72a411cacd503b6fadb15dc90f1f9beb79ff79c620df76da381e5c780c53e11258aae72db2848c241ec55af403d67d62340e429e86c23bbf8a71287738de7eaa
-
SSDEEP
768:AiN4q1eksgR4SiI+rxQ3rjFrXRRWxXyw/Afy81XweyetnR9Wsf5AyT9G3kZ:r4HHerjZX7pLken5nWXWi
Score
10/10
Malware Config
Extracted
Path
F:\README.2039ea39.TXT
Family
darkside
Ransom Note
----------- [ Welcome to DarkSide ] ------------->
What happend?
----------------------------------------------
Your computers and servers are encrypted, backups are deleted. We use strong encryption algorithms, so you cannot decrypt your data.
But you can restore everything by purchasing a special program from us - universal decryptor. This program will restore all your network.
Follow our instructions below and you will recover all your data.
Data leak
----------------------------------------------
First of all we have uploaded more then 500GB data.
The data is preloaded and will be automatically published if you do not pay.
After publication, your data will be available for at least 6 months on our tor cdn servers.
We are ready:
- To provide you the evidence of stolen data
- To delete all the stolen data.
What guarantees?
----------------------------------------------
We value our reputation. If we do not do our work and liabilities, nobody will pay us. This is not in our interests.
All our decryption software is perfectly tested and will decrypt your data. We will also provide support in case of problems.
We guarantee to decrypt one file for free. Go to the site and contact us.
How to get access on website?
----------------------------------------------
Using a TOR browser:
1) Download and install TOR browser from this site: https://torproject.org/
2) Open our website: http://dark24vx6fsmdrtbzdzjv6ckz4yqyued4uz455oqpctko7m6vbrzibad.onion/XES2TUV3A9QL89IS7QX91V7TYSF13ASPGB2TASQ68R9Z6QYH69OVY833QSRSFU4I
When you open our website, put the following data in the input form:
Key:
I3tBdXvJ3pOvnhgmupZAJ7BpD5IVUftr7deEdtoxwK0QcbZciUXfs5ChjD0Yj8H2wUXfctFHYShVQHWhwi1CBDRQVPgXqnCgVRQql7B1tS8Q6TSdHq5o0UxOaDrdKCoMCdrMZiw0RTbfpDpuRwLI52rP5YaqZx492wErocN9C7PE6eFQEcqwqiFNA1FwVD3fogTJqOdTJI84FnlCBuRd1ippdTk8y2x16ukfPvVHi4MhyU8i4K1Q25a7wXQUPXhIffgZBnTimLzalSGyaI3f2MlQeYbpFG2o4nfnZCHDMAZAUY6CaiR0eAYVEvesreMmimT1EOyGYjNVtGHrJYXuRI4tYZIVlsHm6Ord42NV9s9PftLGkO8NBScZ9dBTNtz0xw9tpgu8GegVTlMesg6xkUAQWJcy6MNt9nJ7lHydpu27bA1GL8MX8lWAldnClSoUrDYRc8RAZ1oUfMfbtmvMDBGVENh8kMUYaxOt7hD1HxKFn0p5XcCDzWRSWkKUTtt7C6OiIpNOUAYYJ3UvC5S3uoXmt4iokkGq1SSMnr7sXmnekmh9oNwJgh7
!!! DANGER !!!
DO NOT MODIFY or try to RECOVER any files yourself. We WILL NOT be able to RESTORE them.
!!! DANGER !!!
URLs
http://dark24vx6fsmdrtbzdzjv6ckz4yqyued4uz455oqpctko7m6vbrzibad.onion/XES2TUV3A9QL89IS7QX91V7TYSF13ASPGB2TASQ68R9Z6QYH69OVY833QSRSFU4I
Signatures
-
DarkSide
Targeted ransomware first seen in August 2020. Operators steal data to use as leverage.
-
Renames multiple (156) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Enumerates connected drives 3 TTPs 1 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\F: 516664139b0ddd044397a56482d7308d87c213c320a3151ccb9738e8f932654b.exe -
Drops file in System32 directory 12 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache 516664139b0ddd044397a56482d7308d87c213c320a3151ccb9738e8f932654b.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\103621DE9CD5414CC2538780B4B75751 516664139b0ddd044397a56482d7308d87c213c320a3151ccb9738e8f932654b.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content 516664139b0ddd044397a56482d7308d87c213c320a3151ccb9738e8f932654b.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\103621DE9CD5414CC2538780B4B75751 516664139b0ddd044397a56482d7308d87c213c320a3151ccb9738e8f932654b.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\71DC818AAEA1211A26ACC273B35C74BA 516664139b0ddd044397a56482d7308d87c213c320a3151ccb9738e8f932654b.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCookies 516664139b0ddd044397a56482d7308d87c213c320a3151ccb9738e8f932654b.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft 516664139b0ddd044397a56482d7308d87c213c320a3151ccb9738e8f932654b.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5 516664139b0ddd044397a56482d7308d87c213c320a3151ccb9738e8f932654b.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData 516664139b0ddd044397a56482d7308d87c213c320a3151ccb9738e8f932654b.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\71DC818AAEA1211A26ACC273B35C74BA 516664139b0ddd044397a56482d7308d87c213c320a3151ccb9738e8f932654b.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\Content.IE5 516664139b0ddd044397a56482d7308d87c213c320a3151ccb9738e8f932654b.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE 516664139b0ddd044397a56482d7308d87c213c320a3151ccb9738e8f932654b.exe -
Sets desktop wallpaper using registry 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-635608581-3370340891-292606865-1000\Control Panel\Desktop\WallPaper = "C:\\ProgramData\\2039ea39.BMP" 516664139b0ddd044397a56482d7308d87c213c320a3151ccb9738e8f932654b.exe -
Modifies Control Panel 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-635608581-3370340891-292606865-1000\Control Panel\Desktop 516664139b0ddd044397a56482d7308d87c213c320a3151ccb9738e8f932654b.exe Set value (str) \REGISTRY\USER\S-1-5-21-635608581-3370340891-292606865-1000\Control Panel\Desktop\WallpaperStyle = "10" 516664139b0ddd044397a56482d7308d87c213c320a3151ccb9738e8f932654b.exe -
Modifies data under HKEY_USERS 40 IoCs
description ioc Process Key created \REGISTRY\USER\.DEFAULT\Software 516664139b0ddd044397a56482d7308d87c213c320a3151ccb9738e8f932654b.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\RestartManager\Session0000 516664139b0ddd044397a56482d7308d87c213c320a3151ccb9738e8f932654b.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft 516664139b0ddd044397a56482d7308d87c213c320a3151ccb9738e8f932654b.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\RestartManager\Session0000\Sequence = "1" 516664139b0ddd044397a56482d7308d87c213c320a3151ccb9738e8f932654b.exe Key deleted \REGISTRY\USER\.DEFAULT\Software\Microsoft\RestartManager\Session0000 516664139b0ddd044397a56482d7308d87c213c320a3151ccb9738e8f932654b.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\RestartManager\Session0000\RegFiles0000 = 5c005c003f005c0043003a005c00550073006500720073005c00410064006d0069006e005c004e00540055005300450052002e004400410054007b00350033006200330039006500380038002d0031003800630034002d0031003100650061002d0061003800310031002d003000300030006400330061006100340036003900320062007d002e0054004d0043006f006e007400610069006e0065007200300030003000300030003000300030003000300030003000300030003000300030003000300031002e007200650067007400720061006e0073002d006d00730000000000 516664139b0ddd044397a56482d7308d87c213c320a3151ccb9738e8f932654b.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\RestartManager\Session0000\RegFilesHash = 3e8f4c9682a898481ef3510fca7eb770ba10548a574ea6a17f067f5adc87ca88 516664139b0ddd044397a56482d7308d87c213c320a3151ccb9738e8f932654b.exe Key created \REGISTRY\USER\.DEFAULT\Control Panel\International 516664139b0ddd044397a56482d7308d87c213c320a3151ccb9738e8f932654b.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\RestartManager\Session0000\SessionHash = 6edac98fc66fcd6e5e05207322de82aafd6ca3951298c266f5e3358ec3ac6eae 516664139b0ddd044397a56482d7308d87c213c320a3151ccb9738e8f932654b.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings 516664139b0ddd044397a56482d7308d87c213c320a3151ccb9738e8f932654b.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1" 516664139b0ddd044397a56482d7308d87c213c320a3151ccb9738e8f932654b.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\RestartManager\Session0000\RegFilesHash = 22ec0bcb69c451892f2e14d19816651ade8cc25e1190669124bf5e1fb3a72300 516664139b0ddd044397a56482d7308d87c213c320a3151ccb9738e8f932654b.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:" 516664139b0ddd044397a56482d7308d87c213c320a3151ccb9738e8f932654b.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\RestartManager\Session0000\RegFiles0000 = 5c005c003f005c0043003a005c00550073006500720073005c00410064006d0069006e005c006e00740075007300650072002e006400610074002e004c004f004700310000000000 516664139b0ddd044397a56482d7308d87c213c320a3151ccb9738e8f932654b.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\RestartManager\Session0000\SessionHash = 14227484a425fc036bc2bf0fa6c0384cc4cc48bdc59f67c92478d5ec6948e3af 516664139b0ddd044397a56482d7308d87c213c320a3151ccb9738e8f932654b.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\RestartManager\Session0000\RegFilesHash = 69cbf3bcb51095ab8639c9b2fe784ab1d63da6e2ebfda10ec117b07081019bad 516664139b0ddd044397a56482d7308d87c213c320a3151ccb9738e8f932654b.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\RestartManager\Session0000\SessionHash = d1459c05f31846c3ac6ed01de73d4f1000293e511cfd13f2a6ac7ff2e423f39d 516664139b0ddd044397a56482d7308d87c213c320a3151ccb9738e8f932654b.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ 516664139b0ddd044397a56482d7308d87c213c320a3151ccb9738e8f932654b.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1" 516664139b0ddd044397a56482d7308d87c213c320a3151ccb9738e8f932654b.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1" 516664139b0ddd044397a56482d7308d87c213c320a3151ccb9738e8f932654b.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\P3P\History 516664139b0ddd044397a56482d7308d87c213c320a3151ccb9738e8f932654b.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\P3P 516664139b0ddd044397a56482d7308d87c213c320a3151ccb9738e8f932654b.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\RestartManager\Session0000\SessionHash = 714b6593dac0eb7598b07ec83ef4f815bb147ab0df3379553bc8dad9e763231e 516664139b0ddd044397a56482d7308d87c213c320a3151ccb9738e8f932654b.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\RestartManager\Session0000\RegFiles0000 = 5c005c003f005c0043003a005c00550073006500720073005c00410064006d0069006e005c004e00540055005300450052002e004400410054007b00350033006200330039006500380038002d0031003800630034002d0031003100650061002d0061003800310031002d003000300030006400330061006100340036003900320062007d002e0054004d0043006f006e007400610069006e0065007200300030003000300030003000300030003000300030003000300030003000300030003000300032002e007200650067007400720061006e0073002d006d00730000000000 516664139b0ddd044397a56482d7308d87c213c320a3151ccb9738e8f932654b.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix 516664139b0ddd044397a56482d7308d87c213c320a3151ccb9738e8f932654b.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft 516664139b0ddd044397a56482d7308d87c213c320a3151ccb9738e8f932654b.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion 516664139b0ddd044397a56482d7308d87c213c320a3151ccb9738e8f932654b.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\RestartManager 516664139b0ddd044397a56482d7308d87c213c320a3151ccb9738e8f932654b.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\RestartManager\Session0000\SessionHash = 666931ed0ac17d365d38cb8b4c30deea4e94e7049116f7eaeb5f29efc15eccda 516664139b0ddd044397a56482d7308d87c213c320a3151ccb9738e8f932654b.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\RestartManager\Session0000\RegFilesHash = 83509b0f6316baa71d7343741dbbfd3c9c4c367deab895d3ada15d47c536b9d4 516664139b0ddd044397a56482d7308d87c213c320a3151ccb9738e8f932654b.exe Set value (str) \REGISTRY\USER\.DEFAULT\Control Panel\Desktop\Wallpaper = "C:\\ProgramData\\2039ea39.BMP" 516664139b0ddd044397a56482d7308d87c213c320a3151ccb9738e8f932654b.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:" 516664139b0ddd044397a56482d7308d87c213c320a3151ccb9738e8f932654b.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\RestartManager\Session0000\Owner = 800f00009b8b893d5851da01 516664139b0ddd044397a56482d7308d87c213c320a3151ccb9738e8f932654b.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\RestartManager\Session0000\RegFiles0000 = 5c005c003f005c0043003a005c00550073006500720073005c00410064006d0069006e005c004e00540055005300450052002e004400410054007b00350033006200330039006500380038002d0031003800630034002d0031003100650061002d0061003800310031002d003000300030006400330061006100340036003900320062007d002e0054004d002e0062006c00660000000000 516664139b0ddd044397a56482d7308d87c213c320a3151ccb9738e8f932654b.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0" 516664139b0ddd044397a56482d7308d87c213c320a3151ccb9738e8f932654b.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows 516664139b0ddd044397a56482d7308d87c213c320a3151ccb9738e8f932654b.exe Key created \REGISTRY\USER\.DEFAULT\Software 516664139b0ddd044397a56482d7308d87c213c320a3151ccb9738e8f932654b.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\RestartManager\Session0000\RegFilesHash = 0e054cc1d22cb2a9ac18bf239ec4956f1b0c23f13e46a58a0c55e07c3f9e14df 516664139b0ddd044397a56482d7308d87c213c320a3151ccb9738e8f932654b.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\RestartManager\Session0000\RegFiles0000 = 5c005c003f005c0043003a005c00550073006500720073005c00410064006d0069006e005c006e00740075007300650072002e006400610074002e004c004f004700320000000000 516664139b0ddd044397a56482d7308d87c213c320a3151ccb9738e8f932654b.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing 516664139b0ddd044397a56482d7308d87c213c320a3151ccb9738e8f932654b.exe -
Modifies registry class 5 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.2039ea39 516664139b0ddd044397a56482d7308d87c213c320a3151ccb9738e8f932654b.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.2039ea39\ = "2039ea39" 516664139b0ddd044397a56482d7308d87c213c320a3151ccb9738e8f932654b.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\2039ea39\DefaultIcon 516664139b0ddd044397a56482d7308d87c213c320a3151ccb9738e8f932654b.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\2039ea39 516664139b0ddd044397a56482d7308d87c213c320a3151ccb9738e8f932654b.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\2039ea39\DefaultIcon\ = "C:\\ProgramData\\2039ea39.ico" 516664139b0ddd044397a56482d7308d87c213c320a3151ccb9738e8f932654b.exe -
Suspicious behavior: EnumeratesProcesses 32 IoCs
pid Process 3716 516664139b0ddd044397a56482d7308d87c213c320a3151ccb9738e8f932654b.exe 3716 516664139b0ddd044397a56482d7308d87c213c320a3151ccb9738e8f932654b.exe 3968 516664139b0ddd044397a56482d7308d87c213c320a3151ccb9738e8f932654b.exe 3968 516664139b0ddd044397a56482d7308d87c213c320a3151ccb9738e8f932654b.exe 3968 516664139b0ddd044397a56482d7308d87c213c320a3151ccb9738e8f932654b.exe 3968 516664139b0ddd044397a56482d7308d87c213c320a3151ccb9738e8f932654b.exe 3968 516664139b0ddd044397a56482d7308d87c213c320a3151ccb9738e8f932654b.exe 3968 516664139b0ddd044397a56482d7308d87c213c320a3151ccb9738e8f932654b.exe 3968 516664139b0ddd044397a56482d7308d87c213c320a3151ccb9738e8f932654b.exe 3968 516664139b0ddd044397a56482d7308d87c213c320a3151ccb9738e8f932654b.exe 3968 516664139b0ddd044397a56482d7308d87c213c320a3151ccb9738e8f932654b.exe 3968 516664139b0ddd044397a56482d7308d87c213c320a3151ccb9738e8f932654b.exe 3968 516664139b0ddd044397a56482d7308d87c213c320a3151ccb9738e8f932654b.exe 3968 516664139b0ddd044397a56482d7308d87c213c320a3151ccb9738e8f932654b.exe 3968 516664139b0ddd044397a56482d7308d87c213c320a3151ccb9738e8f932654b.exe 3968 516664139b0ddd044397a56482d7308d87c213c320a3151ccb9738e8f932654b.exe 3968 516664139b0ddd044397a56482d7308d87c213c320a3151ccb9738e8f932654b.exe 3968 516664139b0ddd044397a56482d7308d87c213c320a3151ccb9738e8f932654b.exe 3968 516664139b0ddd044397a56482d7308d87c213c320a3151ccb9738e8f932654b.exe 3968 516664139b0ddd044397a56482d7308d87c213c320a3151ccb9738e8f932654b.exe 3968 516664139b0ddd044397a56482d7308d87c213c320a3151ccb9738e8f932654b.exe 3968 516664139b0ddd044397a56482d7308d87c213c320a3151ccb9738e8f932654b.exe 3968 516664139b0ddd044397a56482d7308d87c213c320a3151ccb9738e8f932654b.exe 3968 516664139b0ddd044397a56482d7308d87c213c320a3151ccb9738e8f932654b.exe 3968 516664139b0ddd044397a56482d7308d87c213c320a3151ccb9738e8f932654b.exe 3968 516664139b0ddd044397a56482d7308d87c213c320a3151ccb9738e8f932654b.exe 3968 516664139b0ddd044397a56482d7308d87c213c320a3151ccb9738e8f932654b.exe 3968 516664139b0ddd044397a56482d7308d87c213c320a3151ccb9738e8f932654b.exe 3968 516664139b0ddd044397a56482d7308d87c213c320a3151ccb9738e8f932654b.exe 3968 516664139b0ddd044397a56482d7308d87c213c320a3151ccb9738e8f932654b.exe 3968 516664139b0ddd044397a56482d7308d87c213c320a3151ccb9738e8f932654b.exe 3968 516664139b0ddd044397a56482d7308d87c213c320a3151ccb9738e8f932654b.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
description pid Process Token: SeBackupPrivilege 4948 vssvc.exe Token: SeRestorePrivilege 4948 vssvc.exe Token: SeAuditPrivilege 4948 vssvc.exe -
Suspicious use of WriteProcessMemory 10 IoCs
description pid Process procid_target PID 4808 wrote to memory of 3716 4808 516664139b0ddd044397a56482d7308d87c213c320a3151ccb9738e8f932654b.exe 89 PID 4808 wrote to memory of 3716 4808 516664139b0ddd044397a56482d7308d87c213c320a3151ccb9738e8f932654b.exe 89 PID 4808 wrote to memory of 3716 4808 516664139b0ddd044397a56482d7308d87c213c320a3151ccb9738e8f932654b.exe 89 PID 4808 wrote to memory of 3716 4808 516664139b0ddd044397a56482d7308d87c213c320a3151ccb9738e8f932654b.exe 89 PID 3716 wrote to memory of 3968 3716 516664139b0ddd044397a56482d7308d87c213c320a3151ccb9738e8f932654b.exe 94 PID 3716 wrote to memory of 3968 3716 516664139b0ddd044397a56482d7308d87c213c320a3151ccb9738e8f932654b.exe 94 PID 3716 wrote to memory of 3968 3716 516664139b0ddd044397a56482d7308d87c213c320a3151ccb9738e8f932654b.exe 94 PID 3716 wrote to memory of 1040 3716 516664139b0ddd044397a56482d7308d87c213c320a3151ccb9738e8f932654b.exe 95 PID 3716 wrote to memory of 1040 3716 516664139b0ddd044397a56482d7308d87c213c320a3151ccb9738e8f932654b.exe 95 PID 3716 wrote to memory of 1040 3716 516664139b0ddd044397a56482d7308d87c213c320a3151ccb9738e8f932654b.exe 95 -
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\516664139b0ddd044397a56482d7308d87c213c320a3151ccb9738e8f932654b.exe"C:\Users\Admin\AppData\Local\Temp\516664139b0ddd044397a56482d7308d87c213c320a3151ccb9738e8f932654b.exe"1⤵PID:1124
-
C:\Users\Admin\AppData\Local\Temp\516664139b0ddd044397a56482d7308d87c213c320a3151ccb9738e8f932654b.exe"C:\Users\Admin\AppData\Local\Temp\516664139b0ddd044397a56482d7308d87c213c320a3151ccb9738e8f932654b.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4808 -
C:\Users\Admin\AppData\Local\Temp\516664139b0ddd044397a56482d7308d87c213c320a3151ccb9738e8f932654b.exe"C:\Users\Admin\AppData\Local\Temp\516664139b0ddd044397a56482d7308d87c213c320a3151ccb9738e8f932654b.exe"2⤵
- Drops file in System32 directory
- Sets desktop wallpaper using registry
- Modifies Control Panel
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3716 -
C:\Users\Admin\AppData\Local\Temp\516664139b0ddd044397a56482d7308d87c213c320a3151ccb9738e8f932654b.exeC:\Users\Admin\AppData\Local\Temp\516664139b0ddd044397a56482d7308d87c213c320a3151ccb9738e8f932654b.exe -work worker0 job0-37163⤵
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
PID:3968
-
-
C:\Users\Admin\AppData\Local\Temp\516664139b0ddd044397a56482d7308d87c213c320a3151ccb9738e8f932654b.exeC:\Users\Admin\AppData\Local\Temp\516664139b0ddd044397a56482d7308d87c213c320a3151ccb9738e8f932654b.exe -work worker1 job1-37163⤵
- Enumerates connected drives
PID:1040
-
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
PID:4948
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2KB
MD5cc9673216d53012c400856b86968c4a2
SHA180945bfdc6f2b30fd7b47e92ae762ab4ad792659
SHA2565dfc11166e6b0e978aa5b95aaf2a51733033379b7e7980f5fa1d42b6333cf9e0
SHA512f556026b31927923f385325adb493934e45750f401bf4787a0f0602f8309f520c967da72b9924f1872895718a5376eb8c433084496f5903670ad1e1d47cc4266