Overview
overview
10Static
static
717139a10fd...61.exe
windows7-x64
1017139a10fd...61.exe
windows10-2004-x64
101cc7c198a8...cb.exe
windows7-x64
101cc7c198a8...cb.exe
windows10-2004-x64
10243dff06fc...60.exe
windows7-x64
10243dff06fc...60.exe
windows10-2004-x64
1027214dcb04...8f.exe
windows7-x64
1027214dcb04...8f.exe
windows10-2004-x64
103dabd40d56...a6.exe
windows7-x64
33dabd40d56...a6.exe
windows10-2004-x64
343e61519be...aa.exe
windows7-x64
1043e61519be...aa.exe
windows10-2004-x64
1048a848bc9e...3a.exe
windows7-x64
1048a848bc9e...3a.exe
windows10-2004-x64
10508dd6f7ed...dd.exe
windows7-x64
10508dd6f7ed...dd.exe
windows10-2004-x64
10516664139b...4b.exe
windows7-x64
3516664139b...4b.exe
windows10-2004-x64
10533672da9d...8d.exe
windows7-x64
10533672da9d...8d.exe
windows10-2004-x64
106228f75f52...ff.exe
windows7-x64
106228f75f52...ff.exe
windows10-2004-x64
106836ec8588...d8.exe
windows7-x64
36836ec8588...d8.exe
windows10-2004-x64
368872cc22f...e7.exe
windows7-x64
1068872cc22f...e7.exe
windows10-2004-x64
10691515a485...a5.exe
windows7-x64
10691515a485...a5.exe
windows10-2004-x64
1078782fd324...34.exe
windows7-x64
1078782fd324...34.exe
windows10-2004-x64
108cfd289118...bc.exe
windows7-x64
108cfd289118...bc.exe
windows10-2004-x64
10Resubmissions
27-01-2024 19:37
240127-yb5pksafd3 1027-01-2024 19:36
240127-ybqwesafc2 1012-05-2021 15:56
210512-db4t7vmwas 10Analysis
-
max time kernel
91s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20231222-en -
resource tags
arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system -
submitted
27-01-2024 19:36
Behavioral task
behavioral1
Sample
17139a10fd226d01738fe9323918614aa913b2a50e1a516e95cced93fa151c61.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
17139a10fd226d01738fe9323918614aa913b2a50e1a516e95cced93fa151c61.exe
Resource
win10v2004-20231215-en
Behavioral task
behavioral3
Sample
1cc7c198a8a2c935fd6f07970479e544f5b35a8eb3173de0305ebdf76a0988cb.exe
Resource
win7-20231215-en
Behavioral task
behavioral4
Sample
1cc7c198a8a2c935fd6f07970479e544f5b35a8eb3173de0305ebdf76a0988cb.exe
Resource
win10v2004-20231215-en
Behavioral task
behavioral5
Sample
243dff06fc80a049f4fb37292f8b8def0fce29768f345c88ee10699e22b0ae60.exe
Resource
win7-20231129-en
Behavioral task
behavioral6
Sample
243dff06fc80a049f4fb37292f8b8def0fce29768f345c88ee10699e22b0ae60.exe
Resource
win10v2004-20231215-en
Behavioral task
behavioral7
Sample
27214dcb04310040c38f8d6a65fe03c14b18d4171390da271855fdd02e06768f.exe
Resource
win7-20231215-en
Behavioral task
behavioral8
Sample
27214dcb04310040c38f8d6a65fe03c14b18d4171390da271855fdd02e06768f.exe
Resource
win10v2004-20231215-en
Behavioral task
behavioral9
Sample
3dabd40d564cf8a8163432abc38768b0a7d45f0fc1970d802dc33b9109feb6a6.exe
Resource
win7-20231215-en
Behavioral task
behavioral10
Sample
3dabd40d564cf8a8163432abc38768b0a7d45f0fc1970d802dc33b9109feb6a6.exe
Resource
win10v2004-20231215-en
Behavioral task
behavioral11
Sample
43e61519be440115eeaa3738a0e4aa4bb3c8ac5f9bdfce1a896db17a374eb8aa.exe
Resource
win7-20231215-en
Behavioral task
behavioral12
Sample
43e61519be440115eeaa3738a0e4aa4bb3c8ac5f9bdfce1a896db17a374eb8aa.exe
Resource
win10v2004-20231215-en
Behavioral task
behavioral13
Sample
48a848bc9e0f126b41e5ca196707412c7c40087404c0c8ed70e5cee4a418203a.exe
Resource
win7-20231215-en
Behavioral task
behavioral14
Sample
48a848bc9e0f126b41e5ca196707412c7c40087404c0c8ed70e5cee4a418203a.exe
Resource
win10v2004-20231215-en
Behavioral task
behavioral15
Sample
508dd6f7ed6c143cf5e1ed6a4051dd8ee7b5bf4b7f55e0704d21ba785f2d5add.exe
Resource
win7-20231215-en
Behavioral task
behavioral16
Sample
508dd6f7ed6c143cf5e1ed6a4051dd8ee7b5bf4b7f55e0704d21ba785f2d5add.exe
Resource
win10v2004-20231215-en
Behavioral task
behavioral17
Sample
516664139b0ddd044397a56482d7308d87c213c320a3151ccb9738e8f932654b.exe
Resource
win7-20231215-en
Behavioral task
behavioral18
Sample
516664139b0ddd044397a56482d7308d87c213c320a3151ccb9738e8f932654b.exe
Resource
win10v2004-20231222-en
Behavioral task
behavioral19
Sample
533672da9d276012ebab3ce9f4cd09a7f537f65c6e4b63d43f0c1697e2f5e48d.exe
Resource
win7-20231129-en
Behavioral task
behavioral20
Sample
533672da9d276012ebab3ce9f4cd09a7f537f65c6e4b63d43f0c1697e2f5e48d.exe
Resource
win10v2004-20231222-en
Behavioral task
behavioral21
Sample
6228f75f52fd69488419c0e0eb3617b5b894a566a93e52b99a9addced7364cff.exe
Resource
win7-20231129-en
Behavioral task
behavioral22
Sample
6228f75f52fd69488419c0e0eb3617b5b894a566a93e52b99a9addced7364cff.exe
Resource
win10v2004-20231215-en
Behavioral task
behavioral23
Sample
6836ec8588b8049bcd57cd920b7a75f1e206e5e8bb316927784afadb634ea4d8.exe
Resource
win7-20231215-en
Behavioral task
behavioral24
Sample
6836ec8588b8049bcd57cd920b7a75f1e206e5e8bb316927784afadb634ea4d8.exe
Resource
win10v2004-20231215-en
Behavioral task
behavioral25
Sample
68872cc22fbdf0c2f69c32ac878ba9a7b7cf61fe5dd0e3da200131b8b23438e7.exe
Resource
win7-20231215-en
Behavioral task
behavioral26
Sample
68872cc22fbdf0c2f69c32ac878ba9a7b7cf61fe5dd0e3da200131b8b23438e7.exe
Resource
win10v2004-20231215-en
Behavioral task
behavioral27
Sample
691515a485b0b3989fb71c6807e640eeec1a0e30d90500db6414035d942f70a5.exe
Resource
win7-20231215-en
Behavioral task
behavioral28
Sample
691515a485b0b3989fb71c6807e640eeec1a0e30d90500db6414035d942f70a5.exe
Resource
win10v2004-20231215-en
Behavioral task
behavioral29
Sample
78782fd324bc98a57274bd3fff8f756217c011484ebf6b614060115a699ee134.exe
Resource
win7-20231215-en
Behavioral task
behavioral30
Sample
78782fd324bc98a57274bd3fff8f756217c011484ebf6b614060115a699ee134.exe
Resource
win10v2004-20231215-en
Behavioral task
behavioral31
Sample
8cfd28911878af048fb96b6cc0b9da770542576d5c2b20b193c3cfc4bde4d3bc.exe
Resource
win7-20231215-en
Behavioral task
behavioral32
Sample
8cfd28911878af048fb96b6cc0b9da770542576d5c2b20b193c3cfc4bde4d3bc.exe
Resource
win10v2004-20231222-en
General
-
Target
516664139b0ddd044397a56482d7308d87c213c320a3151ccb9738e8f932654b.exe
-
Size
56KB
-
MD5
84c1567969b86089cc33dccf41562bcd
-
SHA1
53f2133cb25186e9fa6d4ea3b0e41eee5aba5ef2
-
SHA256
516664139b0ddd044397a56482d7308d87c213c320a3151ccb9738e8f932654b
-
SHA512
72a411cacd503b6fadb15dc90f1f9beb79ff79c620df76da381e5c780c53e11258aae72db2848c241ec55af403d67d62340e429e86c23bbf8a71287738de7eaa
-
SSDEEP
768:AiN4q1eksgR4SiI+rxQ3rjFrXRRWxXyw/Afy81XweyetnR9Wsf5AyT9G3kZ:r4HHerjZX7pLken5nWXWi
Malware Config
Extracted
C:\README.b2100882.TXT
darkside
http://dark24vx6fsmdrtbzdzjv6ckz4yqyued4uz455oqpctko7m6vbrzibad.onion/XES2TUV3A9QL89IS7QX91V7TYSF13ASPGB2TASQ68R9Z6QYH69OVY833QSRSFU4I
Signatures
-
DarkSide
Targeted ransomware first seen in August 2020. Operators steal data to use as leverage.
-
Renames multiple (175) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Enumerates connected drives 3 TTPs 1 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
Processes:
516664139b0ddd044397a56482d7308d87c213c320a3151ccb9738e8f932654b.exedescription ioc process File opened (read-only) \??\F: 516664139b0ddd044397a56482d7308d87c213c320a3151ccb9738e8f932654b.exe -
Drops file in System32 directory 12 IoCs
Processes:
516664139b0ddd044397a56482d7308d87c213c320a3151ccb9738e8f932654b.exedescription ioc process File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache 516664139b0ddd044397a56482d7308d87c213c320a3151ccb9738e8f932654b.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\103621DE9CD5414CC2538780B4B75751 516664139b0ddd044397a56482d7308d87c213c320a3151ccb9738e8f932654b.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\71DC818AAEA1211A26ACC273B35C74BA 516664139b0ddd044397a56482d7308d87c213c320a3151ccb9738e8f932654b.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE 516664139b0ddd044397a56482d7308d87c213c320a3151ccb9738e8f932654b.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft 516664139b0ddd044397a56482d7308d87c213c320a3151ccb9738e8f932654b.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5 516664139b0ddd044397a56482d7308d87c213c320a3151ccb9738e8f932654b.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData 516664139b0ddd044397a56482d7308d87c213c320a3151ccb9738e8f932654b.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\103621DE9CD5414CC2538780B4B75751 516664139b0ddd044397a56482d7308d87c213c320a3151ccb9738e8f932654b.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content 516664139b0ddd044397a56482d7308d87c213c320a3151ccb9738e8f932654b.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\71DC818AAEA1211A26ACC273B35C74BA 516664139b0ddd044397a56482d7308d87c213c320a3151ccb9738e8f932654b.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\Content.IE5 516664139b0ddd044397a56482d7308d87c213c320a3151ccb9738e8f932654b.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCookies 516664139b0ddd044397a56482d7308d87c213c320a3151ccb9738e8f932654b.exe -
Sets desktop wallpaper using registry 2 TTPs 1 IoCs
Processes:
516664139b0ddd044397a56482d7308d87c213c320a3151ccb9738e8f932654b.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\Control Panel\Desktop\WallPaper = "C:\\ProgramData\\b2100882.BMP" 516664139b0ddd044397a56482d7308d87c213c320a3151ccb9738e8f932654b.exe -
Modifies Control Panel 2 IoCs
Processes:
516664139b0ddd044397a56482d7308d87c213c320a3151ccb9738e8f932654b.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\Control Panel\Desktop 516664139b0ddd044397a56482d7308d87c213c320a3151ccb9738e8f932654b.exe Set value (str) \REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\Control Panel\Desktop\WallpaperStyle = "10" 516664139b0ddd044397a56482d7308d87c213c320a3151ccb9738e8f932654b.exe -
Modifies data under HKEY_USERS 40 IoCs
Processes:
516664139b0ddd044397a56482d7308d87c213c320a3151ccb9738e8f932654b.exe516664139b0ddd044397a56482d7308d87c213c320a3151ccb9738e8f932654b.exedescription ioc process Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\RestartManager\Session0000\RegFiles0000 = 5c005c003f005c0043003a005c00550073006500720073005c00410064006d0069006e005c006e00740075007300650072002e006400610074002e004c004f004700310000000000 516664139b0ddd044397a56482d7308d87c213c320a3151ccb9738e8f932654b.exe Key deleted \REGISTRY\USER\.DEFAULT\Software\Microsoft\RestartManager\Session0000 516664139b0ddd044397a56482d7308d87c213c320a3151ccb9738e8f932654b.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\RestartManager\Session0000\RegFilesHash = 3904bee23392a4b7db0b21d2f3054646d7610e1e7053cd3a4e14e77468626810 516664139b0ddd044397a56482d7308d87c213c320a3151ccb9738e8f932654b.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\RestartManager\Session0000\SessionHash = 0e365debbaf99c292909a69d281f155eec44b15bd30b8f0bcc937badf61f15ec 516664139b0ddd044397a56482d7308d87c213c320a3151ccb9738e8f932654b.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\RestartManager 516664139b0ddd044397a56482d7308d87c213c320a3151ccb9738e8f932654b.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\RestartManager\Session0000\RegFilesHash = d496730335297ed303fc6b23c65c6459444fb5e7b4ecb33341e1cbaff0b6ce5d 516664139b0ddd044397a56482d7308d87c213c320a3151ccb9738e8f932654b.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\RestartManager\Session0000\SessionHash = 3c73fc9c62bed4c9491c5308fae9dee4e07401394466617b0c9c3e8f45ae2ce3 516664139b0ddd044397a56482d7308d87c213c320a3151ccb9738e8f932654b.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\P3P 516664139b0ddd044397a56482d7308d87c213c320a3151ccb9738e8f932654b.exe Key created \REGISTRY\USER\.DEFAULT\Control Panel\International 516664139b0ddd044397a56482d7308d87c213c320a3151ccb9738e8f932654b.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1" 516664139b0ddd044397a56482d7308d87c213c320a3151ccb9738e8f932654b.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing 516664139b0ddd044397a56482d7308d87c213c320a3151ccb9738e8f932654b.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\RestartManager\Session0000\RegFilesHash = eefcb0da3a5962ee6294106d32db7aba64e564e3f797cf4b3a7bbe9bc81cc14d 516664139b0ddd044397a56482d7308d87c213c320a3151ccb9738e8f932654b.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\P3P\History 516664139b0ddd044397a56482d7308d87c213c320a3151ccb9738e8f932654b.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings 516664139b0ddd044397a56482d7308d87c213c320a3151ccb9738e8f932654b.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ 516664139b0ddd044397a56482d7308d87c213c320a3151ccb9738e8f932654b.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft 516664139b0ddd044397a56482d7308d87c213c320a3151ccb9738e8f932654b.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\RestartManager\Session0000\SessionHash = eb867e3916df33185a4cd7534febc9e93c59a7193c6f410daff007cfd9025052 516664139b0ddd044397a56482d7308d87c213c320a3151ccb9738e8f932654b.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\RestartManager\Session0000\RegFiles0000 = 5c005c003f005c0043003a005c00550073006500720073005c00410064006d0069006e005c004e00540055005300450052002e004400410054007b00350033006200330039006500380038002d0031003800630034002d0031003100650061002d0061003800310031002d003000300030006400330061006100340036003900320062007d002e0054004d0043006f006e007400610069006e0065007200300030003000300030003000300030003000300030003000300030003000300030003000300031002e007200650067007400720061006e0073002d006d00730000000000 516664139b0ddd044397a56482d7308d87c213c320a3151ccb9738e8f932654b.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft 516664139b0ddd044397a56482d7308d87c213c320a3151ccb9738e8f932654b.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion 516664139b0ddd044397a56482d7308d87c213c320a3151ccb9738e8f932654b.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix 516664139b0ddd044397a56482d7308d87c213c320a3151ccb9738e8f932654b.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\RestartManager\Session0000\RegFilesHash = 513d8632dac3fa748b48de18b30512760f92f5df25ff81b31fcff882f23d0ab5 516664139b0ddd044397a56482d7308d87c213c320a3151ccb9738e8f932654b.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\RestartManager\Session0000\RegFiles0000 = 5c005c003f005c0043003a005c00550073006500720073005c00410064006d0069006e005c004e00540055005300450052002e004400410054007b00350033006200330039006500380038002d0031003800630034002d0031003100650061002d0061003800310031002d003000300030006400330061006100340036003900320062007d002e0054004d0043006f006e007400610069006e0065007200300030003000300030003000300030003000300030003000300030003000300030003000300032002e007200650067007400720061006e0073002d006d00730000000000 516664139b0ddd044397a56482d7308d87c213c320a3151ccb9738e8f932654b.exe Key created \REGISTRY\USER\.DEFAULT\Software 516664139b0ddd044397a56482d7308d87c213c320a3151ccb9738e8f932654b.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:" 516664139b0ddd044397a56482d7308d87c213c320a3151ccb9738e8f932654b.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0" 516664139b0ddd044397a56482d7308d87c213c320a3151ccb9738e8f932654b.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\RestartManager\Session0000 516664139b0ddd044397a56482d7308d87c213c320a3151ccb9738e8f932654b.exe Key created \REGISTRY\USER\.DEFAULT\Software 516664139b0ddd044397a56482d7308d87c213c320a3151ccb9738e8f932654b.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\RestartManager\Session0000\Owner = 740b000068120e5c5851da01 516664139b0ddd044397a56482d7308d87c213c320a3151ccb9738e8f932654b.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\RestartManager\Session0000\SessionHash = cbc8852271239ed02cd16d4d77f3a219261fa2443b78729f0757710349f0dfc1 516664139b0ddd044397a56482d7308d87c213c320a3151ccb9738e8f932654b.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\RestartManager\Session0000\RegFiles0000 = 5c005c003f005c0043003a005c00550073006500720073005c00410064006d0069006e005c006e00740075007300650072002e006400610074002e004c004f004700320000000000 516664139b0ddd044397a56482d7308d87c213c320a3151ccb9738e8f932654b.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\RestartManager\Session0000\SessionHash = b1bb72827700a1a13645e064f1d14c3322b42beaa67b095cf90d0afc639fbf6e 516664139b0ddd044397a56482d7308d87c213c320a3151ccb9738e8f932654b.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1" 516664139b0ddd044397a56482d7308d87c213c320a3151ccb9738e8f932654b.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\RestartManager\Session0000\RegFilesHash = 76d7540ab4350842991a54227152074d21b05083a3c6a4c06711dd00ea598d8d 516664139b0ddd044397a56482d7308d87c213c320a3151ccb9738e8f932654b.exe Set value (str) \REGISTRY\USER\.DEFAULT\Control Panel\Desktop\Wallpaper = "C:\\ProgramData\\b2100882.BMP" 516664139b0ddd044397a56482d7308d87c213c320a3151ccb9738e8f932654b.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows 516664139b0ddd044397a56482d7308d87c213c320a3151ccb9738e8f932654b.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\RestartManager\Session0000\RegFiles0000 = 5c005c003f005c0043003a005c00550073006500720073005c00410064006d0069006e005c004e00540055005300450052002e004400410054007b00350033006200330039006500380038002d0031003800630034002d0031003100650061002d0061003800310031002d003000300030006400330061006100340036003900320062007d002e0054004d002e0062006c00660000000000 516664139b0ddd044397a56482d7308d87c213c320a3151ccb9738e8f932654b.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1" 516664139b0ddd044397a56482d7308d87c213c320a3151ccb9738e8f932654b.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\RestartManager\Session0000\Sequence = "1" 516664139b0ddd044397a56482d7308d87c213c320a3151ccb9738e8f932654b.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:" 516664139b0ddd044397a56482d7308d87c213c320a3151ccb9738e8f932654b.exe -
Modifies registry class 5 IoCs
Processes:
516664139b0ddd044397a56482d7308d87c213c320a3151ccb9738e8f932654b.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.b2100882 516664139b0ddd044397a56482d7308d87c213c320a3151ccb9738e8f932654b.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.b2100882\ = "b2100882" 516664139b0ddd044397a56482d7308d87c213c320a3151ccb9738e8f932654b.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\b2100882\DefaultIcon 516664139b0ddd044397a56482d7308d87c213c320a3151ccb9738e8f932654b.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\b2100882 516664139b0ddd044397a56482d7308d87c213c320a3151ccb9738e8f932654b.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\b2100882\DefaultIcon\ = "C:\\ProgramData\\b2100882.ico" 516664139b0ddd044397a56482d7308d87c213c320a3151ccb9738e8f932654b.exe -
Suspicious behavior: EnumeratesProcesses 32 IoCs
Processes:
516664139b0ddd044397a56482d7308d87c213c320a3151ccb9738e8f932654b.exe516664139b0ddd044397a56482d7308d87c213c320a3151ccb9738e8f932654b.exepid process 3068 516664139b0ddd044397a56482d7308d87c213c320a3151ccb9738e8f932654b.exe 3068 516664139b0ddd044397a56482d7308d87c213c320a3151ccb9738e8f932654b.exe 2932 516664139b0ddd044397a56482d7308d87c213c320a3151ccb9738e8f932654b.exe 2932 516664139b0ddd044397a56482d7308d87c213c320a3151ccb9738e8f932654b.exe 2932 516664139b0ddd044397a56482d7308d87c213c320a3151ccb9738e8f932654b.exe 2932 516664139b0ddd044397a56482d7308d87c213c320a3151ccb9738e8f932654b.exe 2932 516664139b0ddd044397a56482d7308d87c213c320a3151ccb9738e8f932654b.exe 2932 516664139b0ddd044397a56482d7308d87c213c320a3151ccb9738e8f932654b.exe 2932 516664139b0ddd044397a56482d7308d87c213c320a3151ccb9738e8f932654b.exe 2932 516664139b0ddd044397a56482d7308d87c213c320a3151ccb9738e8f932654b.exe 2932 516664139b0ddd044397a56482d7308d87c213c320a3151ccb9738e8f932654b.exe 2932 516664139b0ddd044397a56482d7308d87c213c320a3151ccb9738e8f932654b.exe 2932 516664139b0ddd044397a56482d7308d87c213c320a3151ccb9738e8f932654b.exe 2932 516664139b0ddd044397a56482d7308d87c213c320a3151ccb9738e8f932654b.exe 2932 516664139b0ddd044397a56482d7308d87c213c320a3151ccb9738e8f932654b.exe 2932 516664139b0ddd044397a56482d7308d87c213c320a3151ccb9738e8f932654b.exe 2932 516664139b0ddd044397a56482d7308d87c213c320a3151ccb9738e8f932654b.exe 2932 516664139b0ddd044397a56482d7308d87c213c320a3151ccb9738e8f932654b.exe 2932 516664139b0ddd044397a56482d7308d87c213c320a3151ccb9738e8f932654b.exe 2932 516664139b0ddd044397a56482d7308d87c213c320a3151ccb9738e8f932654b.exe 2932 516664139b0ddd044397a56482d7308d87c213c320a3151ccb9738e8f932654b.exe 2932 516664139b0ddd044397a56482d7308d87c213c320a3151ccb9738e8f932654b.exe 2932 516664139b0ddd044397a56482d7308d87c213c320a3151ccb9738e8f932654b.exe 2932 516664139b0ddd044397a56482d7308d87c213c320a3151ccb9738e8f932654b.exe 2932 516664139b0ddd044397a56482d7308d87c213c320a3151ccb9738e8f932654b.exe 2932 516664139b0ddd044397a56482d7308d87c213c320a3151ccb9738e8f932654b.exe 2932 516664139b0ddd044397a56482d7308d87c213c320a3151ccb9738e8f932654b.exe 2932 516664139b0ddd044397a56482d7308d87c213c320a3151ccb9738e8f932654b.exe 2932 516664139b0ddd044397a56482d7308d87c213c320a3151ccb9738e8f932654b.exe 2932 516664139b0ddd044397a56482d7308d87c213c320a3151ccb9738e8f932654b.exe 2932 516664139b0ddd044397a56482d7308d87c213c320a3151ccb9738e8f932654b.exe 2932 516664139b0ddd044397a56482d7308d87c213c320a3151ccb9738e8f932654b.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
vssvc.exedescription pid process Token: SeBackupPrivilege 2224 vssvc.exe Token: SeRestorePrivilege 2224 vssvc.exe Token: SeAuditPrivilege 2224 vssvc.exe -
Suspicious use of WriteProcessMemory 10 IoCs
Processes:
516664139b0ddd044397a56482d7308d87c213c320a3151ccb9738e8f932654b.exedescription pid process target process PID 2680 wrote to memory of 3068 2680 516664139b0ddd044397a56482d7308d87c213c320a3151ccb9738e8f932654b.exe PID 2680 wrote to memory of 3068 2680 516664139b0ddd044397a56482d7308d87c213c320a3151ccb9738e8f932654b.exe PID 2680 wrote to memory of 3068 2680 516664139b0ddd044397a56482d7308d87c213c320a3151ccb9738e8f932654b.exe PID 2680 wrote to memory of 3068 2680 516664139b0ddd044397a56482d7308d87c213c320a3151ccb9738e8f932654b.exe PID 3068 wrote to memory of 2932 3068 516664139b0ddd044397a56482d7308d87c213c320a3151ccb9738e8f932654b.exe 516664139b0ddd044397a56482d7308d87c213c320a3151ccb9738e8f932654b.exe PID 3068 wrote to memory of 2932 3068 516664139b0ddd044397a56482d7308d87c213c320a3151ccb9738e8f932654b.exe 516664139b0ddd044397a56482d7308d87c213c320a3151ccb9738e8f932654b.exe PID 3068 wrote to memory of 2932 3068 516664139b0ddd044397a56482d7308d87c213c320a3151ccb9738e8f932654b.exe 516664139b0ddd044397a56482d7308d87c213c320a3151ccb9738e8f932654b.exe PID 3068 wrote to memory of 1688 3068 516664139b0ddd044397a56482d7308d87c213c320a3151ccb9738e8f932654b.exe 516664139b0ddd044397a56482d7308d87c213c320a3151ccb9738e8f932654b.exe PID 3068 wrote to memory of 1688 3068 516664139b0ddd044397a56482d7308d87c213c320a3151ccb9738e8f932654b.exe 516664139b0ddd044397a56482d7308d87c213c320a3151ccb9738e8f932654b.exe PID 3068 wrote to memory of 1688 3068 516664139b0ddd044397a56482d7308d87c213c320a3151ccb9738e8f932654b.exe 516664139b0ddd044397a56482d7308d87c213c320a3151ccb9738e8f932654b.exe -
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\516664139b0ddd044397a56482d7308d87c213c320a3151ccb9738e8f932654b.exe"C:\Users\Admin\AppData\Local\Temp\516664139b0ddd044397a56482d7308d87c213c320a3151ccb9738e8f932654b.exe"1⤵
-
C:\Users\Admin\AppData\Local\Temp\516664139b0ddd044397a56482d7308d87c213c320a3151ccb9738e8f932654b.exe"C:\Users\Admin\AppData\Local\Temp\516664139b0ddd044397a56482d7308d87c213c320a3151ccb9738e8f932654b.exe"1⤵
-
C:\Users\Admin\AppData\Local\Temp\516664139b0ddd044397a56482d7308d87c213c320a3151ccb9738e8f932654b.exe"C:\Users\Admin\AppData\Local\Temp\516664139b0ddd044397a56482d7308d87c213c320a3151ccb9738e8f932654b.exe"2⤵
- Drops file in System32 directory
- Sets desktop wallpaper using registry
- Modifies Control Panel
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\516664139b0ddd044397a56482d7308d87c213c320a3151ccb9738e8f932654b.exeC:\Users\Admin\AppData\Local\Temp\516664139b0ddd044397a56482d7308d87c213c320a3151ccb9738e8f932654b.exe -work worker0 job0-30683⤵
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
-
C:\Users\Admin\AppData\Local\Temp\516664139b0ddd044397a56482d7308d87c213c320a3151ccb9738e8f932654b.exeC:\Users\Admin\AppData\Local\Temp\516664139b0ddd044397a56482d7308d87c213c320a3151ccb9738e8f932654b.exe -work worker1 job1-30683⤵
- Enumerates connected drives
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\README.b2100882.TXTFilesize
2KB
MD5cc9673216d53012c400856b86968c4a2
SHA180945bfdc6f2b30fd7b47e92ae762ab4ad792659
SHA2565dfc11166e6b0e978aa5b95aaf2a51733033379b7e7980f5fa1d42b6333cf9e0
SHA512f556026b31927923f385325adb493934e45750f401bf4787a0f0602f8309f520c967da72b9924f1872895718a5376eb8c433084496f5903670ad1e1d47cc4266