Analysis
-
max time kernel
120s -
max time network
120s -
platform
windows10_x64 -
resource
win10v20210410 -
submitted
24-05-2021 07:39
Static task
static1
Behavioral task
behavioral1
Sample
2de09a815efcc64810046de69b8e0aa1c9e9beee77b66560a0b15d737485e3c5.exe
Resource
win7v20210408
Behavioral task
behavioral2
Sample
2de09a815efcc64810046de69b8e0aa1c9e9beee77b66560a0b15d737485e3c5.exe
Resource
win10v20210410
General
-
Target
2de09a815efcc64810046de69b8e0aa1c9e9beee77b66560a0b15d737485e3c5.exe
-
Size
56KB
-
MD5
9b5350ddf895a5051b90a1cc563753df
-
SHA1
0e45a5f66f5ce300b8c7135450e76afaccc0d332
-
SHA256
2de09a815efcc64810046de69b8e0aa1c9e9beee77b66560a0b15d737485e3c5
-
SHA512
b96a1d383ca4721e3a0481399eb6dee0c1573e1c07140b7ec57c808b89cc6790937e6a7d49c960639a79c5a1bf1595e05834c6ae42c1c6933d2537fb38eaa190
Malware Config
Extracted
C:\\README.aeef1a75.TXT
darkside
http://dark24vx6fsmdrtbzdzjv6ckz4yqyued4uz455oqpctko7m6vbrzibad.onion/1SJ1TB6JTW4SEUG6GSN7IVSGERSM5H5M2VZOHQ4PSIVS2AGAQDMT3QVGIFMPM3K8
Signatures
-
DarkSide
Targeted ransomware first seen in August 2020. Operators steal data to use as leverage.
-
Enumerates connected drives 3 TTPs 2 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
Processes:
2de09a815efcc64810046de69b8e0aa1c9e9beee77b66560a0b15d737485e3c5.exe2de09a815efcc64810046de69b8e0aa1c9e9beee77b66560a0b15d737485e3c5.exedescription ioc process File opened (read-only) \??\Z: 2de09a815efcc64810046de69b8e0aa1c9e9beee77b66560a0b15d737485e3c5.exe File opened (read-only) \??\Z: 2de09a815efcc64810046de69b8e0aa1c9e9beee77b66560a0b15d737485e3c5.exe -
Drops file in System32 directory 5 IoCs
Processes:
2de09a815efcc64810046de69b8e0aa1c9e9beee77b66560a0b15d737485e3c5.exedescription ioc process File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5 2de09a815efcc64810046de69b8e0aa1c9e9beee77b66560a0b15d737485e3c5.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\counters2.dat 2de09a815efcc64810046de69b8e0aa1c9e9beee77b66560a0b15d737485e3c5.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\Content.IE5 2de09a815efcc64810046de69b8e0aa1c9e9beee77b66560a0b15d737485e3c5.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE 2de09a815efcc64810046de69b8e0aa1c9e9beee77b66560a0b15d737485e3c5.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCookies 2de09a815efcc64810046de69b8e0aa1c9e9beee77b66560a0b15d737485e3c5.exe -
Sets desktop wallpaper using registry 2 TTPs 1 IoCs
Processes:
2de09a815efcc64810046de69b8e0aa1c9e9beee77b66560a0b15d737485e3c5.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Control Panel\Desktop\WallPaper = "C:\\ProgramData\\aeef1a75.BMP" 2de09a815efcc64810046de69b8e0aa1c9e9beee77b66560a0b15d737485e3c5.exe -
Modifies Control Panel 2 IoCs
Processes:
2de09a815efcc64810046de69b8e0aa1c9e9beee77b66560a0b15d737485e3c5.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Control Panel\Desktop 2de09a815efcc64810046de69b8e0aa1c9e9beee77b66560a0b15d737485e3c5.exe Set value (str) \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Control Panel\Desktop\WallpaperStyle = "10" 2de09a815efcc64810046de69b8e0aa1c9e9beee77b66560a0b15d737485e3c5.exe -
Modifies data under HKEY_USERS 29 IoCs
Processes:
2de09a815efcc64810046de69b8e0aa1c9e9beee77b66560a0b15d737485e3c5.exe2de09a815efcc64810046de69b8e0aa1c9e9beee77b66560a0b15d737485e3c5.exedescription ioc process Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ 2de09a815efcc64810046de69b8e0aa1c9e9beee77b66560a0b15d737485e3c5.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\RestartManager\Session0000\Sequence = "1" 2de09a815efcc64810046de69b8e0aa1c9e9beee77b66560a0b15d737485e3c5.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\RestartManager\Session0000\RegFiles0000 = 5c005c003f005c0043003a005c00550073006500720073005c00410064006d0069006e005c004e00540055005300450052002e004400410054007b00340065003000370034003600360038002d0030006300310063002d0031003100650037002d0061003900340033002d006500340031006400320064003700310038006100320030007d002e0054004d002e0062006c00660000000000 2de09a815efcc64810046de69b8e0aa1c9e9beee77b66560a0b15d737485e3c5.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\RestartManager\Session0000\SessionHash = b2529d31ab29cb3b7c8ebbfd8d674773d9f579a4c03843a60bb0a19ea18edda2 2de09a815efcc64810046de69b8e0aa1c9e9beee77b66560a0b15d737485e3c5.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\RestartManager\Session0000\RegFiles0000 = 5c005c003f005c0043003a005c00550073006500720073005c00410064006d0069006e005c004e00540055005300450052002e004400410054007b00340065003000370034003600360038002d0030006300310063002d0031003100650037002d0061003900340033002d006500340031006400320064003700310038006100320030007d002e0054004d0043006f006e007400610069006e0065007200300030003000300030003000300030003000300030003000300030003000300030003000300032002e007200650067007400720061006e0073002d006d00730000000000 2de09a815efcc64810046de69b8e0aa1c9e9beee77b66560a0b15d737485e3c5.exe Key created \REGISTRY\USER\.DEFAULT\Control Panel\International 2de09a815efcc64810046de69b8e0aa1c9e9beee77b66560a0b15d737485e3c5.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\RestartManager 2de09a815efcc64810046de69b8e0aa1c9e9beee77b66560a0b15d737485e3c5.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\RestartManager\Session0000\SessionHash = 06db1950b9cde39b3f06e78b1c49a96c6169e6f0434667bb246f63d7e2675199 2de09a815efcc64810046de69b8e0aa1c9e9beee77b66560a0b15d737485e3c5.exe Set value (str) \REGISTRY\USER\.DEFAULT\Control Panel\Desktop\Wallpaper = "C:\\ProgramData\\aeef1a75.BMP" 2de09a815efcc64810046de69b8e0aa1c9e9beee77b66560a0b15d737485e3c5.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1" 2de09a815efcc64810046de69b8e0aa1c9e9beee77b66560a0b15d737485e3c5.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\RestartManager\Session0000 2de09a815efcc64810046de69b8e0aa1c9e9beee77b66560a0b15d737485e3c5.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft 2de09a815efcc64810046de69b8e0aa1c9e9beee77b66560a0b15d737485e3c5.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\RestartManager\Session0000\RegFilesHash = 5b95fa180d2cd3a95c8905c5fc597da747b1bf654d198e835a728f0600316be8 2de09a815efcc64810046de69b8e0aa1c9e9beee77b66560a0b15d737485e3c5.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1" 2de09a815efcc64810046de69b8e0aa1c9e9beee77b66560a0b15d737485e3c5.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1" 2de09a815efcc64810046de69b8e0aa1c9e9beee77b66560a0b15d737485e3c5.exe Key created \REGISTRY\USER\.DEFAULT\Software 2de09a815efcc64810046de69b8e0aa1c9e9beee77b66560a0b15d737485e3c5.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\RestartManager\Session0000\RegFiles0000 = 5c005c003f005c0043003a005c00550073006500720073005c00410064006d0069006e005c006e00740075007300650072002e006400610074002e004c004f004700310000000000 2de09a815efcc64810046de69b8e0aa1c9e9beee77b66560a0b15d737485e3c5.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:" 2de09a815efcc64810046de69b8e0aa1c9e9beee77b66560a0b15d737485e3c5.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\RestartManager\Session0000\RegFilesHash = 448b4adabfc718bc835e9ce81055e0c5b0dbe42d217afc916572e2772bca57b3 2de09a815efcc64810046de69b8e0aa1c9e9beee77b66560a0b15d737485e3c5.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix 2de09a815efcc64810046de69b8e0aa1c9e9beee77b66560a0b15d737485e3c5.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\RestartManager\Session0000\Owner = 8c090000bdc3ff6c6f50d701 2de09a815efcc64810046de69b8e0aa1c9e9beee77b66560a0b15d737485e3c5.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\RestartManager\Session0000\RegFilesHash = a7d76952d613ede07cc12f2e96cc9ec21004cbbff98e4baebbc08e27a191647c 2de09a815efcc64810046de69b8e0aa1c9e9beee77b66560a0b15d737485e3c5.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:" 2de09a815efcc64810046de69b8e0aa1c9e9beee77b66560a0b15d737485e3c5.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\RestartManager\Session0000\SessionHash = e8e0780113eab020d2fb47fda12b114050501c74d94ef434cbc9c0454028ede7 2de09a815efcc64810046de69b8e0aa1c9e9beee77b66560a0b15d737485e3c5.exe Key deleted \REGISTRY\USER\.DEFAULT\Software\Microsoft\RestartManager\Session0000 2de09a815efcc64810046de69b8e0aa1c9e9beee77b66560a0b15d737485e3c5.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\RestartManager\Session0000\SessionHash = 4c3fe0ee5b43fd6798e56d5b521911a7fb67fea2baa5bbd6fa1a4df443e29061 2de09a815efcc64810046de69b8e0aa1c9e9beee77b66560a0b15d737485e3c5.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\RestartManager\Session0000\RegFilesHash = 09f583792359d08cef5d629808082832b3e74bfe632d6944ab41b3ce9148c8f5 2de09a815efcc64810046de69b8e0aa1c9e9beee77b66560a0b15d737485e3c5.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0" 2de09a815efcc64810046de69b8e0aa1c9e9beee77b66560a0b15d737485e3c5.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\RestartManager\Session0000\RegFiles0000 = 5c005c003f005c0043003a005c00550073006500720073005c00410064006d0069006e005c004e00540055005300450052002e004400410054007b00340065003000370034003600360038002d0030006300310063002d0031003100650037002d0061003900340033002d006500340031006400320064003700310038006100320030007d002e0054004d0043006f006e007400610069006e0065007200300030003000300030003000300030003000300030003000300030003000300030003000300031002e007200650067007400720061006e0073002d006d00730000000000 2de09a815efcc64810046de69b8e0aa1c9e9beee77b66560a0b15d737485e3c5.exe -
Modifies registry class 5 IoCs
Processes:
2de09a815efcc64810046de69b8e0aa1c9e9beee77b66560a0b15d737485e3c5.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\aeef1a75\DefaultIcon\ = "C:\\ProgramData\\aeef1a75.ico" 2de09a815efcc64810046de69b8e0aa1c9e9beee77b66560a0b15d737485e3c5.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.aeef1a75 2de09a815efcc64810046de69b8e0aa1c9e9beee77b66560a0b15d737485e3c5.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.aeef1a75\ = "aeef1a75" 2de09a815efcc64810046de69b8e0aa1c9e9beee77b66560a0b15d737485e3c5.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\aeef1a75\DefaultIcon 2de09a815efcc64810046de69b8e0aa1c9e9beee77b66560a0b15d737485e3c5.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\aeef1a75 2de09a815efcc64810046de69b8e0aa1c9e9beee77b66560a0b15d737485e3c5.exe -
Suspicious behavior: EnumeratesProcesses 26 IoCs
Processes:
2de09a815efcc64810046de69b8e0aa1c9e9beee77b66560a0b15d737485e3c5.exe2de09a815efcc64810046de69b8e0aa1c9e9beee77b66560a0b15d737485e3c5.exepid process 1048 2de09a815efcc64810046de69b8e0aa1c9e9beee77b66560a0b15d737485e3c5.exe 1048 2de09a815efcc64810046de69b8e0aa1c9e9beee77b66560a0b15d737485e3c5.exe 2444 2de09a815efcc64810046de69b8e0aa1c9e9beee77b66560a0b15d737485e3c5.exe 2444 2de09a815efcc64810046de69b8e0aa1c9e9beee77b66560a0b15d737485e3c5.exe 2444 2de09a815efcc64810046de69b8e0aa1c9e9beee77b66560a0b15d737485e3c5.exe 2444 2de09a815efcc64810046de69b8e0aa1c9e9beee77b66560a0b15d737485e3c5.exe 2444 2de09a815efcc64810046de69b8e0aa1c9e9beee77b66560a0b15d737485e3c5.exe 2444 2de09a815efcc64810046de69b8e0aa1c9e9beee77b66560a0b15d737485e3c5.exe 2444 2de09a815efcc64810046de69b8e0aa1c9e9beee77b66560a0b15d737485e3c5.exe 2444 2de09a815efcc64810046de69b8e0aa1c9e9beee77b66560a0b15d737485e3c5.exe 2444 2de09a815efcc64810046de69b8e0aa1c9e9beee77b66560a0b15d737485e3c5.exe 2444 2de09a815efcc64810046de69b8e0aa1c9e9beee77b66560a0b15d737485e3c5.exe 2444 2de09a815efcc64810046de69b8e0aa1c9e9beee77b66560a0b15d737485e3c5.exe 2444 2de09a815efcc64810046de69b8e0aa1c9e9beee77b66560a0b15d737485e3c5.exe 2444 2de09a815efcc64810046de69b8e0aa1c9e9beee77b66560a0b15d737485e3c5.exe 2444 2de09a815efcc64810046de69b8e0aa1c9e9beee77b66560a0b15d737485e3c5.exe 2444 2de09a815efcc64810046de69b8e0aa1c9e9beee77b66560a0b15d737485e3c5.exe 2444 2de09a815efcc64810046de69b8e0aa1c9e9beee77b66560a0b15d737485e3c5.exe 2444 2de09a815efcc64810046de69b8e0aa1c9e9beee77b66560a0b15d737485e3c5.exe 2444 2de09a815efcc64810046de69b8e0aa1c9e9beee77b66560a0b15d737485e3c5.exe 2444 2de09a815efcc64810046de69b8e0aa1c9e9beee77b66560a0b15d737485e3c5.exe 2444 2de09a815efcc64810046de69b8e0aa1c9e9beee77b66560a0b15d737485e3c5.exe 2444 2de09a815efcc64810046de69b8e0aa1c9e9beee77b66560a0b15d737485e3c5.exe 2444 2de09a815efcc64810046de69b8e0aa1c9e9beee77b66560a0b15d737485e3c5.exe 2444 2de09a815efcc64810046de69b8e0aa1c9e9beee77b66560a0b15d737485e3c5.exe 2444 2de09a815efcc64810046de69b8e0aa1c9e9beee77b66560a0b15d737485e3c5.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
vssvc.exedescription pid process Token: SeBackupPrivilege 1788 vssvc.exe Token: SeRestorePrivilege 1788 vssvc.exe Token: SeAuditPrivilege 1788 vssvc.exe -
Suspicious use of WriteProcessMemory 10 IoCs
Processes:
2de09a815efcc64810046de69b8e0aa1c9e9beee77b66560a0b15d737485e3c5.exe2de09a815efcc64810046de69b8e0aa1c9e9beee77b66560a0b15d737485e3c5.exedescription pid process target process PID 808 wrote to memory of 1048 808 2de09a815efcc64810046de69b8e0aa1c9e9beee77b66560a0b15d737485e3c5.exe 2de09a815efcc64810046de69b8e0aa1c9e9beee77b66560a0b15d737485e3c5.exe PID 808 wrote to memory of 1048 808 2de09a815efcc64810046de69b8e0aa1c9e9beee77b66560a0b15d737485e3c5.exe 2de09a815efcc64810046de69b8e0aa1c9e9beee77b66560a0b15d737485e3c5.exe PID 808 wrote to memory of 1048 808 2de09a815efcc64810046de69b8e0aa1c9e9beee77b66560a0b15d737485e3c5.exe 2de09a815efcc64810046de69b8e0aa1c9e9beee77b66560a0b15d737485e3c5.exe PID 808 wrote to memory of 1048 808 2de09a815efcc64810046de69b8e0aa1c9e9beee77b66560a0b15d737485e3c5.exe 2de09a815efcc64810046de69b8e0aa1c9e9beee77b66560a0b15d737485e3c5.exe PID 1048 wrote to memory of 2444 1048 2de09a815efcc64810046de69b8e0aa1c9e9beee77b66560a0b15d737485e3c5.exe 2de09a815efcc64810046de69b8e0aa1c9e9beee77b66560a0b15d737485e3c5.exe PID 1048 wrote to memory of 2444 1048 2de09a815efcc64810046de69b8e0aa1c9e9beee77b66560a0b15d737485e3c5.exe 2de09a815efcc64810046de69b8e0aa1c9e9beee77b66560a0b15d737485e3c5.exe PID 1048 wrote to memory of 2444 1048 2de09a815efcc64810046de69b8e0aa1c9e9beee77b66560a0b15d737485e3c5.exe 2de09a815efcc64810046de69b8e0aa1c9e9beee77b66560a0b15d737485e3c5.exe PID 1048 wrote to memory of 3344 1048 2de09a815efcc64810046de69b8e0aa1c9e9beee77b66560a0b15d737485e3c5.exe 2de09a815efcc64810046de69b8e0aa1c9e9beee77b66560a0b15d737485e3c5.exe PID 1048 wrote to memory of 3344 1048 2de09a815efcc64810046de69b8e0aa1c9e9beee77b66560a0b15d737485e3c5.exe 2de09a815efcc64810046de69b8e0aa1c9e9beee77b66560a0b15d737485e3c5.exe PID 1048 wrote to memory of 3344 1048 2de09a815efcc64810046de69b8e0aa1c9e9beee77b66560a0b15d737485e3c5.exe 2de09a815efcc64810046de69b8e0aa1c9e9beee77b66560a0b15d737485e3c5.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2de09a815efcc64810046de69b8e0aa1c9e9beee77b66560a0b15d737485e3c5.exe"C:\Users\Admin\AppData\Local\Temp\2de09a815efcc64810046de69b8e0aa1c9e9beee77b66560a0b15d737485e3c5.exe"1⤵PID:512
-
C:\Users\Admin\AppData\Local\Temp\2de09a815efcc64810046de69b8e0aa1c9e9beee77b66560a0b15d737485e3c5.exe"C:\Users\Admin\AppData\Local\Temp\2de09a815efcc64810046de69b8e0aa1c9e9beee77b66560a0b15d737485e3c5.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:808 -
C:\Users\Admin\AppData\Local\Temp\2de09a815efcc64810046de69b8e0aa1c9e9beee77b66560a0b15d737485e3c5.exe"C:\Users\Admin\AppData\Local\Temp\2de09a815efcc64810046de69b8e0aa1c9e9beee77b66560a0b15d737485e3c5.exe"2⤵
- Enumerates connected drives
- Drops file in System32 directory
- Sets desktop wallpaper using registry
- Modifies Control Panel
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1048 -
C:\Users\Admin\AppData\Local\Temp\2de09a815efcc64810046de69b8e0aa1c9e9beee77b66560a0b15d737485e3c5.exeC:\Users\Admin\AppData\Local\Temp\2de09a815efcc64810046de69b8e0aa1c9e9beee77b66560a0b15d737485e3c5.exe -work worker0 job0-10483⤵
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
PID:2444 -
C:\Users\Admin\AppData\Local\Temp\2de09a815efcc64810046de69b8e0aa1c9e9beee77b66560a0b15d737485e3c5.exeC:\Users\Admin\AppData\Local\Temp\2de09a815efcc64810046de69b8e0aa1c9e9beee77b66560a0b15d737485e3c5.exe -work worker1 job1-10483⤵
- Enumerates connected drives
PID:3344
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1788