Malware Analysis Report

2024-10-16 03:29

Sample ID 210821-19r51mjyls
Target acer.bin
SHA256 0a0c225f0e5ee941a79f2b7701f1285e4975a2859eb4d025d96d9e366e81abb9
Tags
darkside ransomware
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V6

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

0a0c225f0e5ee941a79f2b7701f1285e4975a2859eb4d025d96d9e366e81abb9

Threat Level: Known bad

The file acer.bin was found to be: Known bad.

Malicious Activity Summary

darkside ransomware

DarkSide

Modifies extensions of user files

Enumerates connected drives

Sets desktop wallpaper using registry

Drops file in System32 directory

Modifies data under HKEY_USERS

Opens file in notepad (likely ransom note)

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

Modifies Control Panel

Modifies registry class

Suspicious behavior: EnumeratesProcesses

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2021-08-21 10:33

Signatures

N/A

Analysis: behavioral1

Detonation Overview

Submitted

2021-08-21 10:33

Reported

2021-08-21 10:36

Platform

win7v20210410

Max time kernel

151s

Max time network

94s

Command Line

"C:\Users\Admin\AppData\Local\Temp\acer.bin.exe"

Signatures

DarkSide

ransomware darkside

Modifies extensions of user files

ransomware
Description Indicator Process Target
File renamed C:\Users\Admin\Pictures\HideAdd.tiff => C:\Users\Admin\Pictures\HideAdd.tiff.949640ab C:\Users\Admin\AppData\Local\Temp\acer.bin.exe N/A
File opened for modification C:\Users\Admin\Pictures\SetInstall.tiff.949640ab C:\Users\Admin\AppData\Local\Temp\acer.bin.exe N/A
File opened for modification C:\Users\Admin\Pictures\ExitSelect.tiff C:\Users\Admin\AppData\Local\Temp\acer.bin.exe N/A
File opened for modification C:\Users\Admin\Pictures\ExitSelect.tiff.949640ab C:\Users\Admin\AppData\Local\Temp\acer.bin.exe N/A
File renamed C:\Users\Admin\Pictures\ExitSelect.tiff => C:\Users\Admin\Pictures\ExitSelect.tiff.949640ab C:\Users\Admin\AppData\Local\Temp\acer.bin.exe N/A
File opened for modification C:\Users\Admin\Pictures\HideAdd.tiff.949640ab C:\Users\Admin\AppData\Local\Temp\acer.bin.exe N/A
File opened for modification C:\Users\Admin\Pictures\ReceiveWait.tif.949640ab C:\Users\Admin\AppData\Local\Temp\acer.bin.exe N/A
File renamed C:\Users\Admin\Pictures\SetInstall.tiff => C:\Users\Admin\Pictures\SetInstall.tiff.949640ab C:\Users\Admin\AppData\Local\Temp\acer.bin.exe N/A
File renamed C:\Users\Admin\Pictures\AddDebug.crw => C:\Users\Admin\Pictures\AddDebug.crw.949640ab C:\Users\Admin\AppData\Local\Temp\acer.bin.exe N/A
File opened for modification C:\Users\Admin\Pictures\ConvertFromStart.crw.949640ab C:\Users\Admin\AppData\Local\Temp\acer.bin.exe N/A
File opened for modification C:\Users\Admin\Pictures\HideAdd.tiff C:\Users\Admin\AppData\Local\Temp\acer.bin.exe N/A
File renamed C:\Users\Admin\Pictures\ProtectWrite.raw => C:\Users\Admin\Pictures\ProtectWrite.raw.949640ab C:\Users\Admin\AppData\Local\Temp\acer.bin.exe N/A
File opened for modification C:\Users\Admin\Pictures\ProtectWrite.raw.949640ab C:\Users\Admin\AppData\Local\Temp\acer.bin.exe N/A
File renamed C:\Users\Admin\Pictures\ReceiveWait.tif => C:\Users\Admin\Pictures\ReceiveWait.tif.949640ab C:\Users\Admin\AppData\Local\Temp\acer.bin.exe N/A
File opened for modification C:\Users\Admin\Pictures\SetInstall.tiff C:\Users\Admin\AppData\Local\Temp\acer.bin.exe N/A
File opened for modification C:\Users\Admin\Pictures\AddDebug.crw.949640ab C:\Users\Admin\AppData\Local\Temp\acer.bin.exe N/A
File renamed C:\Users\Admin\Pictures\ConvertFromStart.crw => C:\Users\Admin\Pictures\ConvertFromStart.crw.949640ab C:\Users\Admin\AppData\Local\Temp\acer.bin.exe N/A

Drops file in System32 directory

Description Indicator Process Target
File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\counters.dat C:\Users\Admin\AppData\Local\Temp\acer.bin.exe N/A

Sets desktop wallpaper using registry

ransomware
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Control Panel\Desktop\WallPaper = "C:\\ProgramData\\949640ab.BMP" C:\Users\Admin\AppData\Local\Temp\acer.bin.exe N/A

Modifies Control Panel

evasion
Description Indicator Process Target
Key created \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Control Panel\Desktop C:\Users\Admin\AppData\Local\Temp\acer.bin.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Control Panel\Desktop\WallpaperStyle = "10" C:\Users\Admin\AppData\Local\Temp\acer.bin.exe N/A

Modifies data under HKEY_USERS

Description Indicator Process Target
Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "0" C:\Users\Admin\AppData\Local\Temp\acer.bin.exe N/A
Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\42-1f-43-76-39-cd C:\Users\Admin\AppData\Local\Temp\acer.bin.exe N/A
Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\42-1f-43-76-39-cd\WpadDecisionTime = 00f5a58d7896d701 C:\Users\Admin\AppData\Local\Temp\acer.bin.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software C:\Users\Admin\AppData\Local\Temp\acer.bin.exe N/A
Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft C:\Users\Admin\AppData\Local\Temp\acer.bin.exe N/A
Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\RestartManager C:\Users\Admin\AppData\Local\Temp\acer.bin.exe N/A
Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings C:\Users\Admin\AppData\Local\Temp\acer.bin.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyEnable = "0" C:\Users\Admin\AppData\Local\Temp\acer.bin.exe N/A
Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\RestartManager\Session0000\RegFiles0000 = 5c005c003f005c0043003a005c00550073006500720073005c00410064006d0069006e005c004e00540055005300450052002e004400410054007b00300031003600380038003800620064002d0036006300360066002d0031003100640065002d0038006400310064002d003000300031006500300062006300640065003300650063007d002e0054004d002e0062006c00660000000000 C:\Users\Admin\AppData\Local\Temp\acer.bin.exe N/A
Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\RestartManager\Session0000\RegFilesHash = 3ce8860b686a8a3fcc63df49210eb2d189240a3f777d51d1bf065ffb7b83e763 C:\Users\Admin\AppData\Local\Temp\acer.bin.exe N/A
Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\RestartManager\Session0000 C:\Users\Admin\AppData\Local\Temp\acer.bin.exe N/A
Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\RestartManager\Session0000\SessionHash = 23a3da11900660ab018ae6dc9646a062fe534ffcdcaedd0906ea65b4d54e8238 C:\Users\Admin\AppData\Local\Temp\acer.bin.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings C:\Users\Admin\AppData\Local\Temp\acer.bin.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{2A905F01-0A57-4E51-8685-54144DDC3A32}\WpadDecision = "0" C:\Users\Admin\AppData\Local\Temp\acer.bin.exe N/A
Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{2A905F01-0A57-4E51-8685-54144DDC3A32} C:\Users\Admin\AppData\Local\Temp\acer.bin.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\42-1f-43-76-39-cd\WpadDecisionReason = "1" C:\Users\Admin\AppData\Local\Temp\acer.bin.exe N/A
Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\RestartManager\Session0000\SessionHash = ef1cda7db9012cc0fbe523cc210c338e18031653a8bf6d42a18fbc8075054b92 C:\Users\Admin\AppData\Local\Temp\acer.bin.exe N/A
Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\RestartManager\Session0000\RegFilesHash = 87d7c9438f7a6b262de85e703e1a695ecb7eaa5633f61bb560ebad2893c1ca29 C:\Users\Admin\AppData\Local\Temp\acer.bin.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix C:\Users\Admin\AppData\Local\Temp\acer.bin.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad C:\Users\Admin\AppData\Local\Temp\acer.bin.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Control Panel\International C:\Users\Admin\AppData\Local\Temp\acer.bin.exe N/A
Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\RestartManager\Session0000\Owner = c405000020c9dd8e7896d701 C:\Users\Admin\AppData\Local\Temp\acer.bin.exe N/A
Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\RestartManager\Session0000\SessionHash = efa542c045d16c2a635bb25c18372a04b0d314ec757f49f55cebba98c93d8b7a C:\Users\Admin\AppData\Local\Temp\acer.bin.exe N/A
Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\RestartManager\Session0000\RegFiles0000 = 5c005c003f005c0043003a005c00550073006500720073005c00410064006d0069006e005c004e00540055005300450052002e004400410054007b00300031003600380038003800620064002d0036006300360066002d0031003100640065002d0038006400310064002d003000300031006500300062006300640065003300650063007d002e0054004d0043006f006e007400610069006e0065007200300030003000300030003000300030003000300030003000300030003000300030003000300031002e007200650067007400720061006e0073002d006d00730000000000 C:\Users\Admin\AppData\Local\Temp\acer.bin.exe N/A
Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\RestartManager\Session0000\RegFiles0000 = 5c005c003f005c0043003a005c00550073006500720073005c00410064006d0069006e005c004e00540055005300450052002e004400410054007b00300031003600380038003800620064002d0036006300360066002d0031003100640065002d0038006400310064002d003000300031006500300062006300640065003300650063007d002e0054004d0043006f006e007400610069006e0065007200300030003000300030003000300030003000300030003000300030003000300030003000300032002e007200650067007400720061006e0073002d006d00730000000000 C:\Users\Admin\AppData\Local\Temp\acer.bin.exe N/A
Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{2A905F01-0A57-4E51-8685-54144DDC3A32}\WpadDecisionTime = 00f5a58d7896d701 C:\Users\Admin\AppData\Local\Temp\acer.bin.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\RestartManager\Session0000 C:\Users\Admin\AppData\Local\Temp\acer.bin.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:" C:\Users\Admin\AppData\Local\Temp\acer.bin.exe N/A
Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\SavedLegacySettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 C:\Users\Admin\AppData\Local\Temp\acer.bin.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "1" C:\Users\Admin\AppData\Local\Temp\acer.bin.exe N/A
Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{2A905F01-0A57-4E51-8685-54144DDC3A32}\42-1f-43-76-39-cd C:\Users\Admin\AppData\Local\Temp\acer.bin.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\42-1f-43-76-39-cd\WpadDecision = "0" C:\Users\Admin\AppData\Local\Temp\acer.bin.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\RestartManager\Session0000\Sequence = "1" C:\Users\Admin\AppData\Local\Temp\acer.bin.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections C:\Users\Admin\AppData\Local\Temp\acer.bin.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:" C:\Users\Admin\AppData\Local\Temp\acer.bin.exe N/A
Key deleted \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\RestartManager\Session0000 C:\Users\Admin\AppData\Local\Temp\acer.bin.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Control Panel\Desktop\Wallpaper = "C:\\ProgramData\\949640ab.BMP" C:\Users\Admin\AppData\Local\Temp\acer.bin.exe N/A
Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\RestartManager\Session0000\RegFiles0000 = 5c005c003f005c0043003a005c00550073006500720073005c00410064006d0069006e005c006e00740075007300650072002e006400610074002e004c004f004700310000000000 C:\Users\Admin\AppData\Local\Temp\acer.bin.exe N/A
Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\RestartManager\Session0000\RegFilesHash = 36950349f2435ac6f56a39c36379e6fe258288897a05854074adc810bf08b3f0 C:\Users\Admin\AppData\Local\Temp\acer.bin.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ C:\Users\Admin\AppData\Local\Temp\acer.bin.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{2A905F01-0A57-4E51-8685-54144DDC3A32}\WpadDecisionReason = "1" C:\Users\Admin\AppData\Local\Temp\acer.bin.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{2A905F01-0A57-4E51-8685-54144DDC3A32}\WpadNetworkName = "Network" C:\Users\Admin\AppData\Local\Temp\acer.bin.exe N/A
Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\RestartManager\Session0000\SessionHash = 74af0e905d114f910d1a0595061448441af68c496ce88b437533ce8670e0f6c1 C:\Users\Admin\AppData\Local\Temp\acer.bin.exe N/A
Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\RestartManager\Session0000\RegFilesHash = 340569a8393d2b786de8cc8489cca4a6dfc33cdde28bdd5918b894cd0f0e6341 C:\Users\Admin\AppData\Local\Temp\acer.bin.exe N/A
Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 C:\Users\Admin\AppData\Local\Temp\acer.bin.exe N/A
Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000003000000090000000000000000000000000000000400000000000000000000000000000000000000000000000000000001000000020000000a07001c000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 C:\Users\Admin\AppData\Local\Temp\acer.bin.exe N/A

Modifies registry class

Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.949640ab\ = "949640ab" C:\Users\Admin\AppData\Local\Temp\acer.bin.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\949640ab\DefaultIcon C:\Users\Admin\AppData\Local\Temp\acer.bin.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\949640ab C:\Users\Admin\AppData\Local\Temp\acer.bin.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\949640ab\DefaultIcon\ = "C:\\ProgramData\\949640ab.ico" C:\Users\Admin\AppData\Local\Temp\acer.bin.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.949640ab C:\Users\Admin\AppData\Local\Temp\acer.bin.exe N/A

Opens file in notepad (likely ransom note)

ransomware
Description Indicator Process Target
N/A N/A C:\Windows\system32\NOTEPAD.EXE N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\acer.bin.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\acer.bin.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\acer.bin.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\acer.bin.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\acer.bin.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\acer.bin.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\acer.bin.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\acer.bin.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\acer.bin.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\acer.bin.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\acer.bin.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\acer.bin.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\acer.bin.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\acer.bin.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\acer.bin.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\acer.bin.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\acer.bin.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\acer.bin.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\acer.bin.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\acer.bin.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\acer.bin.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\acer.bin.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\acer.bin.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\acer.bin.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\acer.bin.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\acer.bin.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeBackupPrivilege N/A C:\Windows\system32\vssvc.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\vssvc.exe N/A
Token: SeAuditPrivilege N/A C:\Windows\system32\vssvc.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\acer.bin.exe

"C:\Users\Admin\AppData\Local\Temp\acer.bin.exe"

C:\Users\Admin\AppData\Local\Temp\acer.bin.exe

"C:\Users\Admin\AppData\Local\Temp\acer.bin.exe"

C:\Users\Admin\AppData\Local\Temp\acer.bin.exe

"C:\Users\Admin\AppData\Local\Temp\acer.bin.exe"

C:\Windows\system32\vssvc.exe

C:\Windows\system32\vssvc.exe

C:\Users\Admin\AppData\Local\Temp\acer.bin.exe

C:\Users\Admin\AppData\Local\Temp\acer.bin.exe -work worker0 job0-1160

C:\Windows\system32\NOTEPAD.EXE

"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\README.949640ab.TXT

Network

Country Destination Domain Proto
N/A 8.8.8.8:53 baroquetees.com udp

Files

memory/1096-60-0x0000000075281000-0x0000000075283000-memory.dmp

memory/1160-62-0x0000000000000000-mapping.dmp

memory/1476-64-0x0000000000000000-mapping.dmp

memory/224-66-0x000007FEFB6B1000-0x000007FEFB6B3000-memory.dmp

C:\Users\Admin\Desktop\README.949640ab.TXT

MD5 164aa420be8e0c2bcdef574355edaa32
SHA1 4336eaafedfc18a27cdf42bffad63b5a54ea8231
SHA256 b326d11dd90c2e4efb0a384981f71c2bd1a6faa0553d6389acb08945b699f73d
SHA512 fd1437bc4f45e3f4b5c3d0e7fca9383f45edceb5c8cb603d0b8ee98350a5f2468c2aabdb66f16bdee0bac49afefa4300a093a54ee43b1ff28a541ae612e34d9d

Analysis: behavioral2

Detonation Overview

Submitted

2021-08-21 10:33

Reported

2021-08-21 10:36

Platform

win10v20210408

Max time kernel

20s

Max time network

116s

Command Line

"C:\Users\Admin\AppData\Local\Temp\acer.bin.exe"

Signatures

DarkSide

ransomware darkside

Modifies extensions of user files

ransomware
Description Indicator Process Target
File renamed C:\Users\Admin\Pictures\DisableMove.tif => C:\Users\Admin\Pictures\DisableMove.tif.70d4d153 C:\Users\Admin\AppData\Local\Temp\acer.bin.exe N/A
File opened for modification C:\Users\Admin\Pictures\ImportSubmit.crw.70d4d153 C:\Users\Admin\AppData\Local\Temp\acer.bin.exe N/A
File renamed C:\Users\Admin\Pictures\InitializeConvert.tif => C:\Users\Admin\Pictures\InitializeConvert.tif.70d4d153 C:\Users\Admin\AppData\Local\Temp\acer.bin.exe N/A
File renamed C:\Users\Admin\Pictures\InstallSearch.png => C:\Users\Admin\Pictures\InstallSearch.png.70d4d153 C:\Users\Admin\AppData\Local\Temp\acer.bin.exe N/A
File opened for modification C:\Users\Admin\Pictures\SendRename.tiff C:\Users\Admin\AppData\Local\Temp\acer.bin.exe N/A
File opened for modification C:\Users\Admin\Pictures\SendRename.tiff.70d4d153 C:\Users\Admin\AppData\Local\Temp\acer.bin.exe N/A
File renamed C:\Users\Admin\Pictures\ApproveWait.crw => C:\Users\Admin\Pictures\ApproveWait.crw.70d4d153 C:\Users\Admin\AppData\Local\Temp\acer.bin.exe N/A
File opened for modification C:\Users\Admin\Pictures\CopyRemove.tif.70d4d153 C:\Users\Admin\AppData\Local\Temp\acer.bin.exe N/A
File renamed C:\Users\Admin\Pictures\UpdateRegister.png => C:\Users\Admin\Pictures\UpdateRegister.png.70d4d153 C:\Users\Admin\AppData\Local\Temp\acer.bin.exe N/A
File opened for modification C:\Users\Admin\Pictures\SplitRead.raw.70d4d153 C:\Users\Admin\AppData\Local\Temp\acer.bin.exe N/A
File renamed C:\Users\Admin\Pictures\CopyRemove.tif => C:\Users\Admin\Pictures\CopyRemove.tif.70d4d153 C:\Users\Admin\AppData\Local\Temp\acer.bin.exe N/A
File renamed C:\Users\Admin\Pictures\LockHide.crw => C:\Users\Admin\Pictures\LockHide.crw.70d4d153 C:\Users\Admin\AppData\Local\Temp\acer.bin.exe N/A
File opened for modification C:\Users\Admin\Pictures\InitializeConvert.tif.70d4d153 C:\Users\Admin\AppData\Local\Temp\acer.bin.exe N/A
File opened for modification C:\Users\Admin\Pictures\InstallSearch.png.70d4d153 C:\Users\Admin\AppData\Local\Temp\acer.bin.exe N/A
File opened for modification C:\Users\Admin\Pictures\LockHide.crw.70d4d153 C:\Users\Admin\AppData\Local\Temp\acer.bin.exe N/A
File renamed C:\Users\Admin\Pictures\SplitRead.raw => C:\Users\Admin\Pictures\SplitRead.raw.70d4d153 C:\Users\Admin\AppData\Local\Temp\acer.bin.exe N/A
File opened for modification C:\Users\Admin\Pictures\SyncExport.tiff C:\Users\Admin\AppData\Local\Temp\acer.bin.exe N/A
File opened for modification C:\Users\Admin\Pictures\SyncExport.tiff.70d4d153 C:\Users\Admin\AppData\Local\Temp\acer.bin.exe N/A
File opened for modification C:\Users\Admin\Pictures\DisableMove.tif.70d4d153 C:\Users\Admin\AppData\Local\Temp\acer.bin.exe N/A
File renamed C:\Users\Admin\Pictures\ImportSubmit.crw => C:\Users\Admin\Pictures\ImportSubmit.crw.70d4d153 C:\Users\Admin\AppData\Local\Temp\acer.bin.exe N/A
File renamed C:\Users\Admin\Pictures\SyncExport.tiff => C:\Users\Admin\Pictures\SyncExport.tiff.70d4d153 C:\Users\Admin\AppData\Local\Temp\acer.bin.exe N/A
File opened for modification C:\Users\Admin\Pictures\UpdateRegister.png.70d4d153 C:\Users\Admin\AppData\Local\Temp\acer.bin.exe N/A
File opened for modification C:\Users\Admin\Pictures\ApproveWait.crw.70d4d153 C:\Users\Admin\AppData\Local\Temp\acer.bin.exe N/A
File renamed C:\Users\Admin\Pictures\SendRename.tiff => C:\Users\Admin\Pictures\SendRename.tiff.70d4d153 C:\Users\Admin\AppData\Local\Temp\acer.bin.exe N/A

Enumerates connected drives

Description Indicator Process Target
File opened (read-only) \??\Z: C:\Users\Admin\AppData\Local\Temp\acer.bin.exe N/A
File opened (read-only) \??\Z: C:\Users\Admin\AppData\Local\Temp\acer.bin.exe N/A

Drops file in System32 directory

Description Indicator Process Target
File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5 C:\Users\Admin\AppData\Local\Temp\acer.bin.exe N/A
File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\counters2.dat C:\Users\Admin\AppData\Local\Temp\acer.bin.exe N/A
File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\Content.IE5 C:\Users\Admin\AppData\Local\Temp\acer.bin.exe N/A
File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE C:\Users\Admin\AppData\Local\Temp\acer.bin.exe N/A
File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCookies C:\Users\Admin\AppData\Local\Temp\acer.bin.exe N/A

Sets desktop wallpaper using registry

ransomware
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Control Panel\Desktop\WallPaper = "C:\\ProgramData\\70d4d153.BMP" C:\Users\Admin\AppData\Local\Temp\acer.bin.exe N/A

Modifies Control Panel

evasion
Description Indicator Process Target
Key created \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Control Panel\Desktop C:\Users\Admin\AppData\Local\Temp\acer.bin.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Control Panel\Desktop\WallpaperStyle = "10" C:\Users\Admin\AppData\Local\Temp\acer.bin.exe N/A

Modifies data under HKEY_USERS

Description Indicator Process Target
Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\RestartManager\Session0000\RegFiles0000 = 5c005c003f005c0043003a005c00550073006500720073005c00410064006d0069006e005c006e00740075007300650072002e006400610074002e004c004f004700310000000000 C:\Users\Admin\AppData\Local\Temp\acer.bin.exe N/A
Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\RestartManager\Session0000\RegFilesHash = 91e691273fcd387b938128d9a11015443c3f79b357bbe7dd508450a52147c875 C:\Users\Admin\AppData\Local\Temp\acer.bin.exe N/A
Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\RestartManager\Session0000\RegFiles0000 = 5c005c003f005c0043003a005c00550073006500720073005c00410064006d0069006e005c004e00540055005300450052002e004400410054007b00340065003000370034003600360038002d0030006300310063002d0031003100650037002d0061003900340033002d006500340031006400320064003700310038006100320030007d002e0054004d0043006f006e007400610069006e0065007200300030003000300030003000300030003000300030003000300030003000300030003000300032002e007200650067007400720061006e0073002d006d00730000000000 C:\Users\Admin\AppData\Local\Temp\acer.bin.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1" C:\Users\Admin\AppData\Local\Temp\acer.bin.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\RestartManager\Session0000 C:\Users\Admin\AppData\Local\Temp\acer.bin.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\RestartManager C:\Users\Admin\AppData\Local\Temp\acer.bin.exe N/A
Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\RestartManager\Session0000\SessionHash = aa66ccf6af00957acbb7e8dc16276a608c7b07223804bd0a1c8aba4c6a78f8a5 C:\Users\Admin\AppData\Local\Temp\acer.bin.exe N/A
Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\RestartManager\Session0000\RegFiles0000 = 5c005c003f005c0043003a005c00550073006500720073005c00410064006d0069006e005c004e00540055005300450052002e004400410054007b00340065003000370034003600360038002d0030006300310063002d0031003100650037002d0061003900340033002d006500340031006400320064003700310038006100320030007d002e0054004d002e0062006c00660000000000 C:\Users\Admin\AppData\Local\Temp\acer.bin.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software C:\Users\Admin\AppData\Local\Temp\acer.bin.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1" C:\Users\Admin\AppData\Local\Temp\acer.bin.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft C:\Users\Admin\AppData\Local\Temp\acer.bin.exe N/A
Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\RestartManager\Session0000\SessionHash = 55eb7574d3943913a3d94015886dcf5ef76b6fefebdd61eee2d13619d9faf1c7 C:\Users\Admin\AppData\Local\Temp\acer.bin.exe N/A
Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\RestartManager\Session0000\RegFilesHash = db71dabbac89e2dff05c38b69b3894398bcc98287c545859f011c19c32a0d004 C:\Users\Admin\AppData\Local\Temp\acer.bin.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:" C:\Users\Admin\AppData\Local\Temp\acer.bin.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0" C:\Users\Admin\AppData\Local\Temp\acer.bin.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\RestartManager\Session0000\Sequence = "1" C:\Users\Admin\AppData\Local\Temp\acer.bin.exe N/A
Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\RestartManager\Session0000\RegFilesHash = 5b185e6bcaf1ddda0d9b852f2e23526c46a5433592c35a591511e0a7f49c3266 C:\Users\Admin\AppData\Local\Temp\acer.bin.exe N/A
Key deleted \REGISTRY\USER\.DEFAULT\Software\Microsoft\RestartManager\Session0000 C:\Users\Admin\AppData\Local\Temp\acer.bin.exe N/A
Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\RestartManager\Session0000\SessionHash = 1bd5014a73f62176b200c0b0e8bf219ce1551e175ae11bf7719c49d4b13da17d C:\Users\Admin\AppData\Local\Temp\acer.bin.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Control Panel\International C:\Users\Admin\AppData\Local\Temp\acer.bin.exe N/A
Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\RestartManager\Session0000\SessionHash = 7c32e6cf0bb6476e9c1967d0220eb3abc7b00750a4ea5ea222fecbd73b94b647 C:\Users\Admin\AppData\Local\Temp\acer.bin.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:" C:\Users\Admin\AppData\Local\Temp\acer.bin.exe N/A
Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\RestartManager\Session0000\Owner = 940f00005ee7c1538896d701 C:\Users\Admin\AppData\Local\Temp\acer.bin.exe N/A
Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\RestartManager\Session0000\RegFiles0000 = 5c005c003f005c0043003a005c00550073006500720073005c00410064006d0069006e005c004e00540055005300450052002e004400410054007b00340065003000370034003600360038002d0030006300310063002d0031003100650037002d0061003900340033002d006500340031006400320064003700310038006100320030007d002e0054004d0043006f006e007400610069006e0065007200300030003000300030003000300030003000300030003000300030003000300030003000300031002e007200650067007400720061006e0073002d006d00730000000000 C:\Users\Admin\AppData\Local\Temp\acer.bin.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Control Panel\Desktop\Wallpaper = "C:\\ProgramData\\70d4d153.BMP" C:\Users\Admin\AppData\Local\Temp\acer.bin.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix C:\Users\Admin\AppData\Local\Temp\acer.bin.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ C:\Users\Admin\AppData\Local\Temp\acer.bin.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1" C:\Users\Admin\AppData\Local\Temp\acer.bin.exe N/A
Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\RestartManager\Session0000\RegFilesHash = 41798fbc869f7ea5231dc43f77eedbdf8d93e5ea489f9ad655a8266f3968766f C:\Users\Admin\AppData\Local\Temp\acer.bin.exe N/A

Modifies registry class

Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.70d4d153\ = "70d4d153" C:\Users\Admin\AppData\Local\Temp\acer.bin.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\70d4d153\DefaultIcon C:\Users\Admin\AppData\Local\Temp\acer.bin.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\70d4d153 C:\Users\Admin\AppData\Local\Temp\acer.bin.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\70d4d153\DefaultIcon\ = "C:\\ProgramData\\70d4d153.ico" C:\Users\Admin\AppData\Local\Temp\acer.bin.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.70d4d153 C:\Users\Admin\AppData\Local\Temp\acer.bin.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\acer.bin.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\acer.bin.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\acer.bin.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\acer.bin.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\acer.bin.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\acer.bin.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\acer.bin.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\acer.bin.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\acer.bin.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\acer.bin.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\acer.bin.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\acer.bin.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\acer.bin.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\acer.bin.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\acer.bin.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\acer.bin.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\acer.bin.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\acer.bin.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\acer.bin.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\acer.bin.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\acer.bin.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\acer.bin.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\acer.bin.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\acer.bin.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\acer.bin.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\acer.bin.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeBackupPrivilege N/A C:\Windows\system32\vssvc.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\vssvc.exe N/A
Token: SeAuditPrivilege N/A C:\Windows\system32\vssvc.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\acer.bin.exe

"C:\Users\Admin\AppData\Local\Temp\acer.bin.exe"

C:\Users\Admin\AppData\Local\Temp\acer.bin.exe

"C:\Users\Admin\AppData\Local\Temp\acer.bin.exe"

C:\Users\Admin\AppData\Local\Temp\acer.bin.exe

"C:\Users\Admin\AppData\Local\Temp\acer.bin.exe"

C:\Windows\system32\vssvc.exe

C:\Windows\system32\vssvc.exe

C:\Users\Admin\AppData\Local\Temp\acer.bin.exe

C:\Users\Admin\AppData\Local\Temp\acer.bin.exe -work worker0 job0-1804

C:\Users\Admin\AppData\Local\Temp\acer.bin.exe

C:\Users\Admin\AppData\Local\Temp\acer.bin.exe -work worker1 job1-1804

Network

Country Destination Domain Proto
N/A 8.8.8.8:53 baroquetees.com udp
N/A 8.8.8.8:53 baroquetees.com udp

Files

memory/1804-114-0x0000000000000000-mapping.dmp

memory/3988-115-0x0000000000000000-mapping.dmp

memory/3544-116-0x0000000000000000-mapping.dmp