Analysis
-
max time kernel
121s -
max time network
130s -
platform
windows7_x64 -
resource
win7-en-20211208 -
submitted
09-12-2021 16:32
Static task
static1
Behavioral task
behavioral1
Sample
124e83f0812629fbc7ee0330002d7e5026b0f79e29a7d42facd62dd67b83549a.exe
Resource
win7-en-20211208
Behavioral task
behavioral2
Sample
124e83f0812629fbc7ee0330002d7e5026b0f79e29a7d42facd62dd67b83549a.exe
Resource
win10-en-20211208
General
-
Target
124e83f0812629fbc7ee0330002d7e5026b0f79e29a7d42facd62dd67b83549a.exe
-
Size
59KB
-
MD5
01cef4d4f9306177d42f221854ee552b
-
SHA1
e06c0d3ae9eb341182e937f44906c240cff4c057
-
SHA256
124e83f0812629fbc7ee0330002d7e5026b0f79e29a7d42facd62dd67b83549a
-
SHA512
5ebba89c40862be7405ec41979d4fa6916a2742ba8c2ca5c81c5b9002e9497e54b0281fcad1fac6676e6c3b491e9a777536c6d1ef19a52986e15286a24cff95e
Malware Config
Extracted
C:\\README.27a6f0b5.TXT
darkside
http://darksidfqzcuhtk2.onion/CZEX8E0GR0AO4ASUCJE1K824OKJA1G24B8B3G0P84LJTTE7W8EC86JBE7NBXLMRT
Signatures
-
DarkSide
Targeted ransomware first seen in August 2020. Operators steal data to use as leverage.
-
Modifies extensions of user files 12 IoCs
Ransomware generally changes the extension on encrypted files.
Processes:
124e83f0812629fbc7ee0330002d7e5026b0f79e29a7d42facd62dd67b83549a.exedescription ioc process File opened for modification C:\Users\Admin\Pictures\InstallUnregister.tiff 124e83f0812629fbc7ee0330002d7e5026b0f79e29a7d42facd62dd67b83549a.exe File renamed C:\Users\Admin\Pictures\InstallUnregister.tiff => C:\Users\Admin\Pictures\InstallUnregister.tiff.27a6f0b5 124e83f0812629fbc7ee0330002d7e5026b0f79e29a7d42facd62dd67b83549a.exe File opened for modification C:\Users\Admin\Pictures\InstallUnregister.tiff.27a6f0b5 124e83f0812629fbc7ee0330002d7e5026b0f79e29a7d42facd62dd67b83549a.exe File renamed C:\Users\Admin\Pictures\ExportSearch.tiff => C:\Users\Admin\Pictures\ExportSearch.tiff.27a6f0b5 124e83f0812629fbc7ee0330002d7e5026b0f79e29a7d42facd62dd67b83549a.exe File opened for modification C:\Users\Admin\Pictures\ExportSearch.tiff.27a6f0b5 124e83f0812629fbc7ee0330002d7e5026b0f79e29a7d42facd62dd67b83549a.exe File renamed C:\Users\Admin\Pictures\SelectSearch.tif => C:\Users\Admin\Pictures\SelectSearch.tif.27a6f0b5 124e83f0812629fbc7ee0330002d7e5026b0f79e29a7d42facd62dd67b83549a.exe File opened for modification C:\Users\Admin\Pictures\SelectSearch.tif.27a6f0b5 124e83f0812629fbc7ee0330002d7e5026b0f79e29a7d42facd62dd67b83549a.exe File renamed C:\Users\Admin\Pictures\WaitExit.raw => C:\Users\Admin\Pictures\WaitExit.raw.27a6f0b5 124e83f0812629fbc7ee0330002d7e5026b0f79e29a7d42facd62dd67b83549a.exe File renamed C:\Users\Admin\Pictures\ExitTrace.png => C:\Users\Admin\Pictures\ExitTrace.png.27a6f0b5 124e83f0812629fbc7ee0330002d7e5026b0f79e29a7d42facd62dd67b83549a.exe File opened for modification C:\Users\Admin\Pictures\ExitTrace.png.27a6f0b5 124e83f0812629fbc7ee0330002d7e5026b0f79e29a7d42facd62dd67b83549a.exe File opened for modification C:\Users\Admin\Pictures\ExportSearch.tiff 124e83f0812629fbc7ee0330002d7e5026b0f79e29a7d42facd62dd67b83549a.exe File opened for modification C:\Users\Admin\Pictures\WaitExit.raw.27a6f0b5 124e83f0812629fbc7ee0330002d7e5026b0f79e29a7d42facd62dd67b83549a.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Sets desktop wallpaper using registry 2 TTPs 2 IoCs
Processes:
124e83f0812629fbc7ee0330002d7e5026b0f79e29a7d42facd62dd67b83549a.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-2329389628-4064185017-3901522362-1000\Control Panel\Desktop\WallPaper = "C:\\ProgramData\\27a6f0b5.BMP" 124e83f0812629fbc7ee0330002d7e5026b0f79e29a7d42facd62dd67b83549a.exe Set value (str) \REGISTRY\USER\S-1-5-21-2329389628-4064185017-3901522362-1000\Control Panel\Desktop\Wallpaper = "C:\\ProgramData\\27a6f0b5.BMP" 124e83f0812629fbc7ee0330002d7e5026b0f79e29a7d42facd62dd67b83549a.exe -
Modifies Control Panel 1 IoCs
Processes:
124e83f0812629fbc7ee0330002d7e5026b0f79e29a7d42facd62dd67b83549a.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-2329389628-4064185017-3901522362-1000\Control Panel\Desktop\WallpaperStyle = "10" 124e83f0812629fbc7ee0330002d7e5026b0f79e29a7d42facd62dd67b83549a.exe -
Modifies registry class 5 IoCs
Processes:
124e83f0812629fbc7ee0330002d7e5026b0f79e29a7d42facd62dd67b83549a.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.27a6f0b5 124e83f0812629fbc7ee0330002d7e5026b0f79e29a7d42facd62dd67b83549a.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.27a6f0b5\ = "27a6f0b5" 124e83f0812629fbc7ee0330002d7e5026b0f79e29a7d42facd62dd67b83549a.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\27a6f0b5\DefaultIcon 124e83f0812629fbc7ee0330002d7e5026b0f79e29a7d42facd62dd67b83549a.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\27a6f0b5 124e83f0812629fbc7ee0330002d7e5026b0f79e29a7d42facd62dd67b83549a.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\27a6f0b5\DefaultIcon\ = "C:\\Users\\Admin\\AppData\\Local\\27a6f0b5.ico" 124e83f0812629fbc7ee0330002d7e5026b0f79e29a7d42facd62dd67b83549a.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
124e83f0812629fbc7ee0330002d7e5026b0f79e29a7d42facd62dd67b83549a.exepid process 948 124e83f0812629fbc7ee0330002d7e5026b0f79e29a7d42facd62dd67b83549a.exe 948 124e83f0812629fbc7ee0330002d7e5026b0f79e29a7d42facd62dd67b83549a.exe -
Suspicious use of AdjustPrivilegeToken 20 IoCs
Processes:
124e83f0812629fbc7ee0330002d7e5026b0f79e29a7d42facd62dd67b83549a.exedescription pid process Token: SeIncreaseQuotaPrivilege 948 124e83f0812629fbc7ee0330002d7e5026b0f79e29a7d42facd62dd67b83549a.exe Token: SeSecurityPrivilege 948 124e83f0812629fbc7ee0330002d7e5026b0f79e29a7d42facd62dd67b83549a.exe Token: SeTakeOwnershipPrivilege 948 124e83f0812629fbc7ee0330002d7e5026b0f79e29a7d42facd62dd67b83549a.exe Token: SeLoadDriverPrivilege 948 124e83f0812629fbc7ee0330002d7e5026b0f79e29a7d42facd62dd67b83549a.exe Token: SeSystemProfilePrivilege 948 124e83f0812629fbc7ee0330002d7e5026b0f79e29a7d42facd62dd67b83549a.exe Token: SeSystemtimePrivilege 948 124e83f0812629fbc7ee0330002d7e5026b0f79e29a7d42facd62dd67b83549a.exe Token: SeProfSingleProcessPrivilege 948 124e83f0812629fbc7ee0330002d7e5026b0f79e29a7d42facd62dd67b83549a.exe Token: SeIncBasePriorityPrivilege 948 124e83f0812629fbc7ee0330002d7e5026b0f79e29a7d42facd62dd67b83549a.exe Token: SeCreatePagefilePrivilege 948 124e83f0812629fbc7ee0330002d7e5026b0f79e29a7d42facd62dd67b83549a.exe Token: SeBackupPrivilege 948 124e83f0812629fbc7ee0330002d7e5026b0f79e29a7d42facd62dd67b83549a.exe Token: SeRestorePrivilege 948 124e83f0812629fbc7ee0330002d7e5026b0f79e29a7d42facd62dd67b83549a.exe Token: SeShutdownPrivilege 948 124e83f0812629fbc7ee0330002d7e5026b0f79e29a7d42facd62dd67b83549a.exe Token: SeDebugPrivilege 948 124e83f0812629fbc7ee0330002d7e5026b0f79e29a7d42facd62dd67b83549a.exe Token: SeSystemEnvironmentPrivilege 948 124e83f0812629fbc7ee0330002d7e5026b0f79e29a7d42facd62dd67b83549a.exe Token: SeRemoteShutdownPrivilege 948 124e83f0812629fbc7ee0330002d7e5026b0f79e29a7d42facd62dd67b83549a.exe Token: SeUndockPrivilege 948 124e83f0812629fbc7ee0330002d7e5026b0f79e29a7d42facd62dd67b83549a.exe Token: SeManageVolumePrivilege 948 124e83f0812629fbc7ee0330002d7e5026b0f79e29a7d42facd62dd67b83549a.exe Token: 33 948 124e83f0812629fbc7ee0330002d7e5026b0f79e29a7d42facd62dd67b83549a.exe Token: 34 948 124e83f0812629fbc7ee0330002d7e5026b0f79e29a7d42facd62dd67b83549a.exe Token: 35 948 124e83f0812629fbc7ee0330002d7e5026b0f79e29a7d42facd62dd67b83549a.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\124e83f0812629fbc7ee0330002d7e5026b0f79e29a7d42facd62dd67b83549a.exe"C:\Users\Admin\AppData\Local\Temp\124e83f0812629fbc7ee0330002d7e5026b0f79e29a7d42facd62dd67b83549a.exe"1⤵
- Modifies extensions of user files
- Sets desktop wallpaper using registry
- Modifies Control Panel
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/948-55-0x0000000075F91000-0x0000000075F93000-memory.dmpFilesize
8KB