Overview

overview

10

Static

static

1

chrome_setup.msi

windows7-x64

7

chrome_setup.msi

windows10-1703-x64

10

chrome_setup.msi

windows10-2004-x64

10

chrome_setup.msi

windows11-21h2-x64

10

Resubmissions

27-01-2024 20:08

240127-ywzn3achhm 10

22-01-2024 09:33

240122-ljg72adfc8 10

Analysis

  • max time kernel
    128s
  • max time network
    142s
  • platform
    windows10-1703_x64
  • resource
    win10-20231215-en
  • resource tags

    arch:x64arch:x86image:win10-20231215-enlocale:en-usos:windows10-1703-x64system
  • submitted
    27-01-2024 20:08

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    chrome_setup.msi

  • Size

    304KB

  • MD5

    6b63f4f44ed6a243acbf0ee18c5fb5a2

  • SHA1

    3d6e13fa319d4de1393c23579753833260b3ef2e

  • SHA256

    e34cf173d4a9a9f8c1556c52de1410f3086a1c3f080ea1a8f52726394277a994

  • SHA512

    ba1811c4556d8bd113563d4c175795f6d76b48faa259915a30a341ac425cfa309d74d8028749fe5b87eaf26332136657aae5e34e0db08054f689276db746e809

  • SSDEEP

    3072:NspAtO9mXwCGjtYNKbYO2gjpcm8rRuqpjCL42loHUvU0yGxr5GqM2a8hIZEZnWv:vtO9iRQYpgjpjew5DHyGxcqo8f

Score
10/10
darksidediscoveryransomware

Malware Config

Extracted

Path

C:\README.334cdd42.TXT

Family

darkside

Ransom Note
----------- [ Welcome to DarkSide ] -------------> What happend? ---------------------------------------------- Your computers and servers are encrypted, backups are deleted. We use strong encryption algorithms, so you cannot decrypt your data. But you can restore everything by purchasing a special program from us - universal decryptor. This program will restore all your network. Follow our instructions below and you will recover all your data. Data leak ---------------------------------------------- First of all we have uploaded more then 500GB data. The data is preloaded and will be automatically published if you do not pay. After publication, your data will be available for at least 6 months on our tor cdn servers. We are ready: - To provide you the evidence of stolen data - To delete all the stolen data. What guarantees? ---------------------------------------------- We value our reputation. If we do not do our work and liabilities, nobody will pay us. This is not in our interests. All our decryption software is perfectly tested and will decrypt your data. We will also provide support in case of problems. We guarantee to decrypt one file for free. Go to the site and contact us. How to get access on website? ---------------------------------------------- Using a TOR browser: 1) Download and install TOR browser from this site: https://torproject.org/ 2) Open our website: http://dark24vx6fsmdrtbzdzjv6ckz4yqyued4uz455oqpctko7m6vbrzibad.onion/XES2TUV3A9QL89IS7QX91V7TYSF13ASPGB2TASQ68R9Z6QYH69OVY833QSRSFU4I When you open our website, put the following data in the input form: Key: I3tBdXvJ3pOvnhgmupZAJ7BpD5IVUftr7deEdtoxwK0QcbZciUXfs5ChjD0Yj8H2wUXfctFHYShVQHWhwi1CBDRQVPgXqnCgVRQql7B1tS8Q6TSdHq5o0UxOaDrdKCoMCdrMZiw0RTbfpDpuRwLI52rP5YaqZx492wErocN9C7PE6eFQEcqwqiFNA1FwVD3fogTJqOdTJI84FnlCBuRd1ippdTk8y2x16ukfPvVHi4MhyU8i4K1Q25a7wXQUPXhIffgZBnTimLzalSGyaI3f2MlQeYbpFG2o4nfnZCHDMAZAUY6CaiR0eAYVEvesreMmimT1EOyGYjNVtGHrJYXuRI4tYZIVlsHm6Ord42NV9s9PftLGkO8NBScZ9dBTNtz0xw9tpgu8GegVTlMesg6xkUAQWJcy6MNt9nJ7lHydpu27bA1GL8MX8lWAldnClSoUrDYRc8RAZ1oUfMfbtmvMDBGVENh8kMUYaxOt7hD1HxKFn0p5XcCDzWRSWkKUTtt7C6OiIpNOUAYYJ3UvC5S3uoXmt4iokkGq1SSMnr7sXmnekmh9oNwJgh7 !!! DANGER !!! DO NOT MODIFY or try to RECOVER any files yourself. We WILL NOT be able to RESTORE them. !!! DANGER !!!
URLs

http://dark24vx6fsmdrtbzdzjv6ckz4yqyued4uz455oqpctko7m6vbrzibad.onion/XES2TUV3A9QL89IS7QX91V7TYSF13ASPGB2TASQ68R9Z6QYH69OVY833QSRSFU4I

Signatures

  • DarkSide

    Targeted ransomware first seen in August 2020. Operators steal data to use as leverage.

    ransomwaredarkside
  • Renames multiple (177) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

    ransomware
  • Executes dropped EXE 5 IoCs
  • Loads dropped DLL 2 IoCs
  • Modifies file permissions 1 TTPs 2 IoCs
    discovery
  • Enumerates connected drives 3 TTPs 47 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in System32 directory 21 IoCs
  • Sets desktop wallpaper using registry 2 TTPs 1 IoCs
    ransomware
  • Drops file in Windows directory 11 IoCs
  • Modifies Control Panel 2 IoCs
    evasion
  • Modifies data under HKEY_USERS 29 IoCs
  • Modifies registry class 5 IoCs
  • Suspicious behavior: EnumeratesProcesses 22 IoCs
  • Suspicious use of AdjustPrivilegeToken 45 IoCs
  • Suspicious use of FindShellTrayWindow 2 IoCs
  • Suspicious use of WriteProcessMemory 27 IoCs
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware

Processes

  • C:\Windows\system32\msiexec.exe
    msiexec.exe /I C:\Users\Admin\AppData\Local\Temp\chrome_setup.msi
    1⤵
    • Enumerates connected drives
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    PID:512
  • C:\Windows\system32\msiexec.exe
    C:\Windows\system32\msiexec.exe /V
    1⤵
    • Enumerates connected drives
    • Drops file in Windows directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:4108
    • C:\Windows\system32\srtasks.exe
      C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
      2⤵
        PID:3992
      • C:\Windows\syswow64\MsiExec.exe
        C:\Windows\syswow64\MsiExec.exe -Embedding B7AE79B0D7CCE2D15882E16946F589D5
        2⤵
        • Loads dropped DLL
        • Suspicious use of WriteProcessMemory
        PID:2876
        • C:\Windows\SysWOW64\ICACLS.EXE
          "C:\Windows\system32\ICACLS.EXE" "C:\Users\Admin\AppData\Local\Temp\MW-8a5b1279-19e2-4631-b0e8-a81144eb43d6\." /SETINTEGRITYLEVEL (CI)(OI)HIGH
          3⤵
          • Modifies file permissions
          PID:1444
        • C:\Windows\SysWOW64\EXPAND.EXE
          "C:\Windows\system32\EXPAND.EXE" -R files.cab -F:* files
          3⤵
          • Drops file in Windows directory
          PID:3188
        • C:\Users\Admin\AppData\Local\Temp\MW-8a5b1279-19e2-4631-b0e8-a81144eb43d6\files\516664139b0ddd044397a56482d7308d87c213c320a3151ccb9738e8f932654b-2022-04-20-15-57-51.exe
          "C:\Users\Admin\AppData\Local\Temp\MW-8a5b1279-19e2-4631-b0e8-a81144eb43d6\files\516664139b0ddd044397a56482d7308d87c213c320a3151ccb9738e8f932654b-2022-04-20-15-57-51.exe"
          3⤵
          • Executes dropped EXE
          PID:924
        • C:\Windows\SysWOW64\ICACLS.EXE
          "C:\Windows\system32\ICACLS.EXE" "C:\Users\Admin\AppData\Local\Temp\MW-8a5b1279-19e2-4631-b0e8-a81144eb43d6\." /SETINTEGRITYLEVEL (CI)(OI)LOW
          3⤵
          • Modifies file permissions
          PID:1492
    • C:\Windows\system32\vssvc.exe
      C:\Windows\system32\vssvc.exe
      1⤵
      • Suspicious use of AdjustPrivilegeToken
      PID:4168
    • C:\Users\Admin\AppData\Local\Temp\MW-8a5b1279-19e2-4631-b0e8-a81144eb43d6\files\516664139b0ddd044397a56482d7308d87c213c320a3151ccb9738e8f932654b-2022-04-20-15-57-51.exe
      "C:\Users\Admin\AppData\Local\Temp\MW-8a5b1279-19e2-4631-b0e8-a81144eb43d6\files\516664139b0ddd044397a56482d7308d87c213c320a3151ccb9738e8f932654b-2022-04-20-15-57-51.exe"
      1⤵
      • Executes dropped EXE
      • Suspicious use of WriteProcessMemory
      PID:2272
      • C:\Users\Admin\AppData\Local\Temp\MW-8a5b1279-19e2-4631-b0e8-a81144eb43d6\files\516664139b0ddd044397a56482d7308d87c213c320a3151ccb9738e8f932654b-2022-04-20-15-57-51.exe
        "C:\Users\Admin\AppData\Local\Temp\MW-8a5b1279-19e2-4631-b0e8-a81144eb43d6\files\516664139b0ddd044397a56482d7308d87c213c320a3151ccb9738e8f932654b-2022-04-20-15-57-51.exe"
        2⤵
        • Executes dropped EXE
        • Drops file in System32 directory
        • Sets desktop wallpaper using registry
        • Modifies Control Panel
        • Modifies data under HKEY_USERS
        • Modifies registry class
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of WriteProcessMemory
        PID:1624
        • C:\Users\Admin\AppData\Local\Temp\MW-8a5b1279-19e2-4631-b0e8-a81144eb43d6\files\516664139b0ddd044397a56482d7308d87c213c320a3151ccb9738e8f932654b-2022-04-20-15-57-51.exe
          C:\Users\Admin\AppData\Local\Temp\MW-8a5b1279-19e2-4631-b0e8-a81144eb43d6\files\516664139b0ddd044397a56482d7308d87c213c320a3151ccb9738e8f932654b-2022-04-20-15-57-51.exe -work worker0 job0-1624
          3⤵
          • Executes dropped EXE
          • Modifies data under HKEY_USERS
          • Suspicious behavior: EnumeratesProcesses
          PID:4380
        • C:\Users\Admin\AppData\Local\Temp\MW-8a5b1279-19e2-4631-b0e8-a81144eb43d6\files\516664139b0ddd044397a56482d7308d87c213c320a3151ccb9738e8f932654b-2022-04-20-15-57-51.exe
          C:\Users\Admin\AppData\Local\Temp\MW-8a5b1279-19e2-4631-b0e8-a81144eb43d6\files\516664139b0ddd044397a56482d7308d87c213c320a3151ccb9738e8f932654b-2022-04-20-15-57-51.exe -work worker1 job1-1624
          3⤵
          • Executes dropped EXE
          • Enumerates connected drives
          PID:3916

    Network

    MITRE ATT&CK Matrix ATT&CK v13

    Initial Access

    Execution

    Persistence

    Privilege Escalation

    Defense Evasion

    File and Directory Permissions Modification

    1
    T1222

    Modify Registry

    1
    T1112

    Credential Access

    Discovery

    Query Registry

    1
    T1012

    Peripheral Device Discovery

    1
    T1120

    System Information Discovery

    1
    T1082

    Lateral Movement

    Collection

    Exfiltration

    Command and Control

    Impact

    Defacement

    1
    T1491

    Resource Development

    Reconnaissance

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\README.334cdd42.TXT
      Filesize

      2KB

      MD5

      cc9673216d53012c400856b86968c4a2

      SHA1

      80945bfdc6f2b30fd7b47e92ae762ab4ad792659

      SHA256

      5dfc11166e6b0e978aa5b95aaf2a51733033379b7e7980f5fa1d42b6333cf9e0

      SHA512

      f556026b31927923f385325adb493934e45750f401bf4787a0f0602f8309f520c967da72b9924f1872895718a5376eb8c433084496f5903670ad1e1d47cc4266

      Download Submit
    • C:\Users\Admin\AppData\Local\Temp\MW-8a5b1279-19e2-4631-b0e8-a81144eb43d6\files.cab
      Filesize

      56KB

      MD5

      f8ba117f135d10e3eb80472c1ec46469

      SHA1

      6c084a82bf4ebafde30c5b3182f83dcb66933671

      SHA256

      9bc48ce1d31060a52f1f879fd140d96d60f60dd2d53d83efca323819b048b9f1

      SHA512

      3985a44a1a0907153f1a1eeaf8e91dcf25c0f6f27abc70edbbe5922e281b70fd7c308df022200a35daf2044eb2323f101ded0a5f0f592aed2bd8a50de4f0e0fa

      Download Submit
    • C:\Users\Admin\AppData\Local\Temp\MW-8a5b1279-19e2-4631-b0e8-a81144eb43d6\files\516664139b0ddd044397a56482d7308d87c213c320a3151ccb9738e8f932654b-2022-04-20-15-57-51.exe
      Filesize

      56KB

      MD5

      84c1567969b86089cc33dccf41562bcd

      SHA1

      53f2133cb25186e9fa6d4ea3b0e41eee5aba5ef2

      SHA256

      516664139b0ddd044397a56482d7308d87c213c320a3151ccb9738e8f932654b

      SHA512

      72a411cacd503b6fadb15dc90f1f9beb79ff79c620df76da381e5c780c53e11258aae72db2848c241ec55af403d67d62340e429e86c23bbf8a71287738de7eaa

      Download Submit
    • C:\Users\Admin\AppData\Local\Temp\MW-8a5b1279-19e2-4631-b0e8-a81144eb43d6\msiwrapper.ini
      Filesize

      1KB

      MD5

      3a81bc471bc5aa8771b4d111bfa795f3

      SHA1

      19ffa97edd3c385092a14835e7e2712bee184b95

      SHA256

      a65bf7b5f5767f2d0cf4704d2a9f222bd711c5a027d0ac2c29222f91b8957944

      SHA512

      59c0c57fe1d210aa9473fe76d00820e97c3f0889e8dd91849be5a897af1e2b6eeddeddfcd35052a4657065bc58acf189b6dcc37457d7a7a1f52f5ff2f0e9d000

      Download Submit
    • C:\Users\Admin\AppData\Local\Temp\MW-8a5b1279-19e2-4631-b0e8-a81144eb43d6\msiwrapper.ini
      Filesize

      1KB

      MD5

      7ba7add749b3027a520fb6d8f678edae

      SHA1

      e2038a73ea8ead34f52eff88299b5d927f5f6c1c

      SHA256

      396132bf22366d127f3c901022a3a450ef9c68eca9483313128c27daccf2a198

      SHA512

      6f03e314d07647448c495b314a3d43770cfdbd7493aaafbc8f4bbe769274e6b1fa5445c861cafbe904070bc8d0d976d26d9016d5c54c65ba9e69f2f74acb88fb

      Download Submit
    • C:\Users\Admin\AppData\Local\Temp\MW-8a5b1279-19e2-4631-b0e8-a81144eb43d6\msiwrapper.ini
      Filesize

      1KB

      MD5

      407728803acc59a626f20385e8381780

      SHA1

      6cfe1af5ba015e921faa28d08e1cbce26d8e4f38

      SHA256

      234f9e60bd320978c1a4e64e6c03f0efde51d10662edec74d3475031c6715340

      SHA512

      dfc363b75976c3679840d9c1c30ebc45e716afbae0a15bda7ff0fc1c50a6e4121fa77ea264ab0d924a0cfa176144b8a9c1546d033bb57cd2ba1df1c5e0b37d82

      Download Submit
    • C:\Windows\Installer\MSIA921.tmp
      Filesize

      208KB

      MD5

      0c8921bbcc37c6efd34faf44cf3b0cb5

      SHA1

      dcfa71246157edcd09eecaf9d4c5e360b24b3e49

      SHA256

      fd622cf73ea951a6de631063aba856487d77745dd1500adca61902b8dde56fe1

      SHA512

      ed55443e20d40cca90596f0a0542fa5ab83fe0270399adfaafd172987fb813dfd44ec0da0a58c096af3641003f830341fe259ad5bce9823f238ae63b7e11e108

      Download Submit