Overview

overview

10

Static

static

1

chrome_setup.msi

windows7-x64

7

chrome_setup.msi

windows10-1703-x64

10

chrome_setup.msi

windows10-2004-x64

10

chrome_setup.msi

windows11-21h2-x64

10

Resubmissions

27-01-2024 20:08

240127-ywzn3achhm 10

22-01-2024 09:33

240122-ljg72adfc8 10

Analysis

  • max time kernel
    136s
  • max time network
    149s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231215-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
  • submitted
    27-01-2024 20:08

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    chrome_setup.msi

  • Size

    304KB

  • MD5

    6b63f4f44ed6a243acbf0ee18c5fb5a2

  • SHA1

    3d6e13fa319d4de1393c23579753833260b3ef2e

  • SHA256

    e34cf173d4a9a9f8c1556c52de1410f3086a1c3f080ea1a8f52726394277a994

  • SHA512

    ba1811c4556d8bd113563d4c175795f6d76b48faa259915a30a341ac425cfa309d74d8028749fe5b87eaf26332136657aae5e34e0db08054f689276db746e809

  • SSDEEP

    3072:NspAtO9mXwCGjtYNKbYO2gjpcm8rRuqpjCL42loHUvU0yGxr5GqM2a8hIZEZnWv:vtO9iRQYpgjpjew5DHyGxcqo8f

Score
10/10
darksidediscoveryransomware

Malware Config

Extracted

Path

C:\README.5ae4bc4e.TXT

Family

darkside

Ransom Note
----------- [ Welcome to DarkSide ] -------------> What happend? ---------------------------------------------- Your computers and servers are encrypted, backups are deleted. We use strong encryption algorithms, so you cannot decrypt your data. But you can restore everything by purchasing a special program from us - universal decryptor. This program will restore all your network. Follow our instructions below and you will recover all your data. Data leak ---------------------------------------------- First of all we have uploaded more then 500GB data. The data is preloaded and will be automatically published if you do not pay. After publication, your data will be available for at least 6 months on our tor cdn servers. We are ready: - To provide you the evidence of stolen data - To delete all the stolen data. What guarantees? ---------------------------------------------- We value our reputation. If we do not do our work and liabilities, nobody will pay us. This is not in our interests. All our decryption software is perfectly tested and will decrypt your data. We will also provide support in case of problems. We guarantee to decrypt one file for free. Go to the site and contact us. How to get access on website? ---------------------------------------------- Using a TOR browser: 1) Download and install TOR browser from this site: https://torproject.org/ 2) Open our website: http://dark24vx6fsmdrtbzdzjv6ckz4yqyued4uz455oqpctko7m6vbrzibad.onion/XES2TUV3A9QL89IS7QX91V7TYSF13ASPGB2TASQ68R9Z6QYH69OVY833QSRSFU4I When you open our website, put the following data in the input form: Key: I3tBdXvJ3pOvnhgmupZAJ7BpD5IVUftr7deEdtoxwK0QcbZciUXfs5ChjD0Yj8H2wUXfctFHYShVQHWhwi1CBDRQVPgXqnCgVRQql7B1tS8Q6TSdHq5o0UxOaDrdKCoMCdrMZiw0RTbfpDpuRwLI52rP5YaqZx492wErocN9C7PE6eFQEcqwqiFNA1FwVD3fogTJqOdTJI84FnlCBuRd1ippdTk8y2x16ukfPvVHi4MhyU8i4K1Q25a7wXQUPXhIffgZBnTimLzalSGyaI3f2MlQeYbpFG2o4nfnZCHDMAZAUY6CaiR0eAYVEvesreMmimT1EOyGYjNVtGHrJYXuRI4tYZIVlsHm6Ord42NV9s9PftLGkO8NBScZ9dBTNtz0xw9tpgu8GegVTlMesg6xkUAQWJcy6MNt9nJ7lHydpu27bA1GL8MX8lWAldnClSoUrDYRc8RAZ1oUfMfbtmvMDBGVENh8kMUYaxOt7hD1HxKFn0p5XcCDzWRSWkKUTtt7C6OiIpNOUAYYJ3UvC5S3uoXmt4iokkGq1SSMnr7sXmnekmh9oNwJgh7 !!! DANGER !!! DO NOT MODIFY or try to RECOVER any files yourself. We WILL NOT be able to RESTORE them. !!! DANGER !!!
URLs

http://dark24vx6fsmdrtbzdzjv6ckz4yqyued4uz455oqpctko7m6vbrzibad.onion/XES2TUV3A9QL89IS7QX91V7TYSF13ASPGB2TASQ68R9Z6QYH69OVY833QSRSFU4I

Signatures

  • DarkSide

    Targeted ransomware first seen in August 2020. Operators steal data to use as leverage.

    ransomwaredarkside
  • Renames multiple (182) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

    ransomware
  • Executes dropped EXE 5 IoCs
  • Loads dropped DLL 2 IoCs
  • Modifies file permissions 1 TTPs 2 IoCs
    discovery
  • Enumerates connected drives 3 TTPs 47 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in System32 directory 12 IoCs
  • Sets desktop wallpaper using registry 2 TTPs 1 IoCs
    ransomware
  • Drops file in Windows directory 11 IoCs
  • Checks SCSI registry key(s) 3 TTPs 5 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Modifies Control Panel 2 IoCs
    evasion
  • Modifies data under HKEY_USERS 37 IoCs
  • Modifies registry class 5 IoCs
  • Suspicious behavior: EnumeratesProcesses 28 IoCs
  • Suspicious use of AdjustPrivilegeToken 45 IoCs
  • Suspicious use of FindShellTrayWindow 2 IoCs
  • Suspicious use of WriteProcessMemory 27 IoCs
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware

Processes

  • C:\Windows\system32\msiexec.exe
    msiexec.exe /I C:\Users\Admin\AppData\Local\Temp\chrome_setup.msi
    1⤵
    • Enumerates connected drives
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    PID:4436
  • C:\Windows\system32\msiexec.exe
    C:\Windows\system32\msiexec.exe /V
    1⤵
    • Enumerates connected drives
    • Drops file in Windows directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:1844
    • C:\Windows\system32\srtasks.exe
      C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
      2⤵
        PID:2884
      • C:\Windows\syswow64\MsiExec.exe
        C:\Windows\syswow64\MsiExec.exe -Embedding AE2A18D0B97073E5372372F0FA051ED2
        2⤵
        • Loads dropped DLL
        • Suspicious use of WriteProcessMemory
        PID:4444
        • C:\Windows\SysWOW64\ICACLS.EXE
          "C:\Windows\system32\ICACLS.EXE" "C:\Users\Admin\AppData\Local\Temp\MW-ea6cf7d6-50f1-4d31-8c31-631c7a95d9e1\." /SETINTEGRITYLEVEL (CI)(OI)HIGH
          3⤵
          • Modifies file permissions
          PID:1596
        • C:\Windows\SysWOW64\EXPAND.EXE
          "C:\Windows\system32\EXPAND.EXE" -R files.cab -F:* files
          3⤵
          • Drops file in Windows directory
          PID:2576
        • C:\Users\Admin\AppData\Local\Temp\MW-ea6cf7d6-50f1-4d31-8c31-631c7a95d9e1\files\516664139b0ddd044397a56482d7308d87c213c320a3151ccb9738e8f932654b-2022-04-20-15-57-51.exe
          "C:\Users\Admin\AppData\Local\Temp\MW-ea6cf7d6-50f1-4d31-8c31-631c7a95d9e1\files\516664139b0ddd044397a56482d7308d87c213c320a3151ccb9738e8f932654b-2022-04-20-15-57-51.exe"
          3⤵
          • Executes dropped EXE
          PID:4848
        • C:\Windows\SysWOW64\ICACLS.EXE
          "C:\Windows\system32\ICACLS.EXE" "C:\Users\Admin\AppData\Local\Temp\MW-ea6cf7d6-50f1-4d31-8c31-631c7a95d9e1\." /SETINTEGRITYLEVEL (CI)(OI)LOW
          3⤵
          • Modifies file permissions
          PID:4156
    • C:\Windows\system32\vssvc.exe
      C:\Windows\system32\vssvc.exe
      1⤵
      • Checks SCSI registry key(s)
      • Suspicious use of AdjustPrivilegeToken
      PID:3200
    • C:\Users\Admin\AppData\Local\Temp\MW-ea6cf7d6-50f1-4d31-8c31-631c7a95d9e1\files\516664139b0ddd044397a56482d7308d87c213c320a3151ccb9738e8f932654b-2022-04-20-15-57-51.exe
      "C:\Users\Admin\AppData\Local\Temp\MW-ea6cf7d6-50f1-4d31-8c31-631c7a95d9e1\files\516664139b0ddd044397a56482d7308d87c213c320a3151ccb9738e8f932654b-2022-04-20-15-57-51.exe"
      1⤵
      • Executes dropped EXE
      • Suspicious use of WriteProcessMemory
      PID:4524
      • C:\Users\Admin\AppData\Local\Temp\MW-ea6cf7d6-50f1-4d31-8c31-631c7a95d9e1\files\516664139b0ddd044397a56482d7308d87c213c320a3151ccb9738e8f932654b-2022-04-20-15-57-51.exe
        "C:\Users\Admin\AppData\Local\Temp\MW-ea6cf7d6-50f1-4d31-8c31-631c7a95d9e1\files\516664139b0ddd044397a56482d7308d87c213c320a3151ccb9738e8f932654b-2022-04-20-15-57-51.exe"
        2⤵
        • Executes dropped EXE
        • Drops file in System32 directory
        • Sets desktop wallpaper using registry
        • Modifies Control Panel
        • Modifies data under HKEY_USERS
        • Modifies registry class
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of WriteProcessMemory
        PID:3128
        • C:\Users\Admin\AppData\Local\Temp\MW-ea6cf7d6-50f1-4d31-8c31-631c7a95d9e1\files\516664139b0ddd044397a56482d7308d87c213c320a3151ccb9738e8f932654b-2022-04-20-15-57-51.exe
          C:\Users\Admin\AppData\Local\Temp\MW-ea6cf7d6-50f1-4d31-8c31-631c7a95d9e1\files\516664139b0ddd044397a56482d7308d87c213c320a3151ccb9738e8f932654b-2022-04-20-15-57-51.exe -work worker0 job0-3128
          3⤵
          • Executes dropped EXE
          • Modifies data under HKEY_USERS
          • Suspicious behavior: EnumeratesProcesses
          PID:2052
        • C:\Users\Admin\AppData\Local\Temp\MW-ea6cf7d6-50f1-4d31-8c31-631c7a95d9e1\files\516664139b0ddd044397a56482d7308d87c213c320a3151ccb9738e8f932654b-2022-04-20-15-57-51.exe
          C:\Users\Admin\AppData\Local\Temp\MW-ea6cf7d6-50f1-4d31-8c31-631c7a95d9e1\files\516664139b0ddd044397a56482d7308d87c213c320a3151ccb9738e8f932654b-2022-04-20-15-57-51.exe -work worker1 job1-3128
          3⤵
          • Executes dropped EXE
          • Enumerates connected drives
          PID:3524

    Network

    MITRE ATT&CK Matrix ATT&CK v13

    Initial Access

    Execution

    Persistence

    Privilege Escalation

    Defense Evasion

    File and Directory Permissions Modification

    1
    T1222

    Modify Registry

    1
    T1112

    Credential Access

    Discovery

    Query Registry

    2
    T1012

    Peripheral Device Discovery

    2
    T1120

    System Information Discovery

    2
    T1082

    Lateral Movement

    Collection

    Exfiltration

    Command and Control

    Impact

    Defacement

    1
    T1491

    Resource Development

    Reconnaissance

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\README.5ae4bc4e.TXT
      Filesize

      2KB

      MD5

      cc9673216d53012c400856b86968c4a2

      SHA1

      80945bfdc6f2b30fd7b47e92ae762ab4ad792659

      SHA256

      5dfc11166e6b0e978aa5b95aaf2a51733033379b7e7980f5fa1d42b6333cf9e0

      SHA512

      f556026b31927923f385325adb493934e45750f401bf4787a0f0602f8309f520c967da72b9924f1872895718a5376eb8c433084496f5903670ad1e1d47cc4266

      Download Submit
    • C:\Users\Admin\AppData\Local\Temp\MW-ea6cf7d6-50f1-4d31-8c31-631c7a95d9e1\files.cab
      Filesize

      56KB

      MD5

      f8ba117f135d10e3eb80472c1ec46469

      SHA1

      6c084a82bf4ebafde30c5b3182f83dcb66933671

      SHA256

      9bc48ce1d31060a52f1f879fd140d96d60f60dd2d53d83efca323819b048b9f1

      SHA512

      3985a44a1a0907153f1a1eeaf8e91dcf25c0f6f27abc70edbbe5922e281b70fd7c308df022200a35daf2044eb2323f101ded0a5f0f592aed2bd8a50de4f0e0fa

      Download Submit
    • C:\Users\Admin\AppData\Local\Temp\MW-ea6cf7d6-50f1-4d31-8c31-631c7a95d9e1\files\516664139b0ddd044397a56482d7308d87c213c320a3151ccb9738e8f932654b-2022-04-20-15-57-51.exe
      Filesize

      56KB

      MD5

      84c1567969b86089cc33dccf41562bcd

      SHA1

      53f2133cb25186e9fa6d4ea3b0e41eee5aba5ef2

      SHA256

      516664139b0ddd044397a56482d7308d87c213c320a3151ccb9738e8f932654b

      SHA512

      72a411cacd503b6fadb15dc90f1f9beb79ff79c620df76da381e5c780c53e11258aae72db2848c241ec55af403d67d62340e429e86c23bbf8a71287738de7eaa

      Download Submit
    • C:\Users\Admin\AppData\Local\Temp\MW-ea6cf7d6-50f1-4d31-8c31-631c7a95d9e1\msiwrapper.ini
      Filesize

      1KB

      MD5

      7b322987a003cc458cb6d3c7edd77ea6

      SHA1

      e13aef6f9caf04dc8fb654404f6a75f099e2c17b

      SHA256

      6dc0a8c4fc8ae0b064164f1cbd095628c51076050c672b1c0b1e95fc5a3b7875

      SHA512

      49e4a67a7b99ab23b2108d852fce1bf435508d349d09f43757471ee7ba693b1cb8486467cadab7a80fd43d83fb506d2cc449c11e298197014b89be718f769add

      Download Submit
    • C:\Users\Admin\AppData\Local\Temp\MW-ea6cf7d6-50f1-4d31-8c31-631c7a95d9e1\msiwrapper.ini
      Filesize

      1KB

      MD5

      6076c98442aa0158c992786cabbe7303

      SHA1

      2b9ed6a38a3ac29f85e4830b64cf43315765cff1

      SHA256

      9c230b92ddaf2fc022e1f4a1cd84e7194e9aeef2b4b7ff0a35179907bd40ebd9

      SHA512

      e91c9f87bfb1c2c97f7baf5956d00f5cdc3a5dafcc64d973b71f6bdbf5775b1ffe4173e5c5870c2b9fcbde846b7a080b912bd42ff91ff62efa68adf396a4ab3c

      Download Submit
    • C:\Users\Admin\AppData\Local\Temp\MW-ea6cf7d6-50f1-4d31-8c31-631c7a95d9e1\msiwrapper.ini
      Filesize

      1KB

      MD5

      87b32da922b3c9ca9d0ad71fdc82bc15

      SHA1

      703bed793a70de06fcd2644105289ceb40ec1106

      SHA256

      724e6c1e1603d0cc1b06cf7c52866d1f8a04ab3a79fee0bdc3d155b005cccd4e

      SHA512

      7e7ce714cf655513304544a80e69ba0b21ff918d5cd022674815afeba03fbcf96eb5b12b11ab3d1c15f8ee800e4e3164356f974d726860e189ef6346e4a58aec

      Download Submit
    • C:\Windows\Installer\MSI8211.tmp
      Filesize

      208KB

      MD5

      0c8921bbcc37c6efd34faf44cf3b0cb5

      SHA1

      dcfa71246157edcd09eecaf9d4c5e360b24b3e49

      SHA256

      fd622cf73ea951a6de631063aba856487d77745dd1500adca61902b8dde56fe1

      SHA512

      ed55443e20d40cca90596f0a0542fa5ab83fe0270399adfaafd172987fb813dfd44ec0da0a58c096af3641003f830341fe259ad5bce9823f238ae63b7e11e108

      Download Submit