Analysis

  • max time kernel
    139s
  • max time network
    149s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231215-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
  • submitted
    15-02-2024 12:23

General

  • Target

    2024-02-15_2dadaf10d507b44e7b561405d9227bc2_darkside.exe

  • Size

    147KB

  • MD5

    2dadaf10d507b44e7b561405d9227bc2

  • SHA1

    5406d642422ca05857447ad82979d6d44c326834

  • SHA256

    6dd44d852226fd9e7fc914c6edbaf185bfcaacdc7a4dcdb7268440e6fc811618

  • SHA512

    0cbd90e6bc68e1052ecc22f90c9e3fbfccc796029e7ef9258f4d5f1b29dfe26c0a0f799b5a406a097c32e1beb27e3c1fdbd65ca67615d1e37f265874ddac2f11

  • SSDEEP

    3072:G6glyuxE4GsUPnliByocWepHLamgTCsUd3Mh:G6gDBGpvEByocWeFLamg+NM

Malware Config

Extracted

Path

C:\G3fEAZsSH.README.txt

Ransom Note
What happens? Your network is encrypted, and currently not operational. e need only money, after payment we wil1 give you a decryptor for the entire network and you wil1 restore al1 the data. >>>> What data stolen? From your network was stolen sensitive data. If you do not contact us we wil1 publish al1 your data in our blog and wil1 send it to the biggest mass media. >>>>What guarantees?We are not a politically motivated group and we do not need anything otherthan your money.If you pay, we will provide you the programs for decryption and we will delete your data.If we do not give you decrypters or we do not delete your data, no one will pay us in the future, this does not comply with our goalsWe always keep our promises. >>>>Pay ransom amount contact Email:[email protected] >>>>Payment cryptocurrency address USDT-TRC20 >>>>TN1euwn8NPBcq9ieJvA2roo56eoifCHLZv >>>>payment is completed, send the payment photo to Email: [email protected] >>>>payment is completed Send via email we will provide you the programs Sometimes you will need to wait for our answer because we attack many companies. we will provide you the programs Warning! Recovery recormnendations. We strongly recommend you to do not MODIFY or REPAIR your files, that wil1 damage them
Emails

Signatures

  • Renames multiple (583) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself 1 IoCs
  • Executes dropped EXE 1 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Drops desktop.ini file(s) 2 IoCs
  • Drops file in System32 directory 4 IoCs
  • Sets desktop wallpaper using registry 2 TTPs 2 IoCs
  • Suspicious use of NtSetInformationThreadHideFromDebugger 5 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Checks processor information in registry 2 TTPs 3 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Modifies Control Panel 2 IoCs
  • Modifies registry class 5 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: RenamesItself 26 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of SetWindowsHookEx 13 IoCs
  • Suspicious use of WriteProcessMemory 11 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2024-02-15_2dadaf10d507b44e7b561405d9227bc2_darkside.exe
    "C:\Users\Admin\AppData\Local\Temp\2024-02-15_2dadaf10d507b44e7b561405d9227bc2_darkside.exe"
    1⤵
    • Drops desktop.ini file(s)
    • Sets desktop wallpaper using registry
    • Suspicious use of NtSetInformationThreadHideFromDebugger
    • Modifies Control Panel
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:4512
    • C:\Windows\splwow64.exe
      C:\Windows\splwow64.exe 12288
      2⤵
      • Drops file in System32 directory
      PID:4780
    • C:\ProgramData\949B.tmp
      "C:\ProgramData\949B.tmp"
      2⤵
      • Checks computer location settings
      • Deletes itself
      • Executes dropped EXE
      • Suspicious use of NtSetInformationThreadHideFromDebugger
      • Suspicious behavior: RenamesItself
      • Suspicious use of WriteProcessMemory
      PID:4952
      • C:\Windows\SysWOW64\cmd.exe
        "C:\Windows\System32\cmd.exe" /C DEL /F /Q C:\PROGRA~3\949B.tmp >> NUL
        3⤵
          PID:2636
    • C:\Windows\system32\svchost.exe
      C:\Windows\system32\svchost.exe -k PrintWorkflow -s PrintWorkflowUserSvc
      1⤵
        PID:3268
      • C:\Windows\system32\printfilterpipelinesvc.exe
        C:\Windows\system32\printfilterpipelinesvc.exe -Embedding
        1⤵
        • Drops file in System32 directory
        • Suspicious use of WriteProcessMemory
        PID:3368
        • C:\Program Files\Microsoft Office\root\Office16\ONENOTE.EXE
          /insertdoc "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\{C959188E-3292-439D-AE95-C76F799F8C52}.xps" 133524734507240000
          2⤵
          • Checks processor information in registry
          • Enumerates system info in registry
          • Suspicious use of SetWindowsHookEx
          PID:4604

      Network

      MITRE ATT&CK Enterprise v15

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\$Recycle.Bin\S-1-5-21-3073191680-435865314-2862784915-1000\desktop.ini

        Filesize

        129B

        MD5

        8d5f7adca59dfd6c8ecd7cb2d5721865

        SHA1

        febc9e9c0ce37866466e02cb43fc2a1916c1445b

        SHA256

        915524a825c6ab8148b67e2c35f5009a6d9dba8198c82f75f58f0960c48a01ab

        SHA512

        1ec78dc2a71307b461120c466a3efc803c31707edde6bc18adec76be4dc17effc9976a2ce360c934971c51b5e07d76ec113961b75f785c992270d7bcac2c117d

      • C:\G3fEAZsSH.README.txt

        Filesize

        1KB

        MD5

        c27b4229efac6671942d30719e33225d

        SHA1

        dfc06ec8ae7e1047aedc4e9f8f0c9e83ad69c507

        SHA256

        ccb3796c65736cbb0e28cedc370b210f27dff6877cfb8cec85e75f151b48b630

        SHA512

        5cf85171e683a5982930b047dbfe3278d896b2f146863668620a990003e3467313006fc3e7a139d84f02537a11b42571b7dc958465df8b8caad2091174f992a0

      • C:\ProgramData\949B.tmp

        Filesize

        14KB

        MD5

        294e9f64cb1642dd89229fff0592856b

        SHA1

        97b148c27f3da29ba7b18d6aee8a0db9102f47c9

        SHA256

        917e115cc403e29b4388e0d175cbfac3e7e40ca1742299fbdb353847db2de7c2

        SHA512

        b87d531890bf1577b9b4af41dddb2cdbbfa164cf197bd5987df3a3075983645a3acba443e289b7bfd338422978a104f55298fbfe346872de0895bde44adc89cf

      • C:\Users\Admin\AppData\Local\Temp\DDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDD

        Filesize

        147KB

        MD5

        71ba59ad49314d0c71a9bc76e1d4b02a

        SHA1

        33dbdbf0c6233904781d398c10752fa861c82624

        SHA256

        f57a130ceb40304d8b235322d0c9339d78722e1cb79a52ea6e14cffcdfeac1b6

        SHA512

        332be5d08cf2ab72427cb861a39faf1cd26a73ebea83e1f5017ce03018c03878985eedd389e88db5b5cae98863af7379652874c6b70f5f79780b03088cdfaab7

      • C:\Users\Admin\Documents\OneNote Notebooks\My Notebook\Open Notebook.onetoc2

        Filesize

        4KB

        MD5

        463bb6a2246135694707ba3850d4cc33

        SHA1

        2ffa8a521e365ffd09ded14a2bf6c48841ccf928

        SHA256

        4cb38e5751fbcca30bdfa84ed41efd1161ff56580d740e9276aeb366134d7504

        SHA512

        8f9354650f860f51dabf350c371fd2fc81c3e348c10babd8c94514f0b5ad022fc7397d260e23f507ee91afa62e1049249a5a341443ea1ede71b5134002d5964c

      • F:\$RECYCLE.BIN\S-1-5-21-3073191680-435865314-2862784915-1000\EEEEEEEEEEE

        Filesize

        129B

        MD5

        8604f4612e9c09ca67f8d77ab18868d1

        SHA1

        64c4b3d7eb737915a8f249969b82ee6684b75302

        SHA256

        283e56a4311396c2f126cee7d4ebed0adee8041552c4286431032d439a650106

        SHA512

        e7c96be70a84966f7eeabb0a01edd0179cb28fe2935017323ad8c45d0df28534cf10decf6c4fa7567fee266657fd18505a93d5ff2f684cfea1af2e549633e16a

      • memory/4512-1-0x0000000003330000-0x0000000003340000-memory.dmp

        Filesize

        64KB

      • memory/4512-2-0x0000000003330000-0x0000000003340000-memory.dmp

        Filesize

        64KB

      • memory/4512-2741-0x0000000003330000-0x0000000003340000-memory.dmp

        Filesize

        64KB

      • memory/4512-2742-0x0000000003330000-0x0000000003340000-memory.dmp

        Filesize

        64KB

      • memory/4512-2743-0x0000000003330000-0x0000000003340000-memory.dmp

        Filesize

        64KB

      • memory/4512-0-0x0000000003330000-0x0000000003340000-memory.dmp

        Filesize

        64KB

      • memory/4604-2798-0x00007FFC378F0000-0x00007FFC37AE5000-memory.dmp

        Filesize

        2.0MB

      • memory/4604-2804-0x00007FFBF5010000-0x00007FFBF5020000-memory.dmp

        Filesize

        64KB

      • memory/4604-2763-0x00007FFC378F0000-0x00007FFC37AE5000-memory.dmp

        Filesize

        2.0MB

      • memory/4604-2757-0x00007FFBF7970000-0x00007FFBF7980000-memory.dmp

        Filesize

        64KB

      • memory/4604-2765-0x00007FFBF7970000-0x00007FFBF7980000-memory.dmp

        Filesize

        64KB

      • memory/4604-2766-0x00007FFBF7970000-0x00007FFBF7980000-memory.dmp

        Filesize

        64KB

      • memory/4604-2767-0x00007FFC378F0000-0x00007FFC37AE5000-memory.dmp

        Filesize

        2.0MB

      • memory/4604-2758-0x00007FFC378F0000-0x00007FFC37AE5000-memory.dmp

        Filesize

        2.0MB

      • memory/4604-2772-0x00007FFC378F0000-0x00007FFC37AE5000-memory.dmp

        Filesize

        2.0MB

      • memory/4604-2797-0x00007FFC378F0000-0x00007FFC37AE5000-memory.dmp

        Filesize

        2.0MB

      • memory/4604-2756-0x00007FFC378F0000-0x00007FFC37AE5000-memory.dmp

        Filesize

        2.0MB

      • memory/4604-2799-0x00007FFC378F0000-0x00007FFC37AE5000-memory.dmp

        Filesize

        2.0MB

      • memory/4604-2800-0x00007FFC378F0000-0x00007FFC37AE5000-memory.dmp

        Filesize

        2.0MB

      • memory/4604-2801-0x00007FFC378F0000-0x00007FFC37AE5000-memory.dmp

        Filesize

        2.0MB

      • memory/4604-2802-0x00007FFC378F0000-0x00007FFC37AE5000-memory.dmp

        Filesize

        2.0MB

      • memory/4604-2764-0x00007FFBF7970000-0x00007FFBF7980000-memory.dmp

        Filesize

        64KB

      • memory/4604-2805-0x00007FFC378F0000-0x00007FFC37AE5000-memory.dmp

        Filesize

        2.0MB

      • memory/4604-2803-0x00007FFC378F0000-0x00007FFC37AE5000-memory.dmp

        Filesize

        2.0MB

      • memory/4604-2806-0x00007FFC378F0000-0x00007FFC37AE5000-memory.dmp

        Filesize

        2.0MB

      • memory/4604-2807-0x00007FFC378F0000-0x00007FFC37AE5000-memory.dmp

        Filesize

        2.0MB

      • memory/4604-2809-0x00007FFBF5010000-0x00007FFBF5020000-memory.dmp

        Filesize

        64KB

      • memory/4604-2839-0x00007FFC378F0000-0x00007FFC37AE5000-memory.dmp

        Filesize

        2.0MB

      • memory/4604-2837-0x00007FFC378F0000-0x00007FFC37AE5000-memory.dmp

        Filesize

        2.0MB

      • memory/4604-2836-0x00007FFC378F0000-0x00007FFC37AE5000-memory.dmp

        Filesize

        2.0MB

      • memory/4604-2814-0x00007FFC378F0000-0x00007FFC37AE5000-memory.dmp

        Filesize

        2.0MB

      • memory/4604-2755-0x00007FFBF7970000-0x00007FFBF7980000-memory.dmp

        Filesize

        64KB

      • memory/4604-2808-0x00007FFC378F0000-0x00007FFC37AE5000-memory.dmp

        Filesize

        2.0MB

      • memory/4952-2810-0x00000000023D0000-0x00000000023E0000-memory.dmp

        Filesize

        64KB

      • memory/4952-2811-0x00000000023D0000-0x00000000023E0000-memory.dmp

        Filesize

        64KB

      • memory/4952-2813-0x000000007FDC0000-0x000000007FDC1000-memory.dmp

        Filesize

        4KB

      • memory/4952-2838-0x000000007FDC0000-0x000000007FDC1000-memory.dmp

        Filesize

        4KB

      • memory/4952-2812-0x000000007FE20000-0x000000007FE21000-memory.dmp

        Filesize

        4KB