Malware Analysis Report

2024-11-30 11:33

Sample ID 240217-ns1f3seh57
Target 2024-02-17_93ddced13de907d75d421aff8ce8cde3_darkside
SHA256 492ac25608dda01b3f776b46a7631bb8cd91a0ce0168931ec5bb9a846e702e39
Tags
lockbit spyware stealer
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

492ac25608dda01b3f776b46a7631bb8cd91a0ce0168931ec5bb9a846e702e39

Threat Level: Known bad

The file 2024-02-17_93ddced13de907d75d421aff8ce8cde3_darkside was found to be: Known bad.

Malicious Activity Summary

lockbit spyware stealer

Lockbit family

Rule to detect Lockbit 3.0 ransomware Windows payload

Checks computer location settings

Loads dropped DLL

Reads user/profile data of web browsers

Executes dropped EXE

Deletes itself

Drops desktop.ini file(s)

Drops file in System32 directory

Suspicious use of NtSetInformationThreadHideFromDebugger

Enumerates physical storage devices

Unsigned PE

Checks processor information in registry

Suspicious use of SetWindowsHookEx

Enumerates system info in registry

Suspicious use of WriteProcessMemory

Suspicious behavior: EnumeratesProcesses

Suspicious behavior: RenamesItself

Suspicious use of AdjustPrivilegeToken

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-02-17 11:40

Signatures

Lockbit family

lockbit

Rule to detect Lockbit 3.0 ransomware Windows payload

Description Indicator Process Target
N/A N/A N/A N/A

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-02-17 11:40

Reported

2024-02-17 11:42

Platform

win7-20231215-en

Max time kernel

121s

Max time network

125s

Command Line

"C:\Users\Admin\AppData\Local\Temp\2024-02-17_93ddced13de907d75d421aff8ce8cde3_darkside.exe"

Signatures

Deletes itself

Description Indicator Process Target
N/A N/A C:\ProgramData\9444.tmp N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\ProgramData\9444.tmp N/A

Loads dropped DLL

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-02-17_93ddced13de907d75d421aff8ce8cde3_darkside.exe N/A

Reads user/profile data of web browsers

spyware stealer

Drops desktop.ini file(s)

Description Indicator Process Target
File opened for modification C:\$Recycle.Bin\S-1-5-21-452311807-3713411997-1028535425-1000\desktop.ini C:\Users\Admin\AppData\Local\Temp\2024-02-17_93ddced13de907d75d421aff8ce8cde3_darkside.exe N/A
File opened for modification F:\$RECYCLE.BIN\S-1-5-21-452311807-3713411997-1028535425-1000\desktop.ini C:\Users\Admin\AppData\Local\Temp\2024-02-17_93ddced13de907d75d421aff8ce8cde3_darkside.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-02-17_93ddced13de907d75d421aff8ce8cde3_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-02-17_93ddced13de907d75d421aff8ce8cde3_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-02-17_93ddced13de907d75d421aff8ce8cde3_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-02-17_93ddced13de907d75d421aff8ce8cde3_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-02-17_93ddced13de907d75d421aff8ce8cde3_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-02-17_93ddced13de907d75d421aff8ce8cde3_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-02-17_93ddced13de907d75d421aff8ce8cde3_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-02-17_93ddced13de907d75d421aff8ce8cde3_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-02-17_93ddced13de907d75d421aff8ce8cde3_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-02-17_93ddced13de907d75d421aff8ce8cde3_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-02-17_93ddced13de907d75d421aff8ce8cde3_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-02-17_93ddced13de907d75d421aff8ce8cde3_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-02-17_93ddced13de907d75d421aff8ce8cde3_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-02-17_93ddced13de907d75d421aff8ce8cde3_darkside.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeAssignPrimaryTokenPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-17_93ddced13de907d75d421aff8ce8cde3_darkside.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-17_93ddced13de907d75d421aff8ce8cde3_darkside.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-17_93ddced13de907d75d421aff8ce8cde3_darkside.exe N/A
Token: 36 N/A C:\Users\Admin\AppData\Local\Temp\2024-02-17_93ddced13de907d75d421aff8ce8cde3_darkside.exe N/A
Token: SeImpersonatePrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-17_93ddced13de907d75d421aff8ce8cde3_darkside.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-17_93ddced13de907d75d421aff8ce8cde3_darkside.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-17_93ddced13de907d75d421aff8ce8cde3_darkside.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Local\Temp\2024-02-17_93ddced13de907d75d421aff8ce8cde3_darkside.exe N/A
Token: SeManageVolumePrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-17_93ddced13de907d75d421aff8ce8cde3_darkside.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-17_93ddced13de907d75d421aff8ce8cde3_darkside.exe N/A
Token: SeRestorePrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-17_93ddced13de907d75d421aff8ce8cde3_darkside.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-17_93ddced13de907d75d421aff8ce8cde3_darkside.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-17_93ddced13de907d75d421aff8ce8cde3_darkside.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-17_93ddced13de907d75d421aff8ce8cde3_darkside.exe N/A
Token: SeShutdownPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-17_93ddced13de907d75d421aff8ce8cde3_darkside.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-17_93ddced13de907d75d421aff8ce8cde3_darkside.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-17_93ddced13de907d75d421aff8ce8cde3_darkside.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-17_93ddced13de907d75d421aff8ce8cde3_darkside.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-17_93ddced13de907d75d421aff8ce8cde3_darkside.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-17_93ddced13de907d75d421aff8ce8cde3_darkside.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-17_93ddced13de907d75d421aff8ce8cde3_darkside.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-17_93ddced13de907d75d421aff8ce8cde3_darkside.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-17_93ddced13de907d75d421aff8ce8cde3_darkside.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-17_93ddced13de907d75d421aff8ce8cde3_darkside.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-17_93ddced13de907d75d421aff8ce8cde3_darkside.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-17_93ddced13de907d75d421aff8ce8cde3_darkside.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-17_93ddced13de907d75d421aff8ce8cde3_darkside.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-17_93ddced13de907d75d421aff8ce8cde3_darkside.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-17_93ddced13de907d75d421aff8ce8cde3_darkside.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-17_93ddced13de907d75d421aff8ce8cde3_darkside.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-17_93ddced13de907d75d421aff8ce8cde3_darkside.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-17_93ddced13de907d75d421aff8ce8cde3_darkside.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-17_93ddced13de907d75d421aff8ce8cde3_darkside.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-17_93ddced13de907d75d421aff8ce8cde3_darkside.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-17_93ddced13de907d75d421aff8ce8cde3_darkside.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-17_93ddced13de907d75d421aff8ce8cde3_darkside.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-17_93ddced13de907d75d421aff8ce8cde3_darkside.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-17_93ddced13de907d75d421aff8ce8cde3_darkside.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-17_93ddced13de907d75d421aff8ce8cde3_darkside.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-17_93ddced13de907d75d421aff8ce8cde3_darkside.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-17_93ddced13de907d75d421aff8ce8cde3_darkside.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-17_93ddced13de907d75d421aff8ce8cde3_darkside.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-17_93ddced13de907d75d421aff8ce8cde3_darkside.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-17_93ddced13de907d75d421aff8ce8cde3_darkside.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-17_93ddced13de907d75d421aff8ce8cde3_darkside.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-17_93ddced13de907d75d421aff8ce8cde3_darkside.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-17_93ddced13de907d75d421aff8ce8cde3_darkside.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-17_93ddced13de907d75d421aff8ce8cde3_darkside.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-17_93ddced13de907d75d421aff8ce8cde3_darkside.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-17_93ddced13de907d75d421aff8ce8cde3_darkside.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-17_93ddced13de907d75d421aff8ce8cde3_darkside.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-17_93ddced13de907d75d421aff8ce8cde3_darkside.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-17_93ddced13de907d75d421aff8ce8cde3_darkside.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-17_93ddced13de907d75d421aff8ce8cde3_darkside.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-17_93ddced13de907d75d421aff8ce8cde3_darkside.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-17_93ddced13de907d75d421aff8ce8cde3_darkside.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-17_93ddced13de907d75d421aff8ce8cde3_darkside.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-17_93ddced13de907d75d421aff8ce8cde3_darkside.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-17_93ddced13de907d75d421aff8ce8cde3_darkside.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-17_93ddced13de907d75d421aff8ce8cde3_darkside.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-17_93ddced13de907d75d421aff8ce8cde3_darkside.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-17_93ddced13de907d75d421aff8ce8cde3_darkside.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-17_93ddced13de907d75d421aff8ce8cde3_darkside.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-17_93ddced13de907d75d421aff8ce8cde3_darkside.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\2024-02-17_93ddced13de907d75d421aff8ce8cde3_darkside.exe

"C:\Users\Admin\AppData\Local\Temp\2024-02-17_93ddced13de907d75d421aff8ce8cde3_darkside.exe"

C:\ProgramData\9444.tmp

"C:\ProgramData\9444.tmp"

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /C DEL /F /Q C:\PROGRA~3\9444.tmp >> NUL

C:\Windows\system32\AUDIODG.EXE

C:\Windows\system32\AUDIODG.EXE 0x150

Network

N/A

Files

memory/1712-0-0x0000000002530000-0x0000000002570000-memory.dmp

C:\$Recycle.Bin\S-1-5-21-452311807-3713411997-1028535425-1000\desktop.ini

MD5 e183418993f992d54479ee366a2fa6f1
SHA1 c7b109a4fe4d6e4c1852b84ea79f746363bf463f
SHA256 ab0443bc2f2a4279358cdefea5c7bad67842915df357b3936fa8d33a2653c532
SHA512 8ee09deaf3ab9a141b463c2abe511f8767426a9d9253bb5f98d7b690dce7088683d471c241a5dacf84ff2ca194c0a6db51aa553744b2580e93d10f426c94208b

F:\$RECYCLE.BIN\S-1-5-21-452311807-3713411997-1028535425-1000\DDDDDDDDDDD

MD5 c852ee9d15c97a9b451abb6dffbc0f74
SHA1 31118d9faf0d3651987ca4fd3fc424c054e41f27
SHA256 2cab046141a647445175d4bcbbbbe3b629faf5166ad215edc4f41a2b86e7e3c8
SHA512 e75c7b118a87b52cfaa8f4391e60b3c295680693b3c1c5eaf13ba5b8ce19b932aa09cf47d38f556510b5443825f7a5d590b6e20eb5bf2cf534e6be4cb1415a5f

C:\xy5yyVMdq.README.txt

MD5 616a27a1516d0e2c6596bd33f133a2a4
SHA1 324dd40d0a9896c2e73ffdcf982b44b4683d155a
SHA256 59a9e08e83de790add2307d86381c88ee787506ad6f00112c43c1b62dab7303a
SHA512 953f51cf527320ae67c3c3217eab5197c396eba548c20233b5a3bcadf3290e13478d1c1ec46768bbdbd4231e3fdcf7fb72714cb58ad2e88be0debc8ece23ee27

C:\ProgramData\9444.tmp

MD5 294e9f64cb1642dd89229fff0592856b
SHA1 97b148c27f3da29ba7b18d6aee8a0db9102f47c9
SHA256 917e115cc403e29b4388e0d175cbfac3e7e40ca1742299fbdb353847db2de7c2
SHA512 b87d531890bf1577b9b4af41dddb2cdbbfa164cf197bd5987df3a3075983645a3acba443e289b7bfd338422978a104f55298fbfe346872de0895bde44adc89cf

memory/2132-858-0x000000007EFA0000-0x000000007EFA1000-memory.dmp

memory/2132-859-0x00000000020B0000-0x00000000020F0000-memory.dmp

memory/2132-862-0x000000007EF80000-0x000000007EF81000-memory.dmp

memory/2132-863-0x000000007EF20000-0x000000007EF21000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\DDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDD

MD5 92a0639ad482ac909572ee79961caace
SHA1 c4d23307d48a414df12b008b08f86d9b8951a8bb
SHA256 f4f70fb89ce9a3c6ecf30c3155f9e26a1e9f1958dc0a597091570fc6bdbc8187
SHA512 1b7527702b82128c9ba13c8c655935e8fc85b5919e708653d4d839fad894943e6526a40bc335b814d2fdaed53605b59acb5b1bfe783662c58375e475e0eee40e

memory/2132-890-0x000000007EF40000-0x000000007EF41000-memory.dmp

memory/2132-891-0x000000007EF40000-0x000000007EF41000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2024-02-17 11:40

Reported

2024-02-17 11:42

Platform

win10v2004-20231215-en

Max time kernel

145s

Max time network

144s

Command Line

"C:\Users\Admin\AppData\Local\Temp\2024-02-17_93ddced13de907d75d421aff8ce8cde3_darkside.exe"

Signatures

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000\Control Panel\International\Geo\Nation C:\ProgramData\7928.tmp N/A

Deletes itself

Description Indicator Process Target
N/A N/A C:\ProgramData\7928.tmp N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\ProgramData\7928.tmp N/A

Reads user/profile data of web browsers

spyware stealer

Drops desktop.ini file(s)

Description Indicator Process Target
File opened for modification C:\$Recycle.Bin\S-1-5-21-1497073144-2389943819-3385106915-1000\desktop.ini C:\Users\Admin\AppData\Local\Temp\2024-02-17_93ddced13de907d75d421aff8ce8cde3_darkside.exe N/A
File opened for modification F:\$RECYCLE.BIN\S-1-5-21-1497073144-2389943819-3385106915-1000\desktop.ini C:\Users\Admin\AppData\Local\Temp\2024-02-17_93ddced13de907d75d421aff8ce8cde3_darkside.exe N/A

Drops file in System32 directory

Description Indicator Process Target
File created C:\Windows\system32\spool\PRINTERS\PP891bjtg0tesyylcw5gra2qyud.TMP C:\Windows\system32\printfilterpipelinesvc.exe N/A
File created C:\Windows\system32\spool\PRINTERS\PPwtrf61f7su_5y2y1o2z7slu6d.TMP C:\Windows\system32\printfilterpipelinesvc.exe N/A
File created C:\Windows\system32\spool\PRINTERS\PP9ufrg6sdu_osvabreptldtyv.TMP C:\Windows\system32\printfilterpipelinesvc.exe N/A
File created C:\Windows\system32\spool\PRINTERS\00002.SPL C:\Windows\splwow64.exe N/A

Enumerates physical storage devices

Checks processor information in registry

Description Indicator Process Target
Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 C:\Program Files\Microsoft Office\root\Office16\ONENOTE.EXE N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz C:\Program Files\Microsoft Office\root\Office16\ONENOTE.EXE N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString C:\Program Files\Microsoft Office\root\Office16\ONENOTE.EXE N/A

Enumerates system info in registry

Description Indicator Process Target
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily C:\Program Files\Microsoft Office\root\Office16\ONENOTE.EXE N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU C:\Program Files\Microsoft Office\root\Office16\ONENOTE.EXE N/A
Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS C:\Program Files\Microsoft Office\root\Office16\ONENOTE.EXE N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-02-17_93ddced13de907d75d421aff8ce8cde3_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-02-17_93ddced13de907d75d421aff8ce8cde3_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-02-17_93ddced13de907d75d421aff8ce8cde3_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-02-17_93ddced13de907d75d421aff8ce8cde3_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-02-17_93ddced13de907d75d421aff8ce8cde3_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-02-17_93ddced13de907d75d421aff8ce8cde3_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-02-17_93ddced13de907d75d421aff8ce8cde3_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-02-17_93ddced13de907d75d421aff8ce8cde3_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-02-17_93ddced13de907d75d421aff8ce8cde3_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-02-17_93ddced13de907d75d421aff8ce8cde3_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-02-17_93ddced13de907d75d421aff8ce8cde3_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-02-17_93ddced13de907d75d421aff8ce8cde3_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-02-17_93ddced13de907d75d421aff8ce8cde3_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-02-17_93ddced13de907d75d421aff8ce8cde3_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-02-17_93ddced13de907d75d421aff8ce8cde3_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-02-17_93ddced13de907d75d421aff8ce8cde3_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-02-17_93ddced13de907d75d421aff8ce8cde3_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-02-17_93ddced13de907d75d421aff8ce8cde3_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-02-17_93ddced13de907d75d421aff8ce8cde3_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-02-17_93ddced13de907d75d421aff8ce8cde3_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-02-17_93ddced13de907d75d421aff8ce8cde3_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-02-17_93ddced13de907d75d421aff8ce8cde3_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-02-17_93ddced13de907d75d421aff8ce8cde3_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-02-17_93ddced13de907d75d421aff8ce8cde3_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-02-17_93ddced13de907d75d421aff8ce8cde3_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-02-17_93ddced13de907d75d421aff8ce8cde3_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-02-17_93ddced13de907d75d421aff8ce8cde3_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-02-17_93ddced13de907d75d421aff8ce8cde3_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-02-17_93ddced13de907d75d421aff8ce8cde3_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-02-17_93ddced13de907d75d421aff8ce8cde3_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-02-17_93ddced13de907d75d421aff8ce8cde3_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-02-17_93ddced13de907d75d421aff8ce8cde3_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-02-17_93ddced13de907d75d421aff8ce8cde3_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-02-17_93ddced13de907d75d421aff8ce8cde3_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-02-17_93ddced13de907d75d421aff8ce8cde3_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-02-17_93ddced13de907d75d421aff8ce8cde3_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-02-17_93ddced13de907d75d421aff8ce8cde3_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-02-17_93ddced13de907d75d421aff8ce8cde3_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-02-17_93ddced13de907d75d421aff8ce8cde3_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-02-17_93ddced13de907d75d421aff8ce8cde3_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-02-17_93ddced13de907d75d421aff8ce8cde3_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-02-17_93ddced13de907d75d421aff8ce8cde3_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-02-17_93ddced13de907d75d421aff8ce8cde3_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-02-17_93ddced13de907d75d421aff8ce8cde3_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-02-17_93ddced13de907d75d421aff8ce8cde3_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-02-17_93ddced13de907d75d421aff8ce8cde3_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-02-17_93ddced13de907d75d421aff8ce8cde3_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-02-17_93ddced13de907d75d421aff8ce8cde3_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-02-17_93ddced13de907d75d421aff8ce8cde3_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-02-17_93ddced13de907d75d421aff8ce8cde3_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-02-17_93ddced13de907d75d421aff8ce8cde3_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-02-17_93ddced13de907d75d421aff8ce8cde3_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-02-17_93ddced13de907d75d421aff8ce8cde3_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-02-17_93ddced13de907d75d421aff8ce8cde3_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-02-17_93ddced13de907d75d421aff8ce8cde3_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-02-17_93ddced13de907d75d421aff8ce8cde3_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-02-17_93ddced13de907d75d421aff8ce8cde3_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-02-17_93ddced13de907d75d421aff8ce8cde3_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-02-17_93ddced13de907d75d421aff8ce8cde3_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-02-17_93ddced13de907d75d421aff8ce8cde3_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-02-17_93ddced13de907d75d421aff8ce8cde3_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-02-17_93ddced13de907d75d421aff8ce8cde3_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-02-17_93ddced13de907d75d421aff8ce8cde3_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-02-17_93ddced13de907d75d421aff8ce8cde3_darkside.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeAssignPrimaryTokenPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-17_93ddced13de907d75d421aff8ce8cde3_darkside.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-17_93ddced13de907d75d421aff8ce8cde3_darkside.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-17_93ddced13de907d75d421aff8ce8cde3_darkside.exe N/A
Token: 36 N/A C:\Users\Admin\AppData\Local\Temp\2024-02-17_93ddced13de907d75d421aff8ce8cde3_darkside.exe N/A
Token: SeImpersonatePrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-17_93ddced13de907d75d421aff8ce8cde3_darkside.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-17_93ddced13de907d75d421aff8ce8cde3_darkside.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-17_93ddced13de907d75d421aff8ce8cde3_darkside.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Local\Temp\2024-02-17_93ddced13de907d75d421aff8ce8cde3_darkside.exe N/A
Token: SeManageVolumePrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-17_93ddced13de907d75d421aff8ce8cde3_darkside.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-17_93ddced13de907d75d421aff8ce8cde3_darkside.exe N/A
Token: SeRestorePrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-17_93ddced13de907d75d421aff8ce8cde3_darkside.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-17_93ddced13de907d75d421aff8ce8cde3_darkside.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-17_93ddced13de907d75d421aff8ce8cde3_darkside.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-17_93ddced13de907d75d421aff8ce8cde3_darkside.exe N/A
Token: SeShutdownPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-17_93ddced13de907d75d421aff8ce8cde3_darkside.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-17_93ddced13de907d75d421aff8ce8cde3_darkside.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-17_93ddced13de907d75d421aff8ce8cde3_darkside.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-17_93ddced13de907d75d421aff8ce8cde3_darkside.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-17_93ddced13de907d75d421aff8ce8cde3_darkside.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-17_93ddced13de907d75d421aff8ce8cde3_darkside.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-17_93ddced13de907d75d421aff8ce8cde3_darkside.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-17_93ddced13de907d75d421aff8ce8cde3_darkside.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-17_93ddced13de907d75d421aff8ce8cde3_darkside.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-17_93ddced13de907d75d421aff8ce8cde3_darkside.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-17_93ddced13de907d75d421aff8ce8cde3_darkside.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-17_93ddced13de907d75d421aff8ce8cde3_darkside.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-17_93ddced13de907d75d421aff8ce8cde3_darkside.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-17_93ddced13de907d75d421aff8ce8cde3_darkside.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-17_93ddced13de907d75d421aff8ce8cde3_darkside.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-17_93ddced13de907d75d421aff8ce8cde3_darkside.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-17_93ddced13de907d75d421aff8ce8cde3_darkside.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-17_93ddced13de907d75d421aff8ce8cde3_darkside.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-17_93ddced13de907d75d421aff8ce8cde3_darkside.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-17_93ddced13de907d75d421aff8ce8cde3_darkside.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-17_93ddced13de907d75d421aff8ce8cde3_darkside.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-17_93ddced13de907d75d421aff8ce8cde3_darkside.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-17_93ddced13de907d75d421aff8ce8cde3_darkside.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-17_93ddced13de907d75d421aff8ce8cde3_darkside.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-17_93ddced13de907d75d421aff8ce8cde3_darkside.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-17_93ddced13de907d75d421aff8ce8cde3_darkside.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-17_93ddced13de907d75d421aff8ce8cde3_darkside.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-17_93ddced13de907d75d421aff8ce8cde3_darkside.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-17_93ddced13de907d75d421aff8ce8cde3_darkside.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-17_93ddced13de907d75d421aff8ce8cde3_darkside.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-17_93ddced13de907d75d421aff8ce8cde3_darkside.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-17_93ddced13de907d75d421aff8ce8cde3_darkside.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-17_93ddced13de907d75d421aff8ce8cde3_darkside.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-17_93ddced13de907d75d421aff8ce8cde3_darkside.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-17_93ddced13de907d75d421aff8ce8cde3_darkside.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-17_93ddced13de907d75d421aff8ce8cde3_darkside.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-17_93ddced13de907d75d421aff8ce8cde3_darkside.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-17_93ddced13de907d75d421aff8ce8cde3_darkside.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-17_93ddced13de907d75d421aff8ce8cde3_darkside.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-17_93ddced13de907d75d421aff8ce8cde3_darkside.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-17_93ddced13de907d75d421aff8ce8cde3_darkside.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-17_93ddced13de907d75d421aff8ce8cde3_darkside.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-17_93ddced13de907d75d421aff8ce8cde3_darkside.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-17_93ddced13de907d75d421aff8ce8cde3_darkside.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-17_93ddced13de907d75d421aff8ce8cde3_darkside.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-17_93ddced13de907d75d421aff8ce8cde3_darkside.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-17_93ddced13de907d75d421aff8ce8cde3_darkside.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-17_93ddced13de907d75d421aff8ce8cde3_darkside.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-17_93ddced13de907d75d421aff8ce8cde3_darkside.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-17_93ddced13de907d75d421aff8ce8cde3_darkside.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 4088 wrote to memory of 2924 N/A C:\Users\Admin\AppData\Local\Temp\2024-02-17_93ddced13de907d75d421aff8ce8cde3_darkside.exe C:\Windows\splwow64.exe
PID 4088 wrote to memory of 2924 N/A C:\Users\Admin\AppData\Local\Temp\2024-02-17_93ddced13de907d75d421aff8ce8cde3_darkside.exe C:\Windows\splwow64.exe
PID 4088 wrote to memory of 3392 N/A C:\Users\Admin\AppData\Local\Temp\2024-02-17_93ddced13de907d75d421aff8ce8cde3_darkside.exe C:\ProgramData\7928.tmp
PID 4088 wrote to memory of 3392 N/A C:\Users\Admin\AppData\Local\Temp\2024-02-17_93ddced13de907d75d421aff8ce8cde3_darkside.exe C:\ProgramData\7928.tmp
PID 4088 wrote to memory of 3392 N/A C:\Users\Admin\AppData\Local\Temp\2024-02-17_93ddced13de907d75d421aff8ce8cde3_darkside.exe C:\ProgramData\7928.tmp
PID 4088 wrote to memory of 3392 N/A C:\Users\Admin\AppData\Local\Temp\2024-02-17_93ddced13de907d75d421aff8ce8cde3_darkside.exe C:\ProgramData\7928.tmp
PID 3912 wrote to memory of 3148 N/A C:\Windows\system32\printfilterpipelinesvc.exe C:\Program Files\Microsoft Office\root\Office16\ONENOTE.EXE
PID 3912 wrote to memory of 3148 N/A C:\Windows\system32\printfilterpipelinesvc.exe C:\Program Files\Microsoft Office\root\Office16\ONENOTE.EXE
PID 3392 wrote to memory of 3452 N/A C:\ProgramData\7928.tmp C:\Windows\SysWOW64\cmd.exe
PID 3392 wrote to memory of 3452 N/A C:\ProgramData\7928.tmp C:\Windows\SysWOW64\cmd.exe
PID 3392 wrote to memory of 3452 N/A C:\ProgramData\7928.tmp C:\Windows\SysWOW64\cmd.exe

Processes

C:\Users\Admin\AppData\Local\Temp\2024-02-17_93ddced13de907d75d421aff8ce8cde3_darkside.exe

"C:\Users\Admin\AppData\Local\Temp\2024-02-17_93ddced13de907d75d421aff8ce8cde3_darkside.exe"

C:\Windows\splwow64.exe

C:\Windows\splwow64.exe 12288

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k PrintWorkflow -s PrintWorkflowUserSvc

C:\Windows\system32\printfilterpipelinesvc.exe

C:\Windows\system32\printfilterpipelinesvc.exe -Embedding

C:\ProgramData\7928.tmp

"C:\ProgramData\7928.tmp"

C:\Program Files\Microsoft Office\root\Office16\ONENOTE.EXE

/insertdoc "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\{FDF81851-6958-4B83-98C2-6935CE525A02}.xps" 133526436309430000

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /C DEL /F /Q C:\PROGRA~3\7928.tmp >> NUL

Network

Country Destination Domain Proto
US 8.8.8.8:53 194.178.17.96.in-addr.arpa udp
US 8.8.8.8:53 232.168.11.51.in-addr.arpa udp
US 8.8.8.8:53 134.32.126.40.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 79.121.231.20.in-addr.arpa udp
US 8.8.8.8:53 241.150.49.20.in-addr.arpa udp
US 8.8.8.8:53 97.32.109.52.in-addr.arpa udp
US 8.8.8.8:53 6.173.189.20.in-addr.arpa udp
US 8.8.8.8:53 103.169.127.40.in-addr.arpa udp
US 8.8.8.8:53 171.39.242.20.in-addr.arpa udp
US 8.8.8.8:53 217.135.221.88.in-addr.arpa udp
US 8.8.8.8:53 173.178.17.96.in-addr.arpa udp
US 8.8.8.8:53 11.227.111.52.in-addr.arpa udp

Files

memory/4088-0-0x0000000003240000-0x0000000003250000-memory.dmp

memory/4088-1-0x0000000003240000-0x0000000003250000-memory.dmp

C:\$Recycle.Bin\S-1-5-21-1497073144-2389943819-3385106915-1000\EEEEEEEEEEE

MD5 e633a46de62dd28ffbf848e4bcfc6f7b
SHA1 c7e6f5f1c943d70ffd8d707f3ff30a0fcea1d8d2
SHA256 4330bd5be3ba70b2f3880cb53ad9baf13d73685204282624e2a3b26b6ae1e65c
SHA512 2571879761ed84541cd482f6aaaffc9e9547489f002a61aeb2564938a48ed6966dec3702b2b4c79e7a3ccb2f857a8759f3c45345cf32d3b17f6f0ff1e1304165

C:\xy5yyVMdq.README.txt

MD5 616a27a1516d0e2c6596bd33f133a2a4
SHA1 324dd40d0a9896c2e73ffdcf982b44b4683d155a
SHA256 59a9e08e83de790add2307d86381c88ee787506ad6f00112c43c1b62dab7303a
SHA512 953f51cf527320ae67c3c3217eab5197c396eba548c20233b5a3bcadf3290e13478d1c1ec46768bbdbd4231e3fdcf7fb72714cb58ad2e88be0debc8ece23ee27

F:\$RECYCLE.BIN\S-1-5-21-1497073144-2389943819-3385106915-1000\DDDDDDDDDDD

MD5 3a1b46d878509dcb546642b0063115bc
SHA1 4384bbe72c284989aeeae0cf276a7e3b571898e7
SHA256 e9fa5cfb7016b3aef17bfeb8ddda2c09598150ac8ca231da1d33d6956246284d
SHA512 f5122e35e543dcb35e7cb09023c417bc8bc2672d7ca116329fe956b3a908eb70efc3d5f58c50bf314c2ac6dfc954837380425700a843c72ecd63fde413c18e13

C:\ProgramData\7928.tmp

MD5 294e9f64cb1642dd89229fff0592856b
SHA1 97b148c27f3da29ba7b18d6aee8a0db9102f47c9
SHA256 917e115cc403e29b4388e0d175cbfac3e7e40ca1742299fbdb353847db2de7c2
SHA512 b87d531890bf1577b9b4af41dddb2cdbbfa164cf197bd5987df3a3075983645a3acba443e289b7bfd338422978a104f55298fbfe346872de0895bde44adc89cf

memory/3392-2765-0x00000000026D0000-0x00000000026E0000-memory.dmp

memory/3392-2774-0x00000000026D0000-0x00000000026E0000-memory.dmp

memory/3392-2764-0x000000007FE40000-0x000000007FE41000-memory.dmp

memory/3392-2804-0x000000007FDC0000-0x000000007FDC1000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\DDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDD

MD5 3d02434a08218c6b0e92670dcbce7cdb
SHA1 0292f36616d125c963471f9c72af02968ebd4a80
SHA256 b5dc750ead429c38001fe7cac358b7505610fa284804b12c8b98199f064aad93
SHA512 8a2cb1433b419dfe45cc3771c8d8830e55d373fbdd758cf52a84c5056b5cfd72ecadd6b88e54de96934c88021f89a19d3fffbb4312ed0105813ef24e8fcd7076

memory/3392-2775-0x000000007FE20000-0x000000007FE21000-memory.dmp

memory/3392-2805-0x000000007FDE0000-0x000000007FDE1000-memory.dmp

memory/3392-2806-0x000000007FE00000-0x000000007FE01000-memory.dmp

memory/3148-2807-0x00007FFFB5E50000-0x00007FFFB5E60000-memory.dmp

memory/3148-2808-0x00007FFFB5E50000-0x00007FFFB5E60000-memory.dmp

memory/3148-2809-0x00007FFFB5E50000-0x00007FFFB5E60000-memory.dmp

memory/3148-2810-0x00007FFFB5E50000-0x00007FFFB5E60000-memory.dmp

memory/3148-2811-0x00007FFFF5DD0000-0x00007FFFF5FC5000-memory.dmp

memory/3148-2812-0x00007FFFB5E50000-0x00007FFFB5E60000-memory.dmp

memory/3148-2813-0x00007FFFF5DD0000-0x00007FFFF5FC5000-memory.dmp

memory/3148-2814-0x00007FFFF5DD0000-0x00007FFFF5FC5000-memory.dmp

memory/3148-2815-0x00007FFFF5DD0000-0x00007FFFF5FC5000-memory.dmp

memory/3148-2816-0x00007FFFF5DD0000-0x00007FFFF5FC5000-memory.dmp

memory/3148-2818-0x00007FFFB3C80000-0x00007FFFB3C90000-memory.dmp

memory/3148-2817-0x00007FFFF5DD0000-0x00007FFFF5FC5000-memory.dmp

memory/3148-2819-0x00007FFFF5DD0000-0x00007FFFF5FC5000-memory.dmp

memory/3148-2820-0x00007FFFF5DD0000-0x00007FFFF5FC5000-memory.dmp

memory/3148-2822-0x00007FFFF5DD0000-0x00007FFFF5FC5000-memory.dmp

memory/3148-2821-0x00007FFFB3C80000-0x00007FFFB3C90000-memory.dmp

memory/3148-2823-0x00007FFFF5DD0000-0x00007FFFF5FC5000-memory.dmp

memory/3148-2824-0x00007FFFF5DD0000-0x00007FFFF5FC5000-memory.dmp

memory/3148-2825-0x00007FFFF5DD0000-0x00007FFFF5FC5000-memory.dmp

memory/3148-2826-0x00007FFFF5DD0000-0x00007FFFF5FC5000-memory.dmp

memory/3148-2827-0x00007FFFF5DD0000-0x00007FFFF5FC5000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\{52B6603B-CC0A-417D-BD17-B6C1C66E85F8}

MD5 fc00ca06f4f020f540712f0b612a26a6
SHA1 dd3b3652c559dd1d530810e6a2991a7c5a754c13
SHA256 27eb1e218c55693a332fd1872a6a192ea0ff75a58753661cbf1966cf7aa47b22
SHA512 853edcbd3633284ee1d438163a3971aad4459e9a5d58e606c77c57a04bcef301aabc5de676ce82c6783801c05018f5fe030a26076309cac07c69e73811fce2c9

C:\Users\Admin\Documents\OneNote Notebooks\My Notebook\Open Notebook.onetoc2

MD5 29ef6d10a574dc758dfc5a7cb27ce356
SHA1 581a0031b4b6e640b9a49253b1f88346b4707cd7
SHA256 3ef305333d62ef29db38d8858e9f612d122e194b089d15231305e2282620edf4
SHA512 1fe12ae0857cd707a4f2d97df0ea76a6cad1179525b74c0d7f3d9d6d3bd44a0fd08658cf91a415eba49225672c54548e59a2f16fead2731a03c5141b9a9d832a

memory/3148-2849-0x00007FFFF5DD0000-0x00007FFFF5FC5000-memory.dmp