Analysis
-
max time kernel
139s -
max time network
145s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
21-02-2024 01:07
Behavioral task
behavioral1
Sample
2024-02-21_7e10d07ee37ff5f33e4a17a1e2bccd4e_darkside.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
2024-02-21_7e10d07ee37ff5f33e4a17a1e2bccd4e_darkside.exe
Resource
win10v2004-20231215-en
General
-
Target
2024-02-21_7e10d07ee37ff5f33e4a17a1e2bccd4e_darkside.exe
-
Size
153KB
-
MD5
7e10d07ee37ff5f33e4a17a1e2bccd4e
-
SHA1
fdb0d71ca6b9f16f74f9bc8e4125b213f5c3e708
-
SHA256
655f0d2974bf6da082463a2e1c5cf9ae87dcc873058e5e33cb47ca9490e158c2
-
SHA512
2d6824a70a0389daedfba64a5c1281218ff7d718257e615d87714149f610166559e53bf345634da3caa80ec7e434f2cb4c9e21cfad857b0b25e5534e88255305
-
SSDEEP
3072:LqJogYkcSNm9V7Dd/IKyGwmv+e5UYzjT:Lq2kc4m9tDKPwK
Malware Config
Extracted
C:\Wuxt90cxD.README.txt
lockbit
http://lockbitapt2yfbt7lchxejug47kmqvqqxvvjpqkmevv4l3azl3gy6pyd.onion
http://lockbitapt5x4zkjbcqmz6frdhecqqgadevyiwqxukksspnlidyvd7qd.onion
http://lockbitapt6vx57t3eeqjofwgcglmutr3a35nygvokja5uuccip4ykyd.onion
http://lockbitapt34kvrip6xojylohhxrwsvpzdffgs5z4pbbsywnzsbdguqd.onion
http://lockbitaptc2iq4atewz2ise62q63wfktyrl4qtwuk5qax262kgtzjqd.onion
http://lockbitaptjpikdqjynvgozhgc6bgetgucdk5xjacozeaawihmoio6yd.onion
http://lockbitaptq7ephv2oigdncfhtwhpqgwmqojnxqdyhprxxfpcllqdxad.onion
http://lockbitaptstzf3er2lz6ku3xuifafq2yh5lmiqj5ncur6rtlmkteiqd.onion
http://lockbitaptoofrpignlz6dt2wqqc5z3a4evjevoa3eqdfcntxad5lmyd.onion
http://lockbitapt.uz
http://lockbitapt2yfbt7lchxejug47kmqvqqxvvjpqkmevv4l3azl3gy6pyd.onion.ly
http://lockbitapt5x4zkjbcqmz6frdhecqqgadevyiwqxukksspnlidyvd7qd.onion.ly
http://lockbitapt6vx57t3eeqjofwgcglmutr3a35nygvokja5uuccip4ykyd.onion.ly
http://lockbitapt34kvrip6xojylohhxrwsvpzdffgs5z4pbbsywnzsbdguqd.onion.ly
http://lockbitaptc2iq4atewz2ise62q63wfktyrl4qtwuk5qax262kgtzjqd.onion.ly
http://lockbitaptjpikdqjynvgozhgc6bgetgucdk5xjacozeaawihmoio6yd.onion.ly
http://lockbitaptq7ephv2oigdncfhtwhpqgwmqojnxqdyhprxxfpcllqdxad.onion.ly
http://lockbitaptstzf3er2lz6ku3xuifafq2yh5lmiqj5ncur6rtlmkteiqd.onion.ly
http://lockbitaptoofrpignlz6dt2wqqc5z3a4evjevoa3eqdfcntxad5lmyd.onion.ly
https://twitter.com/hashtag/lockbit?f=live
http://lockbitsupt7nr3fa6e7xyb73lk6bw6rcneqhoyblniiabj4uwvzapqd.onion
http://lockbitsupuhswh4izvoucoxsbnotkmgq6durg7kficg6u33zfvq3oyd.onion
http://lockbitsupn2h6be2cnqpvncyhj4rgmnwn44633hnzzmtxdvjoqlp7yd.onion
http://lockbitsupp.uz
https://tox.chat/download.html
Signatures
-
Lockbit
Ransomware family with multiple variants released since late 2019.
-
Renames multiple (600) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
CCE1.tmpdescription ioc Process Key value queried \REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\Control Panel\International\Geo\Nation CCE1.tmp -
Deletes itself 1 IoCs
Processes:
CCE1.tmppid Process 4020 CCE1.tmp -
Executes dropped EXE 1 IoCs
Processes:
CCE1.tmppid Process 4020 CCE1.tmp -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Drops desktop.ini file(s) 2 IoCs
Processes:
2024-02-21_7e10d07ee37ff5f33e4a17a1e2bccd4e_darkside.exedescription ioc Process File opened for modification F:\$RECYCLE.BIN\S-1-5-21-3073191680-435865314-2862784915-1000\desktop.ini 2024-02-21_7e10d07ee37ff5f33e4a17a1e2bccd4e_darkside.exe File opened for modification C:\$Recycle.Bin\S-1-5-21-3073191680-435865314-2862784915-1000\desktop.ini 2024-02-21_7e10d07ee37ff5f33e4a17a1e2bccd4e_darkside.exe -
Drops file in System32 directory 4 IoCs
Processes:
splwow64.exeprintfilterpipelinesvc.exedescription ioc Process File created C:\Windows\system32\spool\PRINTERS\00002.SPL splwow64.exe File created C:\Windows\system32\spool\PRINTERS\PPk7ifdq_0gtljh8tblt0pnw6db.TMP printfilterpipelinesvc.exe File created C:\Windows\system32\spool\PRINTERS\PPrbcmgc6zz46oxbo1kmrt8ctxb.TMP printfilterpipelinesvc.exe File created C:\Windows\system32\spool\PRINTERS\PPoda9jh7dv360v21xk_j18jxo.TMP printfilterpipelinesvc.exe -
Sets desktop wallpaper using registry 2 TTPs 2 IoCs
Processes:
2024-02-21_7e10d07ee37ff5f33e4a17a1e2bccd4e_darkside.exedescription ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\Control Panel\Desktop\WallPaper = "C:\\ProgramData\\Wuxt90cxD.bmp" 2024-02-21_7e10d07ee37ff5f33e4a17a1e2bccd4e_darkside.exe Set value (str) \REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\Control Panel\Desktop\Wallpaper = "C:\\ProgramData\\Wuxt90cxD.bmp" 2024-02-21_7e10d07ee37ff5f33e4a17a1e2bccd4e_darkside.exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
Processes:
CCE1.tmppid Process 4020 CCE1.tmp -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
ONENOTE.EXEdescription ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString ONENOTE.EXE Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 ONENOTE.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz ONENOTE.EXE -
Enumerates system info in registry 2 TTPs 3 IoCs
Processes:
ONENOTE.EXEdescription ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU ONENOTE.EXE Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS ONENOTE.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily ONENOTE.EXE -
Modifies Control Panel 2 IoCs
Processes:
2024-02-21_7e10d07ee37ff5f33e4a17a1e2bccd4e_darkside.exedescription ioc Process Key created \REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\Control Panel\Desktop 2024-02-21_7e10d07ee37ff5f33e4a17a1e2bccd4e_darkside.exe Set value (str) \REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\Control Panel\Desktop\WallpaperStyle = "10" 2024-02-21_7e10d07ee37ff5f33e4a17a1e2bccd4e_darkside.exe -
Modifies registry class 5 IoCs
Processes:
2024-02-21_7e10d07ee37ff5f33e4a17a1e2bccd4e_darkside.exedescription ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.Wuxt90cxD 2024-02-21_7e10d07ee37ff5f33e4a17a1e2bccd4e_darkside.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.Wuxt90cxD\ = "Wuxt90cxD" 2024-02-21_7e10d07ee37ff5f33e4a17a1e2bccd4e_darkside.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wuxt90cxD\DefaultIcon 2024-02-21_7e10d07ee37ff5f33e4a17a1e2bccd4e_darkside.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wuxt90cxD 2024-02-21_7e10d07ee37ff5f33e4a17a1e2bccd4e_darkside.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wuxt90cxD\DefaultIcon\ = "C:\\ProgramData\\Wuxt90cxD.ico" 2024-02-21_7e10d07ee37ff5f33e4a17a1e2bccd4e_darkside.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
2024-02-21_7e10d07ee37ff5f33e4a17a1e2bccd4e_darkside.exepid Process 3808 2024-02-21_7e10d07ee37ff5f33e4a17a1e2bccd4e_darkside.exe 3808 2024-02-21_7e10d07ee37ff5f33e4a17a1e2bccd4e_darkside.exe 3808 2024-02-21_7e10d07ee37ff5f33e4a17a1e2bccd4e_darkside.exe 3808 2024-02-21_7e10d07ee37ff5f33e4a17a1e2bccd4e_darkside.exe 3808 2024-02-21_7e10d07ee37ff5f33e4a17a1e2bccd4e_darkside.exe 3808 2024-02-21_7e10d07ee37ff5f33e4a17a1e2bccd4e_darkside.exe 3808 2024-02-21_7e10d07ee37ff5f33e4a17a1e2bccd4e_darkside.exe 3808 2024-02-21_7e10d07ee37ff5f33e4a17a1e2bccd4e_darkside.exe 3808 2024-02-21_7e10d07ee37ff5f33e4a17a1e2bccd4e_darkside.exe 3808 2024-02-21_7e10d07ee37ff5f33e4a17a1e2bccd4e_darkside.exe 3808 2024-02-21_7e10d07ee37ff5f33e4a17a1e2bccd4e_darkside.exe 3808 2024-02-21_7e10d07ee37ff5f33e4a17a1e2bccd4e_darkside.exe 3808 2024-02-21_7e10d07ee37ff5f33e4a17a1e2bccd4e_darkside.exe 3808 2024-02-21_7e10d07ee37ff5f33e4a17a1e2bccd4e_darkside.exe 3808 2024-02-21_7e10d07ee37ff5f33e4a17a1e2bccd4e_darkside.exe 3808 2024-02-21_7e10d07ee37ff5f33e4a17a1e2bccd4e_darkside.exe 3808 2024-02-21_7e10d07ee37ff5f33e4a17a1e2bccd4e_darkside.exe 3808 2024-02-21_7e10d07ee37ff5f33e4a17a1e2bccd4e_darkside.exe 3808 2024-02-21_7e10d07ee37ff5f33e4a17a1e2bccd4e_darkside.exe 3808 2024-02-21_7e10d07ee37ff5f33e4a17a1e2bccd4e_darkside.exe 3808 2024-02-21_7e10d07ee37ff5f33e4a17a1e2bccd4e_darkside.exe 3808 2024-02-21_7e10d07ee37ff5f33e4a17a1e2bccd4e_darkside.exe 3808 2024-02-21_7e10d07ee37ff5f33e4a17a1e2bccd4e_darkside.exe 3808 2024-02-21_7e10d07ee37ff5f33e4a17a1e2bccd4e_darkside.exe 3808 2024-02-21_7e10d07ee37ff5f33e4a17a1e2bccd4e_darkside.exe 3808 2024-02-21_7e10d07ee37ff5f33e4a17a1e2bccd4e_darkside.exe 3808 2024-02-21_7e10d07ee37ff5f33e4a17a1e2bccd4e_darkside.exe 3808 2024-02-21_7e10d07ee37ff5f33e4a17a1e2bccd4e_darkside.exe 3808 2024-02-21_7e10d07ee37ff5f33e4a17a1e2bccd4e_darkside.exe 3808 2024-02-21_7e10d07ee37ff5f33e4a17a1e2bccd4e_darkside.exe 3808 2024-02-21_7e10d07ee37ff5f33e4a17a1e2bccd4e_darkside.exe 3808 2024-02-21_7e10d07ee37ff5f33e4a17a1e2bccd4e_darkside.exe 3808 2024-02-21_7e10d07ee37ff5f33e4a17a1e2bccd4e_darkside.exe 3808 2024-02-21_7e10d07ee37ff5f33e4a17a1e2bccd4e_darkside.exe 3808 2024-02-21_7e10d07ee37ff5f33e4a17a1e2bccd4e_darkside.exe 3808 2024-02-21_7e10d07ee37ff5f33e4a17a1e2bccd4e_darkside.exe 3808 2024-02-21_7e10d07ee37ff5f33e4a17a1e2bccd4e_darkside.exe 3808 2024-02-21_7e10d07ee37ff5f33e4a17a1e2bccd4e_darkside.exe 3808 2024-02-21_7e10d07ee37ff5f33e4a17a1e2bccd4e_darkside.exe 3808 2024-02-21_7e10d07ee37ff5f33e4a17a1e2bccd4e_darkside.exe 3808 2024-02-21_7e10d07ee37ff5f33e4a17a1e2bccd4e_darkside.exe 3808 2024-02-21_7e10d07ee37ff5f33e4a17a1e2bccd4e_darkside.exe 3808 2024-02-21_7e10d07ee37ff5f33e4a17a1e2bccd4e_darkside.exe 3808 2024-02-21_7e10d07ee37ff5f33e4a17a1e2bccd4e_darkside.exe 3808 2024-02-21_7e10d07ee37ff5f33e4a17a1e2bccd4e_darkside.exe 3808 2024-02-21_7e10d07ee37ff5f33e4a17a1e2bccd4e_darkside.exe 3808 2024-02-21_7e10d07ee37ff5f33e4a17a1e2bccd4e_darkside.exe 3808 2024-02-21_7e10d07ee37ff5f33e4a17a1e2bccd4e_darkside.exe 3808 2024-02-21_7e10d07ee37ff5f33e4a17a1e2bccd4e_darkside.exe 3808 2024-02-21_7e10d07ee37ff5f33e4a17a1e2bccd4e_darkside.exe 3808 2024-02-21_7e10d07ee37ff5f33e4a17a1e2bccd4e_darkside.exe 3808 2024-02-21_7e10d07ee37ff5f33e4a17a1e2bccd4e_darkside.exe 3808 2024-02-21_7e10d07ee37ff5f33e4a17a1e2bccd4e_darkside.exe 3808 2024-02-21_7e10d07ee37ff5f33e4a17a1e2bccd4e_darkside.exe 3808 2024-02-21_7e10d07ee37ff5f33e4a17a1e2bccd4e_darkside.exe 3808 2024-02-21_7e10d07ee37ff5f33e4a17a1e2bccd4e_darkside.exe 3808 2024-02-21_7e10d07ee37ff5f33e4a17a1e2bccd4e_darkside.exe 3808 2024-02-21_7e10d07ee37ff5f33e4a17a1e2bccd4e_darkside.exe 3808 2024-02-21_7e10d07ee37ff5f33e4a17a1e2bccd4e_darkside.exe 3808 2024-02-21_7e10d07ee37ff5f33e4a17a1e2bccd4e_darkside.exe 3808 2024-02-21_7e10d07ee37ff5f33e4a17a1e2bccd4e_darkside.exe 3808 2024-02-21_7e10d07ee37ff5f33e4a17a1e2bccd4e_darkside.exe 3808 2024-02-21_7e10d07ee37ff5f33e4a17a1e2bccd4e_darkside.exe 3808 2024-02-21_7e10d07ee37ff5f33e4a17a1e2bccd4e_darkside.exe -
Suspicious behavior: RenamesItself 26 IoCs
Processes:
CCE1.tmppid Process 4020 CCE1.tmp 4020 CCE1.tmp 4020 CCE1.tmp 4020 CCE1.tmp 4020 CCE1.tmp 4020 CCE1.tmp 4020 CCE1.tmp 4020 CCE1.tmp 4020 CCE1.tmp 4020 CCE1.tmp 4020 CCE1.tmp 4020 CCE1.tmp 4020 CCE1.tmp 4020 CCE1.tmp 4020 CCE1.tmp 4020 CCE1.tmp 4020 CCE1.tmp 4020 CCE1.tmp 4020 CCE1.tmp 4020 CCE1.tmp 4020 CCE1.tmp 4020 CCE1.tmp 4020 CCE1.tmp 4020 CCE1.tmp 4020 CCE1.tmp 4020 CCE1.tmp -
Suspicious use of AdjustPrivilegeToken 64 IoCs
Processes:
2024-02-21_7e10d07ee37ff5f33e4a17a1e2bccd4e_darkside.exedescription pid Process Token: SeAssignPrimaryTokenPrivilege 3808 2024-02-21_7e10d07ee37ff5f33e4a17a1e2bccd4e_darkside.exe Token: SeBackupPrivilege 3808 2024-02-21_7e10d07ee37ff5f33e4a17a1e2bccd4e_darkside.exe Token: SeDebugPrivilege 3808 2024-02-21_7e10d07ee37ff5f33e4a17a1e2bccd4e_darkside.exe Token: 36 3808 2024-02-21_7e10d07ee37ff5f33e4a17a1e2bccd4e_darkside.exe Token: SeImpersonatePrivilege 3808 2024-02-21_7e10d07ee37ff5f33e4a17a1e2bccd4e_darkside.exe Token: SeIncBasePriorityPrivilege 3808 2024-02-21_7e10d07ee37ff5f33e4a17a1e2bccd4e_darkside.exe Token: SeIncreaseQuotaPrivilege 3808 2024-02-21_7e10d07ee37ff5f33e4a17a1e2bccd4e_darkside.exe Token: 33 3808 2024-02-21_7e10d07ee37ff5f33e4a17a1e2bccd4e_darkside.exe Token: SeManageVolumePrivilege 3808 2024-02-21_7e10d07ee37ff5f33e4a17a1e2bccd4e_darkside.exe Token: SeProfSingleProcessPrivilege 3808 2024-02-21_7e10d07ee37ff5f33e4a17a1e2bccd4e_darkside.exe Token: SeRestorePrivilege 3808 2024-02-21_7e10d07ee37ff5f33e4a17a1e2bccd4e_darkside.exe Token: SeSecurityPrivilege 3808 2024-02-21_7e10d07ee37ff5f33e4a17a1e2bccd4e_darkside.exe Token: SeSystemProfilePrivilege 3808 2024-02-21_7e10d07ee37ff5f33e4a17a1e2bccd4e_darkside.exe Token: SeTakeOwnershipPrivilege 3808 2024-02-21_7e10d07ee37ff5f33e4a17a1e2bccd4e_darkside.exe Token: SeShutdownPrivilege 3808 2024-02-21_7e10d07ee37ff5f33e4a17a1e2bccd4e_darkside.exe Token: SeDebugPrivilege 3808 2024-02-21_7e10d07ee37ff5f33e4a17a1e2bccd4e_darkside.exe Token: SeBackupPrivilege 3808 2024-02-21_7e10d07ee37ff5f33e4a17a1e2bccd4e_darkside.exe Token: SeBackupPrivilege 3808 2024-02-21_7e10d07ee37ff5f33e4a17a1e2bccd4e_darkside.exe Token: SeSecurityPrivilege 3808 2024-02-21_7e10d07ee37ff5f33e4a17a1e2bccd4e_darkside.exe Token: SeSecurityPrivilege 3808 2024-02-21_7e10d07ee37ff5f33e4a17a1e2bccd4e_darkside.exe Token: SeBackupPrivilege 3808 2024-02-21_7e10d07ee37ff5f33e4a17a1e2bccd4e_darkside.exe Token: SeBackupPrivilege 3808 2024-02-21_7e10d07ee37ff5f33e4a17a1e2bccd4e_darkside.exe Token: SeSecurityPrivilege 3808 2024-02-21_7e10d07ee37ff5f33e4a17a1e2bccd4e_darkside.exe Token: SeSecurityPrivilege 3808 2024-02-21_7e10d07ee37ff5f33e4a17a1e2bccd4e_darkside.exe Token: SeBackupPrivilege 3808 2024-02-21_7e10d07ee37ff5f33e4a17a1e2bccd4e_darkside.exe Token: SeBackupPrivilege 3808 2024-02-21_7e10d07ee37ff5f33e4a17a1e2bccd4e_darkside.exe Token: SeSecurityPrivilege 3808 2024-02-21_7e10d07ee37ff5f33e4a17a1e2bccd4e_darkside.exe Token: SeSecurityPrivilege 3808 2024-02-21_7e10d07ee37ff5f33e4a17a1e2bccd4e_darkside.exe Token: SeBackupPrivilege 3808 2024-02-21_7e10d07ee37ff5f33e4a17a1e2bccd4e_darkside.exe Token: SeBackupPrivilege 3808 2024-02-21_7e10d07ee37ff5f33e4a17a1e2bccd4e_darkside.exe Token: SeSecurityPrivilege 3808 2024-02-21_7e10d07ee37ff5f33e4a17a1e2bccd4e_darkside.exe Token: SeSecurityPrivilege 3808 2024-02-21_7e10d07ee37ff5f33e4a17a1e2bccd4e_darkside.exe Token: SeBackupPrivilege 3808 2024-02-21_7e10d07ee37ff5f33e4a17a1e2bccd4e_darkside.exe Token: SeBackupPrivilege 3808 2024-02-21_7e10d07ee37ff5f33e4a17a1e2bccd4e_darkside.exe Token: SeSecurityPrivilege 3808 2024-02-21_7e10d07ee37ff5f33e4a17a1e2bccd4e_darkside.exe Token: SeSecurityPrivilege 3808 2024-02-21_7e10d07ee37ff5f33e4a17a1e2bccd4e_darkside.exe Token: SeBackupPrivilege 3808 2024-02-21_7e10d07ee37ff5f33e4a17a1e2bccd4e_darkside.exe Token: SeBackupPrivilege 3808 2024-02-21_7e10d07ee37ff5f33e4a17a1e2bccd4e_darkside.exe Token: SeSecurityPrivilege 3808 2024-02-21_7e10d07ee37ff5f33e4a17a1e2bccd4e_darkside.exe Token: SeSecurityPrivilege 3808 2024-02-21_7e10d07ee37ff5f33e4a17a1e2bccd4e_darkside.exe Token: SeBackupPrivilege 3808 2024-02-21_7e10d07ee37ff5f33e4a17a1e2bccd4e_darkside.exe Token: SeBackupPrivilege 3808 2024-02-21_7e10d07ee37ff5f33e4a17a1e2bccd4e_darkside.exe Token: SeSecurityPrivilege 3808 2024-02-21_7e10d07ee37ff5f33e4a17a1e2bccd4e_darkside.exe Token: SeSecurityPrivilege 3808 2024-02-21_7e10d07ee37ff5f33e4a17a1e2bccd4e_darkside.exe Token: SeBackupPrivilege 3808 2024-02-21_7e10d07ee37ff5f33e4a17a1e2bccd4e_darkside.exe Token: SeBackupPrivilege 3808 2024-02-21_7e10d07ee37ff5f33e4a17a1e2bccd4e_darkside.exe Token: SeSecurityPrivilege 3808 2024-02-21_7e10d07ee37ff5f33e4a17a1e2bccd4e_darkside.exe Token: SeSecurityPrivilege 3808 2024-02-21_7e10d07ee37ff5f33e4a17a1e2bccd4e_darkside.exe Token: SeBackupPrivilege 3808 2024-02-21_7e10d07ee37ff5f33e4a17a1e2bccd4e_darkside.exe Token: SeBackupPrivilege 3808 2024-02-21_7e10d07ee37ff5f33e4a17a1e2bccd4e_darkside.exe Token: SeSecurityPrivilege 3808 2024-02-21_7e10d07ee37ff5f33e4a17a1e2bccd4e_darkside.exe Token: SeSecurityPrivilege 3808 2024-02-21_7e10d07ee37ff5f33e4a17a1e2bccd4e_darkside.exe Token: SeBackupPrivilege 3808 2024-02-21_7e10d07ee37ff5f33e4a17a1e2bccd4e_darkside.exe Token: SeBackupPrivilege 3808 2024-02-21_7e10d07ee37ff5f33e4a17a1e2bccd4e_darkside.exe Token: SeSecurityPrivilege 3808 2024-02-21_7e10d07ee37ff5f33e4a17a1e2bccd4e_darkside.exe Token: SeSecurityPrivilege 3808 2024-02-21_7e10d07ee37ff5f33e4a17a1e2bccd4e_darkside.exe Token: SeBackupPrivilege 3808 2024-02-21_7e10d07ee37ff5f33e4a17a1e2bccd4e_darkside.exe Token: SeBackupPrivilege 3808 2024-02-21_7e10d07ee37ff5f33e4a17a1e2bccd4e_darkside.exe Token: SeSecurityPrivilege 3808 2024-02-21_7e10d07ee37ff5f33e4a17a1e2bccd4e_darkside.exe Token: SeSecurityPrivilege 3808 2024-02-21_7e10d07ee37ff5f33e4a17a1e2bccd4e_darkside.exe Token: SeBackupPrivilege 3808 2024-02-21_7e10d07ee37ff5f33e4a17a1e2bccd4e_darkside.exe Token: SeBackupPrivilege 3808 2024-02-21_7e10d07ee37ff5f33e4a17a1e2bccd4e_darkside.exe Token: SeSecurityPrivilege 3808 2024-02-21_7e10d07ee37ff5f33e4a17a1e2bccd4e_darkside.exe Token: SeSecurityPrivilege 3808 2024-02-21_7e10d07ee37ff5f33e4a17a1e2bccd4e_darkside.exe -
Suspicious use of SetWindowsHookEx 13 IoCs
Processes:
ONENOTE.EXEpid Process 4700 ONENOTE.EXE 4700 ONENOTE.EXE 4700 ONENOTE.EXE 4700 ONENOTE.EXE 4700 ONENOTE.EXE 4700 ONENOTE.EXE 4700 ONENOTE.EXE 4700 ONENOTE.EXE 4700 ONENOTE.EXE 4700 ONENOTE.EXE 4700 ONENOTE.EXE 4700 ONENOTE.EXE 4700 ONENOTE.EXE -
Suspicious use of WriteProcessMemory 11 IoCs
Processes:
2024-02-21_7e10d07ee37ff5f33e4a17a1e2bccd4e_darkside.exeprintfilterpipelinesvc.exeCCE1.tmpdescription pid Process procid_target PID 3808 wrote to memory of 1192 3808 2024-02-21_7e10d07ee37ff5f33e4a17a1e2bccd4e_darkside.exe 93 PID 3808 wrote to memory of 1192 3808 2024-02-21_7e10d07ee37ff5f33e4a17a1e2bccd4e_darkside.exe 93 PID 4872 wrote to memory of 4700 4872 printfilterpipelinesvc.exe 96 PID 4872 wrote to memory of 4700 4872 printfilterpipelinesvc.exe 96 PID 3808 wrote to memory of 4020 3808 2024-02-21_7e10d07ee37ff5f33e4a17a1e2bccd4e_darkside.exe 97 PID 3808 wrote to memory of 4020 3808 2024-02-21_7e10d07ee37ff5f33e4a17a1e2bccd4e_darkside.exe 97 PID 3808 wrote to memory of 4020 3808 2024-02-21_7e10d07ee37ff5f33e4a17a1e2bccd4e_darkside.exe 97 PID 3808 wrote to memory of 4020 3808 2024-02-21_7e10d07ee37ff5f33e4a17a1e2bccd4e_darkside.exe 97 PID 4020 wrote to memory of 4440 4020 CCE1.tmp 98 PID 4020 wrote to memory of 4440 4020 CCE1.tmp 98 PID 4020 wrote to memory of 4440 4020 CCE1.tmp 98
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-02-21_7e10d07ee37ff5f33e4a17a1e2bccd4e_darkside.exe"C:\Users\Admin\AppData\Local\Temp\2024-02-21_7e10d07ee37ff5f33e4a17a1e2bccd4e_darkside.exe"1⤵
- Drops desktop.ini file(s)
- Sets desktop wallpaper using registry
- Modifies Control Panel
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3808 -
C:\Windows\splwow64.exeC:\Windows\splwow64.exe 122882⤵
- Drops file in System32 directory
PID:1192
-
-
C:\ProgramData\CCE1.tmp"C:\ProgramData\CCE1.tmp"2⤵
- Checks computer location settings
- Deletes itself
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:4020 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C DEL /F /Q C:\PROGRA~3\CCE1.tmp >> NUL3⤵PID:4440
-
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k PrintWorkflow -s PrintWorkflowUserSvc1⤵PID:3632
-
C:\Windows\system32\printfilterpipelinesvc.exeC:\Windows\system32\printfilterpipelinesvc.exe -Embedding1⤵
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:4872 -
C:\Program Files\Microsoft Office\root\Office16\ONENOTE.EXE/insertdoc "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\{0C0C4792-3C48-45E2-8CEF-8F010C61A861}.xps" 1335295132370200002⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious use of SetWindowsHookEx
PID:4700
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
129B
MD5d642a2a44c472dcf9bea0622f5389a17
SHA1f14e85b53021848612bec5130e9150785dd2ac8b
SHA256f655effe87db7f710e2fedcfc78dbc7e29b4fb1fc71dbd69bdc3617d8721315b
SHA51263b29924ffac6bd75b73a6e55ffc67c2d02fe09162b3cb7726280a23d098031e5d7bf41856875e4f089ad2bb6f1be103789e2a2adeff22b6b609c5fc94f50730
-
Filesize
14KB
MD5294e9f64cb1642dd89229fff0592856b
SHA197b148c27f3da29ba7b18d6aee8a0db9102f47c9
SHA256917e115cc403e29b4388e0d175cbfac3e7e40ca1742299fbdb353847db2de7c2
SHA512b87d531890bf1577b9b4af41dddb2cdbbfa164cf197bd5987df3a3075983645a3acba443e289b7bfd338422978a104f55298fbfe346872de0895bde44adc89cf
-
Filesize
153KB
MD56c9ff82d1a8612a11cc02d9175e384d6
SHA1e278c4fbbceca755b8483101029365b31d065f22
SHA256e8a93473b33b912fb77c865b2adf8238c7ac9a43a5ce84fc64e6bf5998c5ada8
SHA512e79f94fdf1dcdcf2535f0572f78bb01cc27d20c6d7409bab505542334cd4f36fc551b6770e968194270bbe01ea9a3ec8b8553d38429a75a47c4bd2b80fbd190d
-
Filesize
4KB
MD58fa7efaf16aa768caaf36eb91f5aa064
SHA15fcff7ab974e59983cccb786bea5971698b243f5
SHA25657681ab8d1cb388efe7f00c8b08bc36ed954128e139773b79c855f26816dab93
SHA5126ef36e7134074ed609323e610d32e83e4b807581a98f5b8288f960fd6aab8c2e146a199964d4dc0f5e4379db0d7b1ff69a45f9f8f0875ebd8bf5decc66745411
-
Filesize
4KB
MD52eafcebfe98e897baf9be39dcb3d15b9
SHA19b15889a475bc4ddf4a1f3238de46e3601e66dec
SHA25648ab2e283a9e7ef18dfe46674b2ca90f0524d1eed2dd40d6c2127c9cd629d118
SHA5121681a097661c0329803539b420abde76a5e8a2e0b3e9e1ab72db57ad027bbebf16f5e974264aeac93387e49af5afd34a2830b0f159fcb5bf73111ec6203e7787
-
Filesize
6KB
MD5dd746ace17e44ace00885b91400f11d5
SHA14a0302d2dca400598f396e4230fdae71779cbeaa
SHA256b27c3c8a30faf7c76483b7e5d964ae85046a9713caa46508ee7a1e31b7dc6272
SHA5128ac26aa7262fdf1afdc74e604720a79ebde076c75f460d7d5f57ff4d81dedb1ad471eb114ddd428c1934029746f5c222339090680bc77a6ea09ce329e1da3ef1
-
Filesize
129B
MD53eaaad500c168b3e7443222b742b20ee
SHA10ba8c468ce101d4494a42f9bc59c3ff5d6d8c5b9
SHA256f8d3643595c3263b4ad78d332ca24e10d662d8140d78a6217c12a2ff41134a53
SHA51212c6171ac8150a0cb0067833ac3818b325c8065e81be52e37365814319ee6599eb856502fd3c7d2328eda06f154f47db29f19cb704d9d21a5e06aecd43f64ddf