Malware Analysis Report

2024-11-30 11:35

Sample ID 240221-bg4yxagh61
Target 2024-02-21_7e10d07ee37ff5f33e4a17a1e2bccd4e_darkside
SHA256 655f0d2974bf6da082463a2e1c5cf9ae87dcc873058e5e33cb47ca9490e158c2
Tags
lockbit ransomware spyware stealer
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

655f0d2974bf6da082463a2e1c5cf9ae87dcc873058e5e33cb47ca9490e158c2

Threat Level: Known bad

The file 2024-02-21_7e10d07ee37ff5f33e4a17a1e2bccd4e_darkside was found to be: Known bad.

Malicious Activity Summary

lockbit ransomware spyware stealer

Lockbit

Lockbit family

Rule to detect Lockbit 3.0 ransomware Windows payload

Renames multiple (348) files with added filename extension

Renames multiple (600) files with added filename extension

Reads user/profile data of web browsers

Checks computer location settings

Deletes itself

Executes dropped EXE

Loads dropped DLL

Drops desktop.ini file(s)

Sets desktop wallpaper using registry

Drops file in System32 directory

Suspicious use of NtSetInformationThreadHideFromDebugger

Enumerates physical storage devices

Unsigned PE

Suspicious behavior: EnumeratesProcesses

Modifies registry class

Suspicious behavior: RenamesItself

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

Suspicious use of SetWindowsHookEx

Enumerates system info in registry

Checks processor information in registry

Modifies Control Panel

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-02-21 01:07

Signatures

Lockbit family

lockbit

Rule to detect Lockbit 3.0 ransomware Windows payload

Description Indicator Process Target
N/A N/A N/A N/A

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-02-21 01:07

Reported

2024-02-21 01:10

Platform

win7-20231215-en

Max time kernel

118s

Max time network

122s

Command Line

"C:\Users\Admin\AppData\Local\Temp\2024-02-21_7e10d07ee37ff5f33e4a17a1e2bccd4e_darkside.exe"

Signatures

Lockbit

ransomware lockbit

Renames multiple (348) files with added filename extension

ransomware

Deletes itself

Description Indicator Process Target
N/A N/A C:\ProgramData\9195.tmp N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\ProgramData\9195.tmp N/A

Loads dropped DLL

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-02-21_7e10d07ee37ff5f33e4a17a1e2bccd4e_darkside.exe N/A

Reads user/profile data of web browsers

spyware stealer

Drops desktop.ini file(s)

Description Indicator Process Target
File opened for modification C:\$Recycle.Bin\S-1-5-21-3427588347-1492276948-3422228430-1000\desktop.ini C:\Users\Admin\AppData\Local\Temp\2024-02-21_7e10d07ee37ff5f33e4a17a1e2bccd4e_darkside.exe N/A
File opened for modification F:\$RECYCLE.BIN\S-1-5-21-3427588347-1492276948-3422228430-1000\desktop.ini C:\Users\Admin\AppData\Local\Temp\2024-02-21_7e10d07ee37ff5f33e4a17a1e2bccd4e_darkside.exe N/A

Sets desktop wallpaper using registry

ransomware
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Control Panel\Desktop\WallPaper = "C:\\ProgramData\\Wuxt90cxD.bmp" C:\Users\Admin\AppData\Local\Temp\2024-02-21_7e10d07ee37ff5f33e4a17a1e2bccd4e_darkside.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Control Panel\Desktop\Wallpaper = "C:\\ProgramData\\Wuxt90cxD.bmp" C:\Users\Admin\AppData\Local\Temp\2024-02-21_7e10d07ee37ff5f33e4a17a1e2bccd4e_darkside.exe N/A

Suspicious use of NtSetInformationThreadHideFromDebugger

Description Indicator Process Target
N/A N/A C:\ProgramData\9195.tmp N/A

Enumerates physical storage devices

Modifies Control Panel

evasion
Description Indicator Process Target
Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Control Panel\Desktop C:\Users\Admin\AppData\Local\Temp\2024-02-21_7e10d07ee37ff5f33e4a17a1e2bccd4e_darkside.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Control Panel\Desktop\WallpaperStyle = "10" C:\Users\Admin\AppData\Local\Temp\2024-02-21_7e10d07ee37ff5f33e4a17a1e2bccd4e_darkside.exe N/A

Modifies registry class

Description Indicator Process Target
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wuxt90cxD C:\Users\Admin\AppData\Local\Temp\2024-02-21_7e10d07ee37ff5f33e4a17a1e2bccd4e_darkside.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wuxt90cxD\DefaultIcon\ = "C:\\ProgramData\\Wuxt90cxD.ico" C:\Users\Admin\AppData\Local\Temp\2024-02-21_7e10d07ee37ff5f33e4a17a1e2bccd4e_darkside.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.Wuxt90cxD C:\Users\Admin\AppData\Local\Temp\2024-02-21_7e10d07ee37ff5f33e4a17a1e2bccd4e_darkside.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.Wuxt90cxD\ = "Wuxt90cxD" C:\Users\Admin\AppData\Local\Temp\2024-02-21_7e10d07ee37ff5f33e4a17a1e2bccd4e_darkside.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wuxt90cxD\DefaultIcon C:\Users\Admin\AppData\Local\Temp\2024-02-21_7e10d07ee37ff5f33e4a17a1e2bccd4e_darkside.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-02-21_7e10d07ee37ff5f33e4a17a1e2bccd4e_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-02-21_7e10d07ee37ff5f33e4a17a1e2bccd4e_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-02-21_7e10d07ee37ff5f33e4a17a1e2bccd4e_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-02-21_7e10d07ee37ff5f33e4a17a1e2bccd4e_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-02-21_7e10d07ee37ff5f33e4a17a1e2bccd4e_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-02-21_7e10d07ee37ff5f33e4a17a1e2bccd4e_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-02-21_7e10d07ee37ff5f33e4a17a1e2bccd4e_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-02-21_7e10d07ee37ff5f33e4a17a1e2bccd4e_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-02-21_7e10d07ee37ff5f33e4a17a1e2bccd4e_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-02-21_7e10d07ee37ff5f33e4a17a1e2bccd4e_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-02-21_7e10d07ee37ff5f33e4a17a1e2bccd4e_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-02-21_7e10d07ee37ff5f33e4a17a1e2bccd4e_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-02-21_7e10d07ee37ff5f33e4a17a1e2bccd4e_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-02-21_7e10d07ee37ff5f33e4a17a1e2bccd4e_darkside.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeAssignPrimaryTokenPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-21_7e10d07ee37ff5f33e4a17a1e2bccd4e_darkside.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-21_7e10d07ee37ff5f33e4a17a1e2bccd4e_darkside.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-21_7e10d07ee37ff5f33e4a17a1e2bccd4e_darkside.exe N/A
Token: 36 N/A C:\Users\Admin\AppData\Local\Temp\2024-02-21_7e10d07ee37ff5f33e4a17a1e2bccd4e_darkside.exe N/A
Token: SeImpersonatePrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-21_7e10d07ee37ff5f33e4a17a1e2bccd4e_darkside.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-21_7e10d07ee37ff5f33e4a17a1e2bccd4e_darkside.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-21_7e10d07ee37ff5f33e4a17a1e2bccd4e_darkside.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Local\Temp\2024-02-21_7e10d07ee37ff5f33e4a17a1e2bccd4e_darkside.exe N/A
Token: SeManageVolumePrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-21_7e10d07ee37ff5f33e4a17a1e2bccd4e_darkside.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-21_7e10d07ee37ff5f33e4a17a1e2bccd4e_darkside.exe N/A
Token: SeRestorePrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-21_7e10d07ee37ff5f33e4a17a1e2bccd4e_darkside.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-21_7e10d07ee37ff5f33e4a17a1e2bccd4e_darkside.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-21_7e10d07ee37ff5f33e4a17a1e2bccd4e_darkside.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-21_7e10d07ee37ff5f33e4a17a1e2bccd4e_darkside.exe N/A
Token: SeShutdownPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-21_7e10d07ee37ff5f33e4a17a1e2bccd4e_darkside.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-21_7e10d07ee37ff5f33e4a17a1e2bccd4e_darkside.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-21_7e10d07ee37ff5f33e4a17a1e2bccd4e_darkside.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-21_7e10d07ee37ff5f33e4a17a1e2bccd4e_darkside.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-21_7e10d07ee37ff5f33e4a17a1e2bccd4e_darkside.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-21_7e10d07ee37ff5f33e4a17a1e2bccd4e_darkside.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-21_7e10d07ee37ff5f33e4a17a1e2bccd4e_darkside.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-21_7e10d07ee37ff5f33e4a17a1e2bccd4e_darkside.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-21_7e10d07ee37ff5f33e4a17a1e2bccd4e_darkside.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-21_7e10d07ee37ff5f33e4a17a1e2bccd4e_darkside.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-21_7e10d07ee37ff5f33e4a17a1e2bccd4e_darkside.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-21_7e10d07ee37ff5f33e4a17a1e2bccd4e_darkside.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-21_7e10d07ee37ff5f33e4a17a1e2bccd4e_darkside.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-21_7e10d07ee37ff5f33e4a17a1e2bccd4e_darkside.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-21_7e10d07ee37ff5f33e4a17a1e2bccd4e_darkside.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-21_7e10d07ee37ff5f33e4a17a1e2bccd4e_darkside.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-21_7e10d07ee37ff5f33e4a17a1e2bccd4e_darkside.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-21_7e10d07ee37ff5f33e4a17a1e2bccd4e_darkside.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-21_7e10d07ee37ff5f33e4a17a1e2bccd4e_darkside.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-21_7e10d07ee37ff5f33e4a17a1e2bccd4e_darkside.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-21_7e10d07ee37ff5f33e4a17a1e2bccd4e_darkside.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-21_7e10d07ee37ff5f33e4a17a1e2bccd4e_darkside.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-21_7e10d07ee37ff5f33e4a17a1e2bccd4e_darkside.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-21_7e10d07ee37ff5f33e4a17a1e2bccd4e_darkside.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-21_7e10d07ee37ff5f33e4a17a1e2bccd4e_darkside.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-21_7e10d07ee37ff5f33e4a17a1e2bccd4e_darkside.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-21_7e10d07ee37ff5f33e4a17a1e2bccd4e_darkside.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-21_7e10d07ee37ff5f33e4a17a1e2bccd4e_darkside.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-21_7e10d07ee37ff5f33e4a17a1e2bccd4e_darkside.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-21_7e10d07ee37ff5f33e4a17a1e2bccd4e_darkside.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-21_7e10d07ee37ff5f33e4a17a1e2bccd4e_darkside.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-21_7e10d07ee37ff5f33e4a17a1e2bccd4e_darkside.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-21_7e10d07ee37ff5f33e4a17a1e2bccd4e_darkside.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-21_7e10d07ee37ff5f33e4a17a1e2bccd4e_darkside.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-21_7e10d07ee37ff5f33e4a17a1e2bccd4e_darkside.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-21_7e10d07ee37ff5f33e4a17a1e2bccd4e_darkside.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-21_7e10d07ee37ff5f33e4a17a1e2bccd4e_darkside.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-21_7e10d07ee37ff5f33e4a17a1e2bccd4e_darkside.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-21_7e10d07ee37ff5f33e4a17a1e2bccd4e_darkside.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-21_7e10d07ee37ff5f33e4a17a1e2bccd4e_darkside.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-21_7e10d07ee37ff5f33e4a17a1e2bccd4e_darkside.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-21_7e10d07ee37ff5f33e4a17a1e2bccd4e_darkside.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-21_7e10d07ee37ff5f33e4a17a1e2bccd4e_darkside.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-21_7e10d07ee37ff5f33e4a17a1e2bccd4e_darkside.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-21_7e10d07ee37ff5f33e4a17a1e2bccd4e_darkside.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-21_7e10d07ee37ff5f33e4a17a1e2bccd4e_darkside.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-21_7e10d07ee37ff5f33e4a17a1e2bccd4e_darkside.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-21_7e10d07ee37ff5f33e4a17a1e2bccd4e_darkside.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-21_7e10d07ee37ff5f33e4a17a1e2bccd4e_darkside.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-21_7e10d07ee37ff5f33e4a17a1e2bccd4e_darkside.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\2024-02-21_7e10d07ee37ff5f33e4a17a1e2bccd4e_darkside.exe

"C:\Users\Admin\AppData\Local\Temp\2024-02-21_7e10d07ee37ff5f33e4a17a1e2bccd4e_darkside.exe"

C:\ProgramData\9195.tmp

"C:\ProgramData\9195.tmp"

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /C DEL /F /Q C:\PROGRA~3\9195.tmp >> NUL

C:\Windows\system32\AUDIODG.EXE

C:\Windows\system32\AUDIODG.EXE 0x154

Network

N/A

Files

C:\Wuxt90cxD.README.txt

MD5 dd746ace17e44ace00885b91400f11d5
SHA1 4a0302d2dca400598f396e4230fdae71779cbeaa
SHA256 b27c3c8a30faf7c76483b7e5d964ae85046a9713caa46508ee7a1e31b7dc6272
SHA512 8ac26aa7262fdf1afdc74e604720a79ebde076c75f460d7d5f57ff4d81dedb1ad471eb114ddd428c1934029746f5c222339090680bc77a6ea09ce329e1da3ef1

F:\$RECYCLE.BIN\S-1-5-21-3427588347-1492276948-3422228430-1000\CCCCCCCCCCC

MD5 039bda5f7f882df350aab2922b3ee3a2
SHA1 72feac11363a3be8f4faef43ffff86c33f0bae71
SHA256 85d69197772a2cb5f5c62494bc766436c96d9baade21ec24d70abb5c7d745af3
SHA512 8c4bf6c685588884375e55bda9699ef874e47855b95a554c352f7e404d8d03b45f3aac194c53fdde5cfb90707c9d1adbbd5e5bf1e7b6fba52cbba240beac0a0c

C:\$Recycle.Bin\S-1-5-21-3427588347-1492276948-3422228430-1000\BBBBBBBBBBB

MD5 f800985f54f78a48fc23dce32dde5d96
SHA1 f779f76a65d7a5bca2e24e3993a8f313f61eb375
SHA256 9143b0e644b211d40cc754718f585c3caa885735683683306eff78c9e3005909
SHA512 b88638914d146b7d0a2741301f082814af0fa408c28a13071e5a77ee955ef3c2e331d320d8ea9fed586f3c113bb09556b9711501b6fb5c3b0506637748fab61e

memory/1156-0-0x0000000000E00000-0x0000000000E40000-memory.dmp

\ProgramData\9195.tmp

MD5 294e9f64cb1642dd89229fff0592856b
SHA1 97b148c27f3da29ba7b18d6aee8a0db9102f47c9
SHA256 917e115cc403e29b4388e0d175cbfac3e7e40ca1742299fbdb353847db2de7c2
SHA512 b87d531890bf1577b9b4af41dddb2cdbbfa164cf197bd5987df3a3075983645a3acba443e289b7bfd338422978a104f55298fbfe346872de0895bde44adc89cf

memory/1120-866-0x0000000000400000-0x0000000000407000-memory.dmp

memory/1120-867-0x000000007EFA0000-0x000000007EFA1000-memory.dmp

memory/1120-868-0x00000000021E0000-0x0000000002220000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\DDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDD

MD5 8c6e4a81892298b0aefc7173015104be
SHA1 f9ae04bb4e738ef1a19a2773219a0f0cb65365d3
SHA256 c9e0fd614942df90b8c00bcf6e1323e6243fa1998428ef4ede75c72a8d44d15b
SHA512 5d9eddb0b768d6a6897da76f1be426cf977bc1324eb32f6e450492852a9af6a5ac39cbe340760bc467eb13138bda8216a9fd8029b59c6e8cc58be0def9a834e5

memory/1120-876-0x000000007EF20000-0x000000007EF21000-memory.dmp

memory/1120-874-0x000000007EF80000-0x000000007EF81000-memory.dmp

memory/1120-872-0x00000000021E0000-0x0000000002220000-memory.dmp

memory/1120-901-0x000000007EF60000-0x000000007EF61000-memory.dmp

memory/1120-900-0x000000007EF40000-0x000000007EF41000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2024-02-21 01:07

Reported

2024-02-21 01:10

Platform

win10v2004-20231215-en

Max time kernel

139s

Max time network

145s

Command Line

"C:\Users\Admin\AppData\Local\Temp\2024-02-21_7e10d07ee37ff5f33e4a17a1e2bccd4e_darkside.exe"

Signatures

Lockbit

ransomware lockbit

Renames multiple (600) files with added filename extension

ransomware

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\Control Panel\International\Geo\Nation C:\ProgramData\CCE1.tmp N/A

Deletes itself

Description Indicator Process Target
N/A N/A C:\ProgramData\CCE1.tmp N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\ProgramData\CCE1.tmp N/A

Reads user/profile data of web browsers

spyware stealer

Drops desktop.ini file(s)

Description Indicator Process Target
File opened for modification F:\$RECYCLE.BIN\S-1-5-21-3073191680-435865314-2862784915-1000\desktop.ini C:\Users\Admin\AppData\Local\Temp\2024-02-21_7e10d07ee37ff5f33e4a17a1e2bccd4e_darkside.exe N/A
File opened for modification C:\$Recycle.Bin\S-1-5-21-3073191680-435865314-2862784915-1000\desktop.ini C:\Users\Admin\AppData\Local\Temp\2024-02-21_7e10d07ee37ff5f33e4a17a1e2bccd4e_darkside.exe N/A

Drops file in System32 directory

Description Indicator Process Target
File created C:\Windows\system32\spool\PRINTERS\00002.SPL C:\Windows\splwow64.exe N/A
File created C:\Windows\system32\spool\PRINTERS\PPk7ifdq_0gtljh8tblt0pnw6db.TMP C:\Windows\system32\printfilterpipelinesvc.exe N/A
File created C:\Windows\system32\spool\PRINTERS\PPrbcmgc6zz46oxbo1kmrt8ctxb.TMP C:\Windows\system32\printfilterpipelinesvc.exe N/A
File created C:\Windows\system32\spool\PRINTERS\PPoda9jh7dv360v21xk_j18jxo.TMP C:\Windows\system32\printfilterpipelinesvc.exe N/A

Sets desktop wallpaper using registry

ransomware
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\Control Panel\Desktop\WallPaper = "C:\\ProgramData\\Wuxt90cxD.bmp" C:\Users\Admin\AppData\Local\Temp\2024-02-21_7e10d07ee37ff5f33e4a17a1e2bccd4e_darkside.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\Control Panel\Desktop\Wallpaper = "C:\\ProgramData\\Wuxt90cxD.bmp" C:\Users\Admin\AppData\Local\Temp\2024-02-21_7e10d07ee37ff5f33e4a17a1e2bccd4e_darkside.exe N/A

Suspicious use of NtSetInformationThreadHideFromDebugger

Description Indicator Process Target
N/A N/A C:\ProgramData\CCE1.tmp N/A

Enumerates physical storage devices

Checks processor information in registry

Description Indicator Process Target
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString C:\Program Files\Microsoft Office\root\Office16\ONENOTE.EXE N/A
Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 C:\Program Files\Microsoft Office\root\Office16\ONENOTE.EXE N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz C:\Program Files\Microsoft Office\root\Office16\ONENOTE.EXE N/A

Enumerates system info in registry

Description Indicator Process Target
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU C:\Program Files\Microsoft Office\root\Office16\ONENOTE.EXE N/A
Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS C:\Program Files\Microsoft Office\root\Office16\ONENOTE.EXE N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily C:\Program Files\Microsoft Office\root\Office16\ONENOTE.EXE N/A

Modifies Control Panel

evasion
Description Indicator Process Target
Key created \REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\Control Panel\Desktop C:\Users\Admin\AppData\Local\Temp\2024-02-21_7e10d07ee37ff5f33e4a17a1e2bccd4e_darkside.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\Control Panel\Desktop\WallpaperStyle = "10" C:\Users\Admin\AppData\Local\Temp\2024-02-21_7e10d07ee37ff5f33e4a17a1e2bccd4e_darkside.exe N/A

Modifies registry class

Description Indicator Process Target
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.Wuxt90cxD C:\Users\Admin\AppData\Local\Temp\2024-02-21_7e10d07ee37ff5f33e4a17a1e2bccd4e_darkside.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.Wuxt90cxD\ = "Wuxt90cxD" C:\Users\Admin\AppData\Local\Temp\2024-02-21_7e10d07ee37ff5f33e4a17a1e2bccd4e_darkside.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wuxt90cxD\DefaultIcon C:\Users\Admin\AppData\Local\Temp\2024-02-21_7e10d07ee37ff5f33e4a17a1e2bccd4e_darkside.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wuxt90cxD C:\Users\Admin\AppData\Local\Temp\2024-02-21_7e10d07ee37ff5f33e4a17a1e2bccd4e_darkside.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wuxt90cxD\DefaultIcon\ = "C:\\ProgramData\\Wuxt90cxD.ico" C:\Users\Admin\AppData\Local\Temp\2024-02-21_7e10d07ee37ff5f33e4a17a1e2bccd4e_darkside.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-02-21_7e10d07ee37ff5f33e4a17a1e2bccd4e_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-02-21_7e10d07ee37ff5f33e4a17a1e2bccd4e_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-02-21_7e10d07ee37ff5f33e4a17a1e2bccd4e_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-02-21_7e10d07ee37ff5f33e4a17a1e2bccd4e_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-02-21_7e10d07ee37ff5f33e4a17a1e2bccd4e_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-02-21_7e10d07ee37ff5f33e4a17a1e2bccd4e_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-02-21_7e10d07ee37ff5f33e4a17a1e2bccd4e_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-02-21_7e10d07ee37ff5f33e4a17a1e2bccd4e_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-02-21_7e10d07ee37ff5f33e4a17a1e2bccd4e_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-02-21_7e10d07ee37ff5f33e4a17a1e2bccd4e_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-02-21_7e10d07ee37ff5f33e4a17a1e2bccd4e_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-02-21_7e10d07ee37ff5f33e4a17a1e2bccd4e_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-02-21_7e10d07ee37ff5f33e4a17a1e2bccd4e_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-02-21_7e10d07ee37ff5f33e4a17a1e2bccd4e_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-02-21_7e10d07ee37ff5f33e4a17a1e2bccd4e_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-02-21_7e10d07ee37ff5f33e4a17a1e2bccd4e_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-02-21_7e10d07ee37ff5f33e4a17a1e2bccd4e_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-02-21_7e10d07ee37ff5f33e4a17a1e2bccd4e_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-02-21_7e10d07ee37ff5f33e4a17a1e2bccd4e_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-02-21_7e10d07ee37ff5f33e4a17a1e2bccd4e_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-02-21_7e10d07ee37ff5f33e4a17a1e2bccd4e_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-02-21_7e10d07ee37ff5f33e4a17a1e2bccd4e_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-02-21_7e10d07ee37ff5f33e4a17a1e2bccd4e_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-02-21_7e10d07ee37ff5f33e4a17a1e2bccd4e_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-02-21_7e10d07ee37ff5f33e4a17a1e2bccd4e_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-02-21_7e10d07ee37ff5f33e4a17a1e2bccd4e_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-02-21_7e10d07ee37ff5f33e4a17a1e2bccd4e_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-02-21_7e10d07ee37ff5f33e4a17a1e2bccd4e_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-02-21_7e10d07ee37ff5f33e4a17a1e2bccd4e_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-02-21_7e10d07ee37ff5f33e4a17a1e2bccd4e_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-02-21_7e10d07ee37ff5f33e4a17a1e2bccd4e_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-02-21_7e10d07ee37ff5f33e4a17a1e2bccd4e_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-02-21_7e10d07ee37ff5f33e4a17a1e2bccd4e_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-02-21_7e10d07ee37ff5f33e4a17a1e2bccd4e_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-02-21_7e10d07ee37ff5f33e4a17a1e2bccd4e_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-02-21_7e10d07ee37ff5f33e4a17a1e2bccd4e_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-02-21_7e10d07ee37ff5f33e4a17a1e2bccd4e_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-02-21_7e10d07ee37ff5f33e4a17a1e2bccd4e_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-02-21_7e10d07ee37ff5f33e4a17a1e2bccd4e_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-02-21_7e10d07ee37ff5f33e4a17a1e2bccd4e_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-02-21_7e10d07ee37ff5f33e4a17a1e2bccd4e_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-02-21_7e10d07ee37ff5f33e4a17a1e2bccd4e_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-02-21_7e10d07ee37ff5f33e4a17a1e2bccd4e_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-02-21_7e10d07ee37ff5f33e4a17a1e2bccd4e_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-02-21_7e10d07ee37ff5f33e4a17a1e2bccd4e_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-02-21_7e10d07ee37ff5f33e4a17a1e2bccd4e_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-02-21_7e10d07ee37ff5f33e4a17a1e2bccd4e_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-02-21_7e10d07ee37ff5f33e4a17a1e2bccd4e_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-02-21_7e10d07ee37ff5f33e4a17a1e2bccd4e_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-02-21_7e10d07ee37ff5f33e4a17a1e2bccd4e_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-02-21_7e10d07ee37ff5f33e4a17a1e2bccd4e_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-02-21_7e10d07ee37ff5f33e4a17a1e2bccd4e_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-02-21_7e10d07ee37ff5f33e4a17a1e2bccd4e_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-02-21_7e10d07ee37ff5f33e4a17a1e2bccd4e_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-02-21_7e10d07ee37ff5f33e4a17a1e2bccd4e_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-02-21_7e10d07ee37ff5f33e4a17a1e2bccd4e_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-02-21_7e10d07ee37ff5f33e4a17a1e2bccd4e_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-02-21_7e10d07ee37ff5f33e4a17a1e2bccd4e_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-02-21_7e10d07ee37ff5f33e4a17a1e2bccd4e_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-02-21_7e10d07ee37ff5f33e4a17a1e2bccd4e_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-02-21_7e10d07ee37ff5f33e4a17a1e2bccd4e_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-02-21_7e10d07ee37ff5f33e4a17a1e2bccd4e_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-02-21_7e10d07ee37ff5f33e4a17a1e2bccd4e_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-02-21_7e10d07ee37ff5f33e4a17a1e2bccd4e_darkside.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeAssignPrimaryTokenPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-21_7e10d07ee37ff5f33e4a17a1e2bccd4e_darkside.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-21_7e10d07ee37ff5f33e4a17a1e2bccd4e_darkside.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-21_7e10d07ee37ff5f33e4a17a1e2bccd4e_darkside.exe N/A
Token: 36 N/A C:\Users\Admin\AppData\Local\Temp\2024-02-21_7e10d07ee37ff5f33e4a17a1e2bccd4e_darkside.exe N/A
Token: SeImpersonatePrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-21_7e10d07ee37ff5f33e4a17a1e2bccd4e_darkside.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-21_7e10d07ee37ff5f33e4a17a1e2bccd4e_darkside.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-21_7e10d07ee37ff5f33e4a17a1e2bccd4e_darkside.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Local\Temp\2024-02-21_7e10d07ee37ff5f33e4a17a1e2bccd4e_darkside.exe N/A
Token: SeManageVolumePrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-21_7e10d07ee37ff5f33e4a17a1e2bccd4e_darkside.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-21_7e10d07ee37ff5f33e4a17a1e2bccd4e_darkside.exe N/A
Token: SeRestorePrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-21_7e10d07ee37ff5f33e4a17a1e2bccd4e_darkside.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-21_7e10d07ee37ff5f33e4a17a1e2bccd4e_darkside.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-21_7e10d07ee37ff5f33e4a17a1e2bccd4e_darkside.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-21_7e10d07ee37ff5f33e4a17a1e2bccd4e_darkside.exe N/A
Token: SeShutdownPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-21_7e10d07ee37ff5f33e4a17a1e2bccd4e_darkside.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-21_7e10d07ee37ff5f33e4a17a1e2bccd4e_darkside.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-21_7e10d07ee37ff5f33e4a17a1e2bccd4e_darkside.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-21_7e10d07ee37ff5f33e4a17a1e2bccd4e_darkside.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-21_7e10d07ee37ff5f33e4a17a1e2bccd4e_darkside.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-21_7e10d07ee37ff5f33e4a17a1e2bccd4e_darkside.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-21_7e10d07ee37ff5f33e4a17a1e2bccd4e_darkside.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-21_7e10d07ee37ff5f33e4a17a1e2bccd4e_darkside.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-21_7e10d07ee37ff5f33e4a17a1e2bccd4e_darkside.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-21_7e10d07ee37ff5f33e4a17a1e2bccd4e_darkside.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-21_7e10d07ee37ff5f33e4a17a1e2bccd4e_darkside.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-21_7e10d07ee37ff5f33e4a17a1e2bccd4e_darkside.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-21_7e10d07ee37ff5f33e4a17a1e2bccd4e_darkside.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-21_7e10d07ee37ff5f33e4a17a1e2bccd4e_darkside.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-21_7e10d07ee37ff5f33e4a17a1e2bccd4e_darkside.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-21_7e10d07ee37ff5f33e4a17a1e2bccd4e_darkside.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-21_7e10d07ee37ff5f33e4a17a1e2bccd4e_darkside.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-21_7e10d07ee37ff5f33e4a17a1e2bccd4e_darkside.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-21_7e10d07ee37ff5f33e4a17a1e2bccd4e_darkside.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-21_7e10d07ee37ff5f33e4a17a1e2bccd4e_darkside.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-21_7e10d07ee37ff5f33e4a17a1e2bccd4e_darkside.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-21_7e10d07ee37ff5f33e4a17a1e2bccd4e_darkside.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-21_7e10d07ee37ff5f33e4a17a1e2bccd4e_darkside.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-21_7e10d07ee37ff5f33e4a17a1e2bccd4e_darkside.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-21_7e10d07ee37ff5f33e4a17a1e2bccd4e_darkside.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-21_7e10d07ee37ff5f33e4a17a1e2bccd4e_darkside.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-21_7e10d07ee37ff5f33e4a17a1e2bccd4e_darkside.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-21_7e10d07ee37ff5f33e4a17a1e2bccd4e_darkside.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-21_7e10d07ee37ff5f33e4a17a1e2bccd4e_darkside.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-21_7e10d07ee37ff5f33e4a17a1e2bccd4e_darkside.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-21_7e10d07ee37ff5f33e4a17a1e2bccd4e_darkside.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-21_7e10d07ee37ff5f33e4a17a1e2bccd4e_darkside.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-21_7e10d07ee37ff5f33e4a17a1e2bccd4e_darkside.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-21_7e10d07ee37ff5f33e4a17a1e2bccd4e_darkside.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-21_7e10d07ee37ff5f33e4a17a1e2bccd4e_darkside.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-21_7e10d07ee37ff5f33e4a17a1e2bccd4e_darkside.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-21_7e10d07ee37ff5f33e4a17a1e2bccd4e_darkside.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-21_7e10d07ee37ff5f33e4a17a1e2bccd4e_darkside.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-21_7e10d07ee37ff5f33e4a17a1e2bccd4e_darkside.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-21_7e10d07ee37ff5f33e4a17a1e2bccd4e_darkside.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-21_7e10d07ee37ff5f33e4a17a1e2bccd4e_darkside.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-21_7e10d07ee37ff5f33e4a17a1e2bccd4e_darkside.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-21_7e10d07ee37ff5f33e4a17a1e2bccd4e_darkside.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-21_7e10d07ee37ff5f33e4a17a1e2bccd4e_darkside.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-21_7e10d07ee37ff5f33e4a17a1e2bccd4e_darkside.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-21_7e10d07ee37ff5f33e4a17a1e2bccd4e_darkside.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-21_7e10d07ee37ff5f33e4a17a1e2bccd4e_darkside.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-21_7e10d07ee37ff5f33e4a17a1e2bccd4e_darkside.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-21_7e10d07ee37ff5f33e4a17a1e2bccd4e_darkside.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-21_7e10d07ee37ff5f33e4a17a1e2bccd4e_darkside.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 3808 wrote to memory of 1192 N/A C:\Users\Admin\AppData\Local\Temp\2024-02-21_7e10d07ee37ff5f33e4a17a1e2bccd4e_darkside.exe C:\Windows\splwow64.exe
PID 3808 wrote to memory of 1192 N/A C:\Users\Admin\AppData\Local\Temp\2024-02-21_7e10d07ee37ff5f33e4a17a1e2bccd4e_darkside.exe C:\Windows\splwow64.exe
PID 4872 wrote to memory of 4700 N/A C:\Windows\system32\printfilterpipelinesvc.exe C:\Program Files\Microsoft Office\root\Office16\ONENOTE.EXE
PID 4872 wrote to memory of 4700 N/A C:\Windows\system32\printfilterpipelinesvc.exe C:\Program Files\Microsoft Office\root\Office16\ONENOTE.EXE
PID 3808 wrote to memory of 4020 N/A C:\Users\Admin\AppData\Local\Temp\2024-02-21_7e10d07ee37ff5f33e4a17a1e2bccd4e_darkside.exe C:\ProgramData\CCE1.tmp
PID 3808 wrote to memory of 4020 N/A C:\Users\Admin\AppData\Local\Temp\2024-02-21_7e10d07ee37ff5f33e4a17a1e2bccd4e_darkside.exe C:\ProgramData\CCE1.tmp
PID 3808 wrote to memory of 4020 N/A C:\Users\Admin\AppData\Local\Temp\2024-02-21_7e10d07ee37ff5f33e4a17a1e2bccd4e_darkside.exe C:\ProgramData\CCE1.tmp
PID 3808 wrote to memory of 4020 N/A C:\Users\Admin\AppData\Local\Temp\2024-02-21_7e10d07ee37ff5f33e4a17a1e2bccd4e_darkside.exe C:\ProgramData\CCE1.tmp
PID 4020 wrote to memory of 4440 N/A C:\ProgramData\CCE1.tmp C:\Windows\SysWOW64\cmd.exe
PID 4020 wrote to memory of 4440 N/A C:\ProgramData\CCE1.tmp C:\Windows\SysWOW64\cmd.exe
PID 4020 wrote to memory of 4440 N/A C:\ProgramData\CCE1.tmp C:\Windows\SysWOW64\cmd.exe

Processes

C:\Users\Admin\AppData\Local\Temp\2024-02-21_7e10d07ee37ff5f33e4a17a1e2bccd4e_darkside.exe

"C:\Users\Admin\AppData\Local\Temp\2024-02-21_7e10d07ee37ff5f33e4a17a1e2bccd4e_darkside.exe"

C:\Windows\splwow64.exe

C:\Windows\splwow64.exe 12288

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k PrintWorkflow -s PrintWorkflowUserSvc

C:\Windows\system32\printfilterpipelinesvc.exe

C:\Windows\system32\printfilterpipelinesvc.exe -Embedding

C:\Program Files\Microsoft Office\root\Office16\ONENOTE.EXE

/insertdoc "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\{0C0C4792-3C48-45E2-8CEF-8F010C61A861}.xps" 133529513237020000

C:\ProgramData\CCE1.tmp

"C:\ProgramData\CCE1.tmp"

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /C DEL /F /Q C:\PROGRA~3\CCE1.tmp >> NUL

Network

Country Destination Domain Proto
US 8.8.8.8:53 183.142.211.20.in-addr.arpa udp
US 8.8.8.8:53 194.178.17.96.in-addr.arpa udp
US 8.8.8.8:53 68.32.126.40.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 154.239.44.20.in-addr.arpa udp
US 8.8.8.8:53 26.165.165.52.in-addr.arpa udp
US 8.8.8.8:53 171.39.242.20.in-addr.arpa udp
US 8.8.8.8:53 140.71.91.104.in-addr.arpa udp
US 8.8.8.8:53 196.249.167.52.in-addr.arpa udp
US 8.8.8.8:53 97.32.109.52.in-addr.arpa udp
US 8.8.8.8:53 180.178.17.96.in-addr.arpa udp
US 8.8.8.8:53 136.71.105.51.in-addr.arpa udp
US 8.8.8.8:53 19.229.111.52.in-addr.arpa udp
US 8.8.8.8:53 173.178.17.96.in-addr.arpa udp

Files

memory/3808-0-0x0000000002B60000-0x0000000002B70000-memory.dmp

memory/3808-1-0x0000000002B60000-0x0000000002B70000-memory.dmp

memory/3808-2-0x0000000002B60000-0x0000000002B70000-memory.dmp

C:\$Recycle.Bin\S-1-5-21-3073191680-435865314-2862784915-1000\HHHHHHHHHHH

MD5 d642a2a44c472dcf9bea0622f5389a17
SHA1 f14e85b53021848612bec5130e9150785dd2ac8b
SHA256 f655effe87db7f710e2fedcfc78dbc7e29b4fb1fc71dbd69bdc3617d8721315b
SHA512 63b29924ffac6bd75b73a6e55ffc67c2d02fe09162b3cb7726280a23d098031e5d7bf41856875e4f089ad2bb6f1be103789e2a2adeff22b6b609c5fc94f50730

F:\$RECYCLE.BIN\S-1-5-21-3073191680-435865314-2862784915-1000\DDDDDDDDDDD

MD5 3eaaad500c168b3e7443222b742b20ee
SHA1 0ba8c468ce101d4494a42f9bc59c3ff5d6d8c5b9
SHA256 f8d3643595c3263b4ad78d332ca24e10d662d8140d78a6217c12a2ff41134a53
SHA512 12c6171ac8150a0cb0067833ac3818b325c8065e81be52e37365814319ee6599eb856502fd3c7d2328eda06f154f47db29f19cb704d9d21a5e06aecd43f64ddf

C:\Wuxt90cxD.README.txt

MD5 dd746ace17e44ace00885b91400f11d5
SHA1 4a0302d2dca400598f396e4230fdae71779cbeaa
SHA256 b27c3c8a30faf7c76483b7e5d964ae85046a9713caa46508ee7a1e31b7dc6272
SHA512 8ac26aa7262fdf1afdc74e604720a79ebde076c75f460d7d5f57ff4d81dedb1ad471eb114ddd428c1934029746f5c222339090680bc77a6ea09ce329e1da3ef1

memory/3808-2758-0x0000000002B60000-0x0000000002B70000-memory.dmp

memory/3808-2759-0x0000000002B60000-0x0000000002B70000-memory.dmp

memory/4700-2771-0x00007FF995210000-0x00007FF995220000-memory.dmp

memory/4700-2772-0x00007FF995210000-0x00007FF995220000-memory.dmp

memory/4700-2773-0x00007FF9D5190000-0x00007FF9D5385000-memory.dmp

memory/4700-2775-0x00007FF9D5190000-0x00007FF9D5385000-memory.dmp

memory/4700-2776-0x00007FF995210000-0x00007FF995220000-memory.dmp

memory/4700-2780-0x00007FF9D5190000-0x00007FF9D5385000-memory.dmp

memory/4700-2783-0x00007FF9D5190000-0x00007FF9D5385000-memory.dmp

C:\ProgramData\CCE1.tmp

MD5 294e9f64cb1642dd89229fff0592856b
SHA1 97b148c27f3da29ba7b18d6aee8a0db9102f47c9
SHA256 917e115cc403e29b4388e0d175cbfac3e7e40ca1742299fbdb353847db2de7c2
SHA512 b87d531890bf1577b9b4af41dddb2cdbbfa164cf197bd5987df3a3075983645a3acba443e289b7bfd338422978a104f55298fbfe346872de0895bde44adc89cf

memory/4700-2777-0x00007FF995210000-0x00007FF995220000-memory.dmp

memory/4700-2774-0x00007FF995210000-0x00007FF995220000-memory.dmp

memory/4700-2784-0x00007FF9D5190000-0x00007FF9D5385000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\DDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDD

MD5 6c9ff82d1a8612a11cc02d9175e384d6
SHA1 e278c4fbbceca755b8483101029365b31d065f22
SHA256 e8a93473b33b912fb77c865b2adf8238c7ac9a43a5ce84fc64e6bf5998c5ada8
SHA512 e79f94fdf1dcdcf2535f0572f78bb01cc27d20c6d7409bab505542334cd4f36fc551b6770e968194270bbe01ea9a3ec8b8553d38429a75a47c4bd2b80fbd190d

memory/4700-2807-0x00007FF9D5190000-0x00007FF9D5385000-memory.dmp

memory/4700-2814-0x00007FF9D5190000-0x00007FF9D5385000-memory.dmp

memory/4700-2815-0x00007FF9D5190000-0x00007FF9D5385000-memory.dmp

memory/4020-2817-0x0000000002800000-0x0000000002810000-memory.dmp

memory/4020-2821-0x000000007FE40000-0x000000007FE41000-memory.dmp

memory/4020-2820-0x000000007FDE0000-0x000000007FDE1000-memory.dmp

memory/4020-2822-0x000000007FE00000-0x000000007FE01000-memory.dmp

memory/4020-2819-0x000000007FDC0000-0x000000007FDC1000-memory.dmp

memory/4020-2818-0x000000007FE20000-0x000000007FE21000-memory.dmp

memory/4020-2816-0x0000000002800000-0x0000000002810000-memory.dmp

memory/4700-2823-0x00007FF9928B0000-0x00007FF9928C0000-memory.dmp

memory/4700-2824-0x00007FF9928B0000-0x00007FF9928C0000-memory.dmp

C:\Users\Admin\Documents\OneNote Notebooks\My Notebook\Open Notebook.onetoc2

MD5 8fa7efaf16aa768caaf36eb91f5aa064
SHA1 5fcff7ab974e59983cccb786bea5971698b243f5
SHA256 57681ab8d1cb388efe7f00c8b08bc36ed954128e139773b79c855f26816dab93
SHA512 6ef36e7134074ed609323e610d32e83e4b807581a98f5b8288f960fd6aab8c2e146a199964d4dc0f5e4379db0d7b1ff69a45f9f8f0875ebd8bf5decc66745411

C:\Users\Admin\Documents\OneNote Notebooks\My Notebook\Open Notebook.onetoc2

MD5 2eafcebfe98e897baf9be39dcb3d15b9
SHA1 9b15889a475bc4ddf4a1f3238de46e3601e66dec
SHA256 48ab2e283a9e7ef18dfe46674b2ca90f0524d1eed2dd40d6c2127c9cd629d118
SHA512 1681a097661c0329803539b420abde76a5e8a2e0b3e9e1ab72db57ad027bbebf16f5e974264aeac93387e49af5afd34a2830b0f159fcb5bf73111ec6203e7787

memory/4700-2847-0x00007FF9D5190000-0x00007FF9D5385000-memory.dmp