Malware Analysis Report

2024-11-30 11:29

Sample ID 240228-2ak6bsfc5t
Target 2024-02-28_164cc506d29ad9bbb3ebb8fa884d643a_darkside
SHA256 46308046be5e9c69399a5fb38529891e73616605e8efeb93c2f1848eacd7d3a7
Tags
ransomware spyware stealer lockbit
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

46308046be5e9c69399a5fb38529891e73616605e8efeb93c2f1848eacd7d3a7

Threat Level: Known bad

The file 2024-02-28_164cc506d29ad9bbb3ebb8fa884d643a_darkside was found to be: Known bad.

Malicious Activity Summary

ransomware spyware stealer lockbit

Lockbit family

Rule to detect Lockbit 3.0 ransomware Windows payload

Renames multiple (579) files with added filename extension

Renames multiple (354) files with added filename extension

Executes dropped EXE

Reads user/profile data of web browsers

Loads dropped DLL

Checks computer location settings

Deletes itself

Drops desktop.ini file(s)

Suspicious use of NtSetInformationThreadHideFromDebugger

Drops file in System32 directory

Unsigned PE

Enumerates physical storage devices

Suspicious use of AdjustPrivilegeToken

Suspicious use of SetWindowsHookEx

Suspicious use of WriteProcessMemory

Enumerates system info in registry

Suspicious behavior: EnumeratesProcesses

Suspicious behavior: RenamesItself

Checks processor information in registry

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-02-28 22:22

Signatures

Lockbit family

lockbit

Rule to detect Lockbit 3.0 ransomware Windows payload

Description Indicator Process Target
N/A N/A N/A N/A

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral2

Detonation Overview

Submitted

2024-02-28 22:22

Reported

2024-02-28 22:25

Platform

win10v2004-20240226-en

Max time kernel

146s

Max time network

125s

Command Line

"C:\Users\Admin\AppData\Local\Temp\2024-02-28_164cc506d29ad9bbb3ebb8fa884d643a_darkside.exe"

Signatures

Renames multiple (579) files with added filename extension

ransomware

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-3270530367-132075249-2153716227-1000\Control Panel\International\Geo\Nation C:\ProgramData\6756.tmp N/A

Deletes itself

Description Indicator Process Target
N/A N/A C:\ProgramData\6756.tmp N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\ProgramData\6756.tmp N/A

Reads user/profile data of web browsers

spyware stealer

Drops desktop.ini file(s)

Description Indicator Process Target
File opened for modification F:\$RECYCLE.BIN\S-1-5-21-3270530367-132075249-2153716227-1000\desktop.ini C:\Users\Admin\AppData\Local\Temp\2024-02-28_164cc506d29ad9bbb3ebb8fa884d643a_darkside.exe N/A
File opened for modification C:\$Recycle.Bin\S-1-5-21-3270530367-132075249-2153716227-1000\desktop.ini C:\Users\Admin\AppData\Local\Temp\2024-02-28_164cc506d29ad9bbb3ebb8fa884d643a_darkside.exe N/A

Drops file in System32 directory

Description Indicator Process Target
File created C:\Windows\system32\spool\PRINTERS\PPdaf_q17e6ip1av44d0ua0mq0c.TMP C:\Windows\system32\printfilterpipelinesvc.exe N/A
File created C:\Windows\system32\spool\PRINTERS\PP0eycpwhgplq0zuq_zyix60dwb.TMP C:\Windows\system32\printfilterpipelinesvc.exe N/A
File created C:\Windows\system32\spool\PRINTERS\00002.SPL C:\Windows\splwow64.exe N/A
File created C:\Windows\system32\spool\PRINTERS\PP61220kylx0c6nuhfiybz68g0c.TMP C:\Windows\system32\printfilterpipelinesvc.exe N/A

Suspicious use of NtSetInformationThreadHideFromDebugger

Description Indicator Process Target
N/A N/A C:\ProgramData\6756.tmp N/A

Enumerates physical storage devices

Checks processor information in registry

Description Indicator Process Target
Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 C:\Program Files\Microsoft Office\root\Office16\ONENOTE.EXE N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz C:\Program Files\Microsoft Office\root\Office16\ONENOTE.EXE N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString C:\Program Files\Microsoft Office\root\Office16\ONENOTE.EXE N/A

Enumerates system info in registry

Description Indicator Process Target
Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS C:\Program Files\Microsoft Office\root\Office16\ONENOTE.EXE N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily C:\Program Files\Microsoft Office\root\Office16\ONENOTE.EXE N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU C:\Program Files\Microsoft Office\root\Office16\ONENOTE.EXE N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-02-28_164cc506d29ad9bbb3ebb8fa884d643a_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-02-28_164cc506d29ad9bbb3ebb8fa884d643a_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-02-28_164cc506d29ad9bbb3ebb8fa884d643a_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-02-28_164cc506d29ad9bbb3ebb8fa884d643a_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-02-28_164cc506d29ad9bbb3ebb8fa884d643a_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-02-28_164cc506d29ad9bbb3ebb8fa884d643a_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-02-28_164cc506d29ad9bbb3ebb8fa884d643a_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-02-28_164cc506d29ad9bbb3ebb8fa884d643a_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-02-28_164cc506d29ad9bbb3ebb8fa884d643a_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-02-28_164cc506d29ad9bbb3ebb8fa884d643a_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-02-28_164cc506d29ad9bbb3ebb8fa884d643a_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-02-28_164cc506d29ad9bbb3ebb8fa884d643a_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-02-28_164cc506d29ad9bbb3ebb8fa884d643a_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-02-28_164cc506d29ad9bbb3ebb8fa884d643a_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-02-28_164cc506d29ad9bbb3ebb8fa884d643a_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-02-28_164cc506d29ad9bbb3ebb8fa884d643a_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-02-28_164cc506d29ad9bbb3ebb8fa884d643a_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-02-28_164cc506d29ad9bbb3ebb8fa884d643a_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-02-28_164cc506d29ad9bbb3ebb8fa884d643a_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-02-28_164cc506d29ad9bbb3ebb8fa884d643a_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-02-28_164cc506d29ad9bbb3ebb8fa884d643a_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-02-28_164cc506d29ad9bbb3ebb8fa884d643a_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-02-28_164cc506d29ad9bbb3ebb8fa884d643a_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-02-28_164cc506d29ad9bbb3ebb8fa884d643a_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-02-28_164cc506d29ad9bbb3ebb8fa884d643a_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-02-28_164cc506d29ad9bbb3ebb8fa884d643a_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-02-28_164cc506d29ad9bbb3ebb8fa884d643a_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-02-28_164cc506d29ad9bbb3ebb8fa884d643a_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-02-28_164cc506d29ad9bbb3ebb8fa884d643a_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-02-28_164cc506d29ad9bbb3ebb8fa884d643a_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-02-28_164cc506d29ad9bbb3ebb8fa884d643a_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-02-28_164cc506d29ad9bbb3ebb8fa884d643a_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-02-28_164cc506d29ad9bbb3ebb8fa884d643a_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-02-28_164cc506d29ad9bbb3ebb8fa884d643a_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-02-28_164cc506d29ad9bbb3ebb8fa884d643a_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-02-28_164cc506d29ad9bbb3ebb8fa884d643a_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-02-28_164cc506d29ad9bbb3ebb8fa884d643a_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-02-28_164cc506d29ad9bbb3ebb8fa884d643a_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-02-28_164cc506d29ad9bbb3ebb8fa884d643a_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-02-28_164cc506d29ad9bbb3ebb8fa884d643a_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-02-28_164cc506d29ad9bbb3ebb8fa884d643a_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-02-28_164cc506d29ad9bbb3ebb8fa884d643a_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-02-28_164cc506d29ad9bbb3ebb8fa884d643a_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-02-28_164cc506d29ad9bbb3ebb8fa884d643a_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-02-28_164cc506d29ad9bbb3ebb8fa884d643a_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-02-28_164cc506d29ad9bbb3ebb8fa884d643a_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-02-28_164cc506d29ad9bbb3ebb8fa884d643a_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-02-28_164cc506d29ad9bbb3ebb8fa884d643a_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-02-28_164cc506d29ad9bbb3ebb8fa884d643a_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-02-28_164cc506d29ad9bbb3ebb8fa884d643a_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-02-28_164cc506d29ad9bbb3ebb8fa884d643a_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-02-28_164cc506d29ad9bbb3ebb8fa884d643a_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-02-28_164cc506d29ad9bbb3ebb8fa884d643a_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-02-28_164cc506d29ad9bbb3ebb8fa884d643a_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-02-28_164cc506d29ad9bbb3ebb8fa884d643a_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-02-28_164cc506d29ad9bbb3ebb8fa884d643a_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-02-28_164cc506d29ad9bbb3ebb8fa884d643a_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-02-28_164cc506d29ad9bbb3ebb8fa884d643a_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-02-28_164cc506d29ad9bbb3ebb8fa884d643a_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-02-28_164cc506d29ad9bbb3ebb8fa884d643a_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-02-28_164cc506d29ad9bbb3ebb8fa884d643a_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-02-28_164cc506d29ad9bbb3ebb8fa884d643a_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-02-28_164cc506d29ad9bbb3ebb8fa884d643a_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-02-28_164cc506d29ad9bbb3ebb8fa884d643a_darkside.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeAssignPrimaryTokenPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-28_164cc506d29ad9bbb3ebb8fa884d643a_darkside.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-28_164cc506d29ad9bbb3ebb8fa884d643a_darkside.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-28_164cc506d29ad9bbb3ebb8fa884d643a_darkside.exe N/A
Token: 36 N/A C:\Users\Admin\AppData\Local\Temp\2024-02-28_164cc506d29ad9bbb3ebb8fa884d643a_darkside.exe N/A
Token: SeImpersonatePrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-28_164cc506d29ad9bbb3ebb8fa884d643a_darkside.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-28_164cc506d29ad9bbb3ebb8fa884d643a_darkside.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-28_164cc506d29ad9bbb3ebb8fa884d643a_darkside.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Local\Temp\2024-02-28_164cc506d29ad9bbb3ebb8fa884d643a_darkside.exe N/A
Token: SeManageVolumePrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-28_164cc506d29ad9bbb3ebb8fa884d643a_darkside.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-28_164cc506d29ad9bbb3ebb8fa884d643a_darkside.exe N/A
Token: SeRestorePrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-28_164cc506d29ad9bbb3ebb8fa884d643a_darkside.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-28_164cc506d29ad9bbb3ebb8fa884d643a_darkside.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-28_164cc506d29ad9bbb3ebb8fa884d643a_darkside.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-28_164cc506d29ad9bbb3ebb8fa884d643a_darkside.exe N/A
Token: SeShutdownPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-28_164cc506d29ad9bbb3ebb8fa884d643a_darkside.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-28_164cc506d29ad9bbb3ebb8fa884d643a_darkside.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-28_164cc506d29ad9bbb3ebb8fa884d643a_darkside.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-28_164cc506d29ad9bbb3ebb8fa884d643a_darkside.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-28_164cc506d29ad9bbb3ebb8fa884d643a_darkside.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-28_164cc506d29ad9bbb3ebb8fa884d643a_darkside.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-28_164cc506d29ad9bbb3ebb8fa884d643a_darkside.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-28_164cc506d29ad9bbb3ebb8fa884d643a_darkside.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-28_164cc506d29ad9bbb3ebb8fa884d643a_darkside.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-28_164cc506d29ad9bbb3ebb8fa884d643a_darkside.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-28_164cc506d29ad9bbb3ebb8fa884d643a_darkside.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-28_164cc506d29ad9bbb3ebb8fa884d643a_darkside.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-28_164cc506d29ad9bbb3ebb8fa884d643a_darkside.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-28_164cc506d29ad9bbb3ebb8fa884d643a_darkside.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-28_164cc506d29ad9bbb3ebb8fa884d643a_darkside.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-28_164cc506d29ad9bbb3ebb8fa884d643a_darkside.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-28_164cc506d29ad9bbb3ebb8fa884d643a_darkside.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-28_164cc506d29ad9bbb3ebb8fa884d643a_darkside.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-28_164cc506d29ad9bbb3ebb8fa884d643a_darkside.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-28_164cc506d29ad9bbb3ebb8fa884d643a_darkside.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-28_164cc506d29ad9bbb3ebb8fa884d643a_darkside.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-28_164cc506d29ad9bbb3ebb8fa884d643a_darkside.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-28_164cc506d29ad9bbb3ebb8fa884d643a_darkside.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-28_164cc506d29ad9bbb3ebb8fa884d643a_darkside.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-28_164cc506d29ad9bbb3ebb8fa884d643a_darkside.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-28_164cc506d29ad9bbb3ebb8fa884d643a_darkside.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-28_164cc506d29ad9bbb3ebb8fa884d643a_darkside.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-28_164cc506d29ad9bbb3ebb8fa884d643a_darkside.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-28_164cc506d29ad9bbb3ebb8fa884d643a_darkside.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-28_164cc506d29ad9bbb3ebb8fa884d643a_darkside.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-28_164cc506d29ad9bbb3ebb8fa884d643a_darkside.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-28_164cc506d29ad9bbb3ebb8fa884d643a_darkside.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-28_164cc506d29ad9bbb3ebb8fa884d643a_darkside.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-28_164cc506d29ad9bbb3ebb8fa884d643a_darkside.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-28_164cc506d29ad9bbb3ebb8fa884d643a_darkside.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-28_164cc506d29ad9bbb3ebb8fa884d643a_darkside.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-28_164cc506d29ad9bbb3ebb8fa884d643a_darkside.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-28_164cc506d29ad9bbb3ebb8fa884d643a_darkside.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-28_164cc506d29ad9bbb3ebb8fa884d643a_darkside.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-28_164cc506d29ad9bbb3ebb8fa884d643a_darkside.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-28_164cc506d29ad9bbb3ebb8fa884d643a_darkside.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-28_164cc506d29ad9bbb3ebb8fa884d643a_darkside.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-28_164cc506d29ad9bbb3ebb8fa884d643a_darkside.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-28_164cc506d29ad9bbb3ebb8fa884d643a_darkside.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-28_164cc506d29ad9bbb3ebb8fa884d643a_darkside.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-28_164cc506d29ad9bbb3ebb8fa884d643a_darkside.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-28_164cc506d29ad9bbb3ebb8fa884d643a_darkside.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-28_164cc506d29ad9bbb3ebb8fa884d643a_darkside.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-28_164cc506d29ad9bbb3ebb8fa884d643a_darkside.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-28_164cc506d29ad9bbb3ebb8fa884d643a_darkside.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 4212 wrote to memory of 2044 N/A C:\Users\Admin\AppData\Local\Temp\2024-02-28_164cc506d29ad9bbb3ebb8fa884d643a_darkside.exe C:\Windows\splwow64.exe
PID 4212 wrote to memory of 2044 N/A C:\Users\Admin\AppData\Local\Temp\2024-02-28_164cc506d29ad9bbb3ebb8fa884d643a_darkside.exe C:\Windows\splwow64.exe
PID 4212 wrote to memory of 4392 N/A C:\Users\Admin\AppData\Local\Temp\2024-02-28_164cc506d29ad9bbb3ebb8fa884d643a_darkside.exe C:\ProgramData\6756.tmp
PID 4212 wrote to memory of 4392 N/A C:\Users\Admin\AppData\Local\Temp\2024-02-28_164cc506d29ad9bbb3ebb8fa884d643a_darkside.exe C:\ProgramData\6756.tmp
PID 4212 wrote to memory of 4392 N/A C:\Users\Admin\AppData\Local\Temp\2024-02-28_164cc506d29ad9bbb3ebb8fa884d643a_darkside.exe C:\ProgramData\6756.tmp
PID 4212 wrote to memory of 4392 N/A C:\Users\Admin\AppData\Local\Temp\2024-02-28_164cc506d29ad9bbb3ebb8fa884d643a_darkside.exe C:\ProgramData\6756.tmp
PID 2076 wrote to memory of 2388 N/A C:\Windows\system32\printfilterpipelinesvc.exe C:\Program Files\Microsoft Office\root\Office16\ONENOTE.EXE
PID 2076 wrote to memory of 2388 N/A C:\Windows\system32\printfilterpipelinesvc.exe C:\Program Files\Microsoft Office\root\Office16\ONENOTE.EXE
PID 4392 wrote to memory of 1972 N/A C:\ProgramData\6756.tmp C:\Windows\SysWOW64\cmd.exe
PID 4392 wrote to memory of 1972 N/A C:\ProgramData\6756.tmp C:\Windows\SysWOW64\cmd.exe
PID 4392 wrote to memory of 1972 N/A C:\ProgramData\6756.tmp C:\Windows\SysWOW64\cmd.exe

Processes

C:\Users\Admin\AppData\Local\Temp\2024-02-28_164cc506d29ad9bbb3ebb8fa884d643a_darkside.exe

"C:\Users\Admin\AppData\Local\Temp\2024-02-28_164cc506d29ad9bbb3ebb8fa884d643a_darkside.exe"

C:\Windows\splwow64.exe

C:\Windows\splwow64.exe 12288

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k PrintWorkflow -s PrintWorkflowUserSvc

C:\Windows\system32\printfilterpipelinesvc.exe

C:\Windows\system32\printfilterpipelinesvc.exe -Embedding

C:\ProgramData\6756.tmp

"C:\ProgramData\6756.tmp"

C:\Program Files\Microsoft Office\root\Office16\ONENOTE.EXE

/insertdoc "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\{CB28016A-C401-4ECE-B5BF-37DF676E234D}.xps" 133536325739360000

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /C DEL /F /Q C:\PROGRA~3\6756.tmp >> NUL

Network

Country Destination Domain Proto
US 8.8.8.8:53 176.178.17.96.in-addr.arpa udp
US 8.8.8.8:53 9.228.82.20.in-addr.arpa udp
US 8.8.8.8:53 26.35.223.20.in-addr.arpa udp
US 8.8.8.8:53 41.110.16.96.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 tse1.mm.bing.net udp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 8.8.8.8:53 200.197.79.204.in-addr.arpa udp
US 8.8.8.8:53 46.28.109.52.in-addr.arpa udp
US 8.8.8.8:53 211.143.182.52.in-addr.arpa udp
US 8.8.8.8:53 183.59.114.20.in-addr.arpa udp
US 8.8.8.8:53 206.23.85.13.in-addr.arpa udp
US 8.8.8.8:53 134.71.91.104.in-addr.arpa udp
US 8.8.8.8:53 29.243.111.52.in-addr.arpa udp

Files

memory/4212-0-0x0000000002EF0000-0x0000000002F00000-memory.dmp

memory/4212-1-0x0000000002EF0000-0x0000000002F00000-memory.dmp

memory/4212-2-0x0000000002EF0000-0x0000000002F00000-memory.dmp

C:\$Recycle.Bin\S-1-5-21-3270530367-132075249-2153716227-1000\HHHHHHHHHHH

MD5 eb57b821c8597a5de97eb02aa9c1e849
SHA1 2442c437b5dc9181d4d249b85730d633b3107d16
SHA256 a58ad3098ae8a775a8acfb47589c5d70331ff1aba0846656819dfe8618c410eb
SHA512 2c79b3984c6999cd88eccc443e99954591744a1f677f11bf335f633e3ba50fa7798225e48ba24a8ee4255db185fd8e5e7b903fc0d707971ef0ddb1da397a8136

C:\Users\Admin\fiDSZhXJl.README.txt

MD5 1efb5475077b08e978c3b43ad80cf101
SHA1 bddb5f78c05c8af7c8ad9aee4941a8aa0959a693
SHA256 74d1ec80a9580000bc5dce42494d8426da76063b7702f23650cfdcaed5bccfe1
SHA512 dd27804fbca3a9195438d7cc05ee16498c144c9bf6c1df81379e3a9221bce180d6690fcbd7aca585e820cc407c787aff4b66ad872e05c005a55fa432c68c1272

F:\$RECYCLE.BIN\S-1-5-21-3270530367-132075249-2153716227-1000\DDDDDDDDDDD

MD5 3aebbd8497814c88bc01aa74669bad84
SHA1 0f143516e0a333d75cfbc1878e5fb1c593eeadc4
SHA256 c266264c2eaf07f0a2d71e5a7c56d41fa9d03dcf77f71c34fbcc4343a113f662
SHA512 9d4421d9b12ee6e9febea8715a86365409b3c5ffee5a38d0bff61612c976bdca71393a99c7491852415a38d2170253a3536a3827c1482639ba8d56af05c66f0f

C:\ProgramData\6756.tmp

MD5 294e9f64cb1642dd89229fff0592856b
SHA1 97b148c27f3da29ba7b18d6aee8a0db9102f47c9
SHA256 917e115cc403e29b4388e0d175cbfac3e7e40ca1742299fbdb353847db2de7c2
SHA512 b87d531890bf1577b9b4af41dddb2cdbbfa164cf197bd5987df3a3075983645a3acba443e289b7bfd338422978a104f55298fbfe346872de0895bde44adc89cf

memory/4392-2738-0x00000000023A0000-0x00000000023B0000-memory.dmp

memory/4392-2737-0x000000007FE40000-0x000000007FE41000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\DDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDD

MD5 f8db639a27c88089a28be8d1521eed11
SHA1 074939637c625af1581ffe3af07b66f6f4e46e7a
SHA256 fa1467c4bf2880f15d98f46e5cb609922bae2142c49c9d28cef04e9bc93eb762
SHA512 7f26ec585ba7973d0a6e005ce09e476890f5067aabeb4b551464d41f56156635758b3e8bdf19b73672c9bae2f2da38651a8fbc902c60c756d10e310bd4aa2611

memory/4392-2758-0x00000000023A0000-0x00000000023B0000-memory.dmp

memory/4392-2768-0x000000007FE20000-0x000000007FE21000-memory.dmp

memory/4392-2777-0x000000007FDC0000-0x000000007FDC1000-memory.dmp

memory/4392-2778-0x000000007FDE0000-0x000000007FDE1000-memory.dmp

memory/2388-2779-0x00007FFEF3390000-0x00007FFEF33A0000-memory.dmp

memory/4392-2780-0x000000007FE00000-0x000000007FE01000-memory.dmp

memory/2388-2782-0x00007FFF33310000-0x00007FFF33505000-memory.dmp

memory/2388-2784-0x00007FFF33310000-0x00007FFF33505000-memory.dmp

memory/2388-2783-0x00007FFEF3390000-0x00007FFEF33A0000-memory.dmp

memory/2388-2781-0x00007FFEF3390000-0x00007FFEF33A0000-memory.dmp

memory/2388-2786-0x00007FFF33310000-0x00007FFF33505000-memory.dmp

memory/2388-2787-0x00007FFEF3390000-0x00007FFEF33A0000-memory.dmp

memory/2388-2785-0x00007FFEF3390000-0x00007FFEF33A0000-memory.dmp

memory/2388-2788-0x00007FFF33310000-0x00007FFF33505000-memory.dmp

memory/2388-2789-0x00007FFF33310000-0x00007FFF33505000-memory.dmp

memory/2388-2791-0x00007FFF33310000-0x00007FFF33505000-memory.dmp

memory/2388-2790-0x00007FFF33310000-0x00007FFF33505000-memory.dmp

memory/2388-2792-0x00007FFF33310000-0x00007FFF33505000-memory.dmp

memory/2388-2793-0x00007FFEF0A30000-0x00007FFEF0A40000-memory.dmp

memory/2388-2794-0x00007FFEF0A30000-0x00007FFEF0A40000-memory.dmp

C:\Users\Admin\Documents\OneNote Notebooks\My Notebook\Open Notebook.onetoc2

MD5 d952c28ea7e05491d1f26093a8590091
SHA1 c051e6fb323606ebbba0290c65694100e841d272
SHA256 9b2d373a83fa30d37984b4f74ac521fd9be3d7813c8f41e81256a7b7f6f7f659
SHA512 fa18a30cb837e0d471bd587fd44f0d6348c81adfcb61ff2702dc1468b0bec3bc664094eaab5fffb7d3df75b9557d778e12d225a63db98c9565adb90fb9221cf2

memory/2388-2813-0x00007FFF33310000-0x00007FFF33505000-memory.dmp

memory/2388-2814-0x00007FFF33310000-0x00007FFF33505000-memory.dmp

Analysis: behavioral1

Detonation Overview

Submitted

2024-02-28 22:22

Reported

2024-02-28 22:25

Platform

win7-20240221-en

Max time kernel

118s

Max time network

119s

Command Line

"C:\Users\Admin\AppData\Local\Temp\2024-02-28_164cc506d29ad9bbb3ebb8fa884d643a_darkside.exe"

Signatures

Renames multiple (354) files with added filename extension

ransomware

Deletes itself

Description Indicator Process Target
N/A N/A C:\ProgramData\4672.tmp N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\ProgramData\4672.tmp N/A

Loads dropped DLL

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-02-28_164cc506d29ad9bbb3ebb8fa884d643a_darkside.exe N/A

Reads user/profile data of web browsers

spyware stealer

Drops desktop.ini file(s)

Description Indicator Process Target
File opened for modification C:\$Recycle.Bin\S-1-5-21-1298544033-3225604241-2703760938-1000\desktop.ini C:\Users\Admin\AppData\Local\Temp\2024-02-28_164cc506d29ad9bbb3ebb8fa884d643a_darkside.exe N/A
File opened for modification F:\$RECYCLE.BIN\S-1-5-21-1298544033-3225604241-2703760938-1000\desktop.ini C:\Users\Admin\AppData\Local\Temp\2024-02-28_164cc506d29ad9bbb3ebb8fa884d643a_darkside.exe N/A

Suspicious use of NtSetInformationThreadHideFromDebugger

Description Indicator Process Target
N/A N/A C:\ProgramData\4672.tmp N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeAssignPrimaryTokenPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-28_164cc506d29ad9bbb3ebb8fa884d643a_darkside.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-28_164cc506d29ad9bbb3ebb8fa884d643a_darkside.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-28_164cc506d29ad9bbb3ebb8fa884d643a_darkside.exe N/A
Token: 36 N/A C:\Users\Admin\AppData\Local\Temp\2024-02-28_164cc506d29ad9bbb3ebb8fa884d643a_darkside.exe N/A
Token: SeImpersonatePrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-28_164cc506d29ad9bbb3ebb8fa884d643a_darkside.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-28_164cc506d29ad9bbb3ebb8fa884d643a_darkside.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-28_164cc506d29ad9bbb3ebb8fa884d643a_darkside.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Local\Temp\2024-02-28_164cc506d29ad9bbb3ebb8fa884d643a_darkside.exe N/A
Token: SeManageVolumePrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-28_164cc506d29ad9bbb3ebb8fa884d643a_darkside.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-28_164cc506d29ad9bbb3ebb8fa884d643a_darkside.exe N/A
Token: SeRestorePrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-28_164cc506d29ad9bbb3ebb8fa884d643a_darkside.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-28_164cc506d29ad9bbb3ebb8fa884d643a_darkside.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-28_164cc506d29ad9bbb3ebb8fa884d643a_darkside.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-28_164cc506d29ad9bbb3ebb8fa884d643a_darkside.exe N/A
Token: SeShutdownPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-28_164cc506d29ad9bbb3ebb8fa884d643a_darkside.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-28_164cc506d29ad9bbb3ebb8fa884d643a_darkside.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-28_164cc506d29ad9bbb3ebb8fa884d643a_darkside.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-28_164cc506d29ad9bbb3ebb8fa884d643a_darkside.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-28_164cc506d29ad9bbb3ebb8fa884d643a_darkside.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-28_164cc506d29ad9bbb3ebb8fa884d643a_darkside.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-28_164cc506d29ad9bbb3ebb8fa884d643a_darkside.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-28_164cc506d29ad9bbb3ebb8fa884d643a_darkside.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-28_164cc506d29ad9bbb3ebb8fa884d643a_darkside.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-28_164cc506d29ad9bbb3ebb8fa884d643a_darkside.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-28_164cc506d29ad9bbb3ebb8fa884d643a_darkside.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-28_164cc506d29ad9bbb3ebb8fa884d643a_darkside.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-28_164cc506d29ad9bbb3ebb8fa884d643a_darkside.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-28_164cc506d29ad9bbb3ebb8fa884d643a_darkside.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-28_164cc506d29ad9bbb3ebb8fa884d643a_darkside.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-28_164cc506d29ad9bbb3ebb8fa884d643a_darkside.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-28_164cc506d29ad9bbb3ebb8fa884d643a_darkside.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-28_164cc506d29ad9bbb3ebb8fa884d643a_darkside.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-28_164cc506d29ad9bbb3ebb8fa884d643a_darkside.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-28_164cc506d29ad9bbb3ebb8fa884d643a_darkside.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-28_164cc506d29ad9bbb3ebb8fa884d643a_darkside.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-28_164cc506d29ad9bbb3ebb8fa884d643a_darkside.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-28_164cc506d29ad9bbb3ebb8fa884d643a_darkside.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-28_164cc506d29ad9bbb3ebb8fa884d643a_darkside.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-28_164cc506d29ad9bbb3ebb8fa884d643a_darkside.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-28_164cc506d29ad9bbb3ebb8fa884d643a_darkside.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-28_164cc506d29ad9bbb3ebb8fa884d643a_darkside.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-28_164cc506d29ad9bbb3ebb8fa884d643a_darkside.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-28_164cc506d29ad9bbb3ebb8fa884d643a_darkside.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-28_164cc506d29ad9bbb3ebb8fa884d643a_darkside.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-28_164cc506d29ad9bbb3ebb8fa884d643a_darkside.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-28_164cc506d29ad9bbb3ebb8fa884d643a_darkside.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-28_164cc506d29ad9bbb3ebb8fa884d643a_darkside.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-28_164cc506d29ad9bbb3ebb8fa884d643a_darkside.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-28_164cc506d29ad9bbb3ebb8fa884d643a_darkside.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-28_164cc506d29ad9bbb3ebb8fa884d643a_darkside.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-28_164cc506d29ad9bbb3ebb8fa884d643a_darkside.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-28_164cc506d29ad9bbb3ebb8fa884d643a_darkside.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-28_164cc506d29ad9bbb3ebb8fa884d643a_darkside.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-28_164cc506d29ad9bbb3ebb8fa884d643a_darkside.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-28_164cc506d29ad9bbb3ebb8fa884d643a_darkside.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-28_164cc506d29ad9bbb3ebb8fa884d643a_darkside.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-28_164cc506d29ad9bbb3ebb8fa884d643a_darkside.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-28_164cc506d29ad9bbb3ebb8fa884d643a_darkside.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-28_164cc506d29ad9bbb3ebb8fa884d643a_darkside.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-28_164cc506d29ad9bbb3ebb8fa884d643a_darkside.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-28_164cc506d29ad9bbb3ebb8fa884d643a_darkside.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-28_164cc506d29ad9bbb3ebb8fa884d643a_darkside.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-28_164cc506d29ad9bbb3ebb8fa884d643a_darkside.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-28_164cc506d29ad9bbb3ebb8fa884d643a_darkside.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\2024-02-28_164cc506d29ad9bbb3ebb8fa884d643a_darkside.exe

"C:\Users\Admin\AppData\Local\Temp\2024-02-28_164cc506d29ad9bbb3ebb8fa884d643a_darkside.exe"

C:\ProgramData\4672.tmp

"C:\ProgramData\4672.tmp"

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /C DEL /F /Q C:\PROGRA~3\4672.tmp >> NUL

C:\Windows\system32\AUDIODG.EXE

C:\Windows\system32\AUDIODG.EXE 0x14c

Network

N/A

Files

memory/2664-0-0x0000000000C70000-0x0000000000CB0000-memory.dmp

C:\$Recycle.Bin\S-1-5-21-1298544033-3225604241-2703760938-1000\desktop.ini

MD5 3d227615ee510f2e7a5bc198ed58c985
SHA1 5a818e4ab8746152577996bd3e82174df1a9cd39
SHA256 75ab131cddc06e58fd92ff8b294a2f9c669af86d881c0b94ad11014b665d3734
SHA512 b1787161183cbb235c30c5729d78ebdfa89c9f8e0a023ccdbdcfe8d1eaed9ca5013d76241709a640f877127ac38d6adcbca713cf3dc591d83fed18d98a7843c6

C:\fiDSZhXJl.README.txt

MD5 e1c4fc9e784e269fc70bdefe912585f0
SHA1 91905213affd4d0163839e2f14f89d2a7b3d20cc
SHA256 7e8e064c5ccc7f3055704fad143f9e6b9e0503ee1363eebf15b5d36a2a458716
SHA512 8d5c56a576f234c3bf58573101a471a438896271f043be85d39e471f10556ae029e4c2b0d022a2cadc5910a85cad21fe2d672245002cfafbc4e4e64b6db41973

F:\$RECYCLE.BIN\S-1-5-21-1298544033-3225604241-2703760938-1000\DDDDDDDDDDD

MD5 720d2c098418d31a36aa5514166639f0
SHA1 9625ef3f680c67d4939c6fefb0951baad2aa0ad1
SHA256 b309e28eb7c6328c62919c723d735a34bdce6da8e6039e6cf223070c8a362197
SHA512 8ca8090428d37f9bbf18735136d7da85c064d1f7ab574c9d083208589053d19ef6d8c8444d476918483fb18bfb33000eb647e37a843dad8a102697bc7b099a89

\ProgramData\4672.tmp

MD5 294e9f64cb1642dd89229fff0592856b
SHA1 97b148c27f3da29ba7b18d6aee8a0db9102f47c9
SHA256 917e115cc403e29b4388e0d175cbfac3e7e40ca1742299fbdb353847db2de7c2
SHA512 b87d531890bf1577b9b4af41dddb2cdbbfa164cf197bd5987df3a3075983645a3acba443e289b7bfd338422978a104f55298fbfe346872de0895bde44adc89cf

memory/1896-877-0x000000007EFA0000-0x000000007EFA1000-memory.dmp

memory/1896-878-0x00000000021F0000-0x0000000002230000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\DDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDD

MD5 d3ef5e2fa1f1db833ce3994e7ca71223
SHA1 3c5246a473fa5bfcc4fba090f000164176d65615
SHA256 82d0ff5be70e526366ad918f01ecb4eaa4f0fdc502b833ad34473281d1e4f802
SHA512 b4732d0256ccb554eb81ea9237c30dc81310c7c65b61bc2688585a4c06caa090a50a250b007b705e30b067117470aa2ac398843cb154150180af431f0d2743e9

memory/1896-879-0x00000000021F0000-0x0000000002230000-memory.dmp

memory/1896-908-0x000000007EF80000-0x000000007EF81000-memory.dmp

memory/1896-909-0x000000007EF80000-0x000000007EF81000-memory.dmp