Analysis
- max time kernel
164s - max time network
163s - platform
windows10-2004_x64 - resource
win10v2004-20240226-en - resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system - submitted
09/03/2024, 23:29
Behavioral task
behavioral1
Sample
2024-03-09_a42ff02d311b9aebb6c43bfc07dbcd0c_darkside.exe
Resource
win7-20240221-en
windows7-x64
15 signatures
150 seconds
Behavioral task
behavioral2
Sample
2024-03-09_a42ff02d311b9aebb6c43bfc07dbcd0c_darkside.exe
Resource
win10v2004-20240226-en
windows10-2004-x64
6 signatures
150 seconds
General
- Target 2024-03-09_a42ff02d311b9aebb6c43bfc07dbcd0c_darkside.exe
- Size 151KB
- Sample240309-3gp9asdh73
- SHA256 2985ef1ebb8d8dc18da89baac584cd58404ce11c06ed70640da98caab0edadd9
- MD5 a42ff02d311b9aebb6c43bfc07dbcd0c
- SHA1 8e032711db16525a407c08984ff5d5c11276f0f4
- SHA512 a15ec5fe5e897341f401fd2ee9f7846a52ff711b9dbed91db250e60d4ce09f36bcbdd55b8c3acfafb281ce986ba590b4bc052cc3ddc13c1d3a2782a4815aa3b7
- SSDEEP 3072:oqJogYkcSNm9V7DXFiC/PI8Yw+2GLH4FT:oq2kc4m9tD1iibYR2Gk
- MD5 SHA1 SHA512 SSDEEP
Score
9/10
Malware Config
Signatures
- Renames multiple (446) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
- Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Drops desktop.ini file(s) 2 IoCs
description ioc Process File opened for modification C:\$Recycle.Bin\S-1-5-21-609813121-2907144057-1731107329-1000\desktop.ini 2024-03-09_a42ff02d311b9aebb6c43bfc07dbcd0c_darkside.exe File opened for modification F:\$RECYCLE.BIN\S-1-5-21-609813121-2907144057-1731107329-1000\desktop.ini 2024-03-09_a42ff02d311b9aebb6c43bfc07dbcd0c_darkside.exe - Modifies registry class 5 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.Yvrb17l03 2024-03-09_a42ff02d311b9aebb6c43bfc07dbcd0c_darkside.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.Yvrb17l03\ = "Yvrb17l03" 2024-03-09_a42ff02d311b9aebb6c43bfc07dbcd0c_darkside.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Yvrb17l03\DefaultIcon 2024-03-09_a42ff02d311b9aebb6c43bfc07dbcd0c_darkside.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Yvrb17l03 2024-03-09_a42ff02d311b9aebb6c43bfc07dbcd0c_darkside.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Yvrb17l03\DefaultIcon\ = "C:\\ProgramData\\Yvrb17l03.ico" 2024-03-09_a42ff02d311b9aebb6c43bfc07dbcd0c_darkside.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1800 2024-03-09_a42ff02d311b9aebb6c43bfc07dbcd0c_darkside.exe 1800 2024-03-09_a42ff02d311b9aebb6c43bfc07dbcd0c_darkside.exe 1800 2024-03-09_a42ff02d311b9aebb6c43bfc07dbcd0c_darkside.exe 1800 2024-03-09_a42ff02d311b9aebb6c43bfc07dbcd0c_darkside.exe 1800 2024-03-09_a42ff02d311b9aebb6c43bfc07dbcd0c_darkside.exe 1800 2024-03-09_a42ff02d311b9aebb6c43bfc07dbcd0c_darkside.exe 1800 2024-03-09_a42ff02d311b9aebb6c43bfc07dbcd0c_darkside.exe 1800 2024-03-09_a42ff02d311b9aebb6c43bfc07dbcd0c_darkside.exe 1800 2024-03-09_a42ff02d311b9aebb6c43bfc07dbcd0c_darkside.exe 1800 2024-03-09_a42ff02d311b9aebb6c43bfc07dbcd0c_darkside.exe 1800 2024-03-09_a42ff02d311b9aebb6c43bfc07dbcd0c_darkside.exe 1800 2024-03-09_a42ff02d311b9aebb6c43bfc07dbcd0c_darkside.exe 1800 2024-03-09_a42ff02d311b9aebb6c43bfc07dbcd0c_darkside.exe 1800 2024-03-09_a42ff02d311b9aebb6c43bfc07dbcd0c_darkside.exe 1800 2024-03-09_a42ff02d311b9aebb6c43bfc07dbcd0c_darkside.exe 1800 2024-03-09_a42ff02d311b9aebb6c43bfc07dbcd0c_darkside.exe 1800 2024-03-09_a42ff02d311b9aebb6c43bfc07dbcd0c_darkside.exe 1800 2024-03-09_a42ff02d311b9aebb6c43bfc07dbcd0c_darkside.exe 1800 2024-03-09_a42ff02d311b9aebb6c43bfc07dbcd0c_darkside.exe 1800 2024-03-09_a42ff02d311b9aebb6c43bfc07dbcd0c_darkside.exe 1800 2024-03-09_a42ff02d311b9aebb6c43bfc07dbcd0c_darkside.exe 1800 2024-03-09_a42ff02d311b9aebb6c43bfc07dbcd0c_darkside.exe 1800 2024-03-09_a42ff02d311b9aebb6c43bfc07dbcd0c_darkside.exe 1800 2024-03-09_a42ff02d311b9aebb6c43bfc07dbcd0c_darkside.exe 1800 2024-03-09_a42ff02d311b9aebb6c43bfc07dbcd0c_darkside.exe 1800 2024-03-09_a42ff02d311b9aebb6c43bfc07dbcd0c_darkside.exe 1800 2024-03-09_a42ff02d311b9aebb6c43bfc07dbcd0c_darkside.exe 1800 2024-03-09_a42ff02d311b9aebb6c43bfc07dbcd0c_darkside.exe 1800 2024-03-09_a42ff02d311b9aebb6c43bfc07dbcd0c_darkside.exe 1800 2024-03-09_a42ff02d311b9aebb6c43bfc07dbcd0c_darkside.exe 1800 2024-03-09_a42ff02d311b9aebb6c43bfc07dbcd0c_darkside.exe 1800 2024-03-09_a42ff02d311b9aebb6c43bfc07dbcd0c_darkside.exe 1800 2024-03-09_a42ff02d311b9aebb6c43bfc07dbcd0c_darkside.exe 1800 2024-03-09_a42ff02d311b9aebb6c43bfc07dbcd0c_darkside.exe 1800 2024-03-09_a42ff02d311b9aebb6c43bfc07dbcd0c_darkside.exe 1800 2024-03-09_a42ff02d311b9aebb6c43bfc07dbcd0c_darkside.exe 1800 2024-03-09_a42ff02d311b9aebb6c43bfc07dbcd0c_darkside.exe 1800 2024-03-09_a42ff02d311b9aebb6c43bfc07dbcd0c_darkside.exe 1800 2024-03-09_a42ff02d311b9aebb6c43bfc07dbcd0c_darkside.exe 1800 2024-03-09_a42ff02d311b9aebb6c43bfc07dbcd0c_darkside.exe 1800 2024-03-09_a42ff02d311b9aebb6c43bfc07dbcd0c_darkside.exe 1800 2024-03-09_a42ff02d311b9aebb6c43bfc07dbcd0c_darkside.exe 1800 2024-03-09_a42ff02d311b9aebb6c43bfc07dbcd0c_darkside.exe 1800 2024-03-09_a42ff02d311b9aebb6c43bfc07dbcd0c_darkside.exe 1800 2024-03-09_a42ff02d311b9aebb6c43bfc07dbcd0c_darkside.exe 1800 2024-03-09_a42ff02d311b9aebb6c43bfc07dbcd0c_darkside.exe 1800 2024-03-09_a42ff02d311b9aebb6c43bfc07dbcd0c_darkside.exe 1800 2024-03-09_a42ff02d311b9aebb6c43bfc07dbcd0c_darkside.exe 1800 2024-03-09_a42ff02d311b9aebb6c43bfc07dbcd0c_darkside.exe 1800 2024-03-09_a42ff02d311b9aebb6c43bfc07dbcd0c_darkside.exe 1800 2024-03-09_a42ff02d311b9aebb6c43bfc07dbcd0c_darkside.exe 1800 2024-03-09_a42ff02d311b9aebb6c43bfc07dbcd0c_darkside.exe 1800 2024-03-09_a42ff02d311b9aebb6c43bfc07dbcd0c_darkside.exe 1800 2024-03-09_a42ff02d311b9aebb6c43bfc07dbcd0c_darkside.exe 1800 2024-03-09_a42ff02d311b9aebb6c43bfc07dbcd0c_darkside.exe 1800 2024-03-09_a42ff02d311b9aebb6c43bfc07dbcd0c_darkside.exe 1800 2024-03-09_a42ff02d311b9aebb6c43bfc07dbcd0c_darkside.exe 1800 2024-03-09_a42ff02d311b9aebb6c43bfc07dbcd0c_darkside.exe 1800 2024-03-09_a42ff02d311b9aebb6c43bfc07dbcd0c_darkside.exe 1800 2024-03-09_a42ff02d311b9aebb6c43bfc07dbcd0c_darkside.exe 1800 2024-03-09_a42ff02d311b9aebb6c43bfc07dbcd0c_darkside.exe 1800 2024-03-09_a42ff02d311b9aebb6c43bfc07dbcd0c_darkside.exe 1800 2024-03-09_a42ff02d311b9aebb6c43bfc07dbcd0c_darkside.exe 1800 2024-03-09_a42ff02d311b9aebb6c43bfc07dbcd0c_darkside.exe - Suspicious use of AdjustPrivilegeToken 16 IoCs
description pid Process Token: SeAssignPrimaryTokenPrivilege 1800 2024-03-09_a42ff02d311b9aebb6c43bfc07dbcd0c_darkside.exe Token: SeBackupPrivilege 1800 2024-03-09_a42ff02d311b9aebb6c43bfc07dbcd0c_darkside.exe Token: SeDebugPrivilege 1800 2024-03-09_a42ff02d311b9aebb6c43bfc07dbcd0c_darkside.exe Token: 36 1800 2024-03-09_a42ff02d311b9aebb6c43bfc07dbcd0c_darkside.exe Token: SeImpersonatePrivilege 1800 2024-03-09_a42ff02d311b9aebb6c43bfc07dbcd0c_darkside.exe Token: SeIncBasePriorityPrivilege 1800 2024-03-09_a42ff02d311b9aebb6c43bfc07dbcd0c_darkside.exe Token: SeIncreaseQuotaPrivilege 1800 2024-03-09_a42ff02d311b9aebb6c43bfc07dbcd0c_darkside.exe Token: 33 1800 2024-03-09_a42ff02d311b9aebb6c43bfc07dbcd0c_darkside.exe Token: SeManageVolumePrivilege 1800 2024-03-09_a42ff02d311b9aebb6c43bfc07dbcd0c_darkside.exe Token: SeProfSingleProcessPrivilege 1800 2024-03-09_a42ff02d311b9aebb6c43bfc07dbcd0c_darkside.exe Token: SeRestorePrivilege 1800 2024-03-09_a42ff02d311b9aebb6c43bfc07dbcd0c_darkside.exe Token: SeSecurityPrivilege 1800 2024-03-09_a42ff02d311b9aebb6c43bfc07dbcd0c_darkside.exe Token: SeSystemProfilePrivilege 1800 2024-03-09_a42ff02d311b9aebb6c43bfc07dbcd0c_darkside.exe Token: SeTakeOwnershipPrivilege 1800 2024-03-09_a42ff02d311b9aebb6c43bfc07dbcd0c_darkside.exe Token: SeShutdownPrivilege 1800 2024-03-09_a42ff02d311b9aebb6c43bfc07dbcd0c_darkside.exe Token: SeDebugPrivilege 1800 2024-03-09_a42ff02d311b9aebb6c43bfc07dbcd0c_darkside.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-03-09_a42ff02d311b9aebb6c43bfc07dbcd0c_darkside.exe"C:\Users\Admin\AppData\Local\Temp\2024-03-09_a42ff02d311b9aebb6c43bfc07dbcd0c_darkside.exe"1⤵
- Drops desktop.ini file(s)
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1800
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\$Recycle.Bin\S-1-5-21-609813121-2907144057-1731107329-1000\EEEEEEEEEEE
- Size 129B
- SHA256 c2875e7e6b0a69dcd6e478f94e9d512234513ccc66aa305e9ad2099d20f0c46f
- MD5 22afde624b57e48e792b2c7a3f6eaeb1
- SHA1 2ceadf9666f31a9ad4a79b1e20ea59e0a7db84c2
- SHA512 2b3952cccbb780732babd4aa52831353f45cffd0b978303b4dbc5d4be66b9853f8ffe78969607149d341acca3bad26ec5503ef05fb34c09a7d24dba0f135eb2b
- MD5 SHA1 SHA512
- Path C:\Yvrb17l03.README.txt
- Size 4KB
- SHA256 1a0666a4d23c1086af8d936ff0cd4ae058f102ae238da007a28a3b8910f0c1c2
- MD5 2203d143367e37e288de6b8605db6f47
- SHA1 1c3b996d3b0d4fb3f73ca81028d6e7784d3c7272
- SHA512 bbc76ffe6f3f9c08a895de93de6f356f896ef5cf0b731b9dfd0a60ec2c60a90c3ebed88fbc6a1b27472e48ed8b8440b580b431d17114a21ec4f1d0ee7a743b6d
- SSDEEP 96:u9HzHJk05f//4C/apwnUrph+JT2qDlZmKX4X25xCM2QbxIw:u9HzHJ33jGGVVZmKRCM2QKw
- MD5 SHA1 SHA512 SSDEEP
- Path F:\$RECYCLE.BIN\S-1-5-21-609813121-2907144057-1731107329-1000\DDDDDDDDDDD
- Size 129B
- SHA256 8b3ce61cbee552a0a3fc019c3191e2fa834fb9eac86d6d8ba6ce5699a7cf4be1
- MD5 a87bff3811f76a5f67f89cf427bf59c9
- SHA1 c694ce1033cfa4c0af35dfa853c66d1da4846d31
- SHA512 b50273ce112fcaa99d08c5abccc67097578cf097dcd231550b6d8204c341324848bdccf763c23d7ba7d2d82fe2b3395aa91752427890242c9cf8d0c90b4bd4a5
- MD5 SHA1 SHA512