Analysis
-
max time kernel
147s -
max time network
155s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
11-03-2024 07:41
Behavioral task
behavioral1
Sample
2024-03-11_22a0002d0c856af8ce443c65fcfb3e66_darkside.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
2024-03-11_22a0002d0c856af8ce443c65fcfb3e66_darkside.exe
Resource
win10v2004-20240226-en
General
-
Target
2024-03-11_22a0002d0c856af8ce443c65fcfb3e66_darkside.exe
-
Size
153KB
-
MD5
22a0002d0c856af8ce443c65fcfb3e66
-
SHA1
01a123f73656a856a80ddb5962d7926b6641c8fd
-
SHA256
0b52d5d29e42804706f99a724ec94d0e2f0fd2a4dfcfbe4ff4e0403e00a71e49
-
SHA512
676e86afb4d39356a7e1631be2c32a3b3c24fc2f498b231399a565ec534a830b4ed838a3f8f51c484fe8cea32b0790c70a91b4e6ff74a588535b85918868aee0
-
SSDEEP
1536:UzICS4AAwczUUf8y8gvMH+1zGSNAojMP95D1xDtyUQX3S0bcSZ9pgTmyW1fsoxrH:7qJogYkcSNm9V7Dtyv3lubW1UId9T
Malware Config
Extracted
C:\nbLGVxVJx.README.txt
lockbit
http://lockbitapt2yfbt7lchxejug47kmqvqqxvvjpqkmevv4l3azl3gy6pyd.onion
http://lockbitapt5x4zkjbcqmz6frdhecqqgadevyiwqxukksspnlidyvd7qd.onion
http://lockbitapt6vx57t3eeqjofwgcglmutr3a35nygvokja5uuccip4ykyd.onion
http://lockbitapt34kvrip6xojylohhxrwsvpzdffgs5z4pbbsywnzsbdguqd.onion
http://lockbitaptc2iq4atewz2ise62q63wfktyrl4qtwuk5qax262kgtzjqd.onion
http://lockbitaptjpikdqjynvgozhgc6bgetgucdk5xjacozeaawihmoio6yd.onion
http://lockbitaptq7ephv2oigdncfhtwhpqgwmqojnxqdyhprxxfpcllqdxad.onion
http://lockbitaptstzf3er2lz6ku3xuifafq2yh5lmiqj5ncur6rtlmkteiqd.onion
http://lockbitaptoofrpignlz6dt2wqqc5z3a4evjevoa3eqdfcntxad5lmyd.onion
http://lockbitapt.uz
http://lockbitapt2yfbt7lchxejug47kmqvqqxvvjpqkmevv4l3azl3gy6pyd.onion.ly
http://lockbitapt5x4zkjbcqmz6frdhecqqgadevyiwqxukksspnlidyvd7qd.onion.ly
http://lockbitapt6vx57t3eeqjofwgcglmutr3a35nygvokja5uuccip4ykyd.onion.ly
http://lockbitapt34kvrip6xojylohhxrwsvpzdffgs5z4pbbsywnzsbdguqd.onion.ly
http://lockbitaptc2iq4atewz2ise62q63wfktyrl4qtwuk5qax262kgtzjqd.onion.ly
http://lockbitaptjpikdqjynvgozhgc6bgetgucdk5xjacozeaawihmoio6yd.onion.ly
http://lockbitaptq7ephv2oigdncfhtwhpqgwmqojnxqdyhprxxfpcllqdxad.onion.ly
http://lockbitaptstzf3er2lz6ku3xuifafq2yh5lmiqj5ncur6rtlmkteiqd.onion.ly
http://lockbitaptoofrpignlz6dt2wqqc5z3a4evjevoa3eqdfcntxad5lmyd.onion.ly
https://twitter.com/hashtag/lockbit?f=live
http://lockbitsupt7nr3fa6e7xyb73lk6bw6rcneqhoyblniiabj4uwvzapqd.onion
http://lockbitsupuhswh4izvoucoxsbnotkmgq6durg7kficg6u33zfvq3oyd.onion
http://lockbitsupn2h6be2cnqpvncyhj4rgmnwn44633hnzzmtxdvjoqlp7yd.onion
http://lockbitsupp.uz
https://tox.chat/download.html
Signatures
-
Lockbit
Ransomware family with multiple variants released since late 2019.
-
Renames multiple (627) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
16C0.tmpdescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-513485977-2495024337-1260977654-1000\Control Panel\International\Geo\Nation 16C0.tmp -
Deletes itself 1 IoCs
Processes:
16C0.tmppid process 3044 16C0.tmp -
Executes dropped EXE 1 IoCs
Processes:
16C0.tmppid process 3044 16C0.tmp -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Drops desktop.ini file(s) 2 IoCs
Processes:
2024-03-11_22a0002d0c856af8ce443c65fcfb3e66_darkside.exedescription ioc process File opened for modification F:\$RECYCLE.BIN\S-1-5-21-513485977-2495024337-1260977654-1000\desktop.ini 2024-03-11_22a0002d0c856af8ce443c65fcfb3e66_darkside.exe File opened for modification C:\$Recycle.Bin\S-1-5-21-513485977-2495024337-1260977654-1000\desktop.ini 2024-03-11_22a0002d0c856af8ce443c65fcfb3e66_darkside.exe -
Drops file in System32 directory 4 IoCs
Processes:
splwow64.exeprintfilterpipelinesvc.exedescription ioc process File created C:\Windows\system32\spool\PRINTERS\00002.SPL splwow64.exe File created C:\Windows\system32\spool\PRINTERS\PPskzhikuqyh7l6eh0b8s3_9_hb.TMP printfilterpipelinesvc.exe File created C:\Windows\system32\spool\PRINTERS\PPtjdovgn6hdeznh1vx247zaxnb.TMP printfilterpipelinesvc.exe File created C:\Windows\system32\spool\PRINTERS\PP07odef9nhlqz43j_rcdgm36f.TMP printfilterpipelinesvc.exe -
Sets desktop wallpaper using registry 2 TTPs 2 IoCs
Processes:
2024-03-11_22a0002d0c856af8ce443c65fcfb3e66_darkside.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-513485977-2495024337-1260977654-1000\Control Panel\Desktop\Wallpaper = "C:\\ProgramData\\nbLGVxVJx.bmp" 2024-03-11_22a0002d0c856af8ce443c65fcfb3e66_darkside.exe Set value (str) \REGISTRY\USER\S-1-5-21-513485977-2495024337-1260977654-1000\Control Panel\Desktop\WallPaper = "C:\\ProgramData\\nbLGVxVJx.bmp" 2024-03-11_22a0002d0c856af8ce443c65fcfb3e66_darkside.exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
Processes:
16C0.tmppid process 3044 16C0.tmp -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
ONENOTE.EXEdescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString ONENOTE.EXE Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 ONENOTE.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz ONENOTE.EXE -
Enumerates system info in registry 2 TTPs 3 IoCs
Processes:
ONENOTE.EXEdescription ioc process Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS ONENOTE.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily ONENOTE.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU ONENOTE.EXE -
Modifies Control Panel 2 IoCs
Processes:
2024-03-11_22a0002d0c856af8ce443c65fcfb3e66_darkside.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-513485977-2495024337-1260977654-1000\Control Panel\Desktop 2024-03-11_22a0002d0c856af8ce443c65fcfb3e66_darkside.exe Set value (str) \REGISTRY\USER\S-1-5-21-513485977-2495024337-1260977654-1000\Control Panel\Desktop\WallpaperStyle = "10" 2024-03-11_22a0002d0c856af8ce443c65fcfb3e66_darkside.exe -
Modifies registry class 5 IoCs
Processes:
2024-03-11_22a0002d0c856af8ce443c65fcfb3e66_darkside.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\nbLGVxVJx\DefaultIcon 2024-03-11_22a0002d0c856af8ce443c65fcfb3e66_darkside.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\nbLGVxVJx 2024-03-11_22a0002d0c856af8ce443c65fcfb3e66_darkside.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\nbLGVxVJx\DefaultIcon\ = "C:\\ProgramData\\nbLGVxVJx.ico" 2024-03-11_22a0002d0c856af8ce443c65fcfb3e66_darkside.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.nbLGVxVJx 2024-03-11_22a0002d0c856af8ce443c65fcfb3e66_darkside.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.nbLGVxVJx\ = "nbLGVxVJx" 2024-03-11_22a0002d0c856af8ce443c65fcfb3e66_darkside.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
2024-03-11_22a0002d0c856af8ce443c65fcfb3e66_darkside.exepid process 1864 2024-03-11_22a0002d0c856af8ce443c65fcfb3e66_darkside.exe 1864 2024-03-11_22a0002d0c856af8ce443c65fcfb3e66_darkside.exe 1864 2024-03-11_22a0002d0c856af8ce443c65fcfb3e66_darkside.exe 1864 2024-03-11_22a0002d0c856af8ce443c65fcfb3e66_darkside.exe 1864 2024-03-11_22a0002d0c856af8ce443c65fcfb3e66_darkside.exe 1864 2024-03-11_22a0002d0c856af8ce443c65fcfb3e66_darkside.exe 1864 2024-03-11_22a0002d0c856af8ce443c65fcfb3e66_darkside.exe 1864 2024-03-11_22a0002d0c856af8ce443c65fcfb3e66_darkside.exe 1864 2024-03-11_22a0002d0c856af8ce443c65fcfb3e66_darkside.exe 1864 2024-03-11_22a0002d0c856af8ce443c65fcfb3e66_darkside.exe 1864 2024-03-11_22a0002d0c856af8ce443c65fcfb3e66_darkside.exe 1864 2024-03-11_22a0002d0c856af8ce443c65fcfb3e66_darkside.exe 1864 2024-03-11_22a0002d0c856af8ce443c65fcfb3e66_darkside.exe 1864 2024-03-11_22a0002d0c856af8ce443c65fcfb3e66_darkside.exe 1864 2024-03-11_22a0002d0c856af8ce443c65fcfb3e66_darkside.exe 1864 2024-03-11_22a0002d0c856af8ce443c65fcfb3e66_darkside.exe 1864 2024-03-11_22a0002d0c856af8ce443c65fcfb3e66_darkside.exe 1864 2024-03-11_22a0002d0c856af8ce443c65fcfb3e66_darkside.exe 1864 2024-03-11_22a0002d0c856af8ce443c65fcfb3e66_darkside.exe 1864 2024-03-11_22a0002d0c856af8ce443c65fcfb3e66_darkside.exe 1864 2024-03-11_22a0002d0c856af8ce443c65fcfb3e66_darkside.exe 1864 2024-03-11_22a0002d0c856af8ce443c65fcfb3e66_darkside.exe 1864 2024-03-11_22a0002d0c856af8ce443c65fcfb3e66_darkside.exe 1864 2024-03-11_22a0002d0c856af8ce443c65fcfb3e66_darkside.exe 1864 2024-03-11_22a0002d0c856af8ce443c65fcfb3e66_darkside.exe 1864 2024-03-11_22a0002d0c856af8ce443c65fcfb3e66_darkside.exe 1864 2024-03-11_22a0002d0c856af8ce443c65fcfb3e66_darkside.exe 1864 2024-03-11_22a0002d0c856af8ce443c65fcfb3e66_darkside.exe 1864 2024-03-11_22a0002d0c856af8ce443c65fcfb3e66_darkside.exe 1864 2024-03-11_22a0002d0c856af8ce443c65fcfb3e66_darkside.exe 1864 2024-03-11_22a0002d0c856af8ce443c65fcfb3e66_darkside.exe 1864 2024-03-11_22a0002d0c856af8ce443c65fcfb3e66_darkside.exe 1864 2024-03-11_22a0002d0c856af8ce443c65fcfb3e66_darkside.exe 1864 2024-03-11_22a0002d0c856af8ce443c65fcfb3e66_darkside.exe 1864 2024-03-11_22a0002d0c856af8ce443c65fcfb3e66_darkside.exe 1864 2024-03-11_22a0002d0c856af8ce443c65fcfb3e66_darkside.exe 1864 2024-03-11_22a0002d0c856af8ce443c65fcfb3e66_darkside.exe 1864 2024-03-11_22a0002d0c856af8ce443c65fcfb3e66_darkside.exe 1864 2024-03-11_22a0002d0c856af8ce443c65fcfb3e66_darkside.exe 1864 2024-03-11_22a0002d0c856af8ce443c65fcfb3e66_darkside.exe 1864 2024-03-11_22a0002d0c856af8ce443c65fcfb3e66_darkside.exe 1864 2024-03-11_22a0002d0c856af8ce443c65fcfb3e66_darkside.exe 1864 2024-03-11_22a0002d0c856af8ce443c65fcfb3e66_darkside.exe 1864 2024-03-11_22a0002d0c856af8ce443c65fcfb3e66_darkside.exe 1864 2024-03-11_22a0002d0c856af8ce443c65fcfb3e66_darkside.exe 1864 2024-03-11_22a0002d0c856af8ce443c65fcfb3e66_darkside.exe 1864 2024-03-11_22a0002d0c856af8ce443c65fcfb3e66_darkside.exe 1864 2024-03-11_22a0002d0c856af8ce443c65fcfb3e66_darkside.exe 1864 2024-03-11_22a0002d0c856af8ce443c65fcfb3e66_darkside.exe 1864 2024-03-11_22a0002d0c856af8ce443c65fcfb3e66_darkside.exe 1864 2024-03-11_22a0002d0c856af8ce443c65fcfb3e66_darkside.exe 1864 2024-03-11_22a0002d0c856af8ce443c65fcfb3e66_darkside.exe 1864 2024-03-11_22a0002d0c856af8ce443c65fcfb3e66_darkside.exe 1864 2024-03-11_22a0002d0c856af8ce443c65fcfb3e66_darkside.exe 1864 2024-03-11_22a0002d0c856af8ce443c65fcfb3e66_darkside.exe 1864 2024-03-11_22a0002d0c856af8ce443c65fcfb3e66_darkside.exe 1864 2024-03-11_22a0002d0c856af8ce443c65fcfb3e66_darkside.exe 1864 2024-03-11_22a0002d0c856af8ce443c65fcfb3e66_darkside.exe 1864 2024-03-11_22a0002d0c856af8ce443c65fcfb3e66_darkside.exe 1864 2024-03-11_22a0002d0c856af8ce443c65fcfb3e66_darkside.exe 1864 2024-03-11_22a0002d0c856af8ce443c65fcfb3e66_darkside.exe 1864 2024-03-11_22a0002d0c856af8ce443c65fcfb3e66_darkside.exe 1864 2024-03-11_22a0002d0c856af8ce443c65fcfb3e66_darkside.exe 1864 2024-03-11_22a0002d0c856af8ce443c65fcfb3e66_darkside.exe -
Suspicious behavior: RenamesItself 26 IoCs
Processes:
16C0.tmppid process 3044 16C0.tmp 3044 16C0.tmp 3044 16C0.tmp 3044 16C0.tmp 3044 16C0.tmp 3044 16C0.tmp 3044 16C0.tmp 3044 16C0.tmp 3044 16C0.tmp 3044 16C0.tmp 3044 16C0.tmp 3044 16C0.tmp 3044 16C0.tmp 3044 16C0.tmp 3044 16C0.tmp 3044 16C0.tmp 3044 16C0.tmp 3044 16C0.tmp 3044 16C0.tmp 3044 16C0.tmp 3044 16C0.tmp 3044 16C0.tmp 3044 16C0.tmp 3044 16C0.tmp 3044 16C0.tmp 3044 16C0.tmp -
Suspicious use of AdjustPrivilegeToken 64 IoCs
Processes:
2024-03-11_22a0002d0c856af8ce443c65fcfb3e66_darkside.exedescription pid process Token: SeAssignPrimaryTokenPrivilege 1864 2024-03-11_22a0002d0c856af8ce443c65fcfb3e66_darkside.exe Token: SeBackupPrivilege 1864 2024-03-11_22a0002d0c856af8ce443c65fcfb3e66_darkside.exe Token: SeDebugPrivilege 1864 2024-03-11_22a0002d0c856af8ce443c65fcfb3e66_darkside.exe Token: 36 1864 2024-03-11_22a0002d0c856af8ce443c65fcfb3e66_darkside.exe Token: SeImpersonatePrivilege 1864 2024-03-11_22a0002d0c856af8ce443c65fcfb3e66_darkside.exe Token: SeIncBasePriorityPrivilege 1864 2024-03-11_22a0002d0c856af8ce443c65fcfb3e66_darkside.exe Token: SeIncreaseQuotaPrivilege 1864 2024-03-11_22a0002d0c856af8ce443c65fcfb3e66_darkside.exe Token: 33 1864 2024-03-11_22a0002d0c856af8ce443c65fcfb3e66_darkside.exe Token: SeManageVolumePrivilege 1864 2024-03-11_22a0002d0c856af8ce443c65fcfb3e66_darkside.exe Token: SeProfSingleProcessPrivilege 1864 2024-03-11_22a0002d0c856af8ce443c65fcfb3e66_darkside.exe Token: SeRestorePrivilege 1864 2024-03-11_22a0002d0c856af8ce443c65fcfb3e66_darkside.exe Token: SeSecurityPrivilege 1864 2024-03-11_22a0002d0c856af8ce443c65fcfb3e66_darkside.exe Token: SeSystemProfilePrivilege 1864 2024-03-11_22a0002d0c856af8ce443c65fcfb3e66_darkside.exe Token: SeTakeOwnershipPrivilege 1864 2024-03-11_22a0002d0c856af8ce443c65fcfb3e66_darkside.exe Token: SeShutdownPrivilege 1864 2024-03-11_22a0002d0c856af8ce443c65fcfb3e66_darkside.exe Token: SeDebugPrivilege 1864 2024-03-11_22a0002d0c856af8ce443c65fcfb3e66_darkside.exe Token: SeBackupPrivilege 1864 2024-03-11_22a0002d0c856af8ce443c65fcfb3e66_darkside.exe Token: SeBackupPrivilege 1864 2024-03-11_22a0002d0c856af8ce443c65fcfb3e66_darkside.exe Token: SeSecurityPrivilege 1864 2024-03-11_22a0002d0c856af8ce443c65fcfb3e66_darkside.exe Token: SeSecurityPrivilege 1864 2024-03-11_22a0002d0c856af8ce443c65fcfb3e66_darkside.exe Token: SeBackupPrivilege 1864 2024-03-11_22a0002d0c856af8ce443c65fcfb3e66_darkside.exe Token: SeBackupPrivilege 1864 2024-03-11_22a0002d0c856af8ce443c65fcfb3e66_darkside.exe Token: SeSecurityPrivilege 1864 2024-03-11_22a0002d0c856af8ce443c65fcfb3e66_darkside.exe Token: SeSecurityPrivilege 1864 2024-03-11_22a0002d0c856af8ce443c65fcfb3e66_darkside.exe Token: SeBackupPrivilege 1864 2024-03-11_22a0002d0c856af8ce443c65fcfb3e66_darkside.exe Token: SeBackupPrivilege 1864 2024-03-11_22a0002d0c856af8ce443c65fcfb3e66_darkside.exe Token: SeSecurityPrivilege 1864 2024-03-11_22a0002d0c856af8ce443c65fcfb3e66_darkside.exe Token: SeSecurityPrivilege 1864 2024-03-11_22a0002d0c856af8ce443c65fcfb3e66_darkside.exe Token: SeBackupPrivilege 1864 2024-03-11_22a0002d0c856af8ce443c65fcfb3e66_darkside.exe Token: SeBackupPrivilege 1864 2024-03-11_22a0002d0c856af8ce443c65fcfb3e66_darkside.exe Token: SeSecurityPrivilege 1864 2024-03-11_22a0002d0c856af8ce443c65fcfb3e66_darkside.exe Token: SeSecurityPrivilege 1864 2024-03-11_22a0002d0c856af8ce443c65fcfb3e66_darkside.exe Token: SeBackupPrivilege 1864 2024-03-11_22a0002d0c856af8ce443c65fcfb3e66_darkside.exe Token: SeBackupPrivilege 1864 2024-03-11_22a0002d0c856af8ce443c65fcfb3e66_darkside.exe Token: SeSecurityPrivilege 1864 2024-03-11_22a0002d0c856af8ce443c65fcfb3e66_darkside.exe Token: SeSecurityPrivilege 1864 2024-03-11_22a0002d0c856af8ce443c65fcfb3e66_darkside.exe Token: SeBackupPrivilege 1864 2024-03-11_22a0002d0c856af8ce443c65fcfb3e66_darkside.exe Token: SeBackupPrivilege 1864 2024-03-11_22a0002d0c856af8ce443c65fcfb3e66_darkside.exe Token: SeSecurityPrivilege 1864 2024-03-11_22a0002d0c856af8ce443c65fcfb3e66_darkside.exe Token: SeSecurityPrivilege 1864 2024-03-11_22a0002d0c856af8ce443c65fcfb3e66_darkside.exe Token: SeBackupPrivilege 1864 2024-03-11_22a0002d0c856af8ce443c65fcfb3e66_darkside.exe Token: SeBackupPrivilege 1864 2024-03-11_22a0002d0c856af8ce443c65fcfb3e66_darkside.exe Token: SeSecurityPrivilege 1864 2024-03-11_22a0002d0c856af8ce443c65fcfb3e66_darkside.exe Token: SeSecurityPrivilege 1864 2024-03-11_22a0002d0c856af8ce443c65fcfb3e66_darkside.exe Token: SeBackupPrivilege 1864 2024-03-11_22a0002d0c856af8ce443c65fcfb3e66_darkside.exe Token: SeBackupPrivilege 1864 2024-03-11_22a0002d0c856af8ce443c65fcfb3e66_darkside.exe Token: SeSecurityPrivilege 1864 2024-03-11_22a0002d0c856af8ce443c65fcfb3e66_darkside.exe Token: SeSecurityPrivilege 1864 2024-03-11_22a0002d0c856af8ce443c65fcfb3e66_darkside.exe Token: SeBackupPrivilege 1864 2024-03-11_22a0002d0c856af8ce443c65fcfb3e66_darkside.exe Token: SeBackupPrivilege 1864 2024-03-11_22a0002d0c856af8ce443c65fcfb3e66_darkside.exe Token: SeSecurityPrivilege 1864 2024-03-11_22a0002d0c856af8ce443c65fcfb3e66_darkside.exe Token: SeSecurityPrivilege 1864 2024-03-11_22a0002d0c856af8ce443c65fcfb3e66_darkside.exe Token: SeBackupPrivilege 1864 2024-03-11_22a0002d0c856af8ce443c65fcfb3e66_darkside.exe Token: SeBackupPrivilege 1864 2024-03-11_22a0002d0c856af8ce443c65fcfb3e66_darkside.exe Token: SeSecurityPrivilege 1864 2024-03-11_22a0002d0c856af8ce443c65fcfb3e66_darkside.exe Token: SeSecurityPrivilege 1864 2024-03-11_22a0002d0c856af8ce443c65fcfb3e66_darkside.exe Token: SeBackupPrivilege 1864 2024-03-11_22a0002d0c856af8ce443c65fcfb3e66_darkside.exe Token: SeBackupPrivilege 1864 2024-03-11_22a0002d0c856af8ce443c65fcfb3e66_darkside.exe Token: SeSecurityPrivilege 1864 2024-03-11_22a0002d0c856af8ce443c65fcfb3e66_darkside.exe Token: SeSecurityPrivilege 1864 2024-03-11_22a0002d0c856af8ce443c65fcfb3e66_darkside.exe Token: SeBackupPrivilege 1864 2024-03-11_22a0002d0c856af8ce443c65fcfb3e66_darkside.exe Token: SeBackupPrivilege 1864 2024-03-11_22a0002d0c856af8ce443c65fcfb3e66_darkside.exe Token: SeSecurityPrivilege 1864 2024-03-11_22a0002d0c856af8ce443c65fcfb3e66_darkside.exe Token: SeSecurityPrivilege 1864 2024-03-11_22a0002d0c856af8ce443c65fcfb3e66_darkside.exe -
Suspicious use of SetWindowsHookEx 13 IoCs
Processes:
ONENOTE.EXEpid process 3660 ONENOTE.EXE 3660 ONENOTE.EXE 3660 ONENOTE.EXE 3660 ONENOTE.EXE 3660 ONENOTE.EXE 3660 ONENOTE.EXE 3660 ONENOTE.EXE 3660 ONENOTE.EXE 3660 ONENOTE.EXE 3660 ONENOTE.EXE 3660 ONENOTE.EXE 3660 ONENOTE.EXE 3660 ONENOTE.EXE -
Suspicious use of WriteProcessMemory 11 IoCs
Processes:
2024-03-11_22a0002d0c856af8ce443c65fcfb3e66_darkside.exeprintfilterpipelinesvc.exe16C0.tmpdescription pid process target process PID 1864 wrote to memory of 3568 1864 2024-03-11_22a0002d0c856af8ce443c65fcfb3e66_darkside.exe splwow64.exe PID 1864 wrote to memory of 3568 1864 2024-03-11_22a0002d0c856af8ce443c65fcfb3e66_darkside.exe splwow64.exe PID 2164 wrote to memory of 3660 2164 printfilterpipelinesvc.exe ONENOTE.EXE PID 2164 wrote to memory of 3660 2164 printfilterpipelinesvc.exe ONENOTE.EXE PID 1864 wrote to memory of 3044 1864 2024-03-11_22a0002d0c856af8ce443c65fcfb3e66_darkside.exe 16C0.tmp PID 1864 wrote to memory of 3044 1864 2024-03-11_22a0002d0c856af8ce443c65fcfb3e66_darkside.exe 16C0.tmp PID 1864 wrote to memory of 3044 1864 2024-03-11_22a0002d0c856af8ce443c65fcfb3e66_darkside.exe 16C0.tmp PID 1864 wrote to memory of 3044 1864 2024-03-11_22a0002d0c856af8ce443c65fcfb3e66_darkside.exe 16C0.tmp PID 3044 wrote to memory of 4828 3044 16C0.tmp cmd.exe PID 3044 wrote to memory of 4828 3044 16C0.tmp cmd.exe PID 3044 wrote to memory of 4828 3044 16C0.tmp cmd.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-03-11_22a0002d0c856af8ce443c65fcfb3e66_darkside.exe"C:\Users\Admin\AppData\Local\Temp\2024-03-11_22a0002d0c856af8ce443c65fcfb3e66_darkside.exe"1⤵
- Drops desktop.ini file(s)
- Sets desktop wallpaper using registry
- Modifies Control Panel
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1864 -
C:\Windows\splwow64.exeC:\Windows\splwow64.exe 122882⤵
- Drops file in System32 directory
PID:3568
-
-
C:\ProgramData\16C0.tmp"C:\ProgramData\16C0.tmp"2⤵
- Checks computer location settings
- Deletes itself
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:3044 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C DEL /F /Q C:\PROGRA~3\16C0.tmp >> NUL3⤵PID:4828
-
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k PrintWorkflow -s PrintWorkflowUserSvc1⤵PID:1484
-
C:\Windows\system32\printfilterpipelinesvc.exeC:\Windows\system32\printfilterpipelinesvc.exe -Embedding1⤵
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:2164 -
C:\Program Files\Microsoft Office\root\Office16\ONENOTE.EXE/insertdoc "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\{DC68C758-98D3-435F-AAF7-63811FDCDC04}.xps" 1335461649398800002⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious use of SetWindowsHookEx
PID:3660
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
129B
MD57283f27f3989edd11b94873a2fa74d87
SHA192f73e5368d207590cffa387b3c28984f41f0be8
SHA256c9893943aa654e51c36d779fbca19609306e20e94e697089a27c48737977ab2a
SHA512036a885e26d2927915f2942e4832a74241ff6939a9d5058b7681683231c3b03645ce9fc7ef1b1c7f15e700cc5afe1a1bed8d728e84d07d4a91b21cd38425217f
-
Filesize
14KB
MD5294e9f64cb1642dd89229fff0592856b
SHA197b148c27f3da29ba7b18d6aee8a0db9102f47c9
SHA256917e115cc403e29b4388e0d175cbfac3e7e40ca1742299fbdb353847db2de7c2
SHA512b87d531890bf1577b9b4af41dddb2cdbbfa164cf197bd5987df3a3075983645a3acba443e289b7bfd338422978a104f55298fbfe346872de0895bde44adc89cf
-
Filesize
153KB
MD52d6860673e99962b483ca6023b850493
SHA12e0465c0abb9939f33c17382480a80a70280536b
SHA2566c406621835f8daa7e779fb91c5a3d6ca0ec0a5ed6fec4d2d05b7e4e1a17ade9
SHA512dfca4b6c83b231f20a6b91eec9dedd7ef4d247be8a719f8a36eab301d5765547a020579dc9c36c90df88a0d2149a2291c37d3f82b407d74b536851b23ed38de4
-
Filesize
4KB
MD50077cfc77d193c3bd67357cd3d35432f
SHA1504b46202501d4f12499e6ef187a9aefba47a3ca
SHA256427b1475b054424616ad40761fe9688098ba86c9b72863d7738986af468ef83d
SHA512725a7699eacdda8a0efc232ef7eb0fc3cd639e0596f3644e198c0bf8e8d6c0b114a16c7a520097d7bf74c1ab34f2f891ea07811c95035bb951cf94ee06ea5804
-
Filesize
6KB
MD5925628a04137959fcb4f6d98274fc2da
SHA144700f588ed58fe9a52165b539375058c026117e
SHA25659741572f7916999fc43d63e08f51501881c58723ab0496e737a4c72c7e698f3
SHA512db9e94974c21feb45aad92e072dc5e12dbe4cd7909f6383ad5ae04d2d124787b54559159600f0b709509e8434882beebdcd23668b40ac0f843c82313a16d3f9e
-
Filesize
129B
MD57f5709c7cd72800c3b5df38574521de2
SHA111440296909e66acbd7b246cdcf6b599ce211929
SHA25657e88554425a023932981003364445c2052a05cea54b4cc54dd57b08d4005d1d
SHA512fcaf8b9232b7d1aefd88a5eac3fedb7eab8a7a3979e48f4f8e001dc6b834651f59097f7e1f6608b2bec7cacc53696e6a3e97c708cdd078058064b5608dc233ee