Malware Analysis Report

2024-11-15 07:21

Sample ID 240312-1dtq7sdb94
Target 2024-03-12_75e3d908fdddee413481dba88258783b_darkside
SHA256 36aae3ba1a6fd78e040bba4522f6c15d5a3627ae78b27ff6879ee64d038445a4
Tags
lockbit ransomware
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

36aae3ba1a6fd78e040bba4522f6c15d5a3627ae78b27ff6879ee64d038445a4

Threat Level: Known bad

The file 2024-03-12_75e3d908fdddee413481dba88258783b_darkside was found to be: Known bad.

Malicious Activity Summary

lockbit ransomware

Rule to detect Lockbit 3.0 ransomware Windows payload

Lockbit family

Renames multiple (151) files with added filename extension

Renames multiple (158) files with added filename extension

Deletes itself

Loads dropped DLL

Executes dropped EXE

Drops desktop.ini file(s)

Suspicious use of NtSetInformationThreadHideFromDebugger

Sets desktop wallpaper using registry

Unsigned PE

Suspicious behavior: RenamesItself

Suspicious use of WriteProcessMemory

Suspicious behavior: EnumeratesProcesses

Modifies registry class

Modifies Control Panel

Uses Volume Shadow Copy service COM API

Suspicious use of AdjustPrivilegeToken

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-03-12 21:32

Signatures

Lockbit family

lockbit

Rule to detect Lockbit 3.0 ransomware Windows payload

Description Indicator Process Target
N/A N/A N/A N/A

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-03-12 21:32

Reported

2024-03-12 21:35

Platform

win7-20240221-en

Max time kernel

122s

Max time network

125s

Command Line

"C:\Users\Admin\AppData\Local\Temp\2024-03-12_75e3d908fdddee413481dba88258783b_darkside.exe"

Signatures

Renames multiple (151) files with added filename extension

ransomware

Deletes itself

Description Indicator Process Target
N/A N/A C:\ProgramData\9EBF.tmp N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\ProgramData\9EBF.tmp N/A

Loads dropped DLL

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-03-12_75e3d908fdddee413481dba88258783b_darkside.exe N/A

Drops desktop.ini file(s)

Description Indicator Process Target
File opened for modification C:\$Recycle.Bin\S-1-5-21-406356229-2805545415-1236085040-1000\desktop.ini C:\Users\Admin\AppData\Local\Temp\2024-03-12_75e3d908fdddee413481dba88258783b_darkside.exe N/A
File opened for modification F:\$RECYCLE.BIN\S-1-5-21-406356229-2805545415-1236085040-1000\desktop.ini C:\Users\Admin\AppData\Local\Temp\2024-03-12_75e3d908fdddee413481dba88258783b_darkside.exe N/A

Sets desktop wallpaper using registry

ransomware
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Control Panel\Desktop\WallPaper = "C:\\ProgramData\\O957g99QW.bmp" C:\Users\Admin\AppData\Local\Temp\2024-03-12_75e3d908fdddee413481dba88258783b_darkside.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Control Panel\Desktop\Wallpaper = "C:\\ProgramData\\O957g99QW.bmp" C:\Users\Admin\AppData\Local\Temp\2024-03-12_75e3d908fdddee413481dba88258783b_darkside.exe N/A

Modifies Control Panel

evasion
Description Indicator Process Target
Key created \REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Control Panel\Desktop C:\Users\Admin\AppData\Local\Temp\2024-03-12_75e3d908fdddee413481dba88258783b_darkside.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Control Panel\Desktop\WallpaperStyle = "10" C:\Users\Admin\AppData\Local\Temp\2024-03-12_75e3d908fdddee413481dba88258783b_darkside.exe N/A

Modifies registry class

Description Indicator Process Target
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\O957g99QW C:\Users\Admin\AppData\Local\Temp\2024-03-12_75e3d908fdddee413481dba88258783b_darkside.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\O957g99QW\DefaultIcon\ = "C:\\ProgramData\\O957g99QW.ico" C:\Users\Admin\AppData\Local\Temp\2024-03-12_75e3d908fdddee413481dba88258783b_darkside.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.O957g99QW C:\Users\Admin\AppData\Local\Temp\2024-03-12_75e3d908fdddee413481dba88258783b_darkside.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.O957g99QW\ = "O957g99QW" C:\Users\Admin\AppData\Local\Temp\2024-03-12_75e3d908fdddee413481dba88258783b_darkside.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\O957g99QW\DefaultIcon C:\Users\Admin\AppData\Local\Temp\2024-03-12_75e3d908fdddee413481dba88258783b_darkside.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeAssignPrimaryTokenPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-03-12_75e3d908fdddee413481dba88258783b_darkside.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-03-12_75e3d908fdddee413481dba88258783b_darkside.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-03-12_75e3d908fdddee413481dba88258783b_darkside.exe N/A
Token: 36 N/A C:\Users\Admin\AppData\Local\Temp\2024-03-12_75e3d908fdddee413481dba88258783b_darkside.exe N/A
Token: SeImpersonatePrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-03-12_75e3d908fdddee413481dba88258783b_darkside.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-03-12_75e3d908fdddee413481dba88258783b_darkside.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-03-12_75e3d908fdddee413481dba88258783b_darkside.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Local\Temp\2024-03-12_75e3d908fdddee413481dba88258783b_darkside.exe N/A
Token: SeManageVolumePrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-03-12_75e3d908fdddee413481dba88258783b_darkside.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-03-12_75e3d908fdddee413481dba88258783b_darkside.exe N/A
Token: SeRestorePrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-03-12_75e3d908fdddee413481dba88258783b_darkside.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-03-12_75e3d908fdddee413481dba88258783b_darkside.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-03-12_75e3d908fdddee413481dba88258783b_darkside.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-03-12_75e3d908fdddee413481dba88258783b_darkside.exe N/A
Token: SeShutdownPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-03-12_75e3d908fdddee413481dba88258783b_darkside.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-03-12_75e3d908fdddee413481dba88258783b_darkside.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\system32\vssvc.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\vssvc.exe N/A
Token: SeAuditPrivilege N/A C:\Windows\system32\vssvc.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-03-12_75e3d908fdddee413481dba88258783b_darkside.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-03-12_75e3d908fdddee413481dba88258783b_darkside.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-03-12_75e3d908fdddee413481dba88258783b_darkside.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-03-12_75e3d908fdddee413481dba88258783b_darkside.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-03-12_75e3d908fdddee413481dba88258783b_darkside.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-03-12_75e3d908fdddee413481dba88258783b_darkside.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-03-12_75e3d908fdddee413481dba88258783b_darkside.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-03-12_75e3d908fdddee413481dba88258783b_darkside.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-03-12_75e3d908fdddee413481dba88258783b_darkside.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-03-12_75e3d908fdddee413481dba88258783b_darkside.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-03-12_75e3d908fdddee413481dba88258783b_darkside.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-03-12_75e3d908fdddee413481dba88258783b_darkside.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-03-12_75e3d908fdddee413481dba88258783b_darkside.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-03-12_75e3d908fdddee413481dba88258783b_darkside.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-03-12_75e3d908fdddee413481dba88258783b_darkside.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-03-12_75e3d908fdddee413481dba88258783b_darkside.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-03-12_75e3d908fdddee413481dba88258783b_darkside.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-03-12_75e3d908fdddee413481dba88258783b_darkside.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-03-12_75e3d908fdddee413481dba88258783b_darkside.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-03-12_75e3d908fdddee413481dba88258783b_darkside.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-03-12_75e3d908fdddee413481dba88258783b_darkside.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-03-12_75e3d908fdddee413481dba88258783b_darkside.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-03-12_75e3d908fdddee413481dba88258783b_darkside.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-03-12_75e3d908fdddee413481dba88258783b_darkside.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-03-12_75e3d908fdddee413481dba88258783b_darkside.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-03-12_75e3d908fdddee413481dba88258783b_darkside.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-03-12_75e3d908fdddee413481dba88258783b_darkside.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-03-12_75e3d908fdddee413481dba88258783b_darkside.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-03-12_75e3d908fdddee413481dba88258783b_darkside.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-03-12_75e3d908fdddee413481dba88258783b_darkside.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-03-12_75e3d908fdddee413481dba88258783b_darkside.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-03-12_75e3d908fdddee413481dba88258783b_darkside.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-03-12_75e3d908fdddee413481dba88258783b_darkside.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-03-12_75e3d908fdddee413481dba88258783b_darkside.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-03-12_75e3d908fdddee413481dba88258783b_darkside.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-03-12_75e3d908fdddee413481dba88258783b_darkside.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-03-12_75e3d908fdddee413481dba88258783b_darkside.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-03-12_75e3d908fdddee413481dba88258783b_darkside.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-03-12_75e3d908fdddee413481dba88258783b_darkside.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-03-12_75e3d908fdddee413481dba88258783b_darkside.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-03-12_75e3d908fdddee413481dba88258783b_darkside.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-03-12_75e3d908fdddee413481dba88258783b_darkside.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-03-12_75e3d908fdddee413481dba88258783b_darkside.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-03-12_75e3d908fdddee413481dba88258783b_darkside.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-03-12_75e3d908fdddee413481dba88258783b_darkside.exe N/A

Uses Volume Shadow Copy service COM API

ransomware

Processes

C:\Users\Admin\AppData\Local\Temp\2024-03-12_75e3d908fdddee413481dba88258783b_darkside.exe

"C:\Users\Admin\AppData\Local\Temp\2024-03-12_75e3d908fdddee413481dba88258783b_darkside.exe"

C:\Windows\system32\vssvc.exe

C:\Windows\system32\vssvc.exe

C:\ProgramData\9EBF.tmp

"C:\ProgramData\9EBF.tmp"

C:\Windows\system32\AUDIODG.EXE

C:\Windows\system32\AUDIODG.EXE 0x154

Network

N/A

Files

memory/2240-0-0x0000000000190000-0x00000000001D0000-memory.dmp

C:\$Recycle.Bin\S-1-5-21-406356229-2805545415-1236085040-1000\desktop.ini

MD5 9c04e553575018ae615dddd15f1bbe8a
SHA1 9def192f4fa5f90e86d71187edc7815fbadafd20
SHA256 b6bd31ebfc75e1dd462473ceaeef656a96091221dd329490a01bf5e5c334b269
SHA512 7ae4bab7220be7a5cf801208aa255973b033a836f52287ca4684394ec885ea7302532d8e72aff661030357ffb8d11593983c9a9028004daeafcc1cf98c105056

F:\$RECYCLE.BIN\S-1-5-21-406356229-2805545415-1236085040-1000\DDDDDDDDDDD

MD5 de0d52ff91f8a6f734a1a683ac79685d
SHA1 dcac846caa9edf0814095c32bee6d762443209aa
SHA256 c2f45a45951d0273411c7ed8b29199ac99ecc9d52d3c326cb5e6bb2e06285e3c
SHA512 666f18f2fa665604f468a55c42eb89051c1281f750e88e37adc2b5fd5317a2fdfb2ee1018529fbfcd1da1f7faa882e5ee97ecda396fe0e43c29e98dcfbef4d7e

C:\Users\O957g99QW.README.txt

MD5 b88940fa8bf0e2daabc9f245797260de
SHA1 42f08e7f1e7fab894c6e0be39f0f2da80614a41e
SHA256 34e4e1ec8181985e204eae174c8dffb710de4bdc2e66f1dc38008702a573fdfa
SHA512 70268fd05b6b226c359159ecde017928a33573f344723a2f1aa259e10becac284968a1e00ccb8944cccc53f10e872a385d887bc2b64506d2defa58ef301c2257

\ProgramData\9EBF.tmp

MD5 294e9f64cb1642dd89229fff0592856b
SHA1 97b148c27f3da29ba7b18d6aee8a0db9102f47c9
SHA256 917e115cc403e29b4388e0d175cbfac3e7e40ca1742299fbdb353847db2de7c2
SHA512 b87d531890bf1577b9b4af41dddb2cdbbfa164cf197bd5987df3a3075983645a3acba443e289b7bfd338422978a104f55298fbfe346872de0895bde44adc89cf

memory/2572-282-0x000000007EFA0000-0x000000007EFA1000-memory.dmp

memory/2572-284-0x000000007EF80000-0x000000007EF81000-memory.dmp

memory/2572-283-0x00000000020E0000-0x0000000002120000-memory.dmp

memory/2572-287-0x000000007EF20000-0x000000007EF21000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\DDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDD

MD5 7344144987c0656a8f498f807a9e3183
SHA1 daa26387cb547c9dc3a2e5e3c44130ce3ec42d57
SHA256 21bbffcc29e11c2f1d71911436ab02480a370922f7bf4cb655bb8be03277dae6
SHA512 ba48df7a84847b9a62751e5c1a9c3d4e8cd0191d17aa0c940bb614769394d788ded93e68b8e3daef78e8b821ea9e6745c5b792da62078cfc83e9ef31a839f204

Analysis: behavioral2

Detonation Overview

Submitted

2024-03-12 21:32

Reported

2024-03-12 21:35

Platform

win10v2004-20240226-en

Max time kernel

154s

Max time network

157s

Command Line

"C:\Users\Admin\AppData\Local\Temp\2024-03-12_75e3d908fdddee413481dba88258783b_darkside.exe"

Signatures

Renames multiple (158) files with added filename extension

ransomware

Drops desktop.ini file(s)

Description Indicator Process Target
File opened for modification C:\$Recycle.Bin\S-1-5-21-609813121-2907144057-1731107329-1000\desktop.ini C:\Users\Admin\AppData\Local\Temp\2024-03-12_75e3d908fdddee413481dba88258783b_darkside.exe N/A
File opened for modification F:\$RECYCLE.BIN\S-1-5-21-609813121-2907144057-1731107329-1000\desktop.ini C:\Users\Admin\AppData\Local\Temp\2024-03-12_75e3d908fdddee413481dba88258783b_darkside.exe N/A

Modifies registry class

Description Indicator Process Target
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\O957g99QW C:\Users\Admin\AppData\Local\Temp\2024-03-12_75e3d908fdddee413481dba88258783b_darkside.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\O957g99QW\DefaultIcon\ = "C:\\ProgramData\\O957g99QW.ico" C:\Users\Admin\AppData\Local\Temp\2024-03-12_75e3d908fdddee413481dba88258783b_darkside.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.O957g99QW C:\Users\Admin\AppData\Local\Temp\2024-03-12_75e3d908fdddee413481dba88258783b_darkside.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.O957g99QW\ = "O957g99QW" C:\Users\Admin\AppData\Local\Temp\2024-03-12_75e3d908fdddee413481dba88258783b_darkside.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\O957g99QW\DefaultIcon C:\Users\Admin\AppData\Local\Temp\2024-03-12_75e3d908fdddee413481dba88258783b_darkside.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-03-12_75e3d908fdddee413481dba88258783b_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-03-12_75e3d908fdddee413481dba88258783b_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-03-12_75e3d908fdddee413481dba88258783b_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-03-12_75e3d908fdddee413481dba88258783b_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-03-12_75e3d908fdddee413481dba88258783b_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-03-12_75e3d908fdddee413481dba88258783b_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-03-12_75e3d908fdddee413481dba88258783b_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-03-12_75e3d908fdddee413481dba88258783b_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-03-12_75e3d908fdddee413481dba88258783b_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-03-12_75e3d908fdddee413481dba88258783b_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-03-12_75e3d908fdddee413481dba88258783b_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-03-12_75e3d908fdddee413481dba88258783b_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-03-12_75e3d908fdddee413481dba88258783b_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-03-12_75e3d908fdddee413481dba88258783b_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-03-12_75e3d908fdddee413481dba88258783b_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-03-12_75e3d908fdddee413481dba88258783b_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-03-12_75e3d908fdddee413481dba88258783b_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-03-12_75e3d908fdddee413481dba88258783b_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-03-12_75e3d908fdddee413481dba88258783b_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-03-12_75e3d908fdddee413481dba88258783b_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-03-12_75e3d908fdddee413481dba88258783b_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-03-12_75e3d908fdddee413481dba88258783b_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-03-12_75e3d908fdddee413481dba88258783b_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-03-12_75e3d908fdddee413481dba88258783b_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-03-12_75e3d908fdddee413481dba88258783b_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-03-12_75e3d908fdddee413481dba88258783b_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-03-12_75e3d908fdddee413481dba88258783b_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-03-12_75e3d908fdddee413481dba88258783b_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-03-12_75e3d908fdddee413481dba88258783b_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-03-12_75e3d908fdddee413481dba88258783b_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-03-12_75e3d908fdddee413481dba88258783b_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-03-12_75e3d908fdddee413481dba88258783b_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-03-12_75e3d908fdddee413481dba88258783b_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-03-12_75e3d908fdddee413481dba88258783b_darkside.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeAssignPrimaryTokenPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-03-12_75e3d908fdddee413481dba88258783b_darkside.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-03-12_75e3d908fdddee413481dba88258783b_darkside.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-03-12_75e3d908fdddee413481dba88258783b_darkside.exe N/A
Token: 36 N/A C:\Users\Admin\AppData\Local\Temp\2024-03-12_75e3d908fdddee413481dba88258783b_darkside.exe N/A
Token: SeImpersonatePrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-03-12_75e3d908fdddee413481dba88258783b_darkside.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-03-12_75e3d908fdddee413481dba88258783b_darkside.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-03-12_75e3d908fdddee413481dba88258783b_darkside.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Local\Temp\2024-03-12_75e3d908fdddee413481dba88258783b_darkside.exe N/A
Token: SeManageVolumePrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-03-12_75e3d908fdddee413481dba88258783b_darkside.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-03-12_75e3d908fdddee413481dba88258783b_darkside.exe N/A
Token: SeRestorePrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-03-12_75e3d908fdddee413481dba88258783b_darkside.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-03-12_75e3d908fdddee413481dba88258783b_darkside.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-03-12_75e3d908fdddee413481dba88258783b_darkside.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-03-12_75e3d908fdddee413481dba88258783b_darkside.exe N/A
Token: SeShutdownPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-03-12_75e3d908fdddee413481dba88258783b_darkside.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-03-12_75e3d908fdddee413481dba88258783b_darkside.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\system32\vssvc.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\vssvc.exe N/A
Token: SeAuditPrivilege N/A C:\Windows\system32\vssvc.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-03-12_75e3d908fdddee413481dba88258783b_darkside.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-03-12_75e3d908fdddee413481dba88258783b_darkside.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-03-12_75e3d908fdddee413481dba88258783b_darkside.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-03-12_75e3d908fdddee413481dba88258783b_darkside.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-03-12_75e3d908fdddee413481dba88258783b_darkside.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-03-12_75e3d908fdddee413481dba88258783b_darkside.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-03-12_75e3d908fdddee413481dba88258783b_darkside.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-03-12_75e3d908fdddee413481dba88258783b_darkside.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-03-12_75e3d908fdddee413481dba88258783b_darkside.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-03-12_75e3d908fdddee413481dba88258783b_darkside.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-03-12_75e3d908fdddee413481dba88258783b_darkside.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-03-12_75e3d908fdddee413481dba88258783b_darkside.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-03-12_75e3d908fdddee413481dba88258783b_darkside.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-03-12_75e3d908fdddee413481dba88258783b_darkside.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-03-12_75e3d908fdddee413481dba88258783b_darkside.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-03-12_75e3d908fdddee413481dba88258783b_darkside.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-03-12_75e3d908fdddee413481dba88258783b_darkside.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-03-12_75e3d908fdddee413481dba88258783b_darkside.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-03-12_75e3d908fdddee413481dba88258783b_darkside.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-03-12_75e3d908fdddee413481dba88258783b_darkside.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-03-12_75e3d908fdddee413481dba88258783b_darkside.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-03-12_75e3d908fdddee413481dba88258783b_darkside.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-03-12_75e3d908fdddee413481dba88258783b_darkside.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-03-12_75e3d908fdddee413481dba88258783b_darkside.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-03-12_75e3d908fdddee413481dba88258783b_darkside.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-03-12_75e3d908fdddee413481dba88258783b_darkside.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-03-12_75e3d908fdddee413481dba88258783b_darkside.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-03-12_75e3d908fdddee413481dba88258783b_darkside.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-03-12_75e3d908fdddee413481dba88258783b_darkside.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-03-12_75e3d908fdddee413481dba88258783b_darkside.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-03-12_75e3d908fdddee413481dba88258783b_darkside.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-03-12_75e3d908fdddee413481dba88258783b_darkside.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-03-12_75e3d908fdddee413481dba88258783b_darkside.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-03-12_75e3d908fdddee413481dba88258783b_darkside.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-03-12_75e3d908fdddee413481dba88258783b_darkside.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-03-12_75e3d908fdddee413481dba88258783b_darkside.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-03-12_75e3d908fdddee413481dba88258783b_darkside.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-03-12_75e3d908fdddee413481dba88258783b_darkside.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-03-12_75e3d908fdddee413481dba88258783b_darkside.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-03-12_75e3d908fdddee413481dba88258783b_darkside.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-03-12_75e3d908fdddee413481dba88258783b_darkside.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-03-12_75e3d908fdddee413481dba88258783b_darkside.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-03-12_75e3d908fdddee413481dba88258783b_darkside.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-03-12_75e3d908fdddee413481dba88258783b_darkside.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-03-12_75e3d908fdddee413481dba88258783b_darkside.exe N/A

Uses Volume Shadow Copy service COM API

ransomware

Processes

C:\Users\Admin\AppData\Local\Temp\2024-03-12_75e3d908fdddee413481dba88258783b_darkside.exe

"C:\Users\Admin\AppData\Local\Temp\2024-03-12_75e3d908fdddee413481dba88258783b_darkside.exe"

C:\Windows\system32\vssvc.exe

C:\Windows\system32\vssvc.exe

Network

Country Destination Domain Proto
US 8.8.8.8:53 69.31.126.40.in-addr.arpa udp
US 8.8.8.8:53 240.221.184.93.in-addr.arpa udp
US 8.8.8.8:53 9.228.82.20.in-addr.arpa udp
US 8.8.8.8:53 217.106.137.52.in-addr.arpa udp
US 8.8.8.8:53 16.234.44.23.in-addr.arpa udp
US 8.8.8.8:53 178.223.142.52.in-addr.arpa udp
US 8.8.8.8:53 195.233.44.23.in-addr.arpa udp
US 8.8.8.8:53 55.36.223.20.in-addr.arpa udp
US 8.8.8.8:53 241.154.82.20.in-addr.arpa udp
US 8.8.8.8:53 149.220.183.52.in-addr.arpa udp
US 8.8.8.8:53 183.59.114.20.in-addr.arpa udp
US 8.8.8.8:53 56.126.166.20.in-addr.arpa udp
US 8.8.8.8:53 134.71.91.104.in-addr.arpa udp
US 8.8.8.8:53 tse1.mm.bing.net udp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 8.8.8.8:53 43.229.111.52.in-addr.arpa udp
US 8.8.8.8:53 28.118.140.52.in-addr.arpa udp
US 8.8.8.8:53 9.73.50.20.in-addr.arpa udp

Files

memory/1616-0-0x0000000001320000-0x0000000001330000-memory.dmp

memory/1616-1-0x0000000001320000-0x0000000001330000-memory.dmp

memory/1616-2-0x0000000001320000-0x0000000001330000-memory.dmp

C:\$Recycle.Bin\S-1-5-21-609813121-2907144057-1731107329-1000\AAAAAAAAAAA

MD5 0e5c609d490e26b9bf84e52b2e025c51
SHA1 957153d4df570dadbad1e64f69405a0d3d5580e2
SHA256 b3a551d6c36609ff7282e8f64995308d4e060e26a4f72c423e94fa917534f6b8
SHA512 ae08f29c4775fd94587c384304f2f84b27b577633674a267e8057c1045fbca75e23c23893dea79b734ae7d7ec16693828d8ef152c706724b9bb2b21115bba006

F:\$RECYCLE.BIN\S-1-5-21-609813121-2907144057-1731107329-1000\DDDDDDDDDDD

MD5 cfde14dd4ee675d35cd60385fbb32fab
SHA1 c2fcd7d3d0592ab548b2f84eb3920da58f7c1d81
SHA256 b14774db4944af0294a80fa83095271f10544649c74a668fe6f5dcc436a42d1a
SHA512 d16da60fcdd94dab8c96584e90f7136172f1f04b5805b0f5d05706728c91f02e248b720a46ab71bbcd1b0c43f2669a1459847860ab3086d65d506064f6ca56c1

C:\Users\O957g99QW.README.txt

MD5 1d359e2243649cb97fc92ab9b6f02321
SHA1 909542af4d62c800be87dd40fd67f17c6167cd9a
SHA256 0ca2802f2b7dc5c1678bffdd140368380f7c42cd6ed9df079adcdb2dbd1666b4
SHA512 c3d4fc76f45f37ddc7c071ba6bb86f8ed8c3d8449bb5371a2bfc807d408a1947d745b281c08c65ab246a7da70a3f31cb2c60a29a31577344e14be89d694f04fb

memory/1616-310-0x0000000001320000-0x0000000001330000-memory.dmp

memory/1616-311-0x0000000001320000-0x0000000001330000-memory.dmp

memory/1616-312-0x0000000001320000-0x0000000001330000-memory.dmp