Analysis
-
max time kernel
120s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240220-en -
resource tags
arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system -
submitted
13-03-2024 22:32
Behavioral task
behavioral1
Sample
2024-03-13_ac6a7885e55155b6025f45bf90d5af64_darkside.exe
Resource
win7-20240220-en
Behavioral task
behavioral2
Sample
2024-03-13_ac6a7885e55155b6025f45bf90d5af64_darkside.exe
Resource
win10v2004-20240226-en
General
-
Target
2024-03-13_ac6a7885e55155b6025f45bf90d5af64_darkside.exe
-
Size
149KB
-
MD5
ac6a7885e55155b6025f45bf90d5af64
-
SHA1
08d5edf13c34b78c68c6a01e1f2346baa9de5d54
-
SHA256
a779818597f3d64aac07f3db86bfa6019bf84069691e581f9f2d1b5a0c15daf0
-
SHA512
1d13fb7f5808392883e9644b91d4423765f3ac063ade2d511c85302fb9c9ebe5d2819f908b2223bf20f49b3162879bef60f50980d70b7fc4f90d8c1b5be47e51
-
SSDEEP
3072:S6glyuxE4GsUPnliByocWepBoOoWPuqMLWlYcaS:S6gDBGpvEByocWejotfqMClY0
Malware Config
Extracted
C:\LPJKYjRBM.README.txt
lockbit
https://twitter.com/hashtag/lockbit?f=live
https://tox.chat/download.html
Signatures
-
Lockbit
Ransomware family with multiple variants released since late 2019.
-
Renames multiple (348) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Drops desktop.ini file(s) 2 IoCs
Processes:
2024-03-13_ac6a7885e55155b6025f45bf90d5af64_darkside.exedescription ioc process File opened for modification C:\$Recycle.Bin\S-1-5-21-2721934792-624042501-2768869379-1000\desktop.ini 2024-03-13_ac6a7885e55155b6025f45bf90d5af64_darkside.exe File opened for modification F:\$RECYCLE.BIN\S-1-5-21-2721934792-624042501-2768869379-1000\desktop.ini 2024-03-13_ac6a7885e55155b6025f45bf90d5af64_darkside.exe -
Sets desktop wallpaper using registry 2 TTPs 2 IoCs
Processes:
2024-03-13_ac6a7885e55155b6025f45bf90d5af64_darkside.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Control Panel\Desktop\WallPaper = "C:\\ProgramData\\LPJKYjRBM.bmp" 2024-03-13_ac6a7885e55155b6025f45bf90d5af64_darkside.exe Set value (str) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Control Panel\Desktop\Wallpaper = "C:\\ProgramData\\LPJKYjRBM.bmp" 2024-03-13_ac6a7885e55155b6025f45bf90d5af64_darkside.exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 4 IoCs
Processes:
2024-03-13_ac6a7885e55155b6025f45bf90d5af64_darkside.exepid process 1660 2024-03-13_ac6a7885e55155b6025f45bf90d5af64_darkside.exe 1660 2024-03-13_ac6a7885e55155b6025f45bf90d5af64_darkside.exe 1660 2024-03-13_ac6a7885e55155b6025f45bf90d5af64_darkside.exe 1660 2024-03-13_ac6a7885e55155b6025f45bf90d5af64_darkside.exe -
Modifies Control Panel 2 IoCs
Processes:
2024-03-13_ac6a7885e55155b6025f45bf90d5af64_darkside.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Control Panel\Desktop 2024-03-13_ac6a7885e55155b6025f45bf90d5af64_darkside.exe Set value (str) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Control Panel\Desktop\WallpaperStyle = "10" 2024-03-13_ac6a7885e55155b6025f45bf90d5af64_darkside.exe -
Modifies registry class 5 IoCs
Processes:
2024-03-13_ac6a7885e55155b6025f45bf90d5af64_darkside.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\LPJKYjRBM\DefaultIcon 2024-03-13_ac6a7885e55155b6025f45bf90d5af64_darkside.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\LPJKYjRBM 2024-03-13_ac6a7885e55155b6025f45bf90d5af64_darkside.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\LPJKYjRBM\DefaultIcon\ = "C:\\ProgramData\\LPJKYjRBM.ico" 2024-03-13_ac6a7885e55155b6025f45bf90d5af64_darkside.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.LPJKYjRBM 2024-03-13_ac6a7885e55155b6025f45bf90d5af64_darkside.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.LPJKYjRBM\ = "LPJKYjRBM" 2024-03-13_ac6a7885e55155b6025f45bf90d5af64_darkside.exe -
Suspicious behavior: EnumeratesProcesses 14 IoCs
Processes:
2024-03-13_ac6a7885e55155b6025f45bf90d5af64_darkside.exepid process 1660 2024-03-13_ac6a7885e55155b6025f45bf90d5af64_darkside.exe 1660 2024-03-13_ac6a7885e55155b6025f45bf90d5af64_darkside.exe 1660 2024-03-13_ac6a7885e55155b6025f45bf90d5af64_darkside.exe 1660 2024-03-13_ac6a7885e55155b6025f45bf90d5af64_darkside.exe 1660 2024-03-13_ac6a7885e55155b6025f45bf90d5af64_darkside.exe 1660 2024-03-13_ac6a7885e55155b6025f45bf90d5af64_darkside.exe 1660 2024-03-13_ac6a7885e55155b6025f45bf90d5af64_darkside.exe 1660 2024-03-13_ac6a7885e55155b6025f45bf90d5af64_darkside.exe 1660 2024-03-13_ac6a7885e55155b6025f45bf90d5af64_darkside.exe 1660 2024-03-13_ac6a7885e55155b6025f45bf90d5af64_darkside.exe 1660 2024-03-13_ac6a7885e55155b6025f45bf90d5af64_darkside.exe 1660 2024-03-13_ac6a7885e55155b6025f45bf90d5af64_darkside.exe 1660 2024-03-13_ac6a7885e55155b6025f45bf90d5af64_darkside.exe 1660 2024-03-13_ac6a7885e55155b6025f45bf90d5af64_darkside.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
Processes:
2024-03-13_ac6a7885e55155b6025f45bf90d5af64_darkside.exedescription pid process Token: SeAssignPrimaryTokenPrivilege 1660 2024-03-13_ac6a7885e55155b6025f45bf90d5af64_darkside.exe Token: SeBackupPrivilege 1660 2024-03-13_ac6a7885e55155b6025f45bf90d5af64_darkside.exe Token: SeDebugPrivilege 1660 2024-03-13_ac6a7885e55155b6025f45bf90d5af64_darkside.exe Token: 36 1660 2024-03-13_ac6a7885e55155b6025f45bf90d5af64_darkside.exe Token: SeImpersonatePrivilege 1660 2024-03-13_ac6a7885e55155b6025f45bf90d5af64_darkside.exe Token: SeIncBasePriorityPrivilege 1660 2024-03-13_ac6a7885e55155b6025f45bf90d5af64_darkside.exe Token: SeIncreaseQuotaPrivilege 1660 2024-03-13_ac6a7885e55155b6025f45bf90d5af64_darkside.exe Token: 33 1660 2024-03-13_ac6a7885e55155b6025f45bf90d5af64_darkside.exe Token: SeManageVolumePrivilege 1660 2024-03-13_ac6a7885e55155b6025f45bf90d5af64_darkside.exe Token: SeProfSingleProcessPrivilege 1660 2024-03-13_ac6a7885e55155b6025f45bf90d5af64_darkside.exe Token: SeRestorePrivilege 1660 2024-03-13_ac6a7885e55155b6025f45bf90d5af64_darkside.exe Token: SeSecurityPrivilege 1660 2024-03-13_ac6a7885e55155b6025f45bf90d5af64_darkside.exe Token: SeSystemProfilePrivilege 1660 2024-03-13_ac6a7885e55155b6025f45bf90d5af64_darkside.exe Token: SeTakeOwnershipPrivilege 1660 2024-03-13_ac6a7885e55155b6025f45bf90d5af64_darkside.exe Token: SeShutdownPrivilege 1660 2024-03-13_ac6a7885e55155b6025f45bf90d5af64_darkside.exe Token: SeDebugPrivilege 1660 2024-03-13_ac6a7885e55155b6025f45bf90d5af64_darkside.exe Token: SeBackupPrivilege 1660 2024-03-13_ac6a7885e55155b6025f45bf90d5af64_darkside.exe Token: SeBackupPrivilege 1660 2024-03-13_ac6a7885e55155b6025f45bf90d5af64_darkside.exe Token: SeSecurityPrivilege 1660 2024-03-13_ac6a7885e55155b6025f45bf90d5af64_darkside.exe Token: SeSecurityPrivilege 1660 2024-03-13_ac6a7885e55155b6025f45bf90d5af64_darkside.exe Token: SeBackupPrivilege 1660 2024-03-13_ac6a7885e55155b6025f45bf90d5af64_darkside.exe Token: SeBackupPrivilege 1660 2024-03-13_ac6a7885e55155b6025f45bf90d5af64_darkside.exe Token: SeSecurityPrivilege 1660 2024-03-13_ac6a7885e55155b6025f45bf90d5af64_darkside.exe Token: SeSecurityPrivilege 1660 2024-03-13_ac6a7885e55155b6025f45bf90d5af64_darkside.exe Token: SeBackupPrivilege 1660 2024-03-13_ac6a7885e55155b6025f45bf90d5af64_darkside.exe Token: SeBackupPrivilege 1660 2024-03-13_ac6a7885e55155b6025f45bf90d5af64_darkside.exe Token: SeSecurityPrivilege 1660 2024-03-13_ac6a7885e55155b6025f45bf90d5af64_darkside.exe Token: SeSecurityPrivilege 1660 2024-03-13_ac6a7885e55155b6025f45bf90d5af64_darkside.exe Token: SeBackupPrivilege 1660 2024-03-13_ac6a7885e55155b6025f45bf90d5af64_darkside.exe Token: SeBackupPrivilege 1660 2024-03-13_ac6a7885e55155b6025f45bf90d5af64_darkside.exe Token: SeSecurityPrivilege 1660 2024-03-13_ac6a7885e55155b6025f45bf90d5af64_darkside.exe Token: SeSecurityPrivilege 1660 2024-03-13_ac6a7885e55155b6025f45bf90d5af64_darkside.exe Token: SeBackupPrivilege 1660 2024-03-13_ac6a7885e55155b6025f45bf90d5af64_darkside.exe Token: SeBackupPrivilege 1660 2024-03-13_ac6a7885e55155b6025f45bf90d5af64_darkside.exe Token: SeSecurityPrivilege 1660 2024-03-13_ac6a7885e55155b6025f45bf90d5af64_darkside.exe Token: SeSecurityPrivilege 1660 2024-03-13_ac6a7885e55155b6025f45bf90d5af64_darkside.exe Token: SeBackupPrivilege 1660 2024-03-13_ac6a7885e55155b6025f45bf90d5af64_darkside.exe Token: SeBackupPrivilege 1660 2024-03-13_ac6a7885e55155b6025f45bf90d5af64_darkside.exe Token: SeSecurityPrivilege 1660 2024-03-13_ac6a7885e55155b6025f45bf90d5af64_darkside.exe Token: SeSecurityPrivilege 1660 2024-03-13_ac6a7885e55155b6025f45bf90d5af64_darkside.exe Token: SeBackupPrivilege 1660 2024-03-13_ac6a7885e55155b6025f45bf90d5af64_darkside.exe Token: SeBackupPrivilege 1660 2024-03-13_ac6a7885e55155b6025f45bf90d5af64_darkside.exe Token: SeSecurityPrivilege 1660 2024-03-13_ac6a7885e55155b6025f45bf90d5af64_darkside.exe Token: SeSecurityPrivilege 1660 2024-03-13_ac6a7885e55155b6025f45bf90d5af64_darkside.exe Token: SeBackupPrivilege 1660 2024-03-13_ac6a7885e55155b6025f45bf90d5af64_darkside.exe Token: SeBackupPrivilege 1660 2024-03-13_ac6a7885e55155b6025f45bf90d5af64_darkside.exe Token: SeSecurityPrivilege 1660 2024-03-13_ac6a7885e55155b6025f45bf90d5af64_darkside.exe Token: SeSecurityPrivilege 1660 2024-03-13_ac6a7885e55155b6025f45bf90d5af64_darkside.exe Token: SeBackupPrivilege 1660 2024-03-13_ac6a7885e55155b6025f45bf90d5af64_darkside.exe Token: SeBackupPrivilege 1660 2024-03-13_ac6a7885e55155b6025f45bf90d5af64_darkside.exe Token: SeSecurityPrivilege 1660 2024-03-13_ac6a7885e55155b6025f45bf90d5af64_darkside.exe Token: SeSecurityPrivilege 1660 2024-03-13_ac6a7885e55155b6025f45bf90d5af64_darkside.exe Token: SeBackupPrivilege 1660 2024-03-13_ac6a7885e55155b6025f45bf90d5af64_darkside.exe Token: SeBackupPrivilege 1660 2024-03-13_ac6a7885e55155b6025f45bf90d5af64_darkside.exe Token: SeSecurityPrivilege 1660 2024-03-13_ac6a7885e55155b6025f45bf90d5af64_darkside.exe Token: SeSecurityPrivilege 1660 2024-03-13_ac6a7885e55155b6025f45bf90d5af64_darkside.exe Token: SeBackupPrivilege 1660 2024-03-13_ac6a7885e55155b6025f45bf90d5af64_darkside.exe Token: SeBackupPrivilege 1660 2024-03-13_ac6a7885e55155b6025f45bf90d5af64_darkside.exe Token: SeSecurityPrivilege 1660 2024-03-13_ac6a7885e55155b6025f45bf90d5af64_darkside.exe Token: SeSecurityPrivilege 1660 2024-03-13_ac6a7885e55155b6025f45bf90d5af64_darkside.exe Token: SeBackupPrivilege 1660 2024-03-13_ac6a7885e55155b6025f45bf90d5af64_darkside.exe Token: SeBackupPrivilege 1660 2024-03-13_ac6a7885e55155b6025f45bf90d5af64_darkside.exe Token: SeSecurityPrivilege 1660 2024-03-13_ac6a7885e55155b6025f45bf90d5af64_darkside.exe Token: SeSecurityPrivilege 1660 2024-03-13_ac6a7885e55155b6025f45bf90d5af64_darkside.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-03-13_ac6a7885e55155b6025f45bf90d5af64_darkside.exe"C:\Users\Admin\AppData\Local\Temp\2024-03-13_ac6a7885e55155b6025f45bf90d5af64_darkside.exe"1⤵
- Drops desktop.ini file(s)
- Sets desktop wallpaper using registry
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Modifies Control Panel
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1660
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x1481⤵PID:2020
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
129B
MD5709c0ca5dfd17783930a876dfcee57f3
SHA10d41d2faf715c1eb14cc7157f197a5aa95cdeeee
SHA256a256930ec2ea1030c4b9d6937c744710b0929ff9716f9f376771a22b677f0bbc
SHA51274435de060fd0f18e4afab63877a817732dcd2c615d6c23535cd23eb94a023eb09c14311d126fca80a90670a0010a0bd204c2bc528d1959d3ba81871d719f674
-
Filesize
2KB
MD529fb3b15492cd58b143f7f2d78a40064
SHA15e791c9dedfbcd72eb3e489f2dfe548d61a72909
SHA2561a77cbf05f015ebf999ac303c5258a2dc1b324dba47cdb5f63b899595a1c7fff
SHA5128b6adca04d5939d049016ad60ed184188b1fbed835070896e3094daa29ed3137839d96d37f69840db867c3896f7574aca66b4cec8b41be9a66d59214589ac27b
-
Filesize
129B
MD54cc96dd055de917f324fcfbedf42ac8d
SHA14ccfa411efe3b328a4c570693ce3679cbaffc38a
SHA256f7285d63df526bf8dbcac612d71635397403252e219f0c5540cc466c19a7cfed
SHA51229b567271999aa733c964169658017afbc4eeb62a8c447f34e60aab8fc82b40e15d7a2edb6601cc91d236fa3c675ee251b36763ace120e9e2d899177cf41f1f1