Malware Analysis Report

2024-11-15 07:22

Sample ID 240313-2gexwsdc36
Target 2024-03-13_ac6a7885e55155b6025f45bf90d5af64_darkside
SHA256 a779818597f3d64aac07f3db86bfa6019bf84069691e581f9f2d1b5a0c15daf0
Tags
lockbit ransomware spyware stealer
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

a779818597f3d64aac07f3db86bfa6019bf84069691e581f9f2d1b5a0c15daf0

Threat Level: Known bad

The file 2024-03-13_ac6a7885e55155b6025f45bf90d5af64_darkside was found to be: Known bad.

Malicious Activity Summary

lockbit ransomware spyware stealer

Lockbit

Lockbit family

Rule to detect Lockbit 3.0 ransomware Windows payload

Renames multiple (348) files with added filename extension

Renames multiple (583) files with added filename extension

Reads user/profile data of web browsers

Drops desktop.ini file(s)

Sets desktop wallpaper using registry

Drops file in System32 directory

Suspicious use of NtSetInformationThreadHideFromDebugger

Unsigned PE

Suspicious use of SetWindowsHookEx

Checks processor information in registry

Suspicious behavior: EnumeratesProcesses

Modifies registry class

Suspicious use of AdjustPrivilegeToken

Enumerates system info in registry

Modifies Control Panel

Suspicious use of WriteProcessMemory

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-03-13 22:32

Signatures

Lockbit family

lockbit

Rule to detect Lockbit 3.0 ransomware Windows payload

Description Indicator Process Target
N/A N/A N/A N/A

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-03-13 22:32

Reported

2024-03-13 22:35

Platform

win7-20240220-en

Max time kernel

120s

Max time network

122s

Command Line

"C:\Users\Admin\AppData\Local\Temp\2024-03-13_ac6a7885e55155b6025f45bf90d5af64_darkside.exe"

Signatures

Lockbit

ransomware lockbit

Renames multiple (348) files with added filename extension

ransomware

Reads user/profile data of web browsers

spyware stealer

Drops desktop.ini file(s)

Description Indicator Process Target
File opened for modification C:\$Recycle.Bin\S-1-5-21-2721934792-624042501-2768869379-1000\desktop.ini C:\Users\Admin\AppData\Local\Temp\2024-03-13_ac6a7885e55155b6025f45bf90d5af64_darkside.exe N/A
File opened for modification F:\$RECYCLE.BIN\S-1-5-21-2721934792-624042501-2768869379-1000\desktop.ini C:\Users\Admin\AppData\Local\Temp\2024-03-13_ac6a7885e55155b6025f45bf90d5af64_darkside.exe N/A

Sets desktop wallpaper using registry

ransomware
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Control Panel\Desktop\WallPaper = "C:\\ProgramData\\LPJKYjRBM.bmp" C:\Users\Admin\AppData\Local\Temp\2024-03-13_ac6a7885e55155b6025f45bf90d5af64_darkside.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Control Panel\Desktop\Wallpaper = "C:\\ProgramData\\LPJKYjRBM.bmp" C:\Users\Admin\AppData\Local\Temp\2024-03-13_ac6a7885e55155b6025f45bf90d5af64_darkside.exe N/A

Modifies Control Panel

evasion
Description Indicator Process Target
Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Control Panel\Desktop C:\Users\Admin\AppData\Local\Temp\2024-03-13_ac6a7885e55155b6025f45bf90d5af64_darkside.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Control Panel\Desktop\WallpaperStyle = "10" C:\Users\Admin\AppData\Local\Temp\2024-03-13_ac6a7885e55155b6025f45bf90d5af64_darkside.exe N/A

Modifies registry class

Description Indicator Process Target
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\LPJKYjRBM\DefaultIcon C:\Users\Admin\AppData\Local\Temp\2024-03-13_ac6a7885e55155b6025f45bf90d5af64_darkside.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\LPJKYjRBM C:\Users\Admin\AppData\Local\Temp\2024-03-13_ac6a7885e55155b6025f45bf90d5af64_darkside.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\LPJKYjRBM\DefaultIcon\ = "C:\\ProgramData\\LPJKYjRBM.ico" C:\Users\Admin\AppData\Local\Temp\2024-03-13_ac6a7885e55155b6025f45bf90d5af64_darkside.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.LPJKYjRBM C:\Users\Admin\AppData\Local\Temp\2024-03-13_ac6a7885e55155b6025f45bf90d5af64_darkside.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.LPJKYjRBM\ = "LPJKYjRBM" C:\Users\Admin\AppData\Local\Temp\2024-03-13_ac6a7885e55155b6025f45bf90d5af64_darkside.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-03-13_ac6a7885e55155b6025f45bf90d5af64_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-03-13_ac6a7885e55155b6025f45bf90d5af64_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-03-13_ac6a7885e55155b6025f45bf90d5af64_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-03-13_ac6a7885e55155b6025f45bf90d5af64_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-03-13_ac6a7885e55155b6025f45bf90d5af64_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-03-13_ac6a7885e55155b6025f45bf90d5af64_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-03-13_ac6a7885e55155b6025f45bf90d5af64_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-03-13_ac6a7885e55155b6025f45bf90d5af64_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-03-13_ac6a7885e55155b6025f45bf90d5af64_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-03-13_ac6a7885e55155b6025f45bf90d5af64_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-03-13_ac6a7885e55155b6025f45bf90d5af64_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-03-13_ac6a7885e55155b6025f45bf90d5af64_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-03-13_ac6a7885e55155b6025f45bf90d5af64_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-03-13_ac6a7885e55155b6025f45bf90d5af64_darkside.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeAssignPrimaryTokenPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-03-13_ac6a7885e55155b6025f45bf90d5af64_darkside.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-03-13_ac6a7885e55155b6025f45bf90d5af64_darkside.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-03-13_ac6a7885e55155b6025f45bf90d5af64_darkside.exe N/A
Token: 36 N/A C:\Users\Admin\AppData\Local\Temp\2024-03-13_ac6a7885e55155b6025f45bf90d5af64_darkside.exe N/A
Token: SeImpersonatePrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-03-13_ac6a7885e55155b6025f45bf90d5af64_darkside.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-03-13_ac6a7885e55155b6025f45bf90d5af64_darkside.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-03-13_ac6a7885e55155b6025f45bf90d5af64_darkside.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Local\Temp\2024-03-13_ac6a7885e55155b6025f45bf90d5af64_darkside.exe N/A
Token: SeManageVolumePrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-03-13_ac6a7885e55155b6025f45bf90d5af64_darkside.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-03-13_ac6a7885e55155b6025f45bf90d5af64_darkside.exe N/A
Token: SeRestorePrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-03-13_ac6a7885e55155b6025f45bf90d5af64_darkside.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-03-13_ac6a7885e55155b6025f45bf90d5af64_darkside.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-03-13_ac6a7885e55155b6025f45bf90d5af64_darkside.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-03-13_ac6a7885e55155b6025f45bf90d5af64_darkside.exe N/A
Token: SeShutdownPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-03-13_ac6a7885e55155b6025f45bf90d5af64_darkside.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-03-13_ac6a7885e55155b6025f45bf90d5af64_darkside.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-03-13_ac6a7885e55155b6025f45bf90d5af64_darkside.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-03-13_ac6a7885e55155b6025f45bf90d5af64_darkside.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-03-13_ac6a7885e55155b6025f45bf90d5af64_darkside.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-03-13_ac6a7885e55155b6025f45bf90d5af64_darkside.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-03-13_ac6a7885e55155b6025f45bf90d5af64_darkside.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-03-13_ac6a7885e55155b6025f45bf90d5af64_darkside.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-03-13_ac6a7885e55155b6025f45bf90d5af64_darkside.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-03-13_ac6a7885e55155b6025f45bf90d5af64_darkside.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-03-13_ac6a7885e55155b6025f45bf90d5af64_darkside.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-03-13_ac6a7885e55155b6025f45bf90d5af64_darkside.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-03-13_ac6a7885e55155b6025f45bf90d5af64_darkside.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-03-13_ac6a7885e55155b6025f45bf90d5af64_darkside.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-03-13_ac6a7885e55155b6025f45bf90d5af64_darkside.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-03-13_ac6a7885e55155b6025f45bf90d5af64_darkside.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-03-13_ac6a7885e55155b6025f45bf90d5af64_darkside.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-03-13_ac6a7885e55155b6025f45bf90d5af64_darkside.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-03-13_ac6a7885e55155b6025f45bf90d5af64_darkside.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-03-13_ac6a7885e55155b6025f45bf90d5af64_darkside.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-03-13_ac6a7885e55155b6025f45bf90d5af64_darkside.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-03-13_ac6a7885e55155b6025f45bf90d5af64_darkside.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-03-13_ac6a7885e55155b6025f45bf90d5af64_darkside.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-03-13_ac6a7885e55155b6025f45bf90d5af64_darkside.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-03-13_ac6a7885e55155b6025f45bf90d5af64_darkside.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-03-13_ac6a7885e55155b6025f45bf90d5af64_darkside.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-03-13_ac6a7885e55155b6025f45bf90d5af64_darkside.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-03-13_ac6a7885e55155b6025f45bf90d5af64_darkside.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-03-13_ac6a7885e55155b6025f45bf90d5af64_darkside.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-03-13_ac6a7885e55155b6025f45bf90d5af64_darkside.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-03-13_ac6a7885e55155b6025f45bf90d5af64_darkside.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-03-13_ac6a7885e55155b6025f45bf90d5af64_darkside.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-03-13_ac6a7885e55155b6025f45bf90d5af64_darkside.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-03-13_ac6a7885e55155b6025f45bf90d5af64_darkside.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-03-13_ac6a7885e55155b6025f45bf90d5af64_darkside.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-03-13_ac6a7885e55155b6025f45bf90d5af64_darkside.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-03-13_ac6a7885e55155b6025f45bf90d5af64_darkside.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-03-13_ac6a7885e55155b6025f45bf90d5af64_darkside.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-03-13_ac6a7885e55155b6025f45bf90d5af64_darkside.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-03-13_ac6a7885e55155b6025f45bf90d5af64_darkside.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-03-13_ac6a7885e55155b6025f45bf90d5af64_darkside.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-03-13_ac6a7885e55155b6025f45bf90d5af64_darkside.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-03-13_ac6a7885e55155b6025f45bf90d5af64_darkside.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-03-13_ac6a7885e55155b6025f45bf90d5af64_darkside.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-03-13_ac6a7885e55155b6025f45bf90d5af64_darkside.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-03-13_ac6a7885e55155b6025f45bf90d5af64_darkside.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-03-13_ac6a7885e55155b6025f45bf90d5af64_darkside.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-03-13_ac6a7885e55155b6025f45bf90d5af64_darkside.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-03-13_ac6a7885e55155b6025f45bf90d5af64_darkside.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-03-13_ac6a7885e55155b6025f45bf90d5af64_darkside.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\2024-03-13_ac6a7885e55155b6025f45bf90d5af64_darkside.exe

"C:\Users\Admin\AppData\Local\Temp\2024-03-13_ac6a7885e55155b6025f45bf90d5af64_darkside.exe"

C:\Windows\system32\AUDIODG.EXE

C:\Windows\system32\AUDIODG.EXE 0x148

Network

N/A

Files

memory/1660-0-0x0000000002420000-0x0000000002460000-memory.dmp

C:\$Recycle.Bin\S-1-5-21-2721934792-624042501-2768869379-1000\desktop.ini

MD5 709c0ca5dfd17783930a876dfcee57f3
SHA1 0d41d2faf715c1eb14cc7157f197a5aa95cdeeee
SHA256 a256930ec2ea1030c4b9d6937c744710b0929ff9716f9f376771a22b677f0bbc
SHA512 74435de060fd0f18e4afab63877a817732dcd2c615d6c23535cd23eb94a023eb09c14311d126fca80a90670a0010a0bd204c2bc528d1959d3ba81871d719f674

C:\LPJKYjRBM.README.txt

MD5 29fb3b15492cd58b143f7f2d78a40064
SHA1 5e791c9dedfbcd72eb3e489f2dfe548d61a72909
SHA256 1a77cbf05f015ebf999ac303c5258a2dc1b324dba47cdb5f63b899595a1c7fff
SHA512 8b6adca04d5939d049016ad60ed184188b1fbed835070896e3094daa29ed3137839d96d37f69840db867c3896f7574aca66b4cec8b41be9a66d59214589ac27b

F:\$RECYCLE.BIN\S-1-5-21-2721934792-624042501-2768869379-1000\QQQQQQQQQQQ

MD5 4cc96dd055de917f324fcfbedf42ac8d
SHA1 4ccfa411efe3b328a4c570693ce3679cbaffc38a
SHA256 f7285d63df526bf8dbcac612d71635397403252e219f0c5540cc466c19a7cfed
SHA512 29b567271999aa733c964169658017afbc4eeb62a8c447f34e60aab8fc82b40e15d7a2edb6601cc91d236fa3c675ee251b36763ace120e9e2d899177cf41f1f1

Analysis: behavioral2

Detonation Overview

Submitted

2024-03-13 22:32

Reported

2024-03-13 22:35

Platform

win10v2004-20240226-en

Max time kernel

150s

Max time network

155s

Command Line

"C:\Users\Admin\AppData\Local\Temp\2024-03-13_ac6a7885e55155b6025f45bf90d5af64_darkside.exe"

Signatures

Lockbit

ransomware lockbit

Renames multiple (583) files with added filename extension

ransomware

Reads user/profile data of web browsers

spyware stealer

Drops desktop.ini file(s)

Description Indicator Process Target
File opened for modification C:\$Recycle.Bin\S-1-5-21-275798769-4264537674-1142822080-1000\desktop.ini C:\Users\Admin\AppData\Local\Temp\2024-03-13_ac6a7885e55155b6025f45bf90d5af64_darkside.exe N/A
File opened for modification F:\$RECYCLE.BIN\S-1-5-21-275798769-4264537674-1142822080-1000\desktop.ini C:\Users\Admin\AppData\Local\Temp\2024-03-13_ac6a7885e55155b6025f45bf90d5af64_darkside.exe N/A

Drops file in System32 directory

Description Indicator Process Target
File created C:\Windows\system32\spool\PRINTERS\00002.SPL C:\Windows\splwow64.exe N/A
File created C:\Windows\system32\spool\PRINTERS\PPf42ghvw0_gfqrhvdme7kwufad.TMP C:\Windows\system32\printfilterpipelinesvc.exe N/A
File created C:\Windows\system32\spool\PRINTERS\PP9r1q4_bsd0nojutdepi27dh7d.TMP C:\Windows\system32\printfilterpipelinesvc.exe N/A
File created C:\Windows\system32\spool\PRINTERS\PP22w44m0ky87o3olyq_b3av48.TMP C:\Windows\system32\printfilterpipelinesvc.exe N/A

Sets desktop wallpaper using registry

ransomware
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-275798769-4264537674-1142822080-1000\Control Panel\Desktop\WallPaper = "C:\\ProgramData\\LPJKYjRBM.bmp" C:\Users\Admin\AppData\Local\Temp\2024-03-13_ac6a7885e55155b6025f45bf90d5af64_darkside.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-275798769-4264537674-1142822080-1000\Control Panel\Desktop\Wallpaper = "C:\\ProgramData\\LPJKYjRBM.bmp" C:\Users\Admin\AppData\Local\Temp\2024-03-13_ac6a7885e55155b6025f45bf90d5af64_darkside.exe N/A

Checks processor information in registry

Description Indicator Process Target
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz C:\Program Files\Microsoft Office\root\Office16\ONENOTE.EXE N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString C:\Program Files\Microsoft Office\root\Office16\ONENOTE.EXE N/A
Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 C:\Program Files\Microsoft Office\root\Office16\ONENOTE.EXE N/A

Enumerates system info in registry

Description Indicator Process Target
Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS C:\Program Files\Microsoft Office\root\Office16\ONENOTE.EXE N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily C:\Program Files\Microsoft Office\root\Office16\ONENOTE.EXE N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU C:\Program Files\Microsoft Office\root\Office16\ONENOTE.EXE N/A

Modifies Control Panel

evasion
Description Indicator Process Target
Key created \REGISTRY\USER\S-1-5-21-275798769-4264537674-1142822080-1000\Control Panel\Desktop C:\Users\Admin\AppData\Local\Temp\2024-03-13_ac6a7885e55155b6025f45bf90d5af64_darkside.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-275798769-4264537674-1142822080-1000\Control Panel\Desktop\WallpaperStyle = "10" C:\Users\Admin\AppData\Local\Temp\2024-03-13_ac6a7885e55155b6025f45bf90d5af64_darkside.exe N/A

Modifies registry class

Description Indicator Process Target
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\LPJKYjRBM C:\Users\Admin\AppData\Local\Temp\2024-03-13_ac6a7885e55155b6025f45bf90d5af64_darkside.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\LPJKYjRBM\DefaultIcon\ = "C:\\ProgramData\\LPJKYjRBM.ico" C:\Users\Admin\AppData\Local\Temp\2024-03-13_ac6a7885e55155b6025f45bf90d5af64_darkside.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.LPJKYjRBM C:\Users\Admin\AppData\Local\Temp\2024-03-13_ac6a7885e55155b6025f45bf90d5af64_darkside.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.LPJKYjRBM\ = "LPJKYjRBM" C:\Users\Admin\AppData\Local\Temp\2024-03-13_ac6a7885e55155b6025f45bf90d5af64_darkside.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\LPJKYjRBM\DefaultIcon C:\Users\Admin\AppData\Local\Temp\2024-03-13_ac6a7885e55155b6025f45bf90d5af64_darkside.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-03-13_ac6a7885e55155b6025f45bf90d5af64_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-03-13_ac6a7885e55155b6025f45bf90d5af64_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-03-13_ac6a7885e55155b6025f45bf90d5af64_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-03-13_ac6a7885e55155b6025f45bf90d5af64_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-03-13_ac6a7885e55155b6025f45bf90d5af64_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-03-13_ac6a7885e55155b6025f45bf90d5af64_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-03-13_ac6a7885e55155b6025f45bf90d5af64_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-03-13_ac6a7885e55155b6025f45bf90d5af64_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-03-13_ac6a7885e55155b6025f45bf90d5af64_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-03-13_ac6a7885e55155b6025f45bf90d5af64_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-03-13_ac6a7885e55155b6025f45bf90d5af64_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-03-13_ac6a7885e55155b6025f45bf90d5af64_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-03-13_ac6a7885e55155b6025f45bf90d5af64_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-03-13_ac6a7885e55155b6025f45bf90d5af64_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-03-13_ac6a7885e55155b6025f45bf90d5af64_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-03-13_ac6a7885e55155b6025f45bf90d5af64_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-03-13_ac6a7885e55155b6025f45bf90d5af64_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-03-13_ac6a7885e55155b6025f45bf90d5af64_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-03-13_ac6a7885e55155b6025f45bf90d5af64_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-03-13_ac6a7885e55155b6025f45bf90d5af64_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-03-13_ac6a7885e55155b6025f45bf90d5af64_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-03-13_ac6a7885e55155b6025f45bf90d5af64_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-03-13_ac6a7885e55155b6025f45bf90d5af64_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-03-13_ac6a7885e55155b6025f45bf90d5af64_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-03-13_ac6a7885e55155b6025f45bf90d5af64_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-03-13_ac6a7885e55155b6025f45bf90d5af64_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-03-13_ac6a7885e55155b6025f45bf90d5af64_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-03-13_ac6a7885e55155b6025f45bf90d5af64_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-03-13_ac6a7885e55155b6025f45bf90d5af64_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-03-13_ac6a7885e55155b6025f45bf90d5af64_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-03-13_ac6a7885e55155b6025f45bf90d5af64_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-03-13_ac6a7885e55155b6025f45bf90d5af64_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-03-13_ac6a7885e55155b6025f45bf90d5af64_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-03-13_ac6a7885e55155b6025f45bf90d5af64_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-03-13_ac6a7885e55155b6025f45bf90d5af64_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-03-13_ac6a7885e55155b6025f45bf90d5af64_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-03-13_ac6a7885e55155b6025f45bf90d5af64_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-03-13_ac6a7885e55155b6025f45bf90d5af64_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-03-13_ac6a7885e55155b6025f45bf90d5af64_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-03-13_ac6a7885e55155b6025f45bf90d5af64_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-03-13_ac6a7885e55155b6025f45bf90d5af64_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-03-13_ac6a7885e55155b6025f45bf90d5af64_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-03-13_ac6a7885e55155b6025f45bf90d5af64_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-03-13_ac6a7885e55155b6025f45bf90d5af64_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-03-13_ac6a7885e55155b6025f45bf90d5af64_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-03-13_ac6a7885e55155b6025f45bf90d5af64_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-03-13_ac6a7885e55155b6025f45bf90d5af64_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-03-13_ac6a7885e55155b6025f45bf90d5af64_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-03-13_ac6a7885e55155b6025f45bf90d5af64_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-03-13_ac6a7885e55155b6025f45bf90d5af64_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-03-13_ac6a7885e55155b6025f45bf90d5af64_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-03-13_ac6a7885e55155b6025f45bf90d5af64_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-03-13_ac6a7885e55155b6025f45bf90d5af64_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-03-13_ac6a7885e55155b6025f45bf90d5af64_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-03-13_ac6a7885e55155b6025f45bf90d5af64_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-03-13_ac6a7885e55155b6025f45bf90d5af64_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-03-13_ac6a7885e55155b6025f45bf90d5af64_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-03-13_ac6a7885e55155b6025f45bf90d5af64_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-03-13_ac6a7885e55155b6025f45bf90d5af64_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-03-13_ac6a7885e55155b6025f45bf90d5af64_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-03-13_ac6a7885e55155b6025f45bf90d5af64_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-03-13_ac6a7885e55155b6025f45bf90d5af64_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-03-13_ac6a7885e55155b6025f45bf90d5af64_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-03-13_ac6a7885e55155b6025f45bf90d5af64_darkside.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeAssignPrimaryTokenPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-03-13_ac6a7885e55155b6025f45bf90d5af64_darkside.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-03-13_ac6a7885e55155b6025f45bf90d5af64_darkside.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-03-13_ac6a7885e55155b6025f45bf90d5af64_darkside.exe N/A
Token: 36 N/A C:\Users\Admin\AppData\Local\Temp\2024-03-13_ac6a7885e55155b6025f45bf90d5af64_darkside.exe N/A
Token: SeImpersonatePrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-03-13_ac6a7885e55155b6025f45bf90d5af64_darkside.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-03-13_ac6a7885e55155b6025f45bf90d5af64_darkside.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-03-13_ac6a7885e55155b6025f45bf90d5af64_darkside.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Local\Temp\2024-03-13_ac6a7885e55155b6025f45bf90d5af64_darkside.exe N/A
Token: SeManageVolumePrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-03-13_ac6a7885e55155b6025f45bf90d5af64_darkside.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-03-13_ac6a7885e55155b6025f45bf90d5af64_darkside.exe N/A
Token: SeRestorePrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-03-13_ac6a7885e55155b6025f45bf90d5af64_darkside.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-03-13_ac6a7885e55155b6025f45bf90d5af64_darkside.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-03-13_ac6a7885e55155b6025f45bf90d5af64_darkside.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-03-13_ac6a7885e55155b6025f45bf90d5af64_darkside.exe N/A
Token: SeShutdownPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-03-13_ac6a7885e55155b6025f45bf90d5af64_darkside.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-03-13_ac6a7885e55155b6025f45bf90d5af64_darkside.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-03-13_ac6a7885e55155b6025f45bf90d5af64_darkside.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-03-13_ac6a7885e55155b6025f45bf90d5af64_darkside.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-03-13_ac6a7885e55155b6025f45bf90d5af64_darkside.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-03-13_ac6a7885e55155b6025f45bf90d5af64_darkside.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-03-13_ac6a7885e55155b6025f45bf90d5af64_darkside.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-03-13_ac6a7885e55155b6025f45bf90d5af64_darkside.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-03-13_ac6a7885e55155b6025f45bf90d5af64_darkside.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-03-13_ac6a7885e55155b6025f45bf90d5af64_darkside.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-03-13_ac6a7885e55155b6025f45bf90d5af64_darkside.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-03-13_ac6a7885e55155b6025f45bf90d5af64_darkside.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-03-13_ac6a7885e55155b6025f45bf90d5af64_darkside.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-03-13_ac6a7885e55155b6025f45bf90d5af64_darkside.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-03-13_ac6a7885e55155b6025f45bf90d5af64_darkside.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-03-13_ac6a7885e55155b6025f45bf90d5af64_darkside.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-03-13_ac6a7885e55155b6025f45bf90d5af64_darkside.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-03-13_ac6a7885e55155b6025f45bf90d5af64_darkside.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-03-13_ac6a7885e55155b6025f45bf90d5af64_darkside.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-03-13_ac6a7885e55155b6025f45bf90d5af64_darkside.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-03-13_ac6a7885e55155b6025f45bf90d5af64_darkside.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-03-13_ac6a7885e55155b6025f45bf90d5af64_darkside.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-03-13_ac6a7885e55155b6025f45bf90d5af64_darkside.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-03-13_ac6a7885e55155b6025f45bf90d5af64_darkside.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-03-13_ac6a7885e55155b6025f45bf90d5af64_darkside.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-03-13_ac6a7885e55155b6025f45bf90d5af64_darkside.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-03-13_ac6a7885e55155b6025f45bf90d5af64_darkside.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-03-13_ac6a7885e55155b6025f45bf90d5af64_darkside.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-03-13_ac6a7885e55155b6025f45bf90d5af64_darkside.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-03-13_ac6a7885e55155b6025f45bf90d5af64_darkside.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-03-13_ac6a7885e55155b6025f45bf90d5af64_darkside.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-03-13_ac6a7885e55155b6025f45bf90d5af64_darkside.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-03-13_ac6a7885e55155b6025f45bf90d5af64_darkside.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-03-13_ac6a7885e55155b6025f45bf90d5af64_darkside.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-03-13_ac6a7885e55155b6025f45bf90d5af64_darkside.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-03-13_ac6a7885e55155b6025f45bf90d5af64_darkside.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-03-13_ac6a7885e55155b6025f45bf90d5af64_darkside.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-03-13_ac6a7885e55155b6025f45bf90d5af64_darkside.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-03-13_ac6a7885e55155b6025f45bf90d5af64_darkside.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-03-13_ac6a7885e55155b6025f45bf90d5af64_darkside.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-03-13_ac6a7885e55155b6025f45bf90d5af64_darkside.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-03-13_ac6a7885e55155b6025f45bf90d5af64_darkside.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-03-13_ac6a7885e55155b6025f45bf90d5af64_darkside.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-03-13_ac6a7885e55155b6025f45bf90d5af64_darkside.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-03-13_ac6a7885e55155b6025f45bf90d5af64_darkside.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-03-13_ac6a7885e55155b6025f45bf90d5af64_darkside.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-03-13_ac6a7885e55155b6025f45bf90d5af64_darkside.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-03-13_ac6a7885e55155b6025f45bf90d5af64_darkside.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-03-13_ac6a7885e55155b6025f45bf90d5af64_darkside.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-03-13_ac6a7885e55155b6025f45bf90d5af64_darkside.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\2024-03-13_ac6a7885e55155b6025f45bf90d5af64_darkside.exe

"C:\Users\Admin\AppData\Local\Temp\2024-03-13_ac6a7885e55155b6025f45bf90d5af64_darkside.exe"

C:\Windows\splwow64.exe

C:\Windows\splwow64.exe 12288

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k PrintWorkflow -s PrintWorkflowUserSvc

C:\Windows\system32\printfilterpipelinesvc.exe

C:\Windows\system32\printfilterpipelinesvc.exe -Embedding

C:\Program Files\Microsoft Office\root\Office16\ONENOTE.EXE

/insertdoc "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\{290AD492-DB90-4FA3-9582-EC21237DAD10}.xps" 133548427918130000

Network

Country Destination Domain Proto
US 8.8.8.8:53 8.8.8.8.in-addr.arpa udp
US 8.8.8.8:53 149.220.183.52.in-addr.arpa udp
US 8.8.8.8:53 20.160.190.20.in-addr.arpa udp
US 8.8.8.8:53 61.179.17.96.in-addr.arpa udp
US 8.8.8.8:53 241.154.82.20.in-addr.arpa udp
US 8.8.8.8:53 57.169.31.20.in-addr.arpa udp
US 8.8.8.8:53 97.17.167.52.in-addr.arpa udp
US 8.8.8.8:53 41.110.16.96.in-addr.arpa udp
US 8.8.8.8:53 157.123.68.40.in-addr.arpa udp
US 8.8.8.8:53 97.32.109.52.in-addr.arpa udp
US 8.8.8.8:53 15.164.165.52.in-addr.arpa udp
US 8.8.8.8:53 195.177.78.104.in-addr.arpa udp
US 8.8.8.8:53 119.110.54.20.in-addr.arpa udp
US 8.8.8.8:53 211.143.182.52.in-addr.arpa udp
US 8.8.8.8:53 240.221.184.93.in-addr.arpa udp
US 8.8.8.8:53 68.179.17.96.in-addr.arpa udp
US 8.8.8.8:53 26.165.165.52.in-addr.arpa udp
US 8.8.8.8:53 41.134.221.88.in-addr.arpa udp
US 8.8.8.8:53 55.179.17.96.in-addr.arpa udp
US 8.8.8.8:53 11.227.111.52.in-addr.arpa udp
US 8.8.8.8:53 tse1.mm.bing.net udp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 8.8.8.8:53 200.197.79.204.in-addr.arpa udp
US 8.8.8.8:53 26.178.89.13.in-addr.arpa udp
GB 96.17.179.55:80 tcp

Files

memory/1108-0-0x0000000001250000-0x0000000001260000-memory.dmp

memory/1108-1-0x0000000001250000-0x0000000001260000-memory.dmp

memory/1108-2-0x0000000001250000-0x0000000001260000-memory.dmp

C:\$Recycle.Bin\S-1-5-21-275798769-4264537674-1142822080-1000\GGGGGGGGGGG

MD5 33408ff3550ad710a974b8c35a9c04c8
SHA1 33604eb69a40f012c36f6c8606864dd7ff1db9f8
SHA256 79bd02183197d044351acee855cdb2f37d8d1c8a6e6593c3b571f68dd88f5c78
SHA512 e16e29fadfc387c19a8c52bb3950ca1edaad93c745abe1178cf648e03d68ad2380acef404380f0a6b54b4557639597ea7e23fcfdfc4dfd2ddb99ce24b24dc3ac

F:\$RECYCLE.BIN\S-1-5-21-275798769-4264537674-1142822080-1000\DDDDDDDDDDD

MD5 8c0354f8db4dd3e2574c60e319bb5d75
SHA1 04781be452bdf7ea2529fb0b42c15acbcaa7de5e
SHA256 13fce3dfc580cb743f530ab32b02ef94edaa30eec74a6b5356e6e954f0882d8e
SHA512 f402294858d7e36f49a752ec55fd96fb1e981f091a6afebb9e87a9dbeda206a01ed716b04dc285f5748fec178dcbf53182cd8ca2aa8aaaaa8bf164381d1ce166

C:\LPJKYjRBM.README.txt

MD5 49d7a5d1df53ecdd8a0833b0534e994b
SHA1 109f6d182d4fa2088abc77ce6829096dd6e3d5b2
SHA256 377bb9d6e9786b2ea9f2f974fb152ff65d372a452667d0c958fe2f440cbf9250
SHA512 cca2532c96d56fa82dc54daa903e657da779a706a966bdbc68ea8da60f3bb8b1599d96aa9da7fbd0b35342d2f2cb24688ce66cd31f89b459d38b23c48481101a

memory/1048-2752-0x00007FF88CF70000-0x00007FF88CF80000-memory.dmp

memory/1048-2754-0x00007FF8CCEF0000-0x00007FF8CD0E5000-memory.dmp

memory/1048-2753-0x00007FF88CF70000-0x00007FF88CF80000-memory.dmp

memory/1048-2755-0x00007FF8CCEF0000-0x00007FF8CD0E5000-memory.dmp

memory/1048-2756-0x00007FF88CF70000-0x00007FF88CF80000-memory.dmp

memory/1048-2757-0x00007FF8CCEF0000-0x00007FF8CD0E5000-memory.dmp

memory/1048-2758-0x00007FF88CF70000-0x00007FF88CF80000-memory.dmp

memory/1048-2760-0x00007FF88CF70000-0x00007FF88CF80000-memory.dmp

memory/1048-2761-0x00007FF8CCEF0000-0x00007FF8CD0E5000-memory.dmp

memory/1048-2759-0x00007FF8CCEF0000-0x00007FF8CD0E5000-memory.dmp

memory/1048-2762-0x00007FF8CCEF0000-0x00007FF8CD0E5000-memory.dmp

memory/1048-2764-0x00007FF88AF10000-0x00007FF88AF20000-memory.dmp

memory/1048-2765-0x00007FF8CCEF0000-0x00007FF8CD0E5000-memory.dmp

memory/1048-2763-0x00007FF8CCEF0000-0x00007FF8CD0E5000-memory.dmp

memory/1048-2766-0x00007FF8CCEF0000-0x00007FF8CD0E5000-memory.dmp

memory/1048-2769-0x00007FF8CCEF0000-0x00007FF8CD0E5000-memory.dmp

memory/1048-2768-0x00007FF8CCEF0000-0x00007FF8CD0E5000-memory.dmp

memory/1048-2767-0x00007FF88AF10000-0x00007FF88AF20000-memory.dmp

memory/1048-2770-0x00007FF8CCEF0000-0x00007FF8CD0E5000-memory.dmp

memory/1048-2771-0x00007FF8CCEF0000-0x00007FF8CD0E5000-memory.dmp

memory/1048-2773-0x00007FF8CCEF0000-0x00007FF8CD0E5000-memory.dmp

memory/1048-2772-0x00007FF8CCEF0000-0x00007FF8CD0E5000-memory.dmp

memory/1048-2774-0x00007FF8CCEF0000-0x00007FF8CD0E5000-memory.dmp

memory/1048-2775-0x00007FF8CCEF0000-0x00007FF8CD0E5000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\{A109750F-5E2E-42C5-912B-0C2AD7A76B13}

MD5 7e93612b4d1adfbd1fa90ae2625d449b
SHA1 4f19e0d8cc970551739cdaef10f25e00117e0d92
SHA256 e398e8ff25c5b42f58dc56c2c3d93f4aea1b112740047861d2963735a06202c3
SHA512 0a1f82631c9d1c21a1a2d9ad6d7f95989ab424efdbeba6d1a8d8d57fb75bb4c467a97b37153ac6885e8d5430e93113e443236a91d15b335fddaeb078a62b2556

C:\Users\Admin\Documents\OneNote Notebooks\My Notebook\Open Notebook.onetoc2

MD5 a6fbd0f128db88ecc5c097f8c4180476
SHA1 d552e892f0c601df674b1a34152a1d3d1555418d
SHA256 992a1c17e128f72b332d8b41828c80a5c67f9e371ce036d3e4e266c2c4414869
SHA512 1a4dbd976a3998a37b26d3364c899ac2fe6fb387d90ac7b2fe04a8a63a4cc59107791d7aced8411879af3666f59bb6f65d37eaec0a9f7952d00f8038c178f897

memory/1048-2797-0x00007FF8CCEF0000-0x00007FF8CD0E5000-memory.dmp

memory/1048-2798-0x00007FF8CCEF0000-0x00007FF8CD0E5000-memory.dmp