Analysis
-
max time kernel
149s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
-
submitted
31-05-2024 04:37
General
-
Target
ea3c8766df6f8390dd6a0e411cec77eb8f5df0556935ea1d217f1938454d3108.exe
-
Size
256KB
-
MD5
d6b0b65300c7f9c0b700ab21f58990cc
-
SHA1
1148829c7032b7c5907337b20902c70a584710a9
-
SHA256
ea3c8766df6f8390dd6a0e411cec77eb8f5df0556935ea1d217f1938454d3108
-
SHA512
e7671432d936a800588859b6c878efba1a0e60b42abc5b0286420dd39cc612f67a2779c1f4d5870060b69446778c6207f6ef840125c73decfa765b910d5e8590
-
SSDEEP
6144:BG2/9A5wlFbBkPj8uYDJTVmxAznfcFf0UoEF:k2VA5wlFbBkPj8uqJqkfcFfHoE
Malware Config
Extracted
C:\Recovery\README.977f5beb.TXT
darkside
http://dark24vx6fsmdrtbzdzjv6ckz4yqyued4uz455oqpctko7m6vbrzibad.onion/86GND2UGQRIP7OXI4KAHWDF3QR4ZDTJ3GGZA02KJYG7H6UDZ2U0DVB03WIUKOK73
Signatures
-
DarkSide
Targeted ransomware first seen in August 2020. Operators steal data to use as leverage.
-
Renames multiple (171) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Enumerates connected drives 3 TTPs 1 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
-
Drops file in System32 directory 12 IoCs
-
Sets desktop wallpaper using registry 2 TTPs 1 IoCs
-
Modifies Control Panel 2 IoCs
-
Modifies data under HKEY_USERS 10 IoCs
-
Modifies registry class 5 IoCs
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
-
Suspicious use of AdjustPrivilegeToken 3 IoCs
-
Suspicious use of WriteProcessMemory 9 IoCs
-
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\ea3c8766df6f8390dd6a0e411cec77eb8f5df0556935ea1d217f1938454d3108.exe"C:\Users\Admin\AppData\Local\Temp\ea3c8766df6f8390dd6a0e411cec77eb8f5df0556935ea1d217f1938454d3108.exe"1⤵
-
C:\Users\Admin\AppData\Local\Temp\ea3c8766df6f8390dd6a0e411cec77eb8f5df0556935ea1d217f1938454d3108.exe"C:\Users\Admin\AppData\Local\Temp\ea3c8766df6f8390dd6a0e411cec77eb8f5df0556935ea1d217f1938454d3108.exe"1⤵
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\ea3c8766df6f8390dd6a0e411cec77eb8f5df0556935ea1d217f1938454d3108.exe"C:\Users\Admin\AppData\Local\Temp\ea3c8766df6f8390dd6a0e411cec77eb8f5df0556935ea1d217f1938454d3108.exe"2⤵
- Drops file in System32 directory
- Sets desktop wallpaper using registry
- Modifies Control Panel
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\ea3c8766df6f8390dd6a0e411cec77eb8f5df0556935ea1d217f1938454d3108.exeC:\Users\Admin\AppData\Local\Temp\ea3c8766df6f8390dd6a0e411cec77eb8f5df0556935ea1d217f1938454d3108.exe -work worker0 job0-36163⤵
- Drops file in System32 directory
-
-
C:\Users\Admin\AppData\Local\Temp\ea3c8766df6f8390dd6a0e411cec77eb8f5df0556935ea1d217f1938454d3108.exeC:\Users\Admin\AppData\Local\Temp\ea3c8766df6f8390dd6a0e411cec77eb8f5df0556935ea1d217f1938454d3108.exe -work worker1 job1-36163⤵
- Enumerates connected drives
- Drops file in System32 directory
-
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD5046211676cf955ca2e617c5c7128f54a
SHA124b6307e85d33dd271471d397ea3f7169f600f7f
SHA256273c68d24bf1b305163237649cd0aff54679114a9fe43fad0c771a58e33e35db
SHA512e26659a23d25ca7d98e9aeb7f08671bfcc64fc41a03c4be40332a1a4f2e49f66499a4c3f96ec08024b7efdf7e45a2efaeb8a05d9eff59b0557b90870c8cb9fe9
-
Filesize
176KB
-
Filesize
4KB
-
Filesize
176KB
-
Filesize
176KB
-
Filesize
4KB
-
Filesize
176KB
-
Filesize
176KB
-
Filesize
176KB
-
Filesize
176KB
-
Filesize
176KB
-
Filesize
176KB
-
Filesize
4KB
-
Filesize
176KB
-
Filesize
176KB
-
Filesize
176KB
-
Filesize
176KB
-
Filesize
176KB
-
Filesize
176KB
-
Filesize
176KB
-
Filesize
176KB
-
Filesize
4KB
-
Filesize
176KB
-
Filesize
236KB
-
Filesize
4KB
-
Filesize
176KB
-
Filesize
236KB
-
Filesize
36KB
-
Filesize
176KB
-
Filesize
176KB
-
Filesize
176KB
-
Filesize
176KB