Overview

overview

10

Static

static

10

2024-07-10...de.exe

windows7-x64

9

2024-07-10...de.exe

windows10-2004-x64

9

Analysis

  • max time kernel
    92s
  • max time network
    139s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240709-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
  • submitted
    10-07-2024 23:43

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    2024-07-10_2f948f1174f626c357e32082a41b2608_darkside.exe

  • Size

    145KB

  • MD5

    2f948f1174f626c357e32082a41b2608

  • SHA1

    6cc04220cc7b08b9d910765d49e63b1f76d5a8e4

  • SHA256

    b08194fdeffcc70daccf02c8eb3f9c15ba34cff4052cd670e01822caab93526a

  • SHA512

    bccdab1d8b34e4612e1e9d0b478dd719fd35be202b2390075ede664a295348dd51dbd78d8009e062ff281a6a9ae7f7f501ef47d47895dac4a5c028f7a52d64bb

  • SSDEEP

    3072:MqJogYkcSNm9V7D5WIlADZSQRhaTgInT:Mq2kc4m9tD5BdOcgI

Score
9/10
ransomwarespywarestealer

Malware Config

Signatures

  • Renames multiple (628) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

    ransomware
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself 1 IoCs
  • Executes dropped EXE 1 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Drops desktop.ini file(s) 2 IoCs
  • Drops file in System32 directory 4 IoCs
  • Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Checks processor information in registry 2 TTPs 3 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: RenamesItself 26 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of SetWindowsHookEx 13 IoCs
  • Suspicious use of WriteProcessMemory 11 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2024-07-10_2f948f1174f626c357e32082a41b2608_darkside.exe
    "C:\Users\Admin\AppData\Local\Temp\2024-07-10_2f948f1174f626c357e32082a41b2608_darkside.exe"
    1⤵
    • Drops desktop.ini file(s)
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:4776
    • C:\Windows\splwow64.exe
      C:\Windows\splwow64.exe 12288
      2⤵
      • Drops file in System32 directory
      PID:4484
    • C:\ProgramData\22C6.tmp
      "C:\ProgramData\22C6.tmp"
      2⤵
      • Checks computer location settings
      • Deletes itself
      • Executes dropped EXE
      • Suspicious use of NtSetInformationThreadHideFromDebugger
      • Suspicious behavior: RenamesItself
      • Suspicious use of WriteProcessMemory
      PID:3904
      • C:\Windows\SysWOW64\cmd.exe
        "C:\Windows\System32\cmd.exe" /C DEL /F /Q C:\PROGRA~3\22C6.tmp >> NUL
        3⤵
          PID:4696
    • C:\Windows\system32\svchost.exe
      C:\Windows\system32\svchost.exe -k PrintWorkflow -s PrintWorkflowUserSvc
      1⤵
        PID:4276
      • C:\Windows\system32\printfilterpipelinesvc.exe
        C:\Windows\system32\printfilterpipelinesvc.exe -Embedding
        1⤵
        • Drops file in System32 directory
        • Suspicious use of WriteProcessMemory
        PID:368
        • C:\Program Files\Microsoft Office\root\Office16\ONENOTE.EXE
          /insertdoc "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\{328EF5B0-A67C-4886-8075-AE25B973BB31}.xps" 133651286460710000
          2⤵
          • Checks processor information in registry
          • Enumerates system info in registry
          • Suspicious use of SetWindowsHookEx
          PID:2400

      Network

      MITRE ATT&CK Enterprise v15

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\$Recycle.Bin\S-1-5-21-384068567-2943195810-3631207890-1000\desktop.ini
        Filesize

        129B

        MD5

        9d1a3f74cfaae69433c956cd0e8a895a

        SHA1

        80cda2a92b5ea434f382e26d2521254447850fd9

        SHA256

        1876ae5cdb0e71c842f7bc93b77cd214fc76b1f5acc1d1ef640422825696b2a9

        SHA512

        f996e3137aa791279c79c5db7f3d84360de78ac44256ae50426e9b5639bcdf4ffaa5e710fdccc7ba284122b0b6cffa78eeb017086e69f88382dc6a541410ae95

        Download Submit

      • C:\GmvBLc9qu.README.txt
        Filesize

        316B

        MD5

        b35990e64b52991f8079862feb23ae16

        SHA1

        3bbfb763aab174768fc36a1a9f2d80e927246133

        SHA256

        0acf0b7edf1d472cc4ba2e5f978d85037810f9fc31d08053c76dae848d31d20c

        SHA512

        b056deacacb2bfa3c18c0e317dc0a695b09c89bb872ae6bbdf17794b8fe3b8ecc8ba7dc323c31235f9390655595d13ecb55672d1448a7ac28f7e27cd2cba74fd

        Download Submit

      • C:\ProgramData\22C6.tmp
        Filesize

        14KB

        MD5

        294e9f64cb1642dd89229fff0592856b

        SHA1

        97b148c27f3da29ba7b18d6aee8a0db9102f47c9

        SHA256

        917e115cc403e29b4388e0d175cbfac3e7e40ca1742299fbdb353847db2de7c2

        SHA512

        b87d531890bf1577b9b4af41dddb2cdbbfa164cf197bd5987df3a3075983645a3acba443e289b7bfd338422978a104f55298fbfe346872de0895bde44adc89cf

        Download Submit

      • C:\Users\Admin\AppData\Local\Temp\DDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDD
        Filesize

        145KB

        MD5

        5dd823ae83f9d28ef43bfb3e46acbb37

        SHA1

        bc38e0ba3304276cf92e32df47fe0ac31c0a2e3f

        SHA256

        c76b641c14388159e812b95c885a9c1d6284cb202fdb98d050b0e2ca83c83c74

        SHA512

        2c5c348fb11c3050812a5896dfbca607b09034c9026b3a6603dca779b2299437f91d4ee7107fb40a49dd4023015cfeca9ee5e842a9a0f716f9c75e2063458652

        Download Submit

      • C:\Users\Admin\Documents\OneNote Notebooks\My Notebook\Open Notebook.onetoc2
        Filesize

        4KB

        MD5

        da3048c4e70482bb0bbed9a7ea215d9a

        SHA1

        75496c84c02651c239293af1049c0e6eabb3d349

        SHA256

        461ee6985407879c371b44b5c3945f07b48aab2e2cdc02719743be7894dcee51

        SHA512

        13782d8f079ce6991105de119d65e88ba6c60c4607beadcd229cb47bec1e865f870b00873398a3ed1faac758a2db7abda2e8c3b0cddc7d2b7216dcb541b3556b

        Download Submit

      • F:\$RECYCLE.BIN\S-1-5-21-384068567-2943195810-3631207890-1000\DDDDDDDDDDD
        Filesize

        129B

        MD5

        93ce9722657767dd1c4d5f4d8797e600

        SHA1

        d75d1cd3b99af7e518606746d57000929e863ee8

        SHA256

        55384295affba7ac2997e202c73bd8ebbf9c085e6c8fa43c60f9a6c23ef099f1

        SHA512

        0d70149b09e1d3072fa166818e2eff99ad616d894555ffb8360eba06da389fc52f3012112bec941f280cb2012a47667a614d1e705c2130a5d5161c72f26d0e54

        Download Submit

      • memory/2400-2978-0x00007FFE07170000-0x00007FFE07180000-memory.dmp

        Filesize

        64KB

        Download

      • memory/2400-2980-0x00007FFE07170000-0x00007FFE07180000-memory.dmp

        Filesize

        64KB

        Download

      • memory/2400-2979-0x00007FFE07170000-0x00007FFE07180000-memory.dmp

        Filesize

        64KB

        Download

      • memory/2400-2981-0x00007FFE07170000-0x00007FFE07180000-memory.dmp

        Filesize

        64KB

        Download

      • memory/2400-2982-0x00007FFE07170000-0x00007FFE07180000-memory.dmp

        Filesize

        64KB

        Download

      • memory/2400-3011-0x00007FFE04C40000-0x00007FFE04C50000-memory.dmp

        Filesize

        64KB

        Download

      • memory/2400-3012-0x00007FFE04C40000-0x00007FFE04C50000-memory.dmp

        Filesize

        64KB

        Download

      • memory/4776-2-0x00000000026D0000-0x00000000026E0000-memory.dmp

        Filesize

        64KB

        Download

      • memory/4776-0-0x00000000026D0000-0x00000000026E0000-memory.dmp

        Filesize

        64KB

        Download

      • memory/4776-1-0x00000000026D0000-0x00000000026E0000-memory.dmp

        Filesize

        64KB

        Download