Overview

overview

10

Static

static

10

2024-07-10...de.exe

windows7-x64

9

2024-07-10...de.exe

windows10-2004-x64

9

Analysis

  • max time kernel
    92s
  • max time network
    153s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240709-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
  • submitted
    10-07-2024 23:45

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    2024-07-10_d3d64f02fda9af093df2c3468046bff6_darkside.exe

  • Size

    145KB

  • MD5

    d3d64f02fda9af093df2c3468046bff6

  • SHA1

    33ac70101c3688cb1074cf7fda84780b9c98786a

  • SHA256

    0f8a4d209ad5ac8e6450f1875c20e0b48e10b9046bd54cac2f957b2c5847ab96

  • SHA512

    b7b1405b086949662d126d62a3102661f37062a96b6b79b8868a3df045880d47c7eae1723c7ae16f404028c68575f611e90a9bb7034c76605627b5d2530540fb

  • SSDEEP

    3072:JqJogYkcSNm9V7DnKrKNzJgIJb587nlyAyVT:Jq2kc4m9tDnKrKNFj27nl

Score
9/10
ransomwarespywarestealer

Malware Config

Signatures

  • Renames multiple (646) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

    ransomware
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself 1 IoCs
  • Executes dropped EXE 1 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Drops desktop.ini file(s) 2 IoCs
  • Drops file in System32 directory 4 IoCs
  • Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Checks processor information in registry 2 TTPs 3 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: RenamesItself 26 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of SetWindowsHookEx 13 IoCs
  • Suspicious use of WriteProcessMemory 11 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2024-07-10_d3d64f02fda9af093df2c3468046bff6_darkside.exe
    "C:\Users\Admin\AppData\Local\Temp\2024-07-10_d3d64f02fda9af093df2c3468046bff6_darkside.exe"
    1⤵
    • Drops desktop.ini file(s)
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:2412
    • C:\Windows\splwow64.exe
      C:\Windows\splwow64.exe 12288
      2⤵
      • Drops file in System32 directory
      PID:3716
    • C:\ProgramData\F2AE.tmp
      "C:\ProgramData\F2AE.tmp"
      2⤵
      • Checks computer location settings
      • Deletes itself
      • Executes dropped EXE
      • Suspicious use of NtSetInformationThreadHideFromDebugger
      • Suspicious behavior: RenamesItself
      • Suspicious use of WriteProcessMemory
      PID:3672
      • C:\Windows\SysWOW64\cmd.exe
        "C:\Windows\System32\cmd.exe" /C DEL /F /Q C:\PROGRA~3\F2AE.tmp >> NUL
        3⤵
          PID:4000
    • C:\Windows\system32\svchost.exe
      C:\Windows\system32\svchost.exe -k PrintWorkflow -s PrintWorkflowUserSvc
      1⤵
        PID:3288
      • C:\Windows\system32\printfilterpipelinesvc.exe
        C:\Windows\system32\printfilterpipelinesvc.exe -Embedding
        1⤵
        • Drops file in System32 directory
        • Suspicious use of WriteProcessMemory
        PID:2108
        • C:\Program Files\Microsoft Office\root\Office16\ONENOTE.EXE
          /insertdoc "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\{B81F3B27-6195-4CFE-956E-BEBA788F5A33}.xps" 133651288026260000
          2⤵
          • Checks processor information in registry
          • Enumerates system info in registry
          • Suspicious use of SetWindowsHookEx
          PID:4424

      Network

      MITRE ATT&CK Enterprise v15

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\$Recycle.Bin\S-1-5-21-701583114-2636601053-947405450-1000\EEEEEEEEEEE
        Filesize

        129B

        MD5

        13a84a1f9e0fb6aac98d4f7b9497c72e

        SHA1

        a99c0a89d831c08c79c2dfe69080a96d86c101c3

        SHA256

        e2243248e67c4263b6743658fc8d92129423e124ca3399d8db4a2dd2282640e0

        SHA512

        bbfb3854b16e5a822491a4927bbf962eb82e59a881f27b49f9b9e0062effe636ee4820c33840020e66fe82107ec0d7a878207f710c3e02218d005476d0b9eaef

        Download Submit

      • C:\ProgramData\F2AE.tmp
        Filesize

        14KB

        MD5

        294e9f64cb1642dd89229fff0592856b

        SHA1

        97b148c27f3da29ba7b18d6aee8a0db9102f47c9

        SHA256

        917e115cc403e29b4388e0d175cbfac3e7e40ca1742299fbdb353847db2de7c2

        SHA512

        b87d531890bf1577b9b4af41dddb2cdbbfa164cf197bd5987df3a3075983645a3acba443e289b7bfd338422978a104f55298fbfe346872de0895bde44adc89cf

        Download Submit

      • C:\Users\Admin\AppData\Local\Temp\DDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDD
        Filesize

        145KB

        MD5

        2ba42f91cce3147a1f426a7df23d5a6f

        SHA1

        8a858a98978884e47cf2f4dd8ebf531115c56f71

        SHA256

        d62ede2d22d858425dbaf5c3e55dbc3d9e96393e876593e06300eb15cfa23b13

        SHA512

        bb6eb380c4548584e92e4d25bdbaff40480470192484ebd3a285ad59da9052cd7dd8307535b1329f6842700e0ab814576fc19ec5576234365b933d95373be279

        Download Submit

      • C:\Users\Admin\AppData\Local\Temp\{FD4618D9-5D3D-4C94-8E56-BBCB7739671A}
        Filesize

        4KB

        MD5

        18988f189d93f3610d0f0e38f16b85d8

        SHA1

        63d32f3c113479e1949798847411d95586ae193e

        SHA256

        a3a224ff58cb038e6434b7a6757292e7b0a1104997c014cefc6606b592bfae2a

        SHA512

        b91b1f966801e8d8771eaaf74c7da1a33a0dfe2e17a30a5798de1bad86e5762dcd5833d8f3f858ed78ec36453e897123fd188bec5a214f9ed28a02bd3835f150

        Download Submit

      • C:\Users\Admin\Documents\OneNote Notebooks\My Notebook\Open Notebook.onetoc2
        Filesize

        4KB

        MD5

        d57320efedf4bd0442cfb80c2bd8e097

        SHA1

        b8566fa1f0eb553f4349ae96da804dd8fce165bc

        SHA256

        12de26fa8af77c9f1e912267f2568aa22bd42bf3724d6b87dc9de34c81515fa4

        SHA512

        d13f6c2934f83840601c5979c3c2066b5c26a0401cf5c0fb2cb879cbcdcd330382b7ad450807c0c52e90631d95bb028798f75318318aef9e5d33255267f513b0

        Download Submit

      • C:\kzCLVJRGC.README.txt
        Filesize

        316B

        MD5

        0f44f298c9f02b7976a877cb2281e650

        SHA1

        a4a32edfb59de74f20c462669c4dab64e38a3510

        SHA256

        3fd1336ecccac3ad51f1e71c819ccdc3444c9bb908cb54531e4748551b9b3447

        SHA512

        287d13190f937c9bf7fa756771d7795e1fa0a6899cffc1774a5b2207a4d82b9829e2e537965f1a1f23bbb5513c8c1680349de080200a2c6996b0c8efa34ad3ba

        Download Submit

      • F:\$RECYCLE.BIN\S-1-5-21-701583114-2636601053-947405450-1000\DDDDDDDDDDD
        Filesize

        129B

        MD5

        c68ca31e89277fada5e83942b1e1e110

        SHA1

        23c4629320516c70da76fdd358d1608b0d1c969a

        SHA256

        9ae575ba27a81670b51315d98202998db31a859d7870741d20b15e0b2f0d43ec

        SHA512

        a71b17fa97e41c5a4c7127f8abb39de0c5791094ed0a3a7f91b335cf6ce0c012226587853d9860cce37cadd0f1ec50b3a7a60369ef5aaffeae50c38981cbc625

        Download Submit

      • memory/2412-0-0x00000000031D0000-0x00000000031E0000-memory.dmp

        Filesize

        64KB

        Download

      • memory/2412-2-0x00000000031D0000-0x00000000031E0000-memory.dmp

        Filesize

        64KB

        Download

      • memory/2412-1-0x00000000031D0000-0x00000000031E0000-memory.dmp

        Filesize

        64KB

        Download

      • memory/4424-2840-0x00007FFF60D30000-0x00007FFF60D40000-memory.dmp

        Filesize

        64KB

        Download

      • memory/4424-2839-0x00007FFF60D30000-0x00007FFF60D40000-memory.dmp

        Filesize

        64KB

        Download

      • memory/4424-2838-0x00007FFF60D30000-0x00007FFF60D40000-memory.dmp

        Filesize

        64KB

        Download

      • memory/4424-2841-0x00007FFF60D30000-0x00007FFF60D40000-memory.dmp

        Filesize

        64KB

        Download

      • memory/4424-2842-0x00007FFF60D30000-0x00007FFF60D40000-memory.dmp

        Filesize

        64KB

        Download

      • memory/4424-2871-0x00007FFF5EB20000-0x00007FFF5EB30000-memory.dmp

        Filesize

        64KB

        Download

      • memory/4424-2872-0x00007FFF5EB20000-0x00007FFF5EB30000-memory.dmp

        Filesize

        64KB

        Download