Analysis
-
max time kernel
118s -
max time network
119s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system -
submitted
30-08-2024 23:24
Static task
static1
Behavioral task
behavioral1
Sample
2024-08-30_608c27640c4d305f54a7f9ec2e0d20c9_darkside.exe
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
2024-08-30_608c27640c4d305f54a7f9ec2e0d20c9_darkside.exe
Resource
win10v2004-20240802-en
General
-
Target
2024-08-30_608c27640c4d305f54a7f9ec2e0d20c9_darkside.exe
-
Size
122KB
-
MD5
608c27640c4d305f54a7f9ec2e0d20c9
-
SHA1
d6bdb127f81f2c1b71f1a51661cf7aed77f1db23
-
SHA256
a96b76f8290757ebdd6c5b85b555e69ea14d2cb6338e4c65e93a32a7d1218637
-
SHA512
9e64214961b032cb37dca760dd92959011bb6c5c1797b830f4c71fc7940fbb5d357ab3989cb425a75de2a7b91be116956b9bea7b3279063b05717ed01d5d5585
-
SSDEEP
768:miN4q1eksgR4SiI+rxQ3rjFrXRRWxXyw/AfydfIaJ/ZB49j9xOOLvSw9kvAx0:R4HHerjZX7pL2JKjSOVi
Malware Config
Extracted
C:\README.827f117e.TXT
darkside
http://darksidc3iux462n6yunevoag52ntvwp6wulaz3zirkmh4cnz6hhj7id.onion/162/thedixiegroup/LCfyHRcwffrYTblpZvoPO3XDbrYPcNu0wVAsH5p49LSjBfzTmtdXT48azXFlMu7q
http://dark24zz36xm4y2phwe7yvnkkkkhxionhfrwp67awpb3r3bdcneivoqd.onion/W57MRI9C7YZJUZEABBBYRQLSUTG22JZ9MAH0WT1ISHC405KP7Z2UWY3AI3J68DNM
Signatures
-
DarkSide
Targeted ransomware first seen in August 2020. Operators steal data to use as leverage.
-
Renames multiple (181) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Enumerates connected drives 3 TTPs 1 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
Processes:
2024-08-30_608c27640c4d305f54a7f9ec2e0d20c9_darkside.exedescription ioc process File opened (read-only) \??\F: 2024-08-30_608c27640c4d305f54a7f9ec2e0d20c9_darkside.exe -
Drops file in System32 directory 1 IoCs
Processes:
2024-08-30_608c27640c4d305f54a7f9ec2e0d20c9_darkside.exedescription ioc process File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\counters.dat 2024-08-30_608c27640c4d305f54a7f9ec2e0d20c9_darkside.exe -
Sets desktop wallpaper using registry 2 TTPs 1 IoCs
Processes:
2024-08-30_608c27640c4d305f54a7f9ec2e0d20c9_darkside.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Control Panel\Desktop\WallPaper = "C:\\ProgramData\\827f117e.BMP" 2024-08-30_608c27640c4d305f54a7f9ec2e0d20c9_darkside.exe -
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
Processes:
2024-08-30_608c27640c4d305f54a7f9ec2e0d20c9_darkside.exe2024-08-30_608c27640c4d305f54a7f9ec2e0d20c9_darkside.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2024-08-30_608c27640c4d305f54a7f9ec2e0d20c9_darkside.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2024-08-30_608c27640c4d305f54a7f9ec2e0d20c9_darkside.exe -
Modifies Control Panel 2 IoCs
Processes:
2024-08-30_608c27640c4d305f54a7f9ec2e0d20c9_darkside.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Control Panel\Desktop 2024-08-30_608c27640c4d305f54a7f9ec2e0d20c9_darkside.exe Set value (str) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Control Panel\Desktop\WallpaperStyle = "10" 2024-08-30_608c27640c4d305f54a7f9ec2e0d20c9_darkside.exe -
Modifies data under HKEY_USERS 46 IoCs
Processes:
2024-08-30_608c27640c4d305f54a7f9ec2e0d20c9_darkside.exe2024-08-30_608c27640c4d305f54a7f9ec2e0d20c9_darkside.exedescription ioc process Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\RestartManager\Session0000 2024-08-30_608c27640c4d305f54a7f9ec2e0d20c9_darkside.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\RestartManager\Session0000\SessionHash = 5f5269189c52460c1107c67379c90e4f7b845c0c0eb4c93edcf43185307a2586 2024-08-30_608c27640c4d305f54a7f9ec2e0d20c9_darkside.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\RestartManager\Session0000\RegFilesHash = a3b24105bdcbd5ef48a95694bbc7d835d263f29109096ad9d5e7388124745f8f 2024-08-30_608c27640c4d305f54a7f9ec2e0d20c9_darkside.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings 2024-08-30_608c27640c4d305f54a7f9ec2e0d20c9_darkside.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad 2024-08-30_608c27640c4d305f54a7f9ec2e0d20c9_darkside.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft 2024-08-30_608c27640c4d305f54a7f9ec2e0d20c9_darkside.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\RestartManager\Session0000\RegFilesHash = 44ab96575c069bfacf7625e303b11db0685c32a1951ba7da21cc76ba670331de 2024-08-30_608c27640c4d305f54a7f9ec2e0d20c9_darkside.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{4CDEF9B0-9C54-423F-A9AF-D86B60EA8D8C}\WpadDecisionTime = 905f22ce33fbda01 2024-08-30_608c27640c4d305f54a7f9ec2e0d20c9_darkside.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{4CDEF9B0-9C54-423F-A9AF-D86B60EA8D8C}\WpadNetworkName = "Network 3" 2024-08-30_608c27640c4d305f54a7f9ec2e0d20c9_darkside.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\6e-e6-7e-99-1f-a0\WpadDecisionReason = "1" 2024-08-30_608c27640c4d305f54a7f9ec2e0d20c9_darkside.exe Key created \REGISTRY\USER\.DEFAULT\Control Panel\International 2024-08-30_608c27640c4d305f54a7f9ec2e0d20c9_darkside.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:" 2024-08-30_608c27640c4d305f54a7f9ec2e0d20c9_darkside.exe Key deleted \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\RestartManager\Session0000 2024-08-30_608c27640c4d305f54a7f9ec2e0d20c9_darkside.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\RestartManager\Session0000 2024-08-30_608c27640c4d305f54a7f9ec2e0d20c9_darkside.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\RestartManager\Session0000\SessionHash = 9cab6eab5e0e805c3c37dca5cf954a5de29d92fce7ac28a1e66ef88930ed04b7 2024-08-30_608c27640c4d305f54a7f9ec2e0d20c9_darkside.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{4CDEF9B0-9C54-423F-A9AF-D86B60EA8D8C}\WpadDecisionReason = "1" 2024-08-30_608c27640c4d305f54a7f9ec2e0d20c9_darkside.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{4CDEF9B0-9C54-423F-A9AF-D86B60EA8D8C}\WpadDecision = "0" 2024-08-30_608c27640c4d305f54a7f9ec2e0d20c9_darkside.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 2024-08-30_608c27640c4d305f54a7f9ec2e0d20c9_darkside.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix 2024-08-30_608c27640c4d305f54a7f9ec2e0d20c9_darkside.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:" 2024-08-30_608c27640c4d305f54a7f9ec2e0d20c9_darkside.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections 2024-08-30_608c27640c4d305f54a7f9ec2e0d20c9_darkside.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\6e-e6-7e-99-1f-a0\WpadDecisionTime = 905f22ce33fbda01 2024-08-30_608c27640c4d305f54a7f9ec2e0d20c9_darkside.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\SavedLegacySettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 2024-08-30_608c27640c4d305f54a7f9ec2e0d20c9_darkside.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\RestartManager\Session0000\SessionHash = b71ae18b38591f0dd4b03070c35223bb1f7599fcf037a1011facf65c1dc3bdb8 2024-08-30_608c27640c4d305f54a7f9ec2e0d20c9_darkside.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\RestartManager\Session0000\RegFiles0000 = 5c005c003f005c0043003a005c00550073006500720073005c00410064006d0069006e005c004e00540055005300450052002e004400410054007b00300031003600380038003800620064002d0036006300360066002d0031003100640065002d0038006400310064002d003000300031006500300062006300640065003300650063007d002e0054004d0043006f006e007400610069006e0065007200300030003000300030003000300030003000300030003000300030003000300030003000300031002e007200650067007400720061006e0073002d006d00730000000000 2024-08-30_608c27640c4d305f54a7f9ec2e0d20c9_darkside.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "1" 2024-08-30_608c27640c4d305f54a7f9ec2e0d20c9_darkside.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\RestartManager 2024-08-30_608c27640c4d305f54a7f9ec2e0d20c9_darkside.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\RestartManager\Session0000\Owner = 580a0000108280cd33fbda01 2024-08-30_608c27640c4d305f54a7f9ec2e0d20c9_darkside.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\RestartManager\Session0000\RegFiles0000 = 5c005c003f005c0043003a005c00550073006500720073005c00410064006d0069006e005c006e00740075007300650072002e006400610074002e004c004f004700310000000000 2024-08-30_608c27640c4d305f54a7f9ec2e0d20c9_darkside.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\RestartManager\Session0000\RegFiles0000 = 5c005c003f005c0043003a005c00550073006500720073005c00410064006d0069006e005c004e00540055005300450052002e004400410054007b00300031003600380038003800620064002d0036006300360066002d0031003100640065002d0038006400310064002d003000300031006500300062006300640065003300650063007d002e0054004d002e0062006c00660000000000 2024-08-30_608c27640c4d305f54a7f9ec2e0d20c9_darkside.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000003000000090000000000000000000000000000000400000000000000000000000000000000000000000000000000000001000000020000000a7f019e000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 2024-08-30_608c27640c4d305f54a7f9ec2e0d20c9_darkside.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\6e-e6-7e-99-1f-a0 2024-08-30_608c27640c4d305f54a7f9ec2e0d20c9_darkside.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\6e-e6-7e-99-1f-a0\WpadDecision = "0" 2024-08-30_608c27640c4d305f54a7f9ec2e0d20c9_darkside.exe Key created \REGISTRY\USER\.DEFAULT\Software 2024-08-30_608c27640c4d305f54a7f9ec2e0d20c9_darkside.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\RestartManager\Session0000\Sequence = "1" 2024-08-30_608c27640c4d305f54a7f9ec2e0d20c9_darkside.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\RestartManager\Session0000\SessionHash = ed22b28a364d57e51cc768b55d59aba29d023e895af7c5b20dc53ab3142cf669 2024-08-30_608c27640c4d305f54a7f9ec2e0d20c9_darkside.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\RestartManager\Session0000\RegFilesHash = 40a3d1e7145cae9a060416619ea8f1384ee20cc10f4b700e1dd4e64e6d36f062 2024-08-30_608c27640c4d305f54a7f9ec2e0d20c9_darkside.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\RestartManager\Session0000\RegFiles0000 = 5c005c003f005c0043003a005c00550073006500720073005c00410064006d0069006e005c004e00540055005300450052002e004400410054007b00300031003600380038003800620064002d0036006300360066002d0031003100640065002d0038006400310064002d003000300031006500300062006300640065003300650063007d002e0054004d0043006f006e007400610069006e0065007200300030003000300030003000300030003000300030003000300030003000300030003000300032002e007200650067007400720061006e0073002d006d00730000000000 2024-08-30_608c27640c4d305f54a7f9ec2e0d20c9_darkside.exe Set value (str) \REGISTRY\USER\.DEFAULT\Control Panel\Desktop\Wallpaper = "C:\\ProgramData\\827f117e.BMP" 2024-08-30_608c27640c4d305f54a7f9ec2e0d20c9_darkside.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ 2024-08-30_608c27640c4d305f54a7f9ec2e0d20c9_darkside.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "0" 2024-08-30_608c27640c4d305f54a7f9ec2e0d20c9_darkside.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings 2024-08-30_608c27640c4d305f54a7f9ec2e0d20c9_darkside.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyEnable = "0" 2024-08-30_608c27640c4d305f54a7f9ec2e0d20c9_darkside.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\RestartManager\Session0000\RegFilesHash = e6efa78e6433b7268e4a5843575fe56f49867445319f6729dab70bb647190cdb 2024-08-30_608c27640c4d305f54a7f9ec2e0d20c9_darkside.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{4CDEF9B0-9C54-423F-A9AF-D86B60EA8D8C} 2024-08-30_608c27640c4d305f54a7f9ec2e0d20c9_darkside.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{4CDEF9B0-9C54-423F-A9AF-D86B60EA8D8C}\6e-e6-7e-99-1f-a0 2024-08-30_608c27640c4d305f54a7f9ec2e0d20c9_darkside.exe -
Modifies registry class 5 IoCs
Processes:
2024-08-30_608c27640c4d305f54a7f9ec2e0d20c9_darkside.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\827f117e\DefaultIcon\ = "C:\\ProgramData\\827f117e.ico" 2024-08-30_608c27640c4d305f54a7f9ec2e0d20c9_darkside.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.827f117e 2024-08-30_608c27640c4d305f54a7f9ec2e0d20c9_darkside.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.827f117e\ = "827f117e" 2024-08-30_608c27640c4d305f54a7f9ec2e0d20c9_darkside.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\827f117e\DefaultIcon 2024-08-30_608c27640c4d305f54a7f9ec2e0d20c9_darkside.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\827f117e 2024-08-30_608c27640c4d305f54a7f9ec2e0d20c9_darkside.exe -
Suspicious behavior: EnumeratesProcesses 26 IoCs
Processes:
2024-08-30_608c27640c4d305f54a7f9ec2e0d20c9_darkside.exe2024-08-30_608c27640c4d305f54a7f9ec2e0d20c9_darkside.exepid process 2256 2024-08-30_608c27640c4d305f54a7f9ec2e0d20c9_darkside.exe 2256 2024-08-30_608c27640c4d305f54a7f9ec2e0d20c9_darkside.exe 2648 2024-08-30_608c27640c4d305f54a7f9ec2e0d20c9_darkside.exe 2648 2024-08-30_608c27640c4d305f54a7f9ec2e0d20c9_darkside.exe 2648 2024-08-30_608c27640c4d305f54a7f9ec2e0d20c9_darkside.exe 2648 2024-08-30_608c27640c4d305f54a7f9ec2e0d20c9_darkside.exe 2648 2024-08-30_608c27640c4d305f54a7f9ec2e0d20c9_darkside.exe 2648 2024-08-30_608c27640c4d305f54a7f9ec2e0d20c9_darkside.exe 2648 2024-08-30_608c27640c4d305f54a7f9ec2e0d20c9_darkside.exe 2648 2024-08-30_608c27640c4d305f54a7f9ec2e0d20c9_darkside.exe 2648 2024-08-30_608c27640c4d305f54a7f9ec2e0d20c9_darkside.exe 2648 2024-08-30_608c27640c4d305f54a7f9ec2e0d20c9_darkside.exe 2648 2024-08-30_608c27640c4d305f54a7f9ec2e0d20c9_darkside.exe 2648 2024-08-30_608c27640c4d305f54a7f9ec2e0d20c9_darkside.exe 2648 2024-08-30_608c27640c4d305f54a7f9ec2e0d20c9_darkside.exe 2648 2024-08-30_608c27640c4d305f54a7f9ec2e0d20c9_darkside.exe 2648 2024-08-30_608c27640c4d305f54a7f9ec2e0d20c9_darkside.exe 2648 2024-08-30_608c27640c4d305f54a7f9ec2e0d20c9_darkside.exe 2648 2024-08-30_608c27640c4d305f54a7f9ec2e0d20c9_darkside.exe 2648 2024-08-30_608c27640c4d305f54a7f9ec2e0d20c9_darkside.exe 2648 2024-08-30_608c27640c4d305f54a7f9ec2e0d20c9_darkside.exe 2648 2024-08-30_608c27640c4d305f54a7f9ec2e0d20c9_darkside.exe 2648 2024-08-30_608c27640c4d305f54a7f9ec2e0d20c9_darkside.exe 2648 2024-08-30_608c27640c4d305f54a7f9ec2e0d20c9_darkside.exe 2648 2024-08-30_608c27640c4d305f54a7f9ec2e0d20c9_darkside.exe 2648 2024-08-30_608c27640c4d305f54a7f9ec2e0d20c9_darkside.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
vssvc.exedescription pid process Token: SeBackupPrivilege 380 vssvc.exe Token: SeRestorePrivilege 380 vssvc.exe Token: SeAuditPrivilege 380 vssvc.exe -
Suspicious use of WriteProcessMemory 13 IoCs
Processes:
2024-08-30_608c27640c4d305f54a7f9ec2e0d20c9_darkside.exe2024-08-30_608c27640c4d305f54a7f9ec2e0d20c9_darkside.exedescription pid process target process PID 720 wrote to memory of 2256 720 2024-08-30_608c27640c4d305f54a7f9ec2e0d20c9_darkside.exe 2024-08-30_608c27640c4d305f54a7f9ec2e0d20c9_darkside.exe PID 720 wrote to memory of 2256 720 2024-08-30_608c27640c4d305f54a7f9ec2e0d20c9_darkside.exe 2024-08-30_608c27640c4d305f54a7f9ec2e0d20c9_darkside.exe PID 720 wrote to memory of 2256 720 2024-08-30_608c27640c4d305f54a7f9ec2e0d20c9_darkside.exe 2024-08-30_608c27640c4d305f54a7f9ec2e0d20c9_darkside.exe PID 720 wrote to memory of 2256 720 2024-08-30_608c27640c4d305f54a7f9ec2e0d20c9_darkside.exe 2024-08-30_608c27640c4d305f54a7f9ec2e0d20c9_darkside.exe PID 720 wrote to memory of 2256 720 2024-08-30_608c27640c4d305f54a7f9ec2e0d20c9_darkside.exe 2024-08-30_608c27640c4d305f54a7f9ec2e0d20c9_darkside.exe PID 2256 wrote to memory of 2648 2256 2024-08-30_608c27640c4d305f54a7f9ec2e0d20c9_darkside.exe 2024-08-30_608c27640c4d305f54a7f9ec2e0d20c9_darkside.exe PID 2256 wrote to memory of 2648 2256 2024-08-30_608c27640c4d305f54a7f9ec2e0d20c9_darkside.exe 2024-08-30_608c27640c4d305f54a7f9ec2e0d20c9_darkside.exe PID 2256 wrote to memory of 2648 2256 2024-08-30_608c27640c4d305f54a7f9ec2e0d20c9_darkside.exe 2024-08-30_608c27640c4d305f54a7f9ec2e0d20c9_darkside.exe PID 2256 wrote to memory of 2648 2256 2024-08-30_608c27640c4d305f54a7f9ec2e0d20c9_darkside.exe 2024-08-30_608c27640c4d305f54a7f9ec2e0d20c9_darkside.exe PID 2256 wrote to memory of 2620 2256 2024-08-30_608c27640c4d305f54a7f9ec2e0d20c9_darkside.exe 2024-08-30_608c27640c4d305f54a7f9ec2e0d20c9_darkside.exe PID 2256 wrote to memory of 2620 2256 2024-08-30_608c27640c4d305f54a7f9ec2e0d20c9_darkside.exe 2024-08-30_608c27640c4d305f54a7f9ec2e0d20c9_darkside.exe PID 2256 wrote to memory of 2620 2256 2024-08-30_608c27640c4d305f54a7f9ec2e0d20c9_darkside.exe 2024-08-30_608c27640c4d305f54a7f9ec2e0d20c9_darkside.exe PID 2256 wrote to memory of 2620 2256 2024-08-30_608c27640c4d305f54a7f9ec2e0d20c9_darkside.exe 2024-08-30_608c27640c4d305f54a7f9ec2e0d20c9_darkside.exe -
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-08-30_608c27640c4d305f54a7f9ec2e0d20c9_darkside.exe"C:\Users\Admin\AppData\Local\Temp\2024-08-30_608c27640c4d305f54a7f9ec2e0d20c9_darkside.exe"1⤵PID:2000
-
C:\Users\Admin\AppData\Local\Temp\2024-08-30_608c27640c4d305f54a7f9ec2e0d20c9_darkside.exe"C:\Users\Admin\AppData\Local\Temp\2024-08-30_608c27640c4d305f54a7f9ec2e0d20c9_darkside.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:720 -
C:\Users\Admin\AppData\Local\Temp\2024-08-30_608c27640c4d305f54a7f9ec2e0d20c9_darkside.exe"C:\Users\Admin\AppData\Local\Temp\2024-08-30_608c27640c4d305f54a7f9ec2e0d20c9_darkside.exe"2⤵
- Drops file in System32 directory
- Sets desktop wallpaper using registry
- System Location Discovery: System Language Discovery
- Modifies Control Panel
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2256 -
C:\Users\Admin\AppData\Local\Temp\2024-08-30_608c27640c4d305f54a7f9ec2e0d20c9_darkside.exeC:\Users\Admin\AppData\Local\Temp\2024-08-30_608c27640c4d305f54a7f9ec2e0d20c9_darkside.exe -work worker0 job0-22563⤵
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
PID:2648 -
C:\Users\Admin\AppData\Local\Temp\2024-08-30_608c27640c4d305f54a7f9ec2e0d20c9_darkside.exeC:\Users\Admin\AppData\Local\Temp\2024-08-30_608c27640c4d305f54a7f9ec2e0d20c9_darkside.exe -work worker1 job1-22563⤵
- Enumerates connected drives
PID:2620
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
PID:380
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
3KB
MD5164aa420be8e0c2bcdef574355edaa32
SHA14336eaafedfc18a27cdf42bffad63b5a54ea8231
SHA256b326d11dd90c2e4efb0a384981f71c2bd1a6faa0553d6389acb08945b699f73d
SHA512fd1437bc4f45e3f4b5c3d0e7fca9383f45edceb5c8cb603d0b8ee98350a5f2468c2aabdb66f16bdee0bac49afefa4300a093a54ee43b1ff28a541ae612e34d9d