Analysis
-
max time kernel
118s -
max time network
118s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
26-09-2024 11:40
General
-
Target
2024092676a0d2ef15e408b4a07f534c8d056b30darkside.exe
-
Size
146KB
-
MD5
76a0d2ef15e408b4a07f534c8d056b30
-
SHA1
7ddc10e637b0ab439b80a193420b00bcf03c3dd7
-
SHA256
2317d33628eb06af24d1d6d94ff892d6fb6a7ecca24094d477f5c77829ca35c0
-
SHA512
48f709fe69c2aa219ee40167f1f82806fd003b697b6ecc96aa87826670b12533530a9314a4a642e92784ef59b4a97628ab27a4c781695a37d946ca624f6fff67
-
SSDEEP
3072:D6glyuxE4GsUPnliByocWepOsNPfGk21h:D6gDBGpvEByocWeqN
Malware Config
Signatures
-
Renames multiple (206) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Deletes itself 1 IoCs
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 1 IoCs
-
Drops desktop.ini file(s) 2 IoCs
-
Indicator Removal: File Deletion 1 TTPs
Adversaries may delete files left behind by the actions of their intrusion activity.
-
Sets desktop wallpaper using registry 2 TTPs 2 IoCs
-
Suspicious use of NtSetInformationThreadHideFromDebugger 5 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Modifies Control Panel 2 IoCs
-
Modifies registry class 5 IoCs
-
Suspicious behavior: EnumeratesProcesses 14 IoCs
-
Suspicious behavior: RenamesItself 26 IoCs
-
Suspicious use of AdjustPrivilegeToken 64 IoCs
-
Suspicious use of WriteProcessMemory 9 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024092676a0d2ef15e408b4a07f534c8d056b30darkside.exe"C:\Users\Admin\AppData\Local\Temp\2024092676a0d2ef15e408b4a07f534c8d056b30darkside.exe"1⤵
- Loads dropped DLL
- Drops desktop.ini file(s)
- Sets desktop wallpaper using registry
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Modifies Control Panel
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\ProgramData\17A6.tmp"C:\ProgramData\17A6.tmp"2⤵
- Deletes itself
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C DEL /F /Q C:\PROGRA~3\17A6.tmp >> NUL3⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x1481⤵
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
129B
MD5fa1fdbc15a5707c5201a27af2c08e8dc
SHA1bd6cac963ed7f421eb32a002fe74511030cfa38f
SHA256a214019b5104a3955fb1258b2e107de23be433c13fec73a1b924e6a8e7b36137
SHA51208c2ebc6ef5ef1508fff3c27722f41820157e831fbc6f4919617f87ac2bca697cec92689587523ed11bab09a49ce235dc3a99bf6f0b5bac9fb85c7c1306142a1
-
Filesize
463B
MD56f7db6bb7b29b288b16771cd09f495e6
SHA1ab4c0ef134b8c4fefa75acd18c5f88d6c6870b58
SHA25695d26fea78a10ee5d82d4de5e16bba8077ef038139b3c0fcf7519f2b4c813518
SHA5128ce9df614eae8036043d85d9c3e36d0d0e464e6d3ae288afd6ad538722ef4e48d8910cd2bf34004f7415a6c894654f03fe0f2eb3ffea67e333351818b2d5edd9
-
Filesize
146KB
MD5774dade54678da31abddc6ca84f3825a
SHA1b66868c41ecbf1d0f67d90ecc8ddc7011d909b6d
SHA256818a34eead813281894640989b87a6b2e0d4dba41dbbfb6aa0c35603d7a5431d
SHA5120962595afabe32c919f773f53ab60a8ef1f5a179695ab755a3ee193242de5b145ed70f9ad53baf278e0855a379328e9e6d17334cfbf86227f565399b699655bd
-
Filesize
129B
MD5c7ea6868e09abad51352df37d04209c5
SHA1176ccbf9d1757c3d755d0087917623b70fd3bcc3
SHA2560aa5805736862cdf6503e90fa1d1a61e0a3246e08994c9b21c37d2f971863e04
SHA512b91f4979f59efe44c3c07a54b315abf3fff385e71119cb1b0cfa77b97ce37a360af04d98a99dbfa7c6a70fe89c474f6754169cf0054a5531ca821b37e0997046
-
Filesize
14KB
MD5294e9f64cb1642dd89229fff0592856b
SHA197b148c27f3da29ba7b18d6aee8a0db9102f47c9
SHA256917e115cc403e29b4388e0d175cbfac3e7e40ca1742299fbdb353847db2de7c2
SHA512b87d531890bf1577b9b4af41dddb2cdbbfa164cf197bd5987df3a3075983645a3acba443e289b7bfd338422978a104f55298fbfe346872de0895bde44adc89cf
-
Filesize
256KB
-
Filesize
256KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
256KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB