Malware Analysis Report

2024-11-13 14:56

Sample ID 241107-ccbbga1qhs
Target 2024-11-07_768c44a8ca7375f504ef546e50218314_darkside
SHA256 a8db150f736de8b8654c7390cee378aebb1a8f11c13869fe9e63c223e4376766
Tags
lockbit defense_evasion discovery ransomware spyware stealer
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

a8db150f736de8b8654c7390cee378aebb1a8f11c13869fe9e63c223e4376766

Threat Level: Known bad

The file 2024-11-07_768c44a8ca7375f504ef546e50218314_darkside was found to be: Known bad.

Malicious Activity Summary

lockbit defense_evasion discovery ransomware spyware stealer

Lockbit family

Lockbit

Rule to detect Lockbit 3.0 ransomware Windows payload

Renames multiple (595) files with added filename extension

Renames multiple (334) files with added filename extension

Reads user/profile data of web browsers

Checks computer location settings

Deletes itself

Loads dropped DLL

Executes dropped EXE

Drops desktop.ini file(s)

Indicator Removal: File Deletion

Suspicious use of NtSetInformationThreadHideFromDebugger

Sets desktop wallpaper using registry

Drops file in System32 directory

System Location Discovery: System Language Discovery

Unsigned PE

Enumerates physical storage devices

Suspicious use of WriteProcessMemory

Enumerates system info in registry

Suspicious behavior: EnumeratesProcesses

Suspicious behavior: RenamesItself

Modifies registry class

Checks processor information in registry

Suspicious use of AdjustPrivilegeToken

Modifies Control Panel

Suspicious use of SetWindowsHookEx

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-11-07 01:55

Signatures

Lockbit family

lockbit

Rule to detect Lockbit 3.0 ransomware Windows payload

Description Indicator Process Target
N/A N/A N/A N/A

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-11-07 01:55

Reported

2024-11-07 01:57

Platform

win7-20240729-en

Max time kernel

91s

Max time network

22s

Command Line

"C:\Users\Admin\AppData\Local\Temp\2024-11-07_768c44a8ca7375f504ef546e50218314_darkside.exe"

Signatures

Lockbit

ransomware lockbit

Lockbit family

lockbit

Renames multiple (334) files with added filename extension

ransomware

Deletes itself

Description Indicator Process Target
N/A N/A C:\ProgramData\91F3.tmp N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\ProgramData\91F3.tmp N/A

Loads dropped DLL

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-11-07_768c44a8ca7375f504ef546e50218314_darkside.exe N/A

Reads user/profile data of web browsers

spyware stealer

Drops desktop.ini file(s)

Description Indicator Process Target
File opened for modification C:\$Recycle.Bin\S-1-5-21-2703099537-420551529-3771253338-1000\desktop.ini C:\Users\Admin\AppData\Local\Temp\2024-11-07_768c44a8ca7375f504ef546e50218314_darkside.exe N/A
File opened for modification F:\$RECYCLE.BIN\S-1-5-21-2703099537-420551529-3771253338-1000\desktop.ini C:\Users\Admin\AppData\Local\Temp\2024-11-07_768c44a8ca7375f504ef546e50218314_darkside.exe N/A

Indicator Removal: File Deletion

defense_evasion

Sets desktop wallpaper using registry

ransomware
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Control Panel\Desktop\WallPaper = "C:\\ProgramData\\pKSLKLNeI.bmp" C:\Users\Admin\AppData\Local\Temp\2024-11-07_768c44a8ca7375f504ef546e50218314_darkside.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Control Panel\Desktop\Wallpaper = "C:\\ProgramData\\pKSLKLNeI.bmp" C:\Users\Admin\AppData\Local\Temp\2024-11-07_768c44a8ca7375f504ef546e50218314_darkside.exe N/A

Suspicious use of NtSetInformationThreadHideFromDebugger

Description Indicator Process Target
N/A N/A C:\ProgramData\91F3.tmp N/A

Enumerates physical storage devices

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\2024-11-07_768c44a8ca7375f504ef546e50218314_darkside.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\ProgramData\91F3.tmp N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A

Modifies Control Panel

evasion
Description Indicator Process Target
Key created \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Control Panel\Desktop C:\Users\Admin\AppData\Local\Temp\2024-11-07_768c44a8ca7375f504ef546e50218314_darkside.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Control Panel\Desktop\WallpaperStyle = "10" C:\Users\Admin\AppData\Local\Temp\2024-11-07_768c44a8ca7375f504ef546e50218314_darkside.exe N/A

Modifies registry class

Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\pKSLKLNeI\DefaultIcon\ = "C:\\ProgramData\\pKSLKLNeI.ico" C:\Users\Admin\AppData\Local\Temp\2024-11-07_768c44a8ca7375f504ef546e50218314_darkside.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.pKSLKLNeI C:\Users\Admin\AppData\Local\Temp\2024-11-07_768c44a8ca7375f504ef546e50218314_darkside.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.pKSLKLNeI\ = "pKSLKLNeI" C:\Users\Admin\AppData\Local\Temp\2024-11-07_768c44a8ca7375f504ef546e50218314_darkside.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\pKSLKLNeI\DefaultIcon C:\Users\Admin\AppData\Local\Temp\2024-11-07_768c44a8ca7375f504ef546e50218314_darkside.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\pKSLKLNeI C:\Users\Admin\AppData\Local\Temp\2024-11-07_768c44a8ca7375f504ef546e50218314_darkside.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-11-07_768c44a8ca7375f504ef546e50218314_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-11-07_768c44a8ca7375f504ef546e50218314_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-11-07_768c44a8ca7375f504ef546e50218314_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-11-07_768c44a8ca7375f504ef546e50218314_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-11-07_768c44a8ca7375f504ef546e50218314_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-11-07_768c44a8ca7375f504ef546e50218314_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-11-07_768c44a8ca7375f504ef546e50218314_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-11-07_768c44a8ca7375f504ef546e50218314_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-11-07_768c44a8ca7375f504ef546e50218314_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-11-07_768c44a8ca7375f504ef546e50218314_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-11-07_768c44a8ca7375f504ef546e50218314_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-11-07_768c44a8ca7375f504ef546e50218314_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-11-07_768c44a8ca7375f504ef546e50218314_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-11-07_768c44a8ca7375f504ef546e50218314_darkside.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeAssignPrimaryTokenPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-11-07_768c44a8ca7375f504ef546e50218314_darkside.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-11-07_768c44a8ca7375f504ef546e50218314_darkside.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-11-07_768c44a8ca7375f504ef546e50218314_darkside.exe N/A
Token: 36 N/A C:\Users\Admin\AppData\Local\Temp\2024-11-07_768c44a8ca7375f504ef546e50218314_darkside.exe N/A
Token: SeImpersonatePrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-11-07_768c44a8ca7375f504ef546e50218314_darkside.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-11-07_768c44a8ca7375f504ef546e50218314_darkside.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-11-07_768c44a8ca7375f504ef546e50218314_darkside.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Local\Temp\2024-11-07_768c44a8ca7375f504ef546e50218314_darkside.exe N/A
Token: SeManageVolumePrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-11-07_768c44a8ca7375f504ef546e50218314_darkside.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-11-07_768c44a8ca7375f504ef546e50218314_darkside.exe N/A
Token: SeRestorePrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-11-07_768c44a8ca7375f504ef546e50218314_darkside.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-11-07_768c44a8ca7375f504ef546e50218314_darkside.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-11-07_768c44a8ca7375f504ef546e50218314_darkside.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-11-07_768c44a8ca7375f504ef546e50218314_darkside.exe N/A
Token: SeShutdownPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-11-07_768c44a8ca7375f504ef546e50218314_darkside.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-11-07_768c44a8ca7375f504ef546e50218314_darkside.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-11-07_768c44a8ca7375f504ef546e50218314_darkside.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-11-07_768c44a8ca7375f504ef546e50218314_darkside.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-11-07_768c44a8ca7375f504ef546e50218314_darkside.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-11-07_768c44a8ca7375f504ef546e50218314_darkside.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-11-07_768c44a8ca7375f504ef546e50218314_darkside.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-11-07_768c44a8ca7375f504ef546e50218314_darkside.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-11-07_768c44a8ca7375f504ef546e50218314_darkside.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-11-07_768c44a8ca7375f504ef546e50218314_darkside.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-11-07_768c44a8ca7375f504ef546e50218314_darkside.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-11-07_768c44a8ca7375f504ef546e50218314_darkside.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-11-07_768c44a8ca7375f504ef546e50218314_darkside.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-11-07_768c44a8ca7375f504ef546e50218314_darkside.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-11-07_768c44a8ca7375f504ef546e50218314_darkside.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-11-07_768c44a8ca7375f504ef546e50218314_darkside.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-11-07_768c44a8ca7375f504ef546e50218314_darkside.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-11-07_768c44a8ca7375f504ef546e50218314_darkside.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-11-07_768c44a8ca7375f504ef546e50218314_darkside.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-11-07_768c44a8ca7375f504ef546e50218314_darkside.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-11-07_768c44a8ca7375f504ef546e50218314_darkside.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-11-07_768c44a8ca7375f504ef546e50218314_darkside.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-11-07_768c44a8ca7375f504ef546e50218314_darkside.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-11-07_768c44a8ca7375f504ef546e50218314_darkside.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-11-07_768c44a8ca7375f504ef546e50218314_darkside.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-11-07_768c44a8ca7375f504ef546e50218314_darkside.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-11-07_768c44a8ca7375f504ef546e50218314_darkside.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-11-07_768c44a8ca7375f504ef546e50218314_darkside.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-11-07_768c44a8ca7375f504ef546e50218314_darkside.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-11-07_768c44a8ca7375f504ef546e50218314_darkside.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-11-07_768c44a8ca7375f504ef546e50218314_darkside.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-11-07_768c44a8ca7375f504ef546e50218314_darkside.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-11-07_768c44a8ca7375f504ef546e50218314_darkside.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-11-07_768c44a8ca7375f504ef546e50218314_darkside.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-11-07_768c44a8ca7375f504ef546e50218314_darkside.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-11-07_768c44a8ca7375f504ef546e50218314_darkside.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-11-07_768c44a8ca7375f504ef546e50218314_darkside.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-11-07_768c44a8ca7375f504ef546e50218314_darkside.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-11-07_768c44a8ca7375f504ef546e50218314_darkside.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-11-07_768c44a8ca7375f504ef546e50218314_darkside.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-11-07_768c44a8ca7375f504ef546e50218314_darkside.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-11-07_768c44a8ca7375f504ef546e50218314_darkside.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-11-07_768c44a8ca7375f504ef546e50218314_darkside.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-11-07_768c44a8ca7375f504ef546e50218314_darkside.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-11-07_768c44a8ca7375f504ef546e50218314_darkside.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-11-07_768c44a8ca7375f504ef546e50218314_darkside.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-11-07_768c44a8ca7375f504ef546e50218314_darkside.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-11-07_768c44a8ca7375f504ef546e50218314_darkside.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-11-07_768c44a8ca7375f504ef546e50218314_darkside.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-11-07_768c44a8ca7375f504ef546e50218314_darkside.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\2024-11-07_768c44a8ca7375f504ef546e50218314_darkside.exe

"C:\Users\Admin\AppData\Local\Temp\2024-11-07_768c44a8ca7375f504ef546e50218314_darkside.exe"

C:\ProgramData\91F3.tmp

"C:\ProgramData\91F3.tmp"

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /C DEL /F /Q C:\PROGRA~3\91F3.tmp >> NUL

C:\Windows\system32\AUDIODG.EXE

C:\Windows\system32\AUDIODG.EXE 0x148

Network

N/A

Files

memory/2296-0-0x0000000000DB0000-0x0000000000DF0000-memory.dmp

C:\$Recycle.Bin\S-1-5-21-2703099537-420551529-3771253338-1000\AAAAAAAAAAA

MD5 b234eff070b131ca2ddcfa48a253de8b
SHA1 2dc930c88561afd49745e1cf3e18da1918468003
SHA256 7256d167fcc8cc840c825999eac21d6891991e5a9d9d130af1f2b57b55361b5f
SHA512 3dda64d197961953e6c509b10a5c5fa8fb23631cff899196b77a402137a2530c006c97f69fc8c4b44f251c7f6f474f25c96fc9800880ae84c711ada21c309d5f

C:\pKSLKLNeI.README.txt

MD5 dd746ace17e44ace00885b91400f11d5
SHA1 4a0302d2dca400598f396e4230fdae71779cbeaa
SHA256 b27c3c8a30faf7c76483b7e5d964ae85046a9713caa46508ee7a1e31b7dc6272
SHA512 8ac26aa7262fdf1afdc74e604720a79ebde076c75f460d7d5f57ff4d81dedb1ad471eb114ddd428c1934029746f5c222339090680bc77a6ea09ce329e1da3ef1

F:\$RECYCLE.BIN\S-1-5-21-2703099537-420551529-3771253338-1000\EEEEEEEEEEE

MD5 9c0c2da334aa39e849c29cd3ceb76b43
SHA1 cb10e69f972591903d6e3a3f12a2f5b874491876
SHA256 159423a1be5bc9aef6f8fc234eb9a03ea94d26b2109d8043c71ca77fe5e1b29b
SHA512 e53f144512e37b3031f9e76ce180a752b006feeef5ff5bf0cd706d18173d480579d4439f270379d14d31ff0e78b76aa11d948a0c13e94e7f5843b6278806c59c

\ProgramData\91F3.tmp

MD5 294e9f64cb1642dd89229fff0592856b
SHA1 97b148c27f3da29ba7b18d6aee8a0db9102f47c9
SHA256 917e115cc403e29b4388e0d175cbfac3e7e40ca1742299fbdb353847db2de7c2
SHA512 b87d531890bf1577b9b4af41dddb2cdbbfa164cf197bd5987df3a3075983645a3acba443e289b7bfd338422978a104f55298fbfe346872de0895bde44adc89cf

memory/2132-862-0x000000007EF80000-0x000000007EF81000-memory.dmp

memory/2132-861-0x000000007EF20000-0x000000007EF21000-memory.dmp

memory/2132-860-0x0000000002170000-0x00000000021B0000-memory.dmp

memory/2132-859-0x0000000002170000-0x00000000021B0000-memory.dmp

memory/2132-857-0x000000007EFA0000-0x000000007EFA1000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\DDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDD

MD5 31f7292ab901b8708f4a6f6b92c7b0fa
SHA1 fe709f6b7b4fd21bd629362346a7812a2ef8db9c
SHA256 8b98a1f83c69595e0d6c587a564f49c1adcbf788e431e6c42647a8202fedeb5a
SHA512 cc9432e1a7db1c4d05df43b61206446dcd7e3a071629483e7ffc4ee0cb715a2bac9788fb53cbb8bd9b56909f0e5391dd80648952f96e4842427b0bf64984a57f

memory/2132-892-0x000000007EF60000-0x000000007EF61000-memory.dmp

memory/2132-891-0x000000007EF40000-0x000000007EF41000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2024-11-07 01:55

Reported

2024-11-07 01:57

Platform

win10v2004-20241007-en

Max time kernel

94s

Max time network

143s

Command Line

"C:\Users\Admin\AppData\Local\Temp\2024-11-07_768c44a8ca7375f504ef546e50218314_darkside.exe"

Signatures

Lockbit

ransomware lockbit

Lockbit family

lockbit

Renames multiple (595) files with added filename extension

ransomware

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\Control Panel\International\Geo\Nation C:\ProgramData\F628.tmp N/A

Deletes itself

Description Indicator Process Target
N/A N/A C:\ProgramData\F628.tmp N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\ProgramData\F628.tmp N/A

Reads user/profile data of web browsers

spyware stealer

Drops desktop.ini file(s)

Description Indicator Process Target
File opened for modification C:\$Recycle.Bin\S-1-5-21-4050598569-1597076380-177084960-1000\desktop.ini C:\Users\Admin\AppData\Local\Temp\2024-11-07_768c44a8ca7375f504ef546e50218314_darkside.exe N/A
File opened for modification F:\$RECYCLE.BIN\S-1-5-21-4050598569-1597076380-177084960-1000\desktop.ini C:\Users\Admin\AppData\Local\Temp\2024-11-07_768c44a8ca7375f504ef546e50218314_darkside.exe N/A

Indicator Removal: File Deletion

defense_evasion

Drops file in System32 directory

Description Indicator Process Target
File created C:\Windows\system32\spool\PRINTERS\00002.SPL C:\Windows\splwow64.exe N/A
File created C:\Windows\system32\spool\PRINTERS\PPw4vvzy0ujeveb6qdn29r30esd.TMP C:\Windows\system32\printfilterpipelinesvc.exe N/A
File created C:\Windows\system32\spool\PRINTERS\PPml9wtj4hl0xvoxuwhmu9ejqj.TMP C:\Windows\system32\printfilterpipelinesvc.exe N/A
File created C:\Windows\system32\spool\PRINTERS\PPel07ow0kpmn11eh381noq2mkb.TMP C:\Windows\system32\printfilterpipelinesvc.exe N/A

Sets desktop wallpaper using registry

ransomware
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\Control Panel\Desktop\Wallpaper = "C:\\ProgramData\\pKSLKLNeI.bmp" C:\Users\Admin\AppData\Local\Temp\2024-11-07_768c44a8ca7375f504ef546e50218314_darkside.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\Control Panel\Desktop\WallPaper = "C:\\ProgramData\\pKSLKLNeI.bmp" C:\Users\Admin\AppData\Local\Temp\2024-11-07_768c44a8ca7375f504ef546e50218314_darkside.exe N/A

Suspicious use of NtSetInformationThreadHideFromDebugger

Description Indicator Process Target
N/A N/A C:\ProgramData\F628.tmp N/A

Enumerates physical storage devices

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\2024-11-07_768c44a8ca7375f504ef546e50218314_darkside.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\ProgramData\F628.tmp N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A

Checks processor information in registry

Description Indicator Process Target
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString C:\Program Files\Microsoft Office\root\Office16\ONENOTE.EXE N/A
Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 C:\Program Files\Microsoft Office\root\Office16\ONENOTE.EXE N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz C:\Program Files\Microsoft Office\root\Office16\ONENOTE.EXE N/A

Enumerates system info in registry

Description Indicator Process Target
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily C:\Program Files\Microsoft Office\root\Office16\ONENOTE.EXE N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU C:\Program Files\Microsoft Office\root\Office16\ONENOTE.EXE N/A
Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS C:\Program Files\Microsoft Office\root\Office16\ONENOTE.EXE N/A

Modifies Control Panel

evasion
Description Indicator Process Target
Key created \REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\Control Panel\Desktop C:\Users\Admin\AppData\Local\Temp\2024-11-07_768c44a8ca7375f504ef546e50218314_darkside.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\Control Panel\Desktop\WallpaperStyle = "10" C:\Users\Admin\AppData\Local\Temp\2024-11-07_768c44a8ca7375f504ef546e50218314_darkside.exe N/A

Modifies registry class

Description Indicator Process Target
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\pKSLKLNeI\DefaultIcon C:\Users\Admin\AppData\Local\Temp\2024-11-07_768c44a8ca7375f504ef546e50218314_darkside.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\pKSLKLNeI C:\Users\Admin\AppData\Local\Temp\2024-11-07_768c44a8ca7375f504ef546e50218314_darkside.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\pKSLKLNeI\DefaultIcon\ = "C:\\ProgramData\\pKSLKLNeI.ico" C:\Users\Admin\AppData\Local\Temp\2024-11-07_768c44a8ca7375f504ef546e50218314_darkside.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.pKSLKLNeI C:\Users\Admin\AppData\Local\Temp\2024-11-07_768c44a8ca7375f504ef546e50218314_darkside.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.pKSLKLNeI\ = "pKSLKLNeI" C:\Users\Admin\AppData\Local\Temp\2024-11-07_768c44a8ca7375f504ef546e50218314_darkside.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-11-07_768c44a8ca7375f504ef546e50218314_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-11-07_768c44a8ca7375f504ef546e50218314_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-11-07_768c44a8ca7375f504ef546e50218314_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-11-07_768c44a8ca7375f504ef546e50218314_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-11-07_768c44a8ca7375f504ef546e50218314_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-11-07_768c44a8ca7375f504ef546e50218314_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-11-07_768c44a8ca7375f504ef546e50218314_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-11-07_768c44a8ca7375f504ef546e50218314_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-11-07_768c44a8ca7375f504ef546e50218314_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-11-07_768c44a8ca7375f504ef546e50218314_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-11-07_768c44a8ca7375f504ef546e50218314_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-11-07_768c44a8ca7375f504ef546e50218314_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-11-07_768c44a8ca7375f504ef546e50218314_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-11-07_768c44a8ca7375f504ef546e50218314_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-11-07_768c44a8ca7375f504ef546e50218314_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-11-07_768c44a8ca7375f504ef546e50218314_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-11-07_768c44a8ca7375f504ef546e50218314_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-11-07_768c44a8ca7375f504ef546e50218314_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-11-07_768c44a8ca7375f504ef546e50218314_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-11-07_768c44a8ca7375f504ef546e50218314_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-11-07_768c44a8ca7375f504ef546e50218314_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-11-07_768c44a8ca7375f504ef546e50218314_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-11-07_768c44a8ca7375f504ef546e50218314_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-11-07_768c44a8ca7375f504ef546e50218314_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-11-07_768c44a8ca7375f504ef546e50218314_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-11-07_768c44a8ca7375f504ef546e50218314_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-11-07_768c44a8ca7375f504ef546e50218314_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-11-07_768c44a8ca7375f504ef546e50218314_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-11-07_768c44a8ca7375f504ef546e50218314_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-11-07_768c44a8ca7375f504ef546e50218314_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-11-07_768c44a8ca7375f504ef546e50218314_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-11-07_768c44a8ca7375f504ef546e50218314_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-11-07_768c44a8ca7375f504ef546e50218314_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-11-07_768c44a8ca7375f504ef546e50218314_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-11-07_768c44a8ca7375f504ef546e50218314_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-11-07_768c44a8ca7375f504ef546e50218314_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-11-07_768c44a8ca7375f504ef546e50218314_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-11-07_768c44a8ca7375f504ef546e50218314_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-11-07_768c44a8ca7375f504ef546e50218314_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-11-07_768c44a8ca7375f504ef546e50218314_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-11-07_768c44a8ca7375f504ef546e50218314_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-11-07_768c44a8ca7375f504ef546e50218314_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-11-07_768c44a8ca7375f504ef546e50218314_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-11-07_768c44a8ca7375f504ef546e50218314_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-11-07_768c44a8ca7375f504ef546e50218314_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-11-07_768c44a8ca7375f504ef546e50218314_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-11-07_768c44a8ca7375f504ef546e50218314_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-11-07_768c44a8ca7375f504ef546e50218314_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-11-07_768c44a8ca7375f504ef546e50218314_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-11-07_768c44a8ca7375f504ef546e50218314_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-11-07_768c44a8ca7375f504ef546e50218314_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-11-07_768c44a8ca7375f504ef546e50218314_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-11-07_768c44a8ca7375f504ef546e50218314_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-11-07_768c44a8ca7375f504ef546e50218314_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-11-07_768c44a8ca7375f504ef546e50218314_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-11-07_768c44a8ca7375f504ef546e50218314_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-11-07_768c44a8ca7375f504ef546e50218314_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-11-07_768c44a8ca7375f504ef546e50218314_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-11-07_768c44a8ca7375f504ef546e50218314_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-11-07_768c44a8ca7375f504ef546e50218314_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-11-07_768c44a8ca7375f504ef546e50218314_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-11-07_768c44a8ca7375f504ef546e50218314_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-11-07_768c44a8ca7375f504ef546e50218314_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-11-07_768c44a8ca7375f504ef546e50218314_darkside.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeAssignPrimaryTokenPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-11-07_768c44a8ca7375f504ef546e50218314_darkside.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-11-07_768c44a8ca7375f504ef546e50218314_darkside.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-11-07_768c44a8ca7375f504ef546e50218314_darkside.exe N/A
Token: 36 N/A C:\Users\Admin\AppData\Local\Temp\2024-11-07_768c44a8ca7375f504ef546e50218314_darkside.exe N/A
Token: SeImpersonatePrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-11-07_768c44a8ca7375f504ef546e50218314_darkside.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-11-07_768c44a8ca7375f504ef546e50218314_darkside.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-11-07_768c44a8ca7375f504ef546e50218314_darkside.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Local\Temp\2024-11-07_768c44a8ca7375f504ef546e50218314_darkside.exe N/A
Token: SeManageVolumePrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-11-07_768c44a8ca7375f504ef546e50218314_darkside.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-11-07_768c44a8ca7375f504ef546e50218314_darkside.exe N/A
Token: SeRestorePrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-11-07_768c44a8ca7375f504ef546e50218314_darkside.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-11-07_768c44a8ca7375f504ef546e50218314_darkside.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-11-07_768c44a8ca7375f504ef546e50218314_darkside.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-11-07_768c44a8ca7375f504ef546e50218314_darkside.exe N/A
Token: SeShutdownPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-11-07_768c44a8ca7375f504ef546e50218314_darkside.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-11-07_768c44a8ca7375f504ef546e50218314_darkside.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-11-07_768c44a8ca7375f504ef546e50218314_darkside.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-11-07_768c44a8ca7375f504ef546e50218314_darkside.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-11-07_768c44a8ca7375f504ef546e50218314_darkside.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-11-07_768c44a8ca7375f504ef546e50218314_darkside.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-11-07_768c44a8ca7375f504ef546e50218314_darkside.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-11-07_768c44a8ca7375f504ef546e50218314_darkside.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-11-07_768c44a8ca7375f504ef546e50218314_darkside.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-11-07_768c44a8ca7375f504ef546e50218314_darkside.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-11-07_768c44a8ca7375f504ef546e50218314_darkside.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-11-07_768c44a8ca7375f504ef546e50218314_darkside.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-11-07_768c44a8ca7375f504ef546e50218314_darkside.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-11-07_768c44a8ca7375f504ef546e50218314_darkside.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-11-07_768c44a8ca7375f504ef546e50218314_darkside.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-11-07_768c44a8ca7375f504ef546e50218314_darkside.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-11-07_768c44a8ca7375f504ef546e50218314_darkside.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-11-07_768c44a8ca7375f504ef546e50218314_darkside.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-11-07_768c44a8ca7375f504ef546e50218314_darkside.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-11-07_768c44a8ca7375f504ef546e50218314_darkside.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-11-07_768c44a8ca7375f504ef546e50218314_darkside.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-11-07_768c44a8ca7375f504ef546e50218314_darkside.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-11-07_768c44a8ca7375f504ef546e50218314_darkside.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-11-07_768c44a8ca7375f504ef546e50218314_darkside.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-11-07_768c44a8ca7375f504ef546e50218314_darkside.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-11-07_768c44a8ca7375f504ef546e50218314_darkside.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-11-07_768c44a8ca7375f504ef546e50218314_darkside.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-11-07_768c44a8ca7375f504ef546e50218314_darkside.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-11-07_768c44a8ca7375f504ef546e50218314_darkside.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-11-07_768c44a8ca7375f504ef546e50218314_darkside.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-11-07_768c44a8ca7375f504ef546e50218314_darkside.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-11-07_768c44a8ca7375f504ef546e50218314_darkside.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-11-07_768c44a8ca7375f504ef546e50218314_darkside.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-11-07_768c44a8ca7375f504ef546e50218314_darkside.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-11-07_768c44a8ca7375f504ef546e50218314_darkside.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-11-07_768c44a8ca7375f504ef546e50218314_darkside.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-11-07_768c44a8ca7375f504ef546e50218314_darkside.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-11-07_768c44a8ca7375f504ef546e50218314_darkside.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-11-07_768c44a8ca7375f504ef546e50218314_darkside.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-11-07_768c44a8ca7375f504ef546e50218314_darkside.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-11-07_768c44a8ca7375f504ef546e50218314_darkside.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-11-07_768c44a8ca7375f504ef546e50218314_darkside.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-11-07_768c44a8ca7375f504ef546e50218314_darkside.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-11-07_768c44a8ca7375f504ef546e50218314_darkside.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-11-07_768c44a8ca7375f504ef546e50218314_darkside.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-11-07_768c44a8ca7375f504ef546e50218314_darkside.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-11-07_768c44a8ca7375f504ef546e50218314_darkside.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-11-07_768c44a8ca7375f504ef546e50218314_darkside.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-11-07_768c44a8ca7375f504ef546e50218314_darkside.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-11-07_768c44a8ca7375f504ef546e50218314_darkside.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2912 wrote to memory of 4236 N/A C:\Users\Admin\AppData\Local\Temp\2024-11-07_768c44a8ca7375f504ef546e50218314_darkside.exe C:\Windows\splwow64.exe
PID 2912 wrote to memory of 4236 N/A C:\Users\Admin\AppData\Local\Temp\2024-11-07_768c44a8ca7375f504ef546e50218314_darkside.exe C:\Windows\splwow64.exe
PID 2716 wrote to memory of 4056 N/A C:\Windows\system32\printfilterpipelinesvc.exe C:\Program Files\Microsoft Office\root\Office16\ONENOTE.EXE
PID 2716 wrote to memory of 4056 N/A C:\Windows\system32\printfilterpipelinesvc.exe C:\Program Files\Microsoft Office\root\Office16\ONENOTE.EXE
PID 2912 wrote to memory of 4724 N/A C:\Users\Admin\AppData\Local\Temp\2024-11-07_768c44a8ca7375f504ef546e50218314_darkside.exe C:\ProgramData\F628.tmp
PID 2912 wrote to memory of 4724 N/A C:\Users\Admin\AppData\Local\Temp\2024-11-07_768c44a8ca7375f504ef546e50218314_darkside.exe C:\ProgramData\F628.tmp
PID 2912 wrote to memory of 4724 N/A C:\Users\Admin\AppData\Local\Temp\2024-11-07_768c44a8ca7375f504ef546e50218314_darkside.exe C:\ProgramData\F628.tmp
PID 2912 wrote to memory of 4724 N/A C:\Users\Admin\AppData\Local\Temp\2024-11-07_768c44a8ca7375f504ef546e50218314_darkside.exe C:\ProgramData\F628.tmp
PID 4724 wrote to memory of 2120 N/A C:\ProgramData\F628.tmp C:\Windows\SysWOW64\cmd.exe
PID 4724 wrote to memory of 2120 N/A C:\ProgramData\F628.tmp C:\Windows\SysWOW64\cmd.exe
PID 4724 wrote to memory of 2120 N/A C:\ProgramData\F628.tmp C:\Windows\SysWOW64\cmd.exe

Processes

C:\Users\Admin\AppData\Local\Temp\2024-11-07_768c44a8ca7375f504ef546e50218314_darkside.exe

"C:\Users\Admin\AppData\Local\Temp\2024-11-07_768c44a8ca7375f504ef546e50218314_darkside.exe"

C:\Windows\splwow64.exe

C:\Windows\splwow64.exe 12288

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k PrintWorkflow -s PrintWorkflowUserSvc

C:\Windows\system32\printfilterpipelinesvc.exe

C:\Windows\system32\printfilterpipelinesvc.exe -Embedding

C:\Program Files\Microsoft Office\root\Office16\ONENOTE.EXE

/insertdoc "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\{FBED37EA-C11D-4CF2-99DF-95E46CB942A5}.xps" 133754181393280000

C:\ProgramData\F628.tmp

"C:\ProgramData\F628.tmp"

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /C DEL /F /Q C:\PROGRA~3\F628.tmp >> NUL

Network

Country Destination Domain Proto
US 8.8.8.8:53 154.239.44.20.in-addr.arpa udp
US 8.8.8.8:53 140.32.126.40.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 149.220.183.52.in-addr.arpa udp
US 8.8.8.8:53 58.55.71.13.in-addr.arpa udp
US 8.8.8.8:53 46.28.109.52.in-addr.arpa udp
US 8.8.8.8:53 roaming.officeapps.live.com udp
FR 52.109.68.129:443 roaming.officeapps.live.com tcp
US 8.8.8.8:53 129.68.109.52.in-addr.arpa udp
US 8.8.8.8:53 89.65.42.20.in-addr.arpa udp
US 8.8.8.8:53 53.210.109.20.in-addr.arpa udp
US 8.8.8.8:53 15.164.165.52.in-addr.arpa udp
US 8.8.8.8:53 240.221.184.93.in-addr.arpa udp
US 8.8.8.8:53 88.210.23.2.in-addr.arpa udp
US 8.8.8.8:53 19.229.111.52.in-addr.arpa udp
US 8.8.8.8:53 13.227.111.52.in-addr.arpa udp

Files

memory/2912-1-0x0000000002B10000-0x0000000002B20000-memory.dmp

memory/2912-2-0x0000000002B10000-0x0000000002B20000-memory.dmp

memory/2912-0-0x0000000002B10000-0x0000000002B20000-memory.dmp

C:\$Recycle.Bin\S-1-5-21-4050598569-1597076380-177084960-1000\GGGGGGGGGGG

MD5 a418a9b19dbc29d47faaf66ed722d535
SHA1 292692c7ea9c70bea8b45cb5f9961c3baedf7fb2
SHA256 25717131eac0a5f5bd8e676a2ce15302d382fcd4d29769f286970846dd90a5c1
SHA512 74c732cf8576467985e399adb1fda24c531ee8b281574ed01b6872dc2b6b14102cac9562fe8efc0633c454e0170e33fd563b7528c39425f44d1efa8789b63572

F:\$RECYCLE.BIN\S-1-5-21-4050598569-1597076380-177084960-1000\DDDDDDDDDDD

MD5 2929528042eeeaeb41d7d2d90e3938f4
SHA1 ddedb0570c17c514c6ae21b757f11508dc652d81
SHA256 fc691dfc0de409f0f3bf48cb0135c401ce218715b914c8bb5d109a00d8cdce75
SHA512 f3cdcb5e259eab105f0b339a8ca51db31eca9c4b05614bb4ccfe23e8ba42a9ddb059bf337f897c04705fe3231d6d5c290841f5502ecc9877e41697ae9248abae

C:\pKSLKLNeI.README.txt

MD5 dd746ace17e44ace00885b91400f11d5
SHA1 4a0302d2dca400598f396e4230fdae71779cbeaa
SHA256 b27c3c8a30faf7c76483b7e5d964ae85046a9713caa46508ee7a1e31b7dc6272
SHA512 8ac26aa7262fdf1afdc74e604720a79ebde076c75f460d7d5f57ff4d81dedb1ad471eb114ddd428c1934029746f5c222339090680bc77a6ea09ce329e1da3ef1

memory/2912-2933-0x0000000002B10000-0x0000000002B20000-memory.dmp

memory/2912-2935-0x0000000002B10000-0x0000000002B20000-memory.dmp

memory/2912-2934-0x0000000002B10000-0x0000000002B20000-memory.dmp

memory/4056-2947-0x00007FFCE9070000-0x00007FFCE9080000-memory.dmp

memory/4056-2949-0x00007FFCE9070000-0x00007FFCE9080000-memory.dmp

memory/4056-2948-0x00007FFCE9070000-0x00007FFCE9080000-memory.dmp

memory/4056-2950-0x00007FFCE9070000-0x00007FFCE9080000-memory.dmp

memory/4056-2951-0x00007FFCE9070000-0x00007FFCE9080000-memory.dmp

C:\ProgramData\F628.tmp

MD5 294e9f64cb1642dd89229fff0592856b
SHA1 97b148c27f3da29ba7b18d6aee8a0db9102f47c9
SHA256 917e115cc403e29b4388e0d175cbfac3e7e40ca1742299fbdb353847db2de7c2
SHA512 b87d531890bf1577b9b4af41dddb2cdbbfa164cf197bd5987df3a3075983645a3acba443e289b7bfd338422978a104f55298fbfe346872de0895bde44adc89cf

C:\Users\Admin\AppData\Local\Temp\EEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEE

MD5 e662d06f36fbff4378cfdf495e0df465
SHA1 cd71239a1064f409be31badcce85c438319521a5
SHA256 9fa4e8ce91dd91ce30998df1914d4d1f3a31842980a9f4e86c208982e3bcd199
SHA512 6a073ab3d0a4b9aff181d4a243e8cb72be4d8e7a0501b0f54bb59ebcd3f2087d552db2d1e2bd67b41128ac6b94d858c736207c8209588cc20b04f99bfed16c4d

memory/4056-2984-0x00007FFCE6E20000-0x00007FFCE6E30000-memory.dmp

memory/4056-2985-0x00007FFCE6E20000-0x00007FFCE6E30000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\{20AEE37C-A1BB-4A11-B285-AB519DA3332D}

MD5 aa424649efedfff5cfa6f5460054c111
SHA1 c6cc947a0f7150ff3b2a22d50f2d691e1c255b4d
SHA256 e1a4bd92dd6f92310e494433c9413b1898a581842be7cbfab0bb0f9366f0bb40
SHA512 7587dbe81990692a6911e495f3a9ff5d9c2bb6a2c6be28278da676dce1591712aabc8873092593673bf60429709aab83fc1848f944a4314b5af5e7cc9187c60c

C:\Users\Admin\Documents\OneNote Notebooks\My Notebook\Open Notebook.onetoc2

MD5 43ef831e575b73c6c6693076eaf70d95
SHA1 d62679c868dec9f9d78790da26b2ffc9c5175de6
SHA256 12cf7cce47c381253840e96668982dabb751b87b366904f9324f1924e6182ac3
SHA512 4ec12ba17c45dd6d9c1c59f18b5e72f006b11afe0dc825e9a11c10f5737f28b8a8f0c3069d0c59f40f53e8495c4141bfc50549d9e262ed94df028d7a3cce0279