Malware Analysis Report

2024-11-13 14:56

Sample ID 241107-ctx7kateln
Target 2024-11-07_768c44a8ca7375f504ef546e50218314_darkside
SHA256 a8db150f736de8b8654c7390cee378aebb1a8f11c13869fe9e63c223e4376766
Tags
lockbit defense_evasion discovery ransomware spyware stealer
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

a8db150f736de8b8654c7390cee378aebb1a8f11c13869fe9e63c223e4376766

Threat Level: Known bad

The file 2024-11-07_768c44a8ca7375f504ef546e50218314_darkside was found to be: Known bad.

Malicious Activity Summary

lockbit defense_evasion discovery ransomware spyware stealer

Rule to detect Lockbit 3.0 ransomware Windows payload

Lockbit

Lockbit family

Renames multiple (601) files with added filename extension

Renames multiple (345) files with added filename extension

Checks computer location settings

Executes dropped EXE

Reads user/profile data of web browsers

Deletes itself

Loads dropped DLL

Drops desktop.ini file(s)

Indicator Removal: File Deletion

Sets desktop wallpaper using registry

Drops file in System32 directory

Suspicious use of NtSetInformationThreadHideFromDebugger

Unsigned PE

Enumerates physical storage devices

System Location Discovery: System Language Discovery

Suspicious use of SetWindowsHookEx

Suspicious use of AdjustPrivilegeToken

Opens file in notepad (likely ransom note)

Suspicious use of FindShellTrayWindow

Suspicious behavior: EnumeratesProcesses

Suspicious behavior: RenamesItself

Modifies registry class

Enumerates system info in registry

Checks processor information in registry

Suspicious behavior: AddClipboardFormatListener

Suspicious use of WriteProcessMemory

Modifies Control Panel

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-11-07 02:22

Signatures

Lockbit family

lockbit

Rule to detect Lockbit 3.0 ransomware Windows payload

Description Indicator Process Target
N/A N/A N/A N/A

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral2

Detonation Overview

Submitted

2024-11-07 02:22

Reported

2024-11-07 02:23

Platform

win10v2004-20241007-en

Max time kernel

54s

Max time network

35s

Command Line

"C:\Users\Admin\AppData\Local\Temp\2024-11-07_768c44a8ca7375f504ef546e50218314_darkside.exe"

Signatures

Lockbit

ransomware lockbit

Lockbit family

lockbit

Renames multiple (601) files with added filename extension

ransomware

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\Control Panel\International\Geo\Nation C:\ProgramData\A0B5.tmp N/A

Deletes itself

Description Indicator Process Target
N/A N/A C:\ProgramData\A0B5.tmp N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\ProgramData\A0B5.tmp N/A

Reads user/profile data of web browsers

spyware stealer

Drops desktop.ini file(s)

Description Indicator Process Target
File opened for modification C:\$Recycle.Bin\S-1-5-21-3227495264-2217614367-4027411560-1000\desktop.ini C:\Users\Admin\AppData\Local\Temp\2024-11-07_768c44a8ca7375f504ef546e50218314_darkside.exe N/A
File opened for modification F:\$RECYCLE.BIN\S-1-5-21-3227495264-2217614367-4027411560-1000\desktop.ini C:\Users\Admin\AppData\Local\Temp\2024-11-07_768c44a8ca7375f504ef546e50218314_darkside.exe N/A

Indicator Removal: File Deletion

defense_evasion

Drops file in System32 directory

Description Indicator Process Target
File created C:\Windows\system32\spool\PRINTERS\00002.SPL C:\Windows\splwow64.exe N/A
File created C:\Windows\system32\spool\PRINTERS\PPt05ufn0mukjc4c9q9ovkjy0wb.TMP C:\Windows\system32\printfilterpipelinesvc.exe N/A
File created C:\Windows\system32\spool\PRINTERS\PPmpiqndwqtv0u083rfou_txnbb.TMP C:\Windows\system32\printfilterpipelinesvc.exe N/A
File created C:\Windows\system32\spool\PRINTERS\PPok6c8m93hmvtndzxjofnz87rc.TMP C:\Windows\system32\printfilterpipelinesvc.exe N/A

Sets desktop wallpaper using registry

ransomware
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\Control Panel\Desktop\WallPaper = "C:\\ProgramData\\pKSLKLNeI.bmp" C:\Users\Admin\AppData\Local\Temp\2024-11-07_768c44a8ca7375f504ef546e50218314_darkside.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\Control Panel\Desktop\Wallpaper = "C:\\ProgramData\\pKSLKLNeI.bmp" C:\Users\Admin\AppData\Local\Temp\2024-11-07_768c44a8ca7375f504ef546e50218314_darkside.exe N/A

Suspicious use of NtSetInformationThreadHideFromDebugger

Description Indicator Process Target
N/A N/A C:\ProgramData\A0B5.tmp N/A

Enumerates physical storage devices

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\ProgramData\A0B5.tmp N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\2024-11-07_768c44a8ca7375f504ef546e50218314_darkside.exe N/A

Checks processor information in registry

Description Indicator Process Target
Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 C:\Program Files\Microsoft Office\root\Office16\ONENOTE.EXE N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz C:\Program Files\Microsoft Office\root\Office16\ONENOTE.EXE N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString C:\Program Files\Microsoft Office\root\Office16\ONENOTE.EXE N/A

Enumerates system info in registry

Description Indicator Process Target
Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS C:\Program Files\Microsoft Office\root\Office16\ONENOTE.EXE N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily C:\Program Files\Microsoft Office\root\Office16\ONENOTE.EXE N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU C:\Program Files\Microsoft Office\root\Office16\ONENOTE.EXE N/A

Modifies Control Panel

evasion
Description Indicator Process Target
Key created \REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\Control Panel\Desktop C:\Users\Admin\AppData\Local\Temp\2024-11-07_768c44a8ca7375f504ef546e50218314_darkside.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\Control Panel\Desktop\WallpaperStyle = "10" C:\Users\Admin\AppData\Local\Temp\2024-11-07_768c44a8ca7375f504ef546e50218314_darkside.exe N/A

Modifies registry class

Description Indicator Process Target
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\pKSLKLNeI C:\Users\Admin\AppData\Local\Temp\2024-11-07_768c44a8ca7375f504ef546e50218314_darkside.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\pKSLKLNeI\DefaultIcon\ = "C:\\ProgramData\\pKSLKLNeI.ico" C:\Users\Admin\AppData\Local\Temp\2024-11-07_768c44a8ca7375f504ef546e50218314_darkside.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000_Classes\Local Settings C:\Windows\system32\OpenWith.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.pKSLKLNeI C:\Users\Admin\AppData\Local\Temp\2024-11-07_768c44a8ca7375f504ef546e50218314_darkside.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.pKSLKLNeI\ = "pKSLKLNeI" C:\Users\Admin\AppData\Local\Temp\2024-11-07_768c44a8ca7375f504ef546e50218314_darkside.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\pKSLKLNeI\DefaultIcon C:\Users\Admin\AppData\Local\Temp\2024-11-07_768c44a8ca7375f504ef546e50218314_darkside.exe N/A

Suspicious behavior: AddClipboardFormatListener

Description Indicator Process Target
N/A N/A C:\Program Files\Microsoft Office\root\Office16\ONENOTE.EXE N/A
N/A N/A C:\Program Files\Microsoft Office\root\Office16\ONENOTE.EXE N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-11-07_768c44a8ca7375f504ef546e50218314_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-11-07_768c44a8ca7375f504ef546e50218314_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-11-07_768c44a8ca7375f504ef546e50218314_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-11-07_768c44a8ca7375f504ef546e50218314_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-11-07_768c44a8ca7375f504ef546e50218314_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-11-07_768c44a8ca7375f504ef546e50218314_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-11-07_768c44a8ca7375f504ef546e50218314_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-11-07_768c44a8ca7375f504ef546e50218314_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-11-07_768c44a8ca7375f504ef546e50218314_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-11-07_768c44a8ca7375f504ef546e50218314_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-11-07_768c44a8ca7375f504ef546e50218314_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-11-07_768c44a8ca7375f504ef546e50218314_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-11-07_768c44a8ca7375f504ef546e50218314_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-11-07_768c44a8ca7375f504ef546e50218314_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-11-07_768c44a8ca7375f504ef546e50218314_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-11-07_768c44a8ca7375f504ef546e50218314_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-11-07_768c44a8ca7375f504ef546e50218314_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-11-07_768c44a8ca7375f504ef546e50218314_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-11-07_768c44a8ca7375f504ef546e50218314_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-11-07_768c44a8ca7375f504ef546e50218314_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-11-07_768c44a8ca7375f504ef546e50218314_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-11-07_768c44a8ca7375f504ef546e50218314_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-11-07_768c44a8ca7375f504ef546e50218314_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-11-07_768c44a8ca7375f504ef546e50218314_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-11-07_768c44a8ca7375f504ef546e50218314_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-11-07_768c44a8ca7375f504ef546e50218314_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-11-07_768c44a8ca7375f504ef546e50218314_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-11-07_768c44a8ca7375f504ef546e50218314_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-11-07_768c44a8ca7375f504ef546e50218314_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-11-07_768c44a8ca7375f504ef546e50218314_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-11-07_768c44a8ca7375f504ef546e50218314_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-11-07_768c44a8ca7375f504ef546e50218314_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-11-07_768c44a8ca7375f504ef546e50218314_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-11-07_768c44a8ca7375f504ef546e50218314_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-11-07_768c44a8ca7375f504ef546e50218314_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-11-07_768c44a8ca7375f504ef546e50218314_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-11-07_768c44a8ca7375f504ef546e50218314_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-11-07_768c44a8ca7375f504ef546e50218314_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-11-07_768c44a8ca7375f504ef546e50218314_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-11-07_768c44a8ca7375f504ef546e50218314_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-11-07_768c44a8ca7375f504ef546e50218314_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-11-07_768c44a8ca7375f504ef546e50218314_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-11-07_768c44a8ca7375f504ef546e50218314_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-11-07_768c44a8ca7375f504ef546e50218314_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-11-07_768c44a8ca7375f504ef546e50218314_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-11-07_768c44a8ca7375f504ef546e50218314_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-11-07_768c44a8ca7375f504ef546e50218314_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-11-07_768c44a8ca7375f504ef546e50218314_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-11-07_768c44a8ca7375f504ef546e50218314_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-11-07_768c44a8ca7375f504ef546e50218314_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-11-07_768c44a8ca7375f504ef546e50218314_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-11-07_768c44a8ca7375f504ef546e50218314_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-11-07_768c44a8ca7375f504ef546e50218314_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-11-07_768c44a8ca7375f504ef546e50218314_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-11-07_768c44a8ca7375f504ef546e50218314_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-11-07_768c44a8ca7375f504ef546e50218314_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-11-07_768c44a8ca7375f504ef546e50218314_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-11-07_768c44a8ca7375f504ef546e50218314_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-11-07_768c44a8ca7375f504ef546e50218314_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-11-07_768c44a8ca7375f504ef546e50218314_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-11-07_768c44a8ca7375f504ef546e50218314_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-11-07_768c44a8ca7375f504ef546e50218314_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-11-07_768c44a8ca7375f504ef546e50218314_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-11-07_768c44a8ca7375f504ef546e50218314_darkside.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeAssignPrimaryTokenPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-11-07_768c44a8ca7375f504ef546e50218314_darkside.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-11-07_768c44a8ca7375f504ef546e50218314_darkside.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-11-07_768c44a8ca7375f504ef546e50218314_darkside.exe N/A
Token: 36 N/A C:\Users\Admin\AppData\Local\Temp\2024-11-07_768c44a8ca7375f504ef546e50218314_darkside.exe N/A
Token: SeImpersonatePrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-11-07_768c44a8ca7375f504ef546e50218314_darkside.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-11-07_768c44a8ca7375f504ef546e50218314_darkside.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-11-07_768c44a8ca7375f504ef546e50218314_darkside.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Local\Temp\2024-11-07_768c44a8ca7375f504ef546e50218314_darkside.exe N/A
Token: SeManageVolumePrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-11-07_768c44a8ca7375f504ef546e50218314_darkside.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-11-07_768c44a8ca7375f504ef546e50218314_darkside.exe N/A
Token: SeRestorePrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-11-07_768c44a8ca7375f504ef546e50218314_darkside.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-11-07_768c44a8ca7375f504ef546e50218314_darkside.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-11-07_768c44a8ca7375f504ef546e50218314_darkside.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-11-07_768c44a8ca7375f504ef546e50218314_darkside.exe N/A
Token: SeShutdownPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-11-07_768c44a8ca7375f504ef546e50218314_darkside.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-11-07_768c44a8ca7375f504ef546e50218314_darkside.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-11-07_768c44a8ca7375f504ef546e50218314_darkside.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-11-07_768c44a8ca7375f504ef546e50218314_darkside.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-11-07_768c44a8ca7375f504ef546e50218314_darkside.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-11-07_768c44a8ca7375f504ef546e50218314_darkside.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-11-07_768c44a8ca7375f504ef546e50218314_darkside.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-11-07_768c44a8ca7375f504ef546e50218314_darkside.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-11-07_768c44a8ca7375f504ef546e50218314_darkside.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-11-07_768c44a8ca7375f504ef546e50218314_darkside.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-11-07_768c44a8ca7375f504ef546e50218314_darkside.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-11-07_768c44a8ca7375f504ef546e50218314_darkside.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-11-07_768c44a8ca7375f504ef546e50218314_darkside.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-11-07_768c44a8ca7375f504ef546e50218314_darkside.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-11-07_768c44a8ca7375f504ef546e50218314_darkside.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-11-07_768c44a8ca7375f504ef546e50218314_darkside.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-11-07_768c44a8ca7375f504ef546e50218314_darkside.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-11-07_768c44a8ca7375f504ef546e50218314_darkside.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-11-07_768c44a8ca7375f504ef546e50218314_darkside.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-11-07_768c44a8ca7375f504ef546e50218314_darkside.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-11-07_768c44a8ca7375f504ef546e50218314_darkside.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-11-07_768c44a8ca7375f504ef546e50218314_darkside.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-11-07_768c44a8ca7375f504ef546e50218314_darkside.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-11-07_768c44a8ca7375f504ef546e50218314_darkside.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-11-07_768c44a8ca7375f504ef546e50218314_darkside.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-11-07_768c44a8ca7375f504ef546e50218314_darkside.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-11-07_768c44a8ca7375f504ef546e50218314_darkside.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-11-07_768c44a8ca7375f504ef546e50218314_darkside.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-11-07_768c44a8ca7375f504ef546e50218314_darkside.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-11-07_768c44a8ca7375f504ef546e50218314_darkside.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-11-07_768c44a8ca7375f504ef546e50218314_darkside.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-11-07_768c44a8ca7375f504ef546e50218314_darkside.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-11-07_768c44a8ca7375f504ef546e50218314_darkside.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-11-07_768c44a8ca7375f504ef546e50218314_darkside.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-11-07_768c44a8ca7375f504ef546e50218314_darkside.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-11-07_768c44a8ca7375f504ef546e50218314_darkside.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-11-07_768c44a8ca7375f504ef546e50218314_darkside.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-11-07_768c44a8ca7375f504ef546e50218314_darkside.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-11-07_768c44a8ca7375f504ef546e50218314_darkside.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-11-07_768c44a8ca7375f504ef546e50218314_darkside.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-11-07_768c44a8ca7375f504ef546e50218314_darkside.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-11-07_768c44a8ca7375f504ef546e50218314_darkside.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-11-07_768c44a8ca7375f504ef546e50218314_darkside.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-11-07_768c44a8ca7375f504ef546e50218314_darkside.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-11-07_768c44a8ca7375f504ef546e50218314_darkside.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-11-07_768c44a8ca7375f504ef546e50218314_darkside.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-11-07_768c44a8ca7375f504ef546e50218314_darkside.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-11-07_768c44a8ca7375f504ef546e50218314_darkside.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-11-07_768c44a8ca7375f504ef546e50218314_darkside.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-11-07_768c44a8ca7375f504ef546e50218314_darkside.exe N/A

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\Program Files\Microsoft Office\root\Office16\ONENOTE.EXE N/A
N/A N/A C:\Program Files\Microsoft Office\root\Office16\ONENOTE.EXE N/A
N/A N/A C:\Program Files\Microsoft Office\root\Office16\ONENOTE.EXE N/A
N/A N/A C:\Program Files\Microsoft Office\root\Office16\ONENOTE.EXE N/A
N/A N/A C:\Program Files\Microsoft Office\root\Office16\ONENOTE.EXE N/A
N/A N/A C:\Program Files\Microsoft Office\root\Office16\ONENOTE.EXE N/A
N/A N/A C:\Program Files\Microsoft Office\root\Office16\ONENOTE.EXE N/A
N/A N/A C:\Program Files\Microsoft Office\root\Office16\ONENOTE.EXE N/A
N/A N/A C:\Program Files\Microsoft Office\root\Office16\ONENOTE.EXE N/A
N/A N/A C:\Program Files\Microsoft Office\root\Office16\ONENOTE.EXE N/A
N/A N/A C:\Program Files\Microsoft Office\root\Office16\ONENOTE.EXE N/A
N/A N/A C:\Program Files\Microsoft Office\root\Office16\ONENOTE.EXE N/A
N/A N/A C:\Program Files\Microsoft Office\root\Office16\ONENOTE.EXE N/A
N/A N/A C:\Program Files\Microsoft Office\root\Office16\ONENOTE.EXE N/A
N/A N/A C:\Windows\system32\OpenWith.exe N/A
N/A N/A C:\Windows\system32\OpenWith.exe N/A
N/A N/A C:\Windows\system32\OpenWith.exe N/A
N/A N/A C:\Windows\system32\OpenWith.exe N/A
N/A N/A C:\Windows\system32\OpenWith.exe N/A
N/A N/A C:\Windows\system32\OpenWith.exe N/A
N/A N/A C:\Windows\system32\OpenWith.exe N/A
N/A N/A C:\Windows\system32\OpenWith.exe N/A
N/A N/A C:\Windows\system32\OpenWith.exe N/A
N/A N/A C:\Windows\system32\OpenWith.exe N/A
N/A N/A C:\Windows\system32\OpenWith.exe N/A
N/A N/A C:\Windows\system32\OpenWith.exe N/A
N/A N/A C:\Windows\system32\OpenWith.exe N/A
N/A N/A C:\Windows\system32\OpenWith.exe N/A
N/A N/A C:\Windows\system32\OpenWith.exe N/A
N/A N/A C:\Windows\system32\OpenWith.exe N/A
N/A N/A C:\Windows\system32\OpenWith.exe N/A
N/A N/A C:\Windows\system32\OpenWith.exe N/A
N/A N/A C:\Windows\system32\OpenWith.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 3264 wrote to memory of 900 N/A C:\Users\Admin\AppData\Local\Temp\2024-11-07_768c44a8ca7375f504ef546e50218314_darkside.exe C:\Windows\splwow64.exe
PID 3264 wrote to memory of 900 N/A C:\Users\Admin\AppData\Local\Temp\2024-11-07_768c44a8ca7375f504ef546e50218314_darkside.exe C:\Windows\splwow64.exe
PID 3040 wrote to memory of 2032 N/A C:\Windows\system32\printfilterpipelinesvc.exe C:\Program Files\Microsoft Office\root\Office16\ONENOTE.EXE
PID 3040 wrote to memory of 2032 N/A C:\Windows\system32\printfilterpipelinesvc.exe C:\Program Files\Microsoft Office\root\Office16\ONENOTE.EXE
PID 3264 wrote to memory of 560 N/A C:\Users\Admin\AppData\Local\Temp\2024-11-07_768c44a8ca7375f504ef546e50218314_darkside.exe C:\ProgramData\A0B5.tmp
PID 3264 wrote to memory of 560 N/A C:\Users\Admin\AppData\Local\Temp\2024-11-07_768c44a8ca7375f504ef546e50218314_darkside.exe C:\ProgramData\A0B5.tmp
PID 3264 wrote to memory of 560 N/A C:\Users\Admin\AppData\Local\Temp\2024-11-07_768c44a8ca7375f504ef546e50218314_darkside.exe C:\ProgramData\A0B5.tmp
PID 3264 wrote to memory of 560 N/A C:\Users\Admin\AppData\Local\Temp\2024-11-07_768c44a8ca7375f504ef546e50218314_darkside.exe C:\ProgramData\A0B5.tmp
PID 560 wrote to memory of 3312 N/A C:\ProgramData\A0B5.tmp C:\Windows\SysWOW64\cmd.exe
PID 560 wrote to memory of 3312 N/A C:\ProgramData\A0B5.tmp C:\Windows\SysWOW64\cmd.exe
PID 560 wrote to memory of 3312 N/A C:\ProgramData\A0B5.tmp C:\Windows\SysWOW64\cmd.exe
PID 2964 wrote to memory of 1144 N/A C:\Windows\system32\OpenWith.exe C:\Windows\system32\NOTEPAD.EXE
PID 2964 wrote to memory of 1144 N/A C:\Windows\system32\OpenWith.exe C:\Windows\system32\NOTEPAD.EXE

Processes

C:\Users\Admin\AppData\Local\Temp\2024-11-07_768c44a8ca7375f504ef546e50218314_darkside.exe

"C:\Users\Admin\AppData\Local\Temp\2024-11-07_768c44a8ca7375f504ef546e50218314_darkside.exe"

C:\Windows\splwow64.exe

C:\Windows\splwow64.exe 12288

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k PrintWorkflow -s PrintWorkflowUserSvc

C:\Windows\system32\printfilterpipelinesvc.exe

C:\Windows\system32\printfilterpipelinesvc.exe -Embedding

C:\Program Files\Microsoft Office\root\Office16\ONENOTE.EXE

/insertdoc "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\{6D81A5B9-00AF-4283-9B1F-865EA2186115}.xps" 133754197787050000

C:\ProgramData\A0B5.tmp

"C:\ProgramData\A0B5.tmp"

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /C DEL /F /Q C:\PROGRA~3\A0B5.tmp >> NUL

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\Desktop\CloseDisconnect.bat" "

C:\Windows\system32\OpenWith.exe

C:\Windows\system32\OpenWith.exe -Embedding

C:\Windows\system32\NOTEPAD.EXE

"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\α½µ¼GKa╛

Network

Country Destination Domain Proto
US 8.8.8.8:53 8.8.8.8.in-addr.arpa udp
US 8.8.8.8:53 97.17.167.52.in-addr.arpa udp
US 8.8.8.8:53 83.210.23.2.in-addr.arpa udp
US 8.8.8.8:53 136.32.126.40.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 232.168.11.51.in-addr.arpa udp
US 8.8.8.8:53 roaming.officeapps.live.com udp
NL 52.109.89.19:443 roaming.officeapps.live.com tcp
US 8.8.8.8:53 46.28.109.52.in-addr.arpa udp
US 8.8.8.8:53 19.89.109.52.in-addr.arpa udp
US 8.8.8.8:53 75.159.190.20.in-addr.arpa udp
US 8.8.8.8:53 9.173.189.20.in-addr.arpa udp
US 8.8.8.8:53 15.164.165.52.in-addr.arpa udp
US 8.8.8.8:53 212.20.149.52.in-addr.arpa udp
US 8.8.8.8:53 75.117.19.2.in-addr.arpa udp

Files

memory/3264-2-0x0000000000B70000-0x0000000000B80000-memory.dmp

memory/3264-1-0x0000000000B70000-0x0000000000B80000-memory.dmp

memory/3264-0-0x0000000000B70000-0x0000000000B80000-memory.dmp

C:\$Recycle.Bin\S-1-5-21-3227495264-2217614367-4027411560-1000\HHHHHHHHHHH

MD5 ee9b6793e789425e982028899fe47322
SHA1 79639657c2438f5cd23fba16d190ddd4a48ef895
SHA256 df7b7574ed186bcc305d6555f49f1f6c9cc1057e5cf52dfe0b5dd4959fcf6f58
SHA512 c11818b42a054fc7caaccc407f86a6fbc145a5390ea67825367f6d1dcf081e019fb301e8864c0385c7634420b5c47fdc5121acf96d0d402f1156117a49fa1249

F:\$RECYCLE.BIN\S-1-5-21-3227495264-2217614367-4027411560-1000\DDDDDDDDDDD

MD5 25c32a0b18d3167694e7e62752123918
SHA1 8026d40f39357699daba192702dd8849614bb295
SHA256 11d37a9396b2879c2c8957ad4cd1426ec71ee2965654f2e3bd1cdf029352fc6e
SHA512 6d7b21137c02604bb20e115745dd9b24041d9c7c2163265eb81a6bf871b67e33e962d94e6cadc9addbb8f61392967c7445b0b94807134ae9d5aa5c4429b83f79

C:\pKSLKLNeI.README.txt

MD5 dd746ace17e44ace00885b91400f11d5
SHA1 4a0302d2dca400598f396e4230fdae71779cbeaa
SHA256 b27c3c8a30faf7c76483b7e5d964ae85046a9713caa46508ee7a1e31b7dc6272
SHA512 8ac26aa7262fdf1afdc74e604720a79ebde076c75f460d7d5f57ff4d81dedb1ad471eb114ddd428c1934029746f5c222339090680bc77a6ea09ce329e1da3ef1

memory/3264-2774-0x0000000000B70000-0x0000000000B80000-memory.dmp

memory/3264-2776-0x0000000000B70000-0x0000000000B80000-memory.dmp

memory/3264-2775-0x0000000000B70000-0x0000000000B80000-memory.dmp

C:\ProgramData\A0B5.tmp

MD5 294e9f64cb1642dd89229fff0592856b
SHA1 97b148c27f3da29ba7b18d6aee8a0db9102f47c9
SHA256 917e115cc403e29b4388e0d175cbfac3e7e40ca1742299fbdb353847db2de7c2
SHA512 b87d531890bf1577b9b4af41dddb2cdbbfa164cf197bd5987df3a3075983645a3acba443e289b7bfd338422978a104f55298fbfe346872de0895bde44adc89cf

memory/2032-2794-0x00007FFD93990000-0x00007FFD939A0000-memory.dmp

memory/2032-2795-0x00007FFD93990000-0x00007FFD939A0000-memory.dmp

memory/2032-2793-0x00007FFD93990000-0x00007FFD939A0000-memory.dmp

memory/2032-2796-0x00007FFD93990000-0x00007FFD939A0000-memory.dmp

memory/2032-2792-0x00007FFD93990000-0x00007FFD939A0000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\DDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDD

MD5 5dba51afce94807edc92c21d4f3fc5c6
SHA1 cb2c5c28835847a4d024a28de17f9fac746a32e7
SHA256 7f8b513e8639d5566fbfc09a8011b772a5b314b288123b1a67a370b52371db85
SHA512 dc291cdb1c5a7948a23d9a9fa92cfc8ee53cd4f97a59303c5dc9870991772f6f54b11204d290028c7d51f23855316caa5a0a153c00c21a62945e7de5317449f9

memory/2032-2825-0x00007FFD91700000-0x00007FFD91710000-memory.dmp

memory/2032-2826-0x00007FFD91700000-0x00007FFD91710000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\{BAABA19E-4790-42DF-BACE-4C2618C48093}

MD5 0bdc2148b28427fb95a47d14f8f8a9f4
SHA1 cf78fd00a80b74d09265e55018425124ca716901
SHA256 5e3e822c5b67a6b03f134a6e639d2b644b92306fb7718dc949298993488d7bb9
SHA512 ca5dd7e76560982e1e4a17c140b0c46f7914e6995109e244b718eb179e811520a113afe3763a6f68a2a65611156265327519a0b98ecdc293675b3c1cca5546cd

C:\Users\Admin\Documents\OneNote Notebooks\My Notebook\Open Notebook.onetoc2

MD5 d71fe7cc36faf6453a27f0be29fbabd5
SHA1 3c2915ae1a649a9d6ab6da555187ad792c0fc7da
SHA256 eb98d0a18c3cadd634667af654a5743860ec756f439717fa6c8f1c7c4b40e71b
SHA512 9d1db318b2ec43f52c956d26183a1271076cc57cdec090974b0d862cfee2ce73285f999e3fd790d50dc56160ab083375997fd5becd34286e303978b790ab0a82

memory/2032-2864-0x00007FFD93990000-0x00007FFD939A0000-memory.dmp

memory/2032-2865-0x00007FFD93990000-0x00007FFD939A0000-memory.dmp

memory/2032-2867-0x00007FFD93990000-0x00007FFD939A0000-memory.dmp

memory/2032-2866-0x00007FFD93990000-0x00007FFD939A0000-memory.dmp

Analysis: behavioral1

Detonation Overview

Submitted

2024-11-07 02:22

Reported

2024-11-07 02:25

Platform

win7-20241010-en

Max time kernel

75s

Max time network

34s

Command Line

"C:\Users\Admin\AppData\Local\Temp\2024-11-07_768c44a8ca7375f504ef546e50218314_darkside.exe"

Signatures

Lockbit

ransomware lockbit

Lockbit family

lockbit

Renames multiple (345) files with added filename extension

ransomware

Deletes itself

Description Indicator Process Target
N/A N/A C:\ProgramData\D28B.tmp N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\ProgramData\D28B.tmp N/A

Loads dropped DLL

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-11-07_768c44a8ca7375f504ef546e50218314_darkside.exe N/A

Reads user/profile data of web browsers

spyware stealer

Drops desktop.ini file(s)

Description Indicator Process Target
File opened for modification C:\$Recycle.Bin\S-1-5-21-3692679935-4019334568-335155002-1000\desktop.ini C:\Users\Admin\AppData\Local\Temp\2024-11-07_768c44a8ca7375f504ef546e50218314_darkside.exe N/A
File opened for modification F:\$RECYCLE.BIN\S-1-5-21-3692679935-4019334568-335155002-1000\desktop.ini C:\Users\Admin\AppData\Local\Temp\2024-11-07_768c44a8ca7375f504ef546e50218314_darkside.exe N/A

Indicator Removal: File Deletion

defense_evasion

Sets desktop wallpaper using registry

ransomware
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Control Panel\Desktop\WallPaper = "C:\\ProgramData\\pKSLKLNeI.bmp" C:\Users\Admin\AppData\Local\Temp\2024-11-07_768c44a8ca7375f504ef546e50218314_darkside.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Control Panel\Desktop\Wallpaper = "C:\\ProgramData\\pKSLKLNeI.bmp" C:\Users\Admin\AppData\Local\Temp\2024-11-07_768c44a8ca7375f504ef546e50218314_darkside.exe N/A

Suspicious use of NtSetInformationThreadHideFromDebugger

Description Indicator Process Target
N/A N/A C:\ProgramData\D28B.tmp N/A

Enumerates physical storage devices

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\2024-11-07_768c44a8ca7375f504ef546e50218314_darkside.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\ProgramData\D28B.tmp N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A

Modifies Control Panel

evasion
Description Indicator Process Target
Key created \REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Control Panel\Desktop C:\Users\Admin\AppData\Local\Temp\2024-11-07_768c44a8ca7375f504ef546e50218314_darkside.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Control Panel\Desktop\WallpaperStyle = "10" C:\Users\Admin\AppData\Local\Temp\2024-11-07_768c44a8ca7375f504ef546e50218314_darkside.exe N/A

Modifies registry class

Description Indicator Process Target
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.pKSLKLNeI C:\Users\Admin\AppData\Local\Temp\2024-11-07_768c44a8ca7375f504ef546e50218314_darkside.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.pKSLKLNeI\ = "pKSLKLNeI" C:\Users\Admin\AppData\Local\Temp\2024-11-07_768c44a8ca7375f504ef546e50218314_darkside.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\pKSLKLNeI\DefaultIcon C:\Users\Admin\AppData\Local\Temp\2024-11-07_768c44a8ca7375f504ef546e50218314_darkside.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\pKSLKLNeI C:\Users\Admin\AppData\Local\Temp\2024-11-07_768c44a8ca7375f504ef546e50218314_darkside.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\pKSLKLNeI\DefaultIcon\ = "C:\\ProgramData\\pKSLKLNeI.ico" C:\Users\Admin\AppData\Local\Temp\2024-11-07_768c44a8ca7375f504ef546e50218314_darkside.exe N/A

Opens file in notepad (likely ransom note)

ransomware
Description Indicator Process Target
N/A N/A C:\Windows\system32\NOTEPAD.EXE N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-11-07_768c44a8ca7375f504ef546e50218314_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-11-07_768c44a8ca7375f504ef546e50218314_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-11-07_768c44a8ca7375f504ef546e50218314_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-11-07_768c44a8ca7375f504ef546e50218314_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-11-07_768c44a8ca7375f504ef546e50218314_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-11-07_768c44a8ca7375f504ef546e50218314_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-11-07_768c44a8ca7375f504ef546e50218314_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-11-07_768c44a8ca7375f504ef546e50218314_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-11-07_768c44a8ca7375f504ef546e50218314_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-11-07_768c44a8ca7375f504ef546e50218314_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-11-07_768c44a8ca7375f504ef546e50218314_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-11-07_768c44a8ca7375f504ef546e50218314_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-11-07_768c44a8ca7375f504ef546e50218314_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-11-07_768c44a8ca7375f504ef546e50218314_darkside.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeAssignPrimaryTokenPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-11-07_768c44a8ca7375f504ef546e50218314_darkside.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-11-07_768c44a8ca7375f504ef546e50218314_darkside.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-11-07_768c44a8ca7375f504ef546e50218314_darkside.exe N/A
Token: 36 N/A C:\Users\Admin\AppData\Local\Temp\2024-11-07_768c44a8ca7375f504ef546e50218314_darkside.exe N/A
Token: SeImpersonatePrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-11-07_768c44a8ca7375f504ef546e50218314_darkside.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-11-07_768c44a8ca7375f504ef546e50218314_darkside.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-11-07_768c44a8ca7375f504ef546e50218314_darkside.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Local\Temp\2024-11-07_768c44a8ca7375f504ef546e50218314_darkside.exe N/A
Token: SeManageVolumePrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-11-07_768c44a8ca7375f504ef546e50218314_darkside.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-11-07_768c44a8ca7375f504ef546e50218314_darkside.exe N/A
Token: SeRestorePrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-11-07_768c44a8ca7375f504ef546e50218314_darkside.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-11-07_768c44a8ca7375f504ef546e50218314_darkside.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-11-07_768c44a8ca7375f504ef546e50218314_darkside.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-11-07_768c44a8ca7375f504ef546e50218314_darkside.exe N/A
Token: SeShutdownPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-11-07_768c44a8ca7375f504ef546e50218314_darkside.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-11-07_768c44a8ca7375f504ef546e50218314_darkside.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-11-07_768c44a8ca7375f504ef546e50218314_darkside.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-11-07_768c44a8ca7375f504ef546e50218314_darkside.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-11-07_768c44a8ca7375f504ef546e50218314_darkside.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-11-07_768c44a8ca7375f504ef546e50218314_darkside.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-11-07_768c44a8ca7375f504ef546e50218314_darkside.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-11-07_768c44a8ca7375f504ef546e50218314_darkside.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-11-07_768c44a8ca7375f504ef546e50218314_darkside.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-11-07_768c44a8ca7375f504ef546e50218314_darkside.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-11-07_768c44a8ca7375f504ef546e50218314_darkside.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-11-07_768c44a8ca7375f504ef546e50218314_darkside.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-11-07_768c44a8ca7375f504ef546e50218314_darkside.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-11-07_768c44a8ca7375f504ef546e50218314_darkside.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-11-07_768c44a8ca7375f504ef546e50218314_darkside.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-11-07_768c44a8ca7375f504ef546e50218314_darkside.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-11-07_768c44a8ca7375f504ef546e50218314_darkside.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-11-07_768c44a8ca7375f504ef546e50218314_darkside.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-11-07_768c44a8ca7375f504ef546e50218314_darkside.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-11-07_768c44a8ca7375f504ef546e50218314_darkside.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-11-07_768c44a8ca7375f504ef546e50218314_darkside.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-11-07_768c44a8ca7375f504ef546e50218314_darkside.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-11-07_768c44a8ca7375f504ef546e50218314_darkside.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-11-07_768c44a8ca7375f504ef546e50218314_darkside.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-11-07_768c44a8ca7375f504ef546e50218314_darkside.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-11-07_768c44a8ca7375f504ef546e50218314_darkside.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-11-07_768c44a8ca7375f504ef546e50218314_darkside.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-11-07_768c44a8ca7375f504ef546e50218314_darkside.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-11-07_768c44a8ca7375f504ef546e50218314_darkside.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-11-07_768c44a8ca7375f504ef546e50218314_darkside.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-11-07_768c44a8ca7375f504ef546e50218314_darkside.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-11-07_768c44a8ca7375f504ef546e50218314_darkside.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-11-07_768c44a8ca7375f504ef546e50218314_darkside.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-11-07_768c44a8ca7375f504ef546e50218314_darkside.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-11-07_768c44a8ca7375f504ef546e50218314_darkside.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-11-07_768c44a8ca7375f504ef546e50218314_darkside.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-11-07_768c44a8ca7375f504ef546e50218314_darkside.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-11-07_768c44a8ca7375f504ef546e50218314_darkside.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-11-07_768c44a8ca7375f504ef546e50218314_darkside.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-11-07_768c44a8ca7375f504ef546e50218314_darkside.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-11-07_768c44a8ca7375f504ef546e50218314_darkside.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-11-07_768c44a8ca7375f504ef546e50218314_darkside.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-11-07_768c44a8ca7375f504ef546e50218314_darkside.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-11-07_768c44a8ca7375f504ef546e50218314_darkside.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-11-07_768c44a8ca7375f504ef546e50218314_darkside.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-11-07_768c44a8ca7375f504ef546e50218314_darkside.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-11-07_768c44a8ca7375f504ef546e50218314_darkside.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-11-07_768c44a8ca7375f504ef546e50218314_darkside.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-11-07_768c44a8ca7375f504ef546e50218314_darkside.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-11-07_768c44a8ca7375f504ef546e50218314_darkside.exe N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A C:\Windows\system32\NOTEPAD.EXE N/A

Processes

C:\Users\Admin\AppData\Local\Temp\2024-11-07_768c44a8ca7375f504ef546e50218314_darkside.exe

"C:\Users\Admin\AppData\Local\Temp\2024-11-07_768c44a8ca7375f504ef546e50218314_darkside.exe"

C:\Windows\system32\NOTEPAD.EXE

"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\pKSLKLNeI.README.txt

C:\ProgramData\D28B.tmp

"C:\ProgramData\D28B.tmp"

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /C DEL /F /Q C:\PROGRA~3\D28B.tmp >> NUL

C:\Windows\system32\AUDIODG.EXE

C:\Windows\system32\AUDIODG.EXE 0x150

Network

N/A

Files

memory/2116-0-0x0000000000290000-0x00000000002D0000-memory.dmp

C:\$Recycle.Bin\S-1-5-21-3692679935-4019334568-335155002-1000\IIIIIIIIIII

MD5 2fbbe8389be09b4f832a1434af8ff910
SHA1 1c642122c192514673815a1e74ac218cdcc6cb7d
SHA256 736dd236573607492082dc74136e93f3bb6035f719f0d6e850c268835bd76009
SHA512 3bf64fc3f1c79097630c9e7c99044286c26fc3d7838d1ca87145918c5a5ec0a51dc0ce99dd26e6e5324d05f1217b3cd1eb5d9ec450e6b8ddcc7f243b4364788c

C:\pKSLKLNeI.README.txt

MD5 dd746ace17e44ace00885b91400f11d5
SHA1 4a0302d2dca400598f396e4230fdae71779cbeaa
SHA256 b27c3c8a30faf7c76483b7e5d964ae85046a9713caa46508ee7a1e31b7dc6272
SHA512 8ac26aa7262fdf1afdc74e604720a79ebde076c75f460d7d5f57ff4d81dedb1ad471eb114ddd428c1934029746f5c222339090680bc77a6ea09ce329e1da3ef1

F:\$RECYCLE.BIN\S-1-5-21-3692679935-4019334568-335155002-1000\DDDDDDDDDDD

MD5 3d5749c3abb2bddc12a70f1ce8a41dd4
SHA1 cebe30c49375342c6716a7ae89a1639c8c628964
SHA256 d08ac8b671fb03fed465b47ac6d4ed35ce7b7dbc9a78a698e5c72caaaae277da
SHA512 b36c864d0d7e15e34cbf14a2ac7c4925e70f1f3232886c3d154eb342784969514203e30de7818ac60f1c545b70fa733af20502d65f8cba25de1ded8a7b552322

\ProgramData\D28B.tmp

MD5 294e9f64cb1642dd89229fff0592856b
SHA1 97b148c27f3da29ba7b18d6aee8a0db9102f47c9
SHA256 917e115cc403e29b4388e0d175cbfac3e7e40ca1742299fbdb353847db2de7c2
SHA512 b87d531890bf1577b9b4af41dddb2cdbbfa164cf197bd5987df3a3075983645a3acba443e289b7bfd338422978a104f55298fbfe346872de0895bde44adc89cf

memory/1356-876-0x000000007EF20000-0x000000007EF21000-memory.dmp

memory/1356-875-0x000000007EF80000-0x000000007EF81000-memory.dmp

memory/1356-874-0x00000000003B0000-0x00000000003F0000-memory.dmp

memory/1356-873-0x00000000003B0000-0x00000000003F0000-memory.dmp

memory/1356-872-0x000000007EFA0000-0x000000007EFA1000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\DDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDD

MD5 0c897279c61f0288c67ed04e27ce79e9
SHA1 e3303fbeb2f1b20173e5858b990c85b870f873c9
SHA256 06424c5cbae19fef4d783f7438d68354a2e558b3a9caad86b0ccdf3b1781c811
SHA512 83a6acc0e2ad0ea4fa61666c4c201dbb7f95194f5496618d45f3501ce559214e86b0c8f381e9fab3331e6633f654446cc3b0ee0aa89cceca17072abd888bb16a

memory/1356-906-0x000000007EF60000-0x000000007EF61000-memory.dmp

memory/1356-905-0x000000007EF40000-0x000000007EF41000-memory.dmp