Malware Analysis Report

2024-11-30 11:28

Sample ID 241115-pknyratfpg
Target 2024-11-15_8005b63da0a2688ea287976c6f943abe_darkside
SHA256 0b96b4946ea996ef7d79b7d2d4d5bf3506457f26a47e835492c53f587f0a6111
Tags
lockbit defense_evasion discovery ransomware spyware stealer
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

0b96b4946ea996ef7d79b7d2d4d5bf3506457f26a47e835492c53f587f0a6111

Threat Level: Known bad

The file 2024-11-15_8005b63da0a2688ea287976c6f943abe_darkside was found to be: Known bad.

Malicious Activity Summary

lockbit defense_evasion discovery ransomware spyware stealer

Lockbit family

Rule to detect Lockbit 3.0 ransomware Windows payload

Renames multiple (639) files with added filename extension

Renames multiple (357) files with added filename extension

Deletes itself

Executes dropped EXE

Loads dropped DLL

Checks computer location settings

Reads user/profile data of web browsers

Drops desktop.ini file(s)

Indicator Removal: File Deletion

Drops file in System32 directory

Suspicious use of NtSetInformationThreadHideFromDebugger

Sets desktop wallpaper using registry

System Location Discovery: System Language Discovery

Enumerates physical storage devices

Unsigned PE

Suspicious use of SetWindowsHookEx

Suspicious use of WriteProcessMemory

Suspicious use of AdjustPrivilegeToken

Enumerates system info in registry

Suspicious behavior: RenamesItself

Modifies registry class

Checks processor information in registry

Modifies Control Panel

Suspicious behavior: EnumeratesProcesses

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-11-15 12:23

Signatures

Lockbit family

lockbit

Rule to detect Lockbit 3.0 ransomware Windows payload

Description Indicator Process Target
N/A N/A N/A N/A

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-11-15 12:23

Reported

2024-11-15 12:25

Platform

win7-20240903-en

Max time kernel

117s

Max time network

118s

Command Line

"C:\Users\Admin\AppData\Local\Temp\2024-11-15_8005b63da0a2688ea287976c6f943abe_darkside.exe"

Signatures

Renames multiple (357) files with added filename extension

ransomware

Deletes itself

Description Indicator Process Target
N/A N/A C:\ProgramData\12A6.tmp N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\ProgramData\12A6.tmp N/A

Loads dropped DLL

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-11-15_8005b63da0a2688ea287976c6f943abe_darkside.exe N/A

Reads user/profile data of web browsers

spyware stealer

Drops desktop.ini file(s)

Description Indicator Process Target
File opened for modification C:\$Recycle.Bin\S-1-5-21-2872745919-2748461613-2989606286-1000\desktop.ini C:\Users\Admin\AppData\Local\Temp\2024-11-15_8005b63da0a2688ea287976c6f943abe_darkside.exe N/A
File opened for modification F:\$RECYCLE.BIN\S-1-5-21-2872745919-2748461613-2989606286-1000\desktop.ini C:\Users\Admin\AppData\Local\Temp\2024-11-15_8005b63da0a2688ea287976c6f943abe_darkside.exe N/A

Indicator Removal: File Deletion

defense_evasion

Sets desktop wallpaper using registry

ransomware
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Control Panel\Desktop\Wallpaper = "C:\\ProgramData\\IPjaex13M.bmp" C:\Users\Admin\AppData\Local\Temp\2024-11-15_8005b63da0a2688ea287976c6f943abe_darkside.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Control Panel\Desktop\WallPaper = "C:\\ProgramData\\IPjaex13M.bmp" C:\Users\Admin\AppData\Local\Temp\2024-11-15_8005b63da0a2688ea287976c6f943abe_darkside.exe N/A

Enumerates physical storage devices

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\2024-11-15_8005b63da0a2688ea287976c6f943abe_darkside.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\ProgramData\12A6.tmp N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A

Modifies Control Panel

evasion
Description Indicator Process Target
Key created \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Control Panel\Desktop C:\Users\Admin\AppData\Local\Temp\2024-11-15_8005b63da0a2688ea287976c6f943abe_darkside.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Control Panel\Desktop\WallpaperStyle = "10" C:\Users\Admin\AppData\Local\Temp\2024-11-15_8005b63da0a2688ea287976c6f943abe_darkside.exe N/A

Modifies registry class

Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\IPjaex13M\DefaultIcon\ = "C:\\ProgramData\\IPjaex13M.ico" C:\Users\Admin\AppData\Local\Temp\2024-11-15_8005b63da0a2688ea287976c6f943abe_darkside.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.IPjaex13M C:\Users\Admin\AppData\Local\Temp\2024-11-15_8005b63da0a2688ea287976c6f943abe_darkside.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.IPjaex13M\ = "IPjaex13M" C:\Users\Admin\AppData\Local\Temp\2024-11-15_8005b63da0a2688ea287976c6f943abe_darkside.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\IPjaex13M\DefaultIcon C:\Users\Admin\AppData\Local\Temp\2024-11-15_8005b63da0a2688ea287976c6f943abe_darkside.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\IPjaex13M C:\Users\Admin\AppData\Local\Temp\2024-11-15_8005b63da0a2688ea287976c6f943abe_darkside.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-11-15_8005b63da0a2688ea287976c6f943abe_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-11-15_8005b63da0a2688ea287976c6f943abe_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-11-15_8005b63da0a2688ea287976c6f943abe_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-11-15_8005b63da0a2688ea287976c6f943abe_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-11-15_8005b63da0a2688ea287976c6f943abe_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-11-15_8005b63da0a2688ea287976c6f943abe_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-11-15_8005b63da0a2688ea287976c6f943abe_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-11-15_8005b63da0a2688ea287976c6f943abe_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-11-15_8005b63da0a2688ea287976c6f943abe_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-11-15_8005b63da0a2688ea287976c6f943abe_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-11-15_8005b63da0a2688ea287976c6f943abe_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-11-15_8005b63da0a2688ea287976c6f943abe_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-11-15_8005b63da0a2688ea287976c6f943abe_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-11-15_8005b63da0a2688ea287976c6f943abe_darkside.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeAssignPrimaryTokenPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-11-15_8005b63da0a2688ea287976c6f943abe_darkside.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-11-15_8005b63da0a2688ea287976c6f943abe_darkside.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-11-15_8005b63da0a2688ea287976c6f943abe_darkside.exe N/A
Token: 36 N/A C:\Users\Admin\AppData\Local\Temp\2024-11-15_8005b63da0a2688ea287976c6f943abe_darkside.exe N/A
Token: SeImpersonatePrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-11-15_8005b63da0a2688ea287976c6f943abe_darkside.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-11-15_8005b63da0a2688ea287976c6f943abe_darkside.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-11-15_8005b63da0a2688ea287976c6f943abe_darkside.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Local\Temp\2024-11-15_8005b63da0a2688ea287976c6f943abe_darkside.exe N/A
Token: SeManageVolumePrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-11-15_8005b63da0a2688ea287976c6f943abe_darkside.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-11-15_8005b63da0a2688ea287976c6f943abe_darkside.exe N/A
Token: SeRestorePrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-11-15_8005b63da0a2688ea287976c6f943abe_darkside.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-11-15_8005b63da0a2688ea287976c6f943abe_darkside.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-11-15_8005b63da0a2688ea287976c6f943abe_darkside.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-11-15_8005b63da0a2688ea287976c6f943abe_darkside.exe N/A
Token: SeShutdownPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-11-15_8005b63da0a2688ea287976c6f943abe_darkside.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-11-15_8005b63da0a2688ea287976c6f943abe_darkside.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-11-15_8005b63da0a2688ea287976c6f943abe_darkside.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-11-15_8005b63da0a2688ea287976c6f943abe_darkside.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-11-15_8005b63da0a2688ea287976c6f943abe_darkside.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-11-15_8005b63da0a2688ea287976c6f943abe_darkside.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-11-15_8005b63da0a2688ea287976c6f943abe_darkside.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-11-15_8005b63da0a2688ea287976c6f943abe_darkside.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-11-15_8005b63da0a2688ea287976c6f943abe_darkside.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-11-15_8005b63da0a2688ea287976c6f943abe_darkside.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-11-15_8005b63da0a2688ea287976c6f943abe_darkside.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-11-15_8005b63da0a2688ea287976c6f943abe_darkside.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-11-15_8005b63da0a2688ea287976c6f943abe_darkside.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-11-15_8005b63da0a2688ea287976c6f943abe_darkside.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-11-15_8005b63da0a2688ea287976c6f943abe_darkside.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-11-15_8005b63da0a2688ea287976c6f943abe_darkside.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-11-15_8005b63da0a2688ea287976c6f943abe_darkside.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-11-15_8005b63da0a2688ea287976c6f943abe_darkside.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-11-15_8005b63da0a2688ea287976c6f943abe_darkside.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-11-15_8005b63da0a2688ea287976c6f943abe_darkside.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-11-15_8005b63da0a2688ea287976c6f943abe_darkside.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-11-15_8005b63da0a2688ea287976c6f943abe_darkside.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-11-15_8005b63da0a2688ea287976c6f943abe_darkside.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-11-15_8005b63da0a2688ea287976c6f943abe_darkside.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-11-15_8005b63da0a2688ea287976c6f943abe_darkside.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-11-15_8005b63da0a2688ea287976c6f943abe_darkside.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-11-15_8005b63da0a2688ea287976c6f943abe_darkside.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-11-15_8005b63da0a2688ea287976c6f943abe_darkside.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-11-15_8005b63da0a2688ea287976c6f943abe_darkside.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-11-15_8005b63da0a2688ea287976c6f943abe_darkside.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-11-15_8005b63da0a2688ea287976c6f943abe_darkside.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-11-15_8005b63da0a2688ea287976c6f943abe_darkside.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-11-15_8005b63da0a2688ea287976c6f943abe_darkside.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-11-15_8005b63da0a2688ea287976c6f943abe_darkside.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-11-15_8005b63da0a2688ea287976c6f943abe_darkside.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-11-15_8005b63da0a2688ea287976c6f943abe_darkside.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-11-15_8005b63da0a2688ea287976c6f943abe_darkside.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-11-15_8005b63da0a2688ea287976c6f943abe_darkside.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-11-15_8005b63da0a2688ea287976c6f943abe_darkside.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-11-15_8005b63da0a2688ea287976c6f943abe_darkside.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-11-15_8005b63da0a2688ea287976c6f943abe_darkside.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-11-15_8005b63da0a2688ea287976c6f943abe_darkside.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-11-15_8005b63da0a2688ea287976c6f943abe_darkside.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-11-15_8005b63da0a2688ea287976c6f943abe_darkside.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-11-15_8005b63da0a2688ea287976c6f943abe_darkside.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-11-15_8005b63da0a2688ea287976c6f943abe_darkside.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-11-15_8005b63da0a2688ea287976c6f943abe_darkside.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-11-15_8005b63da0a2688ea287976c6f943abe_darkside.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-11-15_8005b63da0a2688ea287976c6f943abe_darkside.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-11-15_8005b63da0a2688ea287976c6f943abe_darkside.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\2024-11-15_8005b63da0a2688ea287976c6f943abe_darkside.exe

"C:\Users\Admin\AppData\Local\Temp\2024-11-15_8005b63da0a2688ea287976c6f943abe_darkside.exe"

C:\ProgramData\12A6.tmp

"C:\ProgramData\12A6.tmp"

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /C DEL /F /Q C:\PROGRA~3\12A6.tmp >> NUL

C:\Windows\system32\AUDIODG.EXE

C:\Windows\system32\AUDIODG.EXE 0x14c

Network

N/A

Files

memory/2644-0-0x0000000002040000-0x0000000002080000-memory.dmp

C:\$Recycle.Bin\S-1-5-21-2872745919-2748461613-2989606286-1000\AAAAAAAAAAA

MD5 6b8c78b32b1bd3978f2e4924f7d7f84c
SHA1 2203a724f075d2611d94830713515bd965a2dc7f
SHA256 d6d86ec3925a24b87d1f7abe787c7b64f033af45e026f945cd29e0eabcdeeff0
SHA512 b98b022b57d8eb98027fc5c14505caea21c8c6447eec5a936e287693e52947b507b6e4f156f28a030c1aed84350bace5c33e30b9aef72fb283a2202841f39bb7

C:\IPjaex13M.README.txt

MD5 88f6599d557ec2b7a12b3ab4faf3c364
SHA1 1bc917d0543deee57c7e13f7ed182c8692e69458
SHA256 781cf1f98ccd2cf18079967e28996a722e75fa28cb2ecc8b638e2efcdf751e8d
SHA512 d1633a186dbc849f8c056bd53df4b24f972f170cb4e602b487d89b9762ce78699cf148d70f62272e8e2d13888a73b38910b43c378af8d21102a3fd2e08731d19

F:\$RECYCLE.BIN\S-1-5-21-2872745919-2748461613-2989606286-1000\DDDDDDDDDDD

MD5 e45d5c5fc9e71477d4e0114b88a1fb36
SHA1 061f0a84ad71e894276a787f134c18d2a8dc46bb
SHA256 e99ac1938d777196780971108ecd2c9aae3d091749295f4b8d2ceb44a7a9046a
SHA512 19cf0918def20d9c36917fed78371dc3657402312fc68f9bc5fa00971cb1bee7b88eccbf5e5d191f1c8559f52968135043aa790e0b6692baf2d293a4e40ddac6

\ProgramData\12A6.tmp

MD5 294e9f64cb1642dd89229fff0592856b
SHA1 97b148c27f3da29ba7b18d6aee8a0db9102f47c9
SHA256 917e115cc403e29b4388e0d175cbfac3e7e40ca1742299fbdb353847db2de7c2
SHA512 b87d531890bf1577b9b4af41dddb2cdbbfa164cf197bd5987df3a3075983645a3acba443e289b7bfd338422978a104f55298fbfe346872de0895bde44adc89cf

memory/2484-890-0x000000007EFA0000-0x000000007EFA1000-memory.dmp

memory/2484-892-0x0000000002100000-0x0000000002140000-memory.dmp

memory/2484-895-0x000000007EF20000-0x000000007EF21000-memory.dmp

memory/2484-894-0x000000007EF80000-0x000000007EF81000-memory.dmp

memory/2484-893-0x0000000002100000-0x0000000002140000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\DDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDD

MD5 b98b5bc342b41f973787b82d440def39
SHA1 2d25f5345bd34a998a5b931c4b5a80c3aca5fcbd
SHA256 85a37399f7dbfe1a22baa59c921bd3c3717831ea57f0cf0ef8ca02ab66c67fd4
SHA512 6b3e869ab4f741a73c321f16e63fa03d2ac01b7bda715b281692c861c509ffe791e2c9199c05161c29994a6e6b0f252589bd74f239649ce9493e1a1d863a69bf

memory/2484-925-0x000000007EF60000-0x000000007EF61000-memory.dmp

memory/2484-924-0x000000007EF40000-0x000000007EF41000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2024-11-15 12:23

Reported

2024-11-15 12:25

Platform

win10v2004-20241007-en

Max time kernel

148s

Max time network

150s

Command Line

"C:\Users\Admin\AppData\Local\Temp\2024-11-15_8005b63da0a2688ea287976c6f943abe_darkside.exe"

Signatures

Renames multiple (639) files with added filename extension

ransomware

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\Control Panel\International\Geo\Nation C:\ProgramData\F34A.tmp N/A

Deletes itself

Description Indicator Process Target
N/A N/A C:\ProgramData\F34A.tmp N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\ProgramData\F34A.tmp N/A

Reads user/profile data of web browsers

spyware stealer

Drops desktop.ini file(s)

Description Indicator Process Target
File opened for modification C:\$Recycle.Bin\S-1-5-21-2045521122-590294423-3465680274-1000\desktop.ini C:\Users\Admin\AppData\Local\Temp\2024-11-15_8005b63da0a2688ea287976c6f943abe_darkside.exe N/A
File opened for modification F:\$RECYCLE.BIN\S-1-5-21-2045521122-590294423-3465680274-1000\desktop.ini C:\Users\Admin\AppData\Local\Temp\2024-11-15_8005b63da0a2688ea287976c6f943abe_darkside.exe N/A

Indicator Removal: File Deletion

defense_evasion

Drops file in System32 directory

Description Indicator Process Target
File created C:\Windows\system32\spool\PRINTERS\00002.SPL C:\Windows\splwow64.exe N/A
File created C:\Windows\system32\spool\PRINTERS\PP0kxbnaoaxl3nzn03v7rox7_o.TMP C:\Windows\system32\printfilterpipelinesvc.exe N/A
File created C:\Windows\system32\spool\PRINTERS\PP0p56k0dxzetkba2fetjd8c60c.TMP C:\Windows\system32\printfilterpipelinesvc.exe N/A
File created C:\Windows\system32\spool\PRINTERS\PPxg53tlmulvov86_qhw7_ddp3.TMP C:\Windows\system32\printfilterpipelinesvc.exe N/A

Sets desktop wallpaper using registry

ransomware
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\Control Panel\Desktop\WallPaper = "C:\\ProgramData\\IPjaex13M.bmp" C:\Users\Admin\AppData\Local\Temp\2024-11-15_8005b63da0a2688ea287976c6f943abe_darkside.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\Control Panel\Desktop\Wallpaper = "C:\\ProgramData\\IPjaex13M.bmp" C:\Users\Admin\AppData\Local\Temp\2024-11-15_8005b63da0a2688ea287976c6f943abe_darkside.exe N/A

Enumerates physical storage devices

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\2024-11-15_8005b63da0a2688ea287976c6f943abe_darkside.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\ProgramData\F34A.tmp N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A

Checks processor information in registry

Description Indicator Process Target
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString C:\Program Files\Microsoft Office\root\Office16\ONENOTE.EXE N/A
Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 C:\Program Files\Microsoft Office\root\Office16\ONENOTE.EXE N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz C:\Program Files\Microsoft Office\root\Office16\ONENOTE.EXE N/A

Enumerates system info in registry

Description Indicator Process Target
Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS C:\Program Files\Microsoft Office\root\Office16\ONENOTE.EXE N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily C:\Program Files\Microsoft Office\root\Office16\ONENOTE.EXE N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU C:\Program Files\Microsoft Office\root\Office16\ONENOTE.EXE N/A

Modifies Control Panel

evasion
Description Indicator Process Target
Key created \REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\Control Panel\Desktop C:\Users\Admin\AppData\Local\Temp\2024-11-15_8005b63da0a2688ea287976c6f943abe_darkside.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\Control Panel\Desktop\WallpaperStyle = "10" C:\Users\Admin\AppData\Local\Temp\2024-11-15_8005b63da0a2688ea287976c6f943abe_darkside.exe N/A

Modifies registry class

Description Indicator Process Target
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.IPjaex13M C:\Users\Admin\AppData\Local\Temp\2024-11-15_8005b63da0a2688ea287976c6f943abe_darkside.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.IPjaex13M\ = "IPjaex13M" C:\Users\Admin\AppData\Local\Temp\2024-11-15_8005b63da0a2688ea287976c6f943abe_darkside.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\IPjaex13M\DefaultIcon C:\Users\Admin\AppData\Local\Temp\2024-11-15_8005b63da0a2688ea287976c6f943abe_darkside.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\IPjaex13M C:\Users\Admin\AppData\Local\Temp\2024-11-15_8005b63da0a2688ea287976c6f943abe_darkside.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\IPjaex13M\DefaultIcon\ = "C:\\ProgramData\\IPjaex13M.ico" C:\Users\Admin\AppData\Local\Temp\2024-11-15_8005b63da0a2688ea287976c6f943abe_darkside.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-11-15_8005b63da0a2688ea287976c6f943abe_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-11-15_8005b63da0a2688ea287976c6f943abe_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-11-15_8005b63da0a2688ea287976c6f943abe_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-11-15_8005b63da0a2688ea287976c6f943abe_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-11-15_8005b63da0a2688ea287976c6f943abe_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-11-15_8005b63da0a2688ea287976c6f943abe_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-11-15_8005b63da0a2688ea287976c6f943abe_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-11-15_8005b63da0a2688ea287976c6f943abe_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-11-15_8005b63da0a2688ea287976c6f943abe_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-11-15_8005b63da0a2688ea287976c6f943abe_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-11-15_8005b63da0a2688ea287976c6f943abe_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-11-15_8005b63da0a2688ea287976c6f943abe_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-11-15_8005b63da0a2688ea287976c6f943abe_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-11-15_8005b63da0a2688ea287976c6f943abe_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-11-15_8005b63da0a2688ea287976c6f943abe_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-11-15_8005b63da0a2688ea287976c6f943abe_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-11-15_8005b63da0a2688ea287976c6f943abe_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-11-15_8005b63da0a2688ea287976c6f943abe_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-11-15_8005b63da0a2688ea287976c6f943abe_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-11-15_8005b63da0a2688ea287976c6f943abe_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-11-15_8005b63da0a2688ea287976c6f943abe_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-11-15_8005b63da0a2688ea287976c6f943abe_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-11-15_8005b63da0a2688ea287976c6f943abe_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-11-15_8005b63da0a2688ea287976c6f943abe_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-11-15_8005b63da0a2688ea287976c6f943abe_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-11-15_8005b63da0a2688ea287976c6f943abe_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-11-15_8005b63da0a2688ea287976c6f943abe_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-11-15_8005b63da0a2688ea287976c6f943abe_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-11-15_8005b63da0a2688ea287976c6f943abe_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-11-15_8005b63da0a2688ea287976c6f943abe_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-11-15_8005b63da0a2688ea287976c6f943abe_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-11-15_8005b63da0a2688ea287976c6f943abe_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-11-15_8005b63da0a2688ea287976c6f943abe_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-11-15_8005b63da0a2688ea287976c6f943abe_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-11-15_8005b63da0a2688ea287976c6f943abe_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-11-15_8005b63da0a2688ea287976c6f943abe_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-11-15_8005b63da0a2688ea287976c6f943abe_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-11-15_8005b63da0a2688ea287976c6f943abe_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-11-15_8005b63da0a2688ea287976c6f943abe_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-11-15_8005b63da0a2688ea287976c6f943abe_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-11-15_8005b63da0a2688ea287976c6f943abe_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-11-15_8005b63da0a2688ea287976c6f943abe_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-11-15_8005b63da0a2688ea287976c6f943abe_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-11-15_8005b63da0a2688ea287976c6f943abe_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-11-15_8005b63da0a2688ea287976c6f943abe_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-11-15_8005b63da0a2688ea287976c6f943abe_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-11-15_8005b63da0a2688ea287976c6f943abe_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-11-15_8005b63da0a2688ea287976c6f943abe_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-11-15_8005b63da0a2688ea287976c6f943abe_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-11-15_8005b63da0a2688ea287976c6f943abe_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-11-15_8005b63da0a2688ea287976c6f943abe_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-11-15_8005b63da0a2688ea287976c6f943abe_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-11-15_8005b63da0a2688ea287976c6f943abe_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-11-15_8005b63da0a2688ea287976c6f943abe_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-11-15_8005b63da0a2688ea287976c6f943abe_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-11-15_8005b63da0a2688ea287976c6f943abe_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-11-15_8005b63da0a2688ea287976c6f943abe_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-11-15_8005b63da0a2688ea287976c6f943abe_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-11-15_8005b63da0a2688ea287976c6f943abe_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-11-15_8005b63da0a2688ea287976c6f943abe_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-11-15_8005b63da0a2688ea287976c6f943abe_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-11-15_8005b63da0a2688ea287976c6f943abe_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-11-15_8005b63da0a2688ea287976c6f943abe_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-11-15_8005b63da0a2688ea287976c6f943abe_darkside.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeAssignPrimaryTokenPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-11-15_8005b63da0a2688ea287976c6f943abe_darkside.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-11-15_8005b63da0a2688ea287976c6f943abe_darkside.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-11-15_8005b63da0a2688ea287976c6f943abe_darkside.exe N/A
Token: 36 N/A C:\Users\Admin\AppData\Local\Temp\2024-11-15_8005b63da0a2688ea287976c6f943abe_darkside.exe N/A
Token: SeImpersonatePrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-11-15_8005b63da0a2688ea287976c6f943abe_darkside.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-11-15_8005b63da0a2688ea287976c6f943abe_darkside.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-11-15_8005b63da0a2688ea287976c6f943abe_darkside.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Local\Temp\2024-11-15_8005b63da0a2688ea287976c6f943abe_darkside.exe N/A
Token: SeManageVolumePrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-11-15_8005b63da0a2688ea287976c6f943abe_darkside.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-11-15_8005b63da0a2688ea287976c6f943abe_darkside.exe N/A
Token: SeRestorePrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-11-15_8005b63da0a2688ea287976c6f943abe_darkside.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-11-15_8005b63da0a2688ea287976c6f943abe_darkside.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-11-15_8005b63da0a2688ea287976c6f943abe_darkside.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-11-15_8005b63da0a2688ea287976c6f943abe_darkside.exe N/A
Token: SeShutdownPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-11-15_8005b63da0a2688ea287976c6f943abe_darkside.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-11-15_8005b63da0a2688ea287976c6f943abe_darkside.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-11-15_8005b63da0a2688ea287976c6f943abe_darkside.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-11-15_8005b63da0a2688ea287976c6f943abe_darkside.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-11-15_8005b63da0a2688ea287976c6f943abe_darkside.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-11-15_8005b63da0a2688ea287976c6f943abe_darkside.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-11-15_8005b63da0a2688ea287976c6f943abe_darkside.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-11-15_8005b63da0a2688ea287976c6f943abe_darkside.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-11-15_8005b63da0a2688ea287976c6f943abe_darkside.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-11-15_8005b63da0a2688ea287976c6f943abe_darkside.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-11-15_8005b63da0a2688ea287976c6f943abe_darkside.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-11-15_8005b63da0a2688ea287976c6f943abe_darkside.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-11-15_8005b63da0a2688ea287976c6f943abe_darkside.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-11-15_8005b63da0a2688ea287976c6f943abe_darkside.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-11-15_8005b63da0a2688ea287976c6f943abe_darkside.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-11-15_8005b63da0a2688ea287976c6f943abe_darkside.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-11-15_8005b63da0a2688ea287976c6f943abe_darkside.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-11-15_8005b63da0a2688ea287976c6f943abe_darkside.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-11-15_8005b63da0a2688ea287976c6f943abe_darkside.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-11-15_8005b63da0a2688ea287976c6f943abe_darkside.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-11-15_8005b63da0a2688ea287976c6f943abe_darkside.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-11-15_8005b63da0a2688ea287976c6f943abe_darkside.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-11-15_8005b63da0a2688ea287976c6f943abe_darkside.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-11-15_8005b63da0a2688ea287976c6f943abe_darkside.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-11-15_8005b63da0a2688ea287976c6f943abe_darkside.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-11-15_8005b63da0a2688ea287976c6f943abe_darkside.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-11-15_8005b63da0a2688ea287976c6f943abe_darkside.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-11-15_8005b63da0a2688ea287976c6f943abe_darkside.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-11-15_8005b63da0a2688ea287976c6f943abe_darkside.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-11-15_8005b63da0a2688ea287976c6f943abe_darkside.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-11-15_8005b63da0a2688ea287976c6f943abe_darkside.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-11-15_8005b63da0a2688ea287976c6f943abe_darkside.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-11-15_8005b63da0a2688ea287976c6f943abe_darkside.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-11-15_8005b63da0a2688ea287976c6f943abe_darkside.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-11-15_8005b63da0a2688ea287976c6f943abe_darkside.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-11-15_8005b63da0a2688ea287976c6f943abe_darkside.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-11-15_8005b63da0a2688ea287976c6f943abe_darkside.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-11-15_8005b63da0a2688ea287976c6f943abe_darkside.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-11-15_8005b63da0a2688ea287976c6f943abe_darkside.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-11-15_8005b63da0a2688ea287976c6f943abe_darkside.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-11-15_8005b63da0a2688ea287976c6f943abe_darkside.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-11-15_8005b63da0a2688ea287976c6f943abe_darkside.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-11-15_8005b63da0a2688ea287976c6f943abe_darkside.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-11-15_8005b63da0a2688ea287976c6f943abe_darkside.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-11-15_8005b63da0a2688ea287976c6f943abe_darkside.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-11-15_8005b63da0a2688ea287976c6f943abe_darkside.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-11-15_8005b63da0a2688ea287976c6f943abe_darkside.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-11-15_8005b63da0a2688ea287976c6f943abe_darkside.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-11-15_8005b63da0a2688ea287976c6f943abe_darkside.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-11-15_8005b63da0a2688ea287976c6f943abe_darkside.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 1744 wrote to memory of 3796 N/A C:\Users\Admin\AppData\Local\Temp\2024-11-15_8005b63da0a2688ea287976c6f943abe_darkside.exe C:\Windows\splwow64.exe
PID 1744 wrote to memory of 3796 N/A C:\Users\Admin\AppData\Local\Temp\2024-11-15_8005b63da0a2688ea287976c6f943abe_darkside.exe C:\Windows\splwow64.exe
PID 3204 wrote to memory of 3432 N/A C:\Windows\system32\printfilterpipelinesvc.exe C:\Program Files\Microsoft Office\root\Office16\ONENOTE.EXE
PID 3204 wrote to memory of 3432 N/A C:\Windows\system32\printfilterpipelinesvc.exe C:\Program Files\Microsoft Office\root\Office16\ONENOTE.EXE
PID 1744 wrote to memory of 5628 N/A C:\Users\Admin\AppData\Local\Temp\2024-11-15_8005b63da0a2688ea287976c6f943abe_darkside.exe C:\ProgramData\F34A.tmp
PID 1744 wrote to memory of 5628 N/A C:\Users\Admin\AppData\Local\Temp\2024-11-15_8005b63da0a2688ea287976c6f943abe_darkside.exe C:\ProgramData\F34A.tmp
PID 1744 wrote to memory of 5628 N/A C:\Users\Admin\AppData\Local\Temp\2024-11-15_8005b63da0a2688ea287976c6f943abe_darkside.exe C:\ProgramData\F34A.tmp
PID 1744 wrote to memory of 5628 N/A C:\Users\Admin\AppData\Local\Temp\2024-11-15_8005b63da0a2688ea287976c6f943abe_darkside.exe C:\ProgramData\F34A.tmp
PID 5628 wrote to memory of 5160 N/A C:\ProgramData\F34A.tmp C:\Windows\SysWOW64\cmd.exe
PID 5628 wrote to memory of 5160 N/A C:\ProgramData\F34A.tmp C:\Windows\SysWOW64\cmd.exe
PID 5628 wrote to memory of 5160 N/A C:\ProgramData\F34A.tmp C:\Windows\SysWOW64\cmd.exe

Processes

C:\Users\Admin\AppData\Local\Temp\2024-11-15_8005b63da0a2688ea287976c6f943abe_darkside.exe

"C:\Users\Admin\AppData\Local\Temp\2024-11-15_8005b63da0a2688ea287976c6f943abe_darkside.exe"

C:\Windows\splwow64.exe

C:\Windows\splwow64.exe 12288

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k PrintWorkflow -s PrintWorkflowUserSvc

C:\Windows\system32\printfilterpipelinesvc.exe

C:\Windows\system32\printfilterpipelinesvc.exe -Embedding

C:\Program Files\Microsoft Office\root\Office16\ONENOTE.EXE

/insertdoc "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\{5F4B857B-031A-49FF-9D3B-230718EC1328}.xps" 133761470188910000

C:\ProgramData\F34A.tmp

"C:\ProgramData\F34A.tmp"

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /C DEL /F /Q C:\PROGRA~3\F34A.tmp >> NUL

Network

Country Destination Domain Proto
US 8.8.8.8:53 104.219.191.52.in-addr.arpa udp
US 8.8.8.8:53 68.32.126.40.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 133.211.185.52.in-addr.arpa udp
US 8.8.8.8:53 18.89.109.52.in-addr.arpa udp
US 8.8.8.8:53 roaming.officeapps.live.com udp
IE 52.109.76.243:443 roaming.officeapps.live.com tcp
US 8.8.8.8:53 243.76.109.52.in-addr.arpa udp
US 8.8.8.8:53 22.160.190.20.in-addr.arpa udp
US 8.8.8.8:53 27.173.189.20.in-addr.arpa udp
US 8.8.8.8:53 50.23.12.20.in-addr.arpa udp
US 8.8.8.8:53 241.42.69.40.in-addr.arpa udp
US 8.8.8.8:53 43.229.111.52.in-addr.arpa udp

Files

memory/1744-0-0x0000000002C90000-0x0000000002CA0000-memory.dmp

memory/1744-1-0x0000000002C90000-0x0000000002CA0000-memory.dmp

memory/1744-2-0x0000000002C90000-0x0000000002CA0000-memory.dmp

F:\$RECYCLE.BIN\S-1-5-21-2045521122-590294423-3465680274-1000\DDDDDDDDDDD

MD5 8f7de8386b244d7016649660fc787b74
SHA1 a0cbf9134ecc6db87047e196ad7e49b02fca6237
SHA256 434de5303e0e74d2e8be7bc9daa2aa03ccceb04f40eb4a526d4ef1f7970a99ee
SHA512 78ae13ee4434b8a5a4ef297f3a8a11ef5aa70201ef2444696b57e896376c83292ceb4fe340f23b73edbb52f57084e61a75489537de812f6d5b064e4040d88358

C:\$Recycle.Bin\S-1-5-21-2045521122-590294423-3465680274-1000\YYYYYYYYYYY

MD5 c829c1a74bce2c766f4ad164c94fae9e
SHA1 8f334245260277af90fed4eb39168e0f4d231aa2
SHA256 c95fbb508e91b788ab86d19772773059db60f4400d29dc3ae03212ca841b3132
SHA512 85abcd0a457f35c5f85c637d470a0ec141cbf49d8e2f4eeacc9f51679b673d163cb50b92d062be292bf9e36cfb04181244110c6a5fbccbb5ade7985fc9263939

C:\IPjaex13M.README.txt

MD5 88f6599d557ec2b7a12b3ab4faf3c364
SHA1 1bc917d0543deee57c7e13f7ed182c8692e69458
SHA256 781cf1f98ccd2cf18079967e28996a722e75fa28cb2ecc8b638e2efcdf751e8d
SHA512 d1633a186dbc849f8c056bd53df4b24f972f170cb4e602b487d89b9762ce78699cf148d70f62272e8e2d13888a73b38910b43c378af8d21102a3fd2e08731d19

memory/1744-2971-0x0000000002C90000-0x0000000002CA0000-memory.dmp

memory/1744-2972-0x0000000002C90000-0x0000000002CA0000-memory.dmp

memory/1744-2973-0x0000000002C90000-0x0000000002CA0000-memory.dmp

memory/3432-2985-0x00007FF845D30000-0x00007FF845D40000-memory.dmp

memory/3432-2987-0x00007FF845D30000-0x00007FF845D40000-memory.dmp

memory/3432-2988-0x00007FF845D30000-0x00007FF845D40000-memory.dmp

memory/3432-2986-0x00007FF845D30000-0x00007FF845D40000-memory.dmp

memory/3432-2989-0x00007FF845D30000-0x00007FF845D40000-memory.dmp

C:\ProgramData\F34A.tmp

MD5 294e9f64cb1642dd89229fff0592856b
SHA1 97b148c27f3da29ba7b18d6aee8a0db9102f47c9
SHA256 917e115cc403e29b4388e0d175cbfac3e7e40ca1742299fbdb353847db2de7c2
SHA512 b87d531890bf1577b9b4af41dddb2cdbbfa164cf197bd5987df3a3075983645a3acba443e289b7bfd338422978a104f55298fbfe346872de0895bde44adc89cf

C:\Users\Admin\AppData\Local\Temp\EEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEE

MD5 4c6fc9aa85535c6465e8999a4b5bab9f
SHA1 fdb06c49d86375480b36943b97015dc33ac1c1db
SHA256 960fd718c0a3c2ada4d5c604deb457391060db1b4cd2700796f5f82448036119
SHA512 8a0b1b136a173ba9ba70bdbb465a94c63c2cecdd91b5e3660844a7d414f508ae988a111b1e551f1d26728bade1f43b991397543d8a021c5166dc2876b48e62e5

memory/3432-3022-0x00007FF843660000-0x00007FF843670000-memory.dmp

memory/3432-3023-0x00007FF843660000-0x00007FF843670000-memory.dmp

C:\Users\Admin\Documents\OneNote Notebooks\My Notebook\Open Notebook.onetoc2

MD5 350cac3b60c0ad35a63c88151ebdadb0
SHA1 46a7157d030dc2cd74b2fba2b90acd5b0ccd39e8
SHA256 f33889f5a4907fc2ccb3ec02b4c1cdc1672ba2b93d86a4ed99e8c213bb3f5bd6
SHA512 062988baa2bacc4fe10e10911da13d4cf614da6f14eee5a318920b8d0f4ca8a80e05082bb2fc0e5f6e22220650eabcb63be99b02191f8bdff4ae8ad73b1209ed