Overview

overview

10

Static

static

10

2024-11-27...de.exe

windows7-x64

7

2024-11-27...de.exe

windows10-2004-x64

7

Analysis

  • max time kernel
    117s
  • max time network
    121s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    27/11/2024, 02:25

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target

    2024-11-27_12ee1481a91f84a0bc71b45aa00844b0_darkside.exe

  • Size

    156KB

  • MD5

    12ee1481a91f84a0bc71b45aa00844b0

  • SHA1

    309d2273d6875c14acb8976c429e022d9ed5a6ee

  • SHA256

    421f922658b985855a580ad3d6736c55817d252a9d6104c944786f7aae393b6b

  • SHA512

    e3293bc77e8177f7abc3a8b51ce05c20941735f9f3c9902201c8f7907529a25d3e1654704b7163324a6ed3b8604e6002ddcc7aa79ef2a8ec609ea548d160075a

  • SSDEEP

    3072:+DDDDDDDDDDDDDDDDDDDE45d/t6sVkgZqltP3368JmSLTFh1zgH3/W:I5d/zugZqll30SD1gH3

Score
7/10
defense_evasiondiscovery

Malware Config

Signatures

  • Deletes itself 1 IoCs
  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 1 IoCs
  • Drops desktop.ini file(s) 2 IoCs
  • Indicator Removal: File Deletion 1 TTPs

    Adversaries may delete files left behind by the actions of their intrusion activity.

    defense_evasion
  • Suspicious use of NtSetInformationThreadHideFromDebugger 12 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Suspicious behavior: EnumeratesProcesses 12 IoCs
  • Suspicious behavior: RenamesItself 26 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of WriteProcessMemory 9 IoCs
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware

Processes

  • C:\Users\Admin\AppData\Local\Temp\2024-11-27_12ee1481a91f84a0bc71b45aa00844b0_darkside.exe
    "C:\Users\Admin\AppData\Local\Temp\2024-11-27_12ee1481a91f84a0bc71b45aa00844b0_darkside.exe"
    1⤵
    • Loads dropped DLL
    • Drops desktop.ini file(s)
    • Suspicious use of NtSetInformationThreadHideFromDebugger
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:1972
    • C:\ProgramData\BFA7.tmp
      "C:\ProgramData\BFA7.tmp"
      2⤵
      • Deletes itself
      • Executes dropped EXE
      • Suspicious use of NtSetInformationThreadHideFromDebugger
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: RenamesItself
      • Suspicious use of WriteProcessMemory
      PID:532
      • C:\Windows\SysWOW64\cmd.exe
        "C:\Windows\System32\cmd.exe" /C DEL /F /Q C:\PROGRA~3\BFA7.tmp >> NUL
        3⤵
        • System Location Discovery: System Language Discovery
        PID:2080
  • C:\Windows\system32\vssvc.exe
    C:\Windows\system32\vssvc.exe
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    PID:2732
  • C:\Windows\system32\AUDIODG.EXE
    C:\Windows\system32\AUDIODG.EXE 0x14c
    1⤵
      PID:1340

    Network

          MITRE ATT&CK Enterprise v15

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          • C:\$Recycle.Bin\S-1-5-21-2872745919-2748461613-2989606286-1000\desktop.ini
            Filesize

            129B

            MD5

            8949b1b9e6aa1c50299498df74d91251

            SHA1

            b837ccc32337437da7dc5e835604933da0ab2249

            SHA256

            f17ebcd3e0a2c7b25965deb9ef1166cd27f73afb7936a2f6410540cfd334243f

            SHA512

            da3b4536fda6c17af1dea5980c8e573ec487a4b415667f2c45604247f3df1584e0e02054ee7167ca3ae44dddc08e71d122a732432f4a2e2c13e01469da8db630

            Download Submit

          • C:\Users\Admin\AppData\Local\Temp\DDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDD
            Filesize

            156KB

            MD5

            d189fec3bea87c9baf4cbe1ffdf1a072

            SHA1

            b7258027c244b63e575ed88a06c8a2484d19a3db

            SHA256

            f539e03b118a72d39175eb5d4cef5a558dea3438fde48eeff750f3a3052679cb

            SHA512

            51e5c897757cb0cb94f2016e9e515b40ad7ad71c128362df07948eb668c931b6d80284131882842400c6a6cc9101cfe21893afe154e52e555c422d3cbdfb4c36

            Download Submit

          • F:\$RECYCLE.BIN\S-1-5-21-2872745919-2748461613-2989606286-1000\DDDDDDDDDDD
            Filesize

            129B

            MD5

            cd12c65d5abf87cb09f004b6f50e7d1b

            SHA1

            bb42bad8112ca4123a29a75746fa7dbe1e9c361f

            SHA256

            f2a0ad093c49209ab25ee1ecd82f491a256783a35eb6b61af33ba25367dfaf8c

            SHA512

            ac57043bca7319f96921c1620d7d2a1f09ae166fede45a5aed4e1e768dbfbdca3d56ea3584d0f08ca633f7cf6fddd6f88791fd283c481529fcc42746eecbb1ae

            Download Submit

          • \ProgramData\BFA7.tmp
            Filesize

            14KB

            MD5

            294e9f64cb1642dd89229fff0592856b

            SHA1

            97b148c27f3da29ba7b18d6aee8a0db9102f47c9

            SHA256

            917e115cc403e29b4388e0d175cbfac3e7e40ca1742299fbdb353847db2de7c2

            SHA512

            b87d531890bf1577b9b4af41dddb2cdbbfa164cf197bd5987df3a3075983645a3acba443e289b7bfd338422978a104f55298fbfe346872de0895bde44adc89cf

            Download Submit

          • memory/532-88-0x000000007EFA0000-0x000000007EFA1000-memory.dmp

            Filesize

            4KB

            Download

          • memory/532-90-0x0000000002060000-0x00000000020A0000-memory.dmp

            Filesize

            256KB

            Download

          • memory/532-92-0x000000007EF80000-0x000000007EF81000-memory.dmp

            Filesize

            4KB

            Download

          • memory/532-91-0x000000007EF20000-0x000000007EF21000-memory.dmp

            Filesize

            4KB

            Download

          • memory/532-123-0x000000007EF40000-0x000000007EF41000-memory.dmp

            Filesize

            4KB

            Download

          • memory/532-124-0x000000007EF60000-0x000000007EF61000-memory.dmp

            Filesize

            4KB

            Download

          • memory/1972-0-0x00000000023D0000-0x0000000002410000-memory.dmp

            Filesize

            256KB

            Download