Analysis
-
max time kernel
95s -
max time network
143s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
05-12-2024 17:29
Behavioral task
behavioral1
Sample
2024-12-05_70c964b9aeac25bc97055030a1cfb58a_darkside.exe
Resource
win7-20240903-en
windows7-x64
7 signatures
150 seconds
Behavioral task
behavioral2
Sample
2024-12-05_70c964b9aeac25bc97055030a1cfb58a_darkside.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
7 signatures
150 seconds
General
-
Target
2024-12-05_70c964b9aeac25bc97055030a1cfb58a_darkside.exe
-
Size
145KB
-
MD5
70c964b9aeac25bc97055030a1cfb58a
-
SHA1
adedc2fec00056559f911bdfb40bae883c6bbaa4
-
SHA256
8bedd5cf2d48da4f1533ffdd999dd62f48a49a97d16ee67ee837caa9dd2d7d33
-
SHA512
e3fa5d492fac29f2a6fa26a6d9d5dbefb35295fea329c282d019212d4a3048777f8c70c0d48e38bf8629d4b0f68e0f4a59501b1797665d760220fad496f06f3e
-
SSDEEP
1536:MzICS4AAwczUUf8y8gvMH+1zGSNAojMP95D1xDIBpmDtoMOqiXWpyW2C9PqPxUzZ:jqJogYkcSNm9V7DIBk9i2gPxsqYT
Score
9/10
Malware Config
Signatures
-
Renames multiple (601) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Drops desktop.ini file(s) 2 IoCs
description ioc Process File opened for modification C:\$Recycle.Bin\S-1-5-21-2045521122-590294423-3465680274-1000\desktop.ini 2024-12-05_70c964b9aeac25bc97055030a1cfb58a_darkside.exe File opened for modification F:\$RECYCLE.BIN\S-1-5-21-2045521122-590294423-3465680274-1000\desktop.ini 2024-12-05_70c964b9aeac25bc97055030a1cfb58a_darkside.exe -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2024-12-05_70c964b9aeac25bc97055030a1cfb58a_darkside.exe -
Modifies registry class 5 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.oxpF0ii78 2024-12-05_70c964b9aeac25bc97055030a1cfb58a_darkside.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.oxpF0ii78\ = "oxpF0ii78" 2024-12-05_70c964b9aeac25bc97055030a1cfb58a_darkside.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\oxpF0ii78\DefaultIcon 2024-12-05_70c964b9aeac25bc97055030a1cfb58a_darkside.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\oxpF0ii78 2024-12-05_70c964b9aeac25bc97055030a1cfb58a_darkside.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\oxpF0ii78\DefaultIcon\ = "C:\\ProgramData\\oxpF0ii78.ico" 2024-12-05_70c964b9aeac25bc97055030a1cfb58a_darkside.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 3888 2024-12-05_70c964b9aeac25bc97055030a1cfb58a_darkside.exe 3888 2024-12-05_70c964b9aeac25bc97055030a1cfb58a_darkside.exe 3888 2024-12-05_70c964b9aeac25bc97055030a1cfb58a_darkside.exe 3888 2024-12-05_70c964b9aeac25bc97055030a1cfb58a_darkside.exe 3888 2024-12-05_70c964b9aeac25bc97055030a1cfb58a_darkside.exe 3888 2024-12-05_70c964b9aeac25bc97055030a1cfb58a_darkside.exe 3888 2024-12-05_70c964b9aeac25bc97055030a1cfb58a_darkside.exe 3888 2024-12-05_70c964b9aeac25bc97055030a1cfb58a_darkside.exe 3888 2024-12-05_70c964b9aeac25bc97055030a1cfb58a_darkside.exe 3888 2024-12-05_70c964b9aeac25bc97055030a1cfb58a_darkside.exe 3888 2024-12-05_70c964b9aeac25bc97055030a1cfb58a_darkside.exe 3888 2024-12-05_70c964b9aeac25bc97055030a1cfb58a_darkside.exe 3888 2024-12-05_70c964b9aeac25bc97055030a1cfb58a_darkside.exe 3888 2024-12-05_70c964b9aeac25bc97055030a1cfb58a_darkside.exe 3888 2024-12-05_70c964b9aeac25bc97055030a1cfb58a_darkside.exe 3888 2024-12-05_70c964b9aeac25bc97055030a1cfb58a_darkside.exe 3888 2024-12-05_70c964b9aeac25bc97055030a1cfb58a_darkside.exe 3888 2024-12-05_70c964b9aeac25bc97055030a1cfb58a_darkside.exe 3888 2024-12-05_70c964b9aeac25bc97055030a1cfb58a_darkside.exe 3888 2024-12-05_70c964b9aeac25bc97055030a1cfb58a_darkside.exe 3888 2024-12-05_70c964b9aeac25bc97055030a1cfb58a_darkside.exe 3888 2024-12-05_70c964b9aeac25bc97055030a1cfb58a_darkside.exe 3888 2024-12-05_70c964b9aeac25bc97055030a1cfb58a_darkside.exe 3888 2024-12-05_70c964b9aeac25bc97055030a1cfb58a_darkside.exe 3888 2024-12-05_70c964b9aeac25bc97055030a1cfb58a_darkside.exe 3888 2024-12-05_70c964b9aeac25bc97055030a1cfb58a_darkside.exe 3888 2024-12-05_70c964b9aeac25bc97055030a1cfb58a_darkside.exe 3888 2024-12-05_70c964b9aeac25bc97055030a1cfb58a_darkside.exe 3888 2024-12-05_70c964b9aeac25bc97055030a1cfb58a_darkside.exe 3888 2024-12-05_70c964b9aeac25bc97055030a1cfb58a_darkside.exe 3888 2024-12-05_70c964b9aeac25bc97055030a1cfb58a_darkside.exe 3888 2024-12-05_70c964b9aeac25bc97055030a1cfb58a_darkside.exe 3888 2024-12-05_70c964b9aeac25bc97055030a1cfb58a_darkside.exe 3888 2024-12-05_70c964b9aeac25bc97055030a1cfb58a_darkside.exe 3888 2024-12-05_70c964b9aeac25bc97055030a1cfb58a_darkside.exe 3888 2024-12-05_70c964b9aeac25bc97055030a1cfb58a_darkside.exe 3888 2024-12-05_70c964b9aeac25bc97055030a1cfb58a_darkside.exe 3888 2024-12-05_70c964b9aeac25bc97055030a1cfb58a_darkside.exe 3888 2024-12-05_70c964b9aeac25bc97055030a1cfb58a_darkside.exe 3888 2024-12-05_70c964b9aeac25bc97055030a1cfb58a_darkside.exe 3888 2024-12-05_70c964b9aeac25bc97055030a1cfb58a_darkside.exe 3888 2024-12-05_70c964b9aeac25bc97055030a1cfb58a_darkside.exe 3888 2024-12-05_70c964b9aeac25bc97055030a1cfb58a_darkside.exe 3888 2024-12-05_70c964b9aeac25bc97055030a1cfb58a_darkside.exe 3888 2024-12-05_70c964b9aeac25bc97055030a1cfb58a_darkside.exe 3888 2024-12-05_70c964b9aeac25bc97055030a1cfb58a_darkside.exe 3888 2024-12-05_70c964b9aeac25bc97055030a1cfb58a_darkside.exe 3888 2024-12-05_70c964b9aeac25bc97055030a1cfb58a_darkside.exe 3888 2024-12-05_70c964b9aeac25bc97055030a1cfb58a_darkside.exe 3888 2024-12-05_70c964b9aeac25bc97055030a1cfb58a_darkside.exe 3888 2024-12-05_70c964b9aeac25bc97055030a1cfb58a_darkside.exe 3888 2024-12-05_70c964b9aeac25bc97055030a1cfb58a_darkside.exe 3888 2024-12-05_70c964b9aeac25bc97055030a1cfb58a_darkside.exe 3888 2024-12-05_70c964b9aeac25bc97055030a1cfb58a_darkside.exe 3888 2024-12-05_70c964b9aeac25bc97055030a1cfb58a_darkside.exe 3888 2024-12-05_70c964b9aeac25bc97055030a1cfb58a_darkside.exe 3888 2024-12-05_70c964b9aeac25bc97055030a1cfb58a_darkside.exe 3888 2024-12-05_70c964b9aeac25bc97055030a1cfb58a_darkside.exe 3888 2024-12-05_70c964b9aeac25bc97055030a1cfb58a_darkside.exe 3888 2024-12-05_70c964b9aeac25bc97055030a1cfb58a_darkside.exe 3888 2024-12-05_70c964b9aeac25bc97055030a1cfb58a_darkside.exe 3888 2024-12-05_70c964b9aeac25bc97055030a1cfb58a_darkside.exe 3888 2024-12-05_70c964b9aeac25bc97055030a1cfb58a_darkside.exe 3888 2024-12-05_70c964b9aeac25bc97055030a1cfb58a_darkside.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeAssignPrimaryTokenPrivilege 3888 2024-12-05_70c964b9aeac25bc97055030a1cfb58a_darkside.exe Token: SeBackupPrivilege 3888 2024-12-05_70c964b9aeac25bc97055030a1cfb58a_darkside.exe Token: SeDebugPrivilege 3888 2024-12-05_70c964b9aeac25bc97055030a1cfb58a_darkside.exe Token: 36 3888 2024-12-05_70c964b9aeac25bc97055030a1cfb58a_darkside.exe Token: SeImpersonatePrivilege 3888 2024-12-05_70c964b9aeac25bc97055030a1cfb58a_darkside.exe Token: SeIncBasePriorityPrivilege 3888 2024-12-05_70c964b9aeac25bc97055030a1cfb58a_darkside.exe Token: SeIncreaseQuotaPrivilege 3888 2024-12-05_70c964b9aeac25bc97055030a1cfb58a_darkside.exe Token: 33 3888 2024-12-05_70c964b9aeac25bc97055030a1cfb58a_darkside.exe Token: SeManageVolumePrivilege 3888 2024-12-05_70c964b9aeac25bc97055030a1cfb58a_darkside.exe Token: SeProfSingleProcessPrivilege 3888 2024-12-05_70c964b9aeac25bc97055030a1cfb58a_darkside.exe Token: SeRestorePrivilege 3888 2024-12-05_70c964b9aeac25bc97055030a1cfb58a_darkside.exe Token: SeSecurityPrivilege 3888 2024-12-05_70c964b9aeac25bc97055030a1cfb58a_darkside.exe Token: SeSystemProfilePrivilege 3888 2024-12-05_70c964b9aeac25bc97055030a1cfb58a_darkside.exe Token: SeTakeOwnershipPrivilege 3888 2024-12-05_70c964b9aeac25bc97055030a1cfb58a_darkside.exe Token: SeShutdownPrivilege 3888 2024-12-05_70c964b9aeac25bc97055030a1cfb58a_darkside.exe Token: SeDebugPrivilege 3888 2024-12-05_70c964b9aeac25bc97055030a1cfb58a_darkside.exe Token: SeBackupPrivilege 3888 2024-12-05_70c964b9aeac25bc97055030a1cfb58a_darkside.exe Token: SeBackupPrivilege 3888 2024-12-05_70c964b9aeac25bc97055030a1cfb58a_darkside.exe Token: SeSecurityPrivilege 3888 2024-12-05_70c964b9aeac25bc97055030a1cfb58a_darkside.exe Token: SeSecurityPrivilege 3888 2024-12-05_70c964b9aeac25bc97055030a1cfb58a_darkside.exe Token: SeBackupPrivilege 3888 2024-12-05_70c964b9aeac25bc97055030a1cfb58a_darkside.exe Token: SeBackupPrivilege 3888 2024-12-05_70c964b9aeac25bc97055030a1cfb58a_darkside.exe Token: SeSecurityPrivilege 3888 2024-12-05_70c964b9aeac25bc97055030a1cfb58a_darkside.exe Token: SeSecurityPrivilege 3888 2024-12-05_70c964b9aeac25bc97055030a1cfb58a_darkside.exe Token: SeBackupPrivilege 3888 2024-12-05_70c964b9aeac25bc97055030a1cfb58a_darkside.exe Token: SeBackupPrivilege 3888 2024-12-05_70c964b9aeac25bc97055030a1cfb58a_darkside.exe Token: SeSecurityPrivilege 3888 2024-12-05_70c964b9aeac25bc97055030a1cfb58a_darkside.exe Token: SeSecurityPrivilege 3888 2024-12-05_70c964b9aeac25bc97055030a1cfb58a_darkside.exe Token: SeBackupPrivilege 3888 2024-12-05_70c964b9aeac25bc97055030a1cfb58a_darkside.exe Token: SeBackupPrivilege 3888 2024-12-05_70c964b9aeac25bc97055030a1cfb58a_darkside.exe Token: SeSecurityPrivilege 3888 2024-12-05_70c964b9aeac25bc97055030a1cfb58a_darkside.exe Token: SeSecurityPrivilege 3888 2024-12-05_70c964b9aeac25bc97055030a1cfb58a_darkside.exe Token: SeBackupPrivilege 3888 2024-12-05_70c964b9aeac25bc97055030a1cfb58a_darkside.exe Token: SeBackupPrivilege 3888 2024-12-05_70c964b9aeac25bc97055030a1cfb58a_darkside.exe Token: SeSecurityPrivilege 3888 2024-12-05_70c964b9aeac25bc97055030a1cfb58a_darkside.exe Token: SeSecurityPrivilege 3888 2024-12-05_70c964b9aeac25bc97055030a1cfb58a_darkside.exe Token: SeBackupPrivilege 3888 2024-12-05_70c964b9aeac25bc97055030a1cfb58a_darkside.exe Token: SeBackupPrivilege 3888 2024-12-05_70c964b9aeac25bc97055030a1cfb58a_darkside.exe Token: SeSecurityPrivilege 3888 2024-12-05_70c964b9aeac25bc97055030a1cfb58a_darkside.exe Token: SeSecurityPrivilege 3888 2024-12-05_70c964b9aeac25bc97055030a1cfb58a_darkside.exe Token: SeBackupPrivilege 3888 2024-12-05_70c964b9aeac25bc97055030a1cfb58a_darkside.exe Token: SeBackupPrivilege 3888 2024-12-05_70c964b9aeac25bc97055030a1cfb58a_darkside.exe Token: SeSecurityPrivilege 3888 2024-12-05_70c964b9aeac25bc97055030a1cfb58a_darkside.exe Token: SeSecurityPrivilege 3888 2024-12-05_70c964b9aeac25bc97055030a1cfb58a_darkside.exe Token: SeBackupPrivilege 3888 2024-12-05_70c964b9aeac25bc97055030a1cfb58a_darkside.exe Token: SeBackupPrivilege 3888 2024-12-05_70c964b9aeac25bc97055030a1cfb58a_darkside.exe Token: SeSecurityPrivilege 3888 2024-12-05_70c964b9aeac25bc97055030a1cfb58a_darkside.exe Token: SeSecurityPrivilege 3888 2024-12-05_70c964b9aeac25bc97055030a1cfb58a_darkside.exe Token: SeBackupPrivilege 3888 2024-12-05_70c964b9aeac25bc97055030a1cfb58a_darkside.exe Token: SeBackupPrivilege 3888 2024-12-05_70c964b9aeac25bc97055030a1cfb58a_darkside.exe Token: SeSecurityPrivilege 3888 2024-12-05_70c964b9aeac25bc97055030a1cfb58a_darkside.exe Token: SeSecurityPrivilege 3888 2024-12-05_70c964b9aeac25bc97055030a1cfb58a_darkside.exe Token: SeBackupPrivilege 3888 2024-12-05_70c964b9aeac25bc97055030a1cfb58a_darkside.exe Token: SeBackupPrivilege 3888 2024-12-05_70c964b9aeac25bc97055030a1cfb58a_darkside.exe Token: SeSecurityPrivilege 3888 2024-12-05_70c964b9aeac25bc97055030a1cfb58a_darkside.exe Token: SeSecurityPrivilege 3888 2024-12-05_70c964b9aeac25bc97055030a1cfb58a_darkside.exe Token: SeBackupPrivilege 3888 2024-12-05_70c964b9aeac25bc97055030a1cfb58a_darkside.exe Token: SeBackupPrivilege 3888 2024-12-05_70c964b9aeac25bc97055030a1cfb58a_darkside.exe Token: SeSecurityPrivilege 3888 2024-12-05_70c964b9aeac25bc97055030a1cfb58a_darkside.exe Token: SeSecurityPrivilege 3888 2024-12-05_70c964b9aeac25bc97055030a1cfb58a_darkside.exe Token: SeBackupPrivilege 3888 2024-12-05_70c964b9aeac25bc97055030a1cfb58a_darkside.exe Token: SeBackupPrivilege 3888 2024-12-05_70c964b9aeac25bc97055030a1cfb58a_darkside.exe Token: SeSecurityPrivilege 3888 2024-12-05_70c964b9aeac25bc97055030a1cfb58a_darkside.exe Token: SeSecurityPrivilege 3888 2024-12-05_70c964b9aeac25bc97055030a1cfb58a_darkside.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-12-05_70c964b9aeac25bc97055030a1cfb58a_darkside.exe"C:\Users\Admin\AppData\Local\Temp\2024-12-05_70c964b9aeac25bc97055030a1cfb58a_darkside.exe"1⤵
- Drops desktop.ini file(s)
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3888
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
129B
MD53ba799839186da4c419ac459510c828c
SHA136dcf081e98d0710a82de496904650bbfd1d1c07
SHA2567676ae8d64a34b5acf52b6b5a35cce72e47173a72a8d630ce1ca93d0498cccde
SHA512ebfaa2a9e32ea79912fea957986431c8527567d2e78a309e6f2811bcceecb7917097755578e923fd5ced7b9c39d51a22b9f957ff3d4eee78122f18f4157a1189
-
Filesize
54B
MD5f0a4e00d77e2e7554cd4c5e7f55cfba0
SHA1bd806852e434e79eadbf20baf140fa2823e85fa3
SHA256566e1169454a546fab27e78eabf370295c8e68e8cbc852e932719f40dc86643b
SHA512bef26d33e5e5cfef5c8ab848c240607fe97780a279a2af691ce7cf04d9a44d21b58ae9c3bfcede8a7fb1dad742317ad9a1a4061460faaf00b42c03df0d16d02d
-
Filesize
129B
MD5830129ecf74840f3186209eb9da27411
SHA1bf9979a3089a52cf77518bbd5d3d527aee3e3d81
SHA25607620e73c86be770fef900d16eb389418e2ae97761eb75e310873370f1d98bdf
SHA512c96fe11ba12cee72145d728613f37de1258bba0691b67af31a88097b074d96c3274bb54f83f4e8286e13551a9f0f4961a56c24c9cefcc35f9f9384ba92ea17c5