Analysis
-
max time kernel
60s -
max time network
62s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
26-01-2025 14:44
General
-
Target
2025-01-23_3b7bbcc792998c87d854a9587d066d2e_darkside.exe
-
Size
160KB
-
MD5
3b7bbcc792998c87d854a9587d066d2e
-
SHA1
0b3e8f3c71d3fbfa02ad9cef1f3cbaa83c8d2621
-
SHA256
130d6de205082cf8be9c58f327f84080af79f2ebf6f50c83e23aa142f2247cd8
-
SHA512
56d74eef6efb89837c048b1aa91358749992c1e41bc82fe646924efb16c7e32a1d4eeaeeb7d82a0a49314a4f3c47b909e7b1271acb40d1ae8d1c1755c8929ee7
-
SSDEEP
3072:TDDDDDDDDDDDDDDDDDDDE45d/t6sVkgZqltP3368enHx6A2eyKQnWwAYEW:95d/zugZqll30Hw3eyZWwAY
Malware Config
Signatures
-
Renames multiple (147) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
-
Deletes itself 1 IoCs
-
Executes dropped EXE 1 IoCs
-
Drops desktop.ini file(s) 2 IoCs
-
Indicator Removal: File Deletion 1 TTPs
Adversaries may delete files left behind by the actions of their intrusion activity.
-
Drops file in System32 directory 4 IoCs
-
Sets desktop wallpaper using registry 2 TTPs 2 IoCs
-
Suspicious use of NtSetInformationThreadHideFromDebugger 12 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
-
Enumerates system info in registry 2 TTPs 3 IoCs
-
Modifies Control Panel 2 IoCs
-
Modifies registry class 5 IoCs
-
Opens file in notepad (likely ransom note) 1 IoCs
-
Suspicious behavior: AddClipboardFormatListener 2 IoCs
-
Suspicious behavior: EnumeratesProcesses 14 IoCs
-
Suspicious behavior: RenamesItself 26 IoCs
-
Suspicious use of AdjustPrivilegeToken 64 IoCs
-
Suspicious use of SetWindowsHookEx 14 IoCs
-
Suspicious use of WriteProcessMemory 11 IoCs
-
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\2025-01-23_3b7bbcc792998c87d854a9587d066d2e_darkside.exe"C:\Users\Admin\AppData\Local\Temp\2025-01-23_3b7bbcc792998c87d854a9587d066d2e_darkside.exe"1⤵
- Drops desktop.ini file(s)
- Sets desktop wallpaper using registry
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Modifies Control Panel
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\splwow64.exeC:\Windows\splwow64.exe 122882⤵
- Drops file in System32 directory
-
-
C:\ProgramData\DAA2.tmp"C:\ProgramData\DAA2.tmp"2⤵
- Checks computer location settings
- Deletes itself
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C DEL /F /Q C:\PROGRA~3\DAA2.tmp >> NUL3⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k PrintWorkflow -s PrintWorkflowUserSvc1⤵
-
C:\Windows\system32\printfilterpipelinesvc.exeC:\Windows\system32\printfilterpipelinesvc.exe -Embedding1⤵
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Microsoft Office\root\Office16\ONENOTE.EXE/insertdoc "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\{ADA4E258-C1D2-4B8E-BEA4-728528574BD6}.xps" 1338237627817900002⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
-
-
C:\Windows\system32\NOTEPAD.EXE"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\PTfidxFX1.README.txt1⤵
- Opens file in notepad (likely ransom note)
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
129B
MD5a882ccb8e0238b4dc21036d0a6be96cd
SHA1ee6895a99ef658ff31552a112b55ff1577271258
SHA256248d36579edd20f93d470ff51b3cd3a0fe4626e6c9caa03d0a6f8f5245cd361d
SHA512a1826a5cd9b6f5405305696e99b83ee532a7161953a51e62152dafdf2deb8bb74fd42afd0e4fb0a8337311b3715245d069c25844a6d07ddc9280e742e8ca8ddc
-
Filesize
14KB
MD5294e9f64cb1642dd89229fff0592856b
SHA197b148c27f3da29ba7b18d6aee8a0db9102f47c9
SHA256917e115cc403e29b4388e0d175cbfac3e7e40ca1742299fbdb353847db2de7c2
SHA512b87d531890bf1577b9b4af41dddb2cdbbfa164cf197bd5987df3a3075983645a3acba443e289b7bfd338422978a104f55298fbfe346872de0895bde44adc89cf
-
Filesize
160KB
MD5356b3adea2d4bd91d1e8d6f563ac838d
SHA193c88ca513eef195fccdadd5c4b6a888cb59a589
SHA2565772ca71dc4e7c0e2131492a44083fd700c7a3c6da1e7497ed89f3299a768eab
SHA512b092618c01adbc233a7f316fde04aa53258857cad153c853f5aa96cd687fcc9fdef3c93f97d4b076493fb666b24cd39b24ece78766d6213572d402f29c88b954
-
Filesize
4KB
MD559f08b75a4492304f7f7a2be319027a8
SHA164d06c63773ef7978a5850ae12b0da569fa156be
SHA2569ecfcd0debb9022e9c598d965677d0a7d1da7d5e70307aa8233c0d08a323283c
SHA5127a9ba15b00b5c525dda600accd70ae3a463d24d5163bd559404109e376b70967f6de3e5c2b3622a7b52f7deffd0854f1052fd82ab56b80e6caf9f2053841dda2
-
Filesize
6KB
MD547dffad0de54dc76bac5f5e4e29636e7
SHA1ec7d98ac21e437d5d94500a41faadcfa6f5a4acc
SHA256fdbc7381e08647cdae213c57b8e191d16a87c1c1536382043345bf5a6abac1bf
SHA5128632ed8bb9d4ddcdbf667216c1b4b962275837eaff8a66002c001fc0f5ef997305cb4e04fd68feea32b5401bd9a91fa207feadaf50d61bde3f985ccd085d9952
-
Filesize
129B
MD5de0c4e27409a2c55c518e4441479b400
SHA11e2501c7ea70ec2e612a0abf1ceb7ee50ee25959
SHA2563e3c54a0174c2b01c47ba1432b9c0ab91a22af1a65531ce6a2ca6dbf9edb6994
SHA5122c3b0f0bce62410c22ef9980ae657bd7b4f20b3e4cf26de7c4468e68b5e0b0dc36915972317f2183ff95ad816e16558a5d74518b61400319354f600fc6fe8b8b
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB