Malware Analysis Report

2025-05-05 20:48

Sample ID 250417-r57bya1k15
Target 2025-04-17_a40bbbdc17f188eb906dc09cb0556bc6_darkside_elex_lockbit
SHA256 251297b055aa4decdab1a1d8e14ea1331bcbe00974515a647f55b0e0c23e29f5
Tags
lockbit defense_evasion discovery ransomware spyware stealer
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V16

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

251297b055aa4decdab1a1d8e14ea1331bcbe00974515a647f55b0e0c23e29f5

Threat Level: Known bad

The file 2025-04-17_a40bbbdc17f188eb906dc09cb0556bc6_darkside_elex_lockbit was found to be: Known bad.

Malicious Activity Summary

lockbit defense_evasion discovery ransomware spyware stealer

Lockbit

Rule to detect Lockbit 3.0 ransomware Windows payload

Lockbit family

Renames multiple (548) files with added filename extension

Renames multiple (658) files with added filename extension

Deletes itself

Reads user/profile data of web browsers

Checks computer location settings

Executes dropped EXE

Drops desktop.ini file(s)

Indicator Removal: File Deletion

Suspicious use of NtSetInformationThreadHideFromDebugger

Sets desktop wallpaper using registry

Drops file in System32 directory

System Location Discovery: System Language Discovery

Unsigned PE

Enumerates physical storage devices

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

Suspicious behavior: RenamesItself

Suspicious use of SetWindowsHookEx

Suspicious behavior: EnumeratesProcesses

Modifies registry class

Modifies Control Panel

Enumerates system info in registry

Checks processor information in registry

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2025-04-17 14:47

Signatures

Lockbit family

lockbit

Rule to detect Lockbit 3.0 ransomware Windows payload

Description Indicator Process Target
N/A N/A N/A N/A

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2025-04-17 14:47

Reported

2025-04-17 14:50

Platform

win10v2004-20250410-en

Max time kernel

102s

Max time network

129s

Command Line

"C:\Users\Admin\AppData\Local\Temp\2025-04-17_a40bbbdc17f188eb906dc09cb0556bc6_darkside_elex_lockbit.exe"

Signatures

Lockbit

ransomware lockbit

Lockbit family

lockbit

Renames multiple (658) files with added filename extension

ransomware

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-3630502724-2561614198-3854231964-1000\Control Panel\International\Geo\Nation C:\ProgramData\9D89.tmp N/A

Deletes itself

Description Indicator Process Target
N/A N/A C:\ProgramData\9D89.tmp N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\ProgramData\9D89.tmp N/A

Reads user/profile data of web browsers

spyware stealer

Drops desktop.ini file(s)

Description Indicator Process Target
File opened for modification C:\$Recycle.Bin\S-1-5-21-3630502724-2561614198-3854231964-1000\desktop.ini C:\Users\Admin\AppData\Local\Temp\2025-04-17_a40bbbdc17f188eb906dc09cb0556bc6_darkside_elex_lockbit.exe N/A
File opened for modification F:\$RECYCLE.BIN\S-1-5-21-3630502724-2561614198-3854231964-1000\desktop.ini C:\Users\Admin\AppData\Local\Temp\2025-04-17_a40bbbdc17f188eb906dc09cb0556bc6_darkside_elex_lockbit.exe N/A

Indicator Removal: File Deletion

defense_evasion

Drops file in System32 directory

Description Indicator Process Target
File created C:\Windows\system32\spool\PRINTERS\00002.SPL C:\Windows\splwow64.exe N/A
File created C:\Windows\system32\spool\PRINTERS\PPjfs4_t5sqdhhgevmx8u7adaae.TMP C:\Windows\system32\printfilterpipelinesvc.exe N/A
File created C:\Windows\system32\spool\PRINTERS\PP01l6g33w49bibyqjv4b8frgic.TMP C:\Windows\system32\printfilterpipelinesvc.exe N/A
File created C:\Windows\system32\spool\PRINTERS\PPwd43zaoi3z6sv2l8yd7gl31kd.TMP C:\Windows\system32\printfilterpipelinesvc.exe N/A

Sets desktop wallpaper using registry

ransomware
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-3630502724-2561614198-3854231964-1000\Control Panel\Desktop\WallPaper = "C:\\ProgramData\\ryNlsace9.bmp" C:\Users\Admin\AppData\Local\Temp\2025-04-17_a40bbbdc17f188eb906dc09cb0556bc6_darkside_elex_lockbit.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-3630502724-2561614198-3854231964-1000\Control Panel\Desktop\Wallpaper = "C:\\ProgramData\\ryNlsace9.bmp" C:\Users\Admin\AppData\Local\Temp\2025-04-17_a40bbbdc17f188eb906dc09cb0556bc6_darkside_elex_lockbit.exe N/A

Suspicious use of NtSetInformationThreadHideFromDebugger

Description Indicator Process Target
N/A N/A C:\ProgramData\9D89.tmp N/A

Enumerates physical storage devices

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\2025-04-17_a40bbbdc17f188eb906dc09cb0556bc6_darkside_elex_lockbit.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\ProgramData\9D89.tmp N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A

Checks processor information in registry

Description Indicator Process Target
Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 C:\Program Files\Microsoft Office\root\Office16\ONENOTE.EXE N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz C:\Program Files\Microsoft Office\root\Office16\ONENOTE.EXE N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString C:\Program Files\Microsoft Office\root\Office16\ONENOTE.EXE N/A

Enumerates system info in registry

Description Indicator Process Target
Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS C:\Program Files\Microsoft Office\root\Office16\ONENOTE.EXE N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily C:\Program Files\Microsoft Office\root\Office16\ONENOTE.EXE N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU C:\Program Files\Microsoft Office\root\Office16\ONENOTE.EXE N/A

Modifies Control Panel

defense_evasion
Description Indicator Process Target
Key created \REGISTRY\USER\S-1-5-21-3630502724-2561614198-3854231964-1000\Control Panel\Desktop C:\Users\Admin\AppData\Local\Temp\2025-04-17_a40bbbdc17f188eb906dc09cb0556bc6_darkside_elex_lockbit.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-3630502724-2561614198-3854231964-1000\Control Panel\Desktop\WallpaperStyle = "10" C:\Users\Admin\AppData\Local\Temp\2025-04-17_a40bbbdc17f188eb906dc09cb0556bc6_darkside_elex_lockbit.exe N/A

Modifies registry class

Description Indicator Process Target
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.ryNlsace9 C:\Users\Admin\AppData\Local\Temp\2025-04-17_a40bbbdc17f188eb906dc09cb0556bc6_darkside_elex_lockbit.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.ryNlsace9\ = "ryNlsace9" C:\Users\Admin\AppData\Local\Temp\2025-04-17_a40bbbdc17f188eb906dc09cb0556bc6_darkside_elex_lockbit.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\ryNlsace9\DefaultIcon C:\Users\Admin\AppData\Local\Temp\2025-04-17_a40bbbdc17f188eb906dc09cb0556bc6_darkside_elex_lockbit.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\ryNlsace9 C:\Users\Admin\AppData\Local\Temp\2025-04-17_a40bbbdc17f188eb906dc09cb0556bc6_darkside_elex_lockbit.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\ryNlsace9\DefaultIcon\ = "C:\\ProgramData\\ryNlsace9.ico" C:\Users\Admin\AppData\Local\Temp\2025-04-17_a40bbbdc17f188eb906dc09cb0556bc6_darkside_elex_lockbit.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\2025-04-17_a40bbbdc17f188eb906dc09cb0556bc6_darkside_elex_lockbit.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2025-04-17_a40bbbdc17f188eb906dc09cb0556bc6_darkside_elex_lockbit.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2025-04-17_a40bbbdc17f188eb906dc09cb0556bc6_darkside_elex_lockbit.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2025-04-17_a40bbbdc17f188eb906dc09cb0556bc6_darkside_elex_lockbit.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2025-04-17_a40bbbdc17f188eb906dc09cb0556bc6_darkside_elex_lockbit.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2025-04-17_a40bbbdc17f188eb906dc09cb0556bc6_darkside_elex_lockbit.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2025-04-17_a40bbbdc17f188eb906dc09cb0556bc6_darkside_elex_lockbit.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2025-04-17_a40bbbdc17f188eb906dc09cb0556bc6_darkside_elex_lockbit.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2025-04-17_a40bbbdc17f188eb906dc09cb0556bc6_darkside_elex_lockbit.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2025-04-17_a40bbbdc17f188eb906dc09cb0556bc6_darkside_elex_lockbit.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2025-04-17_a40bbbdc17f188eb906dc09cb0556bc6_darkside_elex_lockbit.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2025-04-17_a40bbbdc17f188eb906dc09cb0556bc6_darkside_elex_lockbit.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2025-04-17_a40bbbdc17f188eb906dc09cb0556bc6_darkside_elex_lockbit.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2025-04-17_a40bbbdc17f188eb906dc09cb0556bc6_darkside_elex_lockbit.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2025-04-17_a40bbbdc17f188eb906dc09cb0556bc6_darkside_elex_lockbit.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2025-04-17_a40bbbdc17f188eb906dc09cb0556bc6_darkside_elex_lockbit.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2025-04-17_a40bbbdc17f188eb906dc09cb0556bc6_darkside_elex_lockbit.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2025-04-17_a40bbbdc17f188eb906dc09cb0556bc6_darkside_elex_lockbit.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2025-04-17_a40bbbdc17f188eb906dc09cb0556bc6_darkside_elex_lockbit.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2025-04-17_a40bbbdc17f188eb906dc09cb0556bc6_darkside_elex_lockbit.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2025-04-17_a40bbbdc17f188eb906dc09cb0556bc6_darkside_elex_lockbit.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2025-04-17_a40bbbdc17f188eb906dc09cb0556bc6_darkside_elex_lockbit.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2025-04-17_a40bbbdc17f188eb906dc09cb0556bc6_darkside_elex_lockbit.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2025-04-17_a40bbbdc17f188eb906dc09cb0556bc6_darkside_elex_lockbit.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2025-04-17_a40bbbdc17f188eb906dc09cb0556bc6_darkside_elex_lockbit.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2025-04-17_a40bbbdc17f188eb906dc09cb0556bc6_darkside_elex_lockbit.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2025-04-17_a40bbbdc17f188eb906dc09cb0556bc6_darkside_elex_lockbit.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2025-04-17_a40bbbdc17f188eb906dc09cb0556bc6_darkside_elex_lockbit.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2025-04-17_a40bbbdc17f188eb906dc09cb0556bc6_darkside_elex_lockbit.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2025-04-17_a40bbbdc17f188eb906dc09cb0556bc6_darkside_elex_lockbit.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2025-04-17_a40bbbdc17f188eb906dc09cb0556bc6_darkside_elex_lockbit.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2025-04-17_a40bbbdc17f188eb906dc09cb0556bc6_darkside_elex_lockbit.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2025-04-17_a40bbbdc17f188eb906dc09cb0556bc6_darkside_elex_lockbit.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2025-04-17_a40bbbdc17f188eb906dc09cb0556bc6_darkside_elex_lockbit.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2025-04-17_a40bbbdc17f188eb906dc09cb0556bc6_darkside_elex_lockbit.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2025-04-17_a40bbbdc17f188eb906dc09cb0556bc6_darkside_elex_lockbit.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2025-04-17_a40bbbdc17f188eb906dc09cb0556bc6_darkside_elex_lockbit.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2025-04-17_a40bbbdc17f188eb906dc09cb0556bc6_darkside_elex_lockbit.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2025-04-17_a40bbbdc17f188eb906dc09cb0556bc6_darkside_elex_lockbit.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2025-04-17_a40bbbdc17f188eb906dc09cb0556bc6_darkside_elex_lockbit.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2025-04-17_a40bbbdc17f188eb906dc09cb0556bc6_darkside_elex_lockbit.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2025-04-17_a40bbbdc17f188eb906dc09cb0556bc6_darkside_elex_lockbit.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2025-04-17_a40bbbdc17f188eb906dc09cb0556bc6_darkside_elex_lockbit.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2025-04-17_a40bbbdc17f188eb906dc09cb0556bc6_darkside_elex_lockbit.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2025-04-17_a40bbbdc17f188eb906dc09cb0556bc6_darkside_elex_lockbit.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2025-04-17_a40bbbdc17f188eb906dc09cb0556bc6_darkside_elex_lockbit.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2025-04-17_a40bbbdc17f188eb906dc09cb0556bc6_darkside_elex_lockbit.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2025-04-17_a40bbbdc17f188eb906dc09cb0556bc6_darkside_elex_lockbit.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2025-04-17_a40bbbdc17f188eb906dc09cb0556bc6_darkside_elex_lockbit.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2025-04-17_a40bbbdc17f188eb906dc09cb0556bc6_darkside_elex_lockbit.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2025-04-17_a40bbbdc17f188eb906dc09cb0556bc6_darkside_elex_lockbit.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2025-04-17_a40bbbdc17f188eb906dc09cb0556bc6_darkside_elex_lockbit.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2025-04-17_a40bbbdc17f188eb906dc09cb0556bc6_darkside_elex_lockbit.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2025-04-17_a40bbbdc17f188eb906dc09cb0556bc6_darkside_elex_lockbit.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2025-04-17_a40bbbdc17f188eb906dc09cb0556bc6_darkside_elex_lockbit.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2025-04-17_a40bbbdc17f188eb906dc09cb0556bc6_darkside_elex_lockbit.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2025-04-17_a40bbbdc17f188eb906dc09cb0556bc6_darkside_elex_lockbit.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2025-04-17_a40bbbdc17f188eb906dc09cb0556bc6_darkside_elex_lockbit.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2025-04-17_a40bbbdc17f188eb906dc09cb0556bc6_darkside_elex_lockbit.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2025-04-17_a40bbbdc17f188eb906dc09cb0556bc6_darkside_elex_lockbit.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2025-04-17_a40bbbdc17f188eb906dc09cb0556bc6_darkside_elex_lockbit.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2025-04-17_a40bbbdc17f188eb906dc09cb0556bc6_darkside_elex_lockbit.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2025-04-17_a40bbbdc17f188eb906dc09cb0556bc6_darkside_elex_lockbit.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2025-04-17_a40bbbdc17f188eb906dc09cb0556bc6_darkside_elex_lockbit.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeAssignPrimaryTokenPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2025-04-17_a40bbbdc17f188eb906dc09cb0556bc6_darkside_elex_lockbit.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2025-04-17_a40bbbdc17f188eb906dc09cb0556bc6_darkside_elex_lockbit.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2025-04-17_a40bbbdc17f188eb906dc09cb0556bc6_darkside_elex_lockbit.exe N/A
Token: 36 N/A C:\Users\Admin\AppData\Local\Temp\2025-04-17_a40bbbdc17f188eb906dc09cb0556bc6_darkside_elex_lockbit.exe N/A
Token: SeImpersonatePrivilege N/A C:\Users\Admin\AppData\Local\Temp\2025-04-17_a40bbbdc17f188eb906dc09cb0556bc6_darkside_elex_lockbit.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2025-04-17_a40bbbdc17f188eb906dc09cb0556bc6_darkside_elex_lockbit.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2025-04-17_a40bbbdc17f188eb906dc09cb0556bc6_darkside_elex_lockbit.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Local\Temp\2025-04-17_a40bbbdc17f188eb906dc09cb0556bc6_darkside_elex_lockbit.exe N/A
Token: SeManageVolumePrivilege N/A C:\Users\Admin\AppData\Local\Temp\2025-04-17_a40bbbdc17f188eb906dc09cb0556bc6_darkside_elex_lockbit.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2025-04-17_a40bbbdc17f188eb906dc09cb0556bc6_darkside_elex_lockbit.exe N/A
Token: SeRestorePrivilege N/A C:\Users\Admin\AppData\Local\Temp\2025-04-17_a40bbbdc17f188eb906dc09cb0556bc6_darkside_elex_lockbit.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2025-04-17_a40bbbdc17f188eb906dc09cb0556bc6_darkside_elex_lockbit.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Users\Admin\AppData\Local\Temp\2025-04-17_a40bbbdc17f188eb906dc09cb0556bc6_darkside_elex_lockbit.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2025-04-17_a40bbbdc17f188eb906dc09cb0556bc6_darkside_elex_lockbit.exe N/A
Token: SeShutdownPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2025-04-17_a40bbbdc17f188eb906dc09cb0556bc6_darkside_elex_lockbit.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2025-04-17_a40bbbdc17f188eb906dc09cb0556bc6_darkside_elex_lockbit.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2025-04-17_a40bbbdc17f188eb906dc09cb0556bc6_darkside_elex_lockbit.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2025-04-17_a40bbbdc17f188eb906dc09cb0556bc6_darkside_elex_lockbit.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2025-04-17_a40bbbdc17f188eb906dc09cb0556bc6_darkside_elex_lockbit.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2025-04-17_a40bbbdc17f188eb906dc09cb0556bc6_darkside_elex_lockbit.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2025-04-17_a40bbbdc17f188eb906dc09cb0556bc6_darkside_elex_lockbit.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2025-04-17_a40bbbdc17f188eb906dc09cb0556bc6_darkside_elex_lockbit.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2025-04-17_a40bbbdc17f188eb906dc09cb0556bc6_darkside_elex_lockbit.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2025-04-17_a40bbbdc17f188eb906dc09cb0556bc6_darkside_elex_lockbit.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2025-04-17_a40bbbdc17f188eb906dc09cb0556bc6_darkside_elex_lockbit.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2025-04-17_a40bbbdc17f188eb906dc09cb0556bc6_darkside_elex_lockbit.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2025-04-17_a40bbbdc17f188eb906dc09cb0556bc6_darkside_elex_lockbit.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2025-04-17_a40bbbdc17f188eb906dc09cb0556bc6_darkside_elex_lockbit.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2025-04-17_a40bbbdc17f188eb906dc09cb0556bc6_darkside_elex_lockbit.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2025-04-17_a40bbbdc17f188eb906dc09cb0556bc6_darkside_elex_lockbit.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2025-04-17_a40bbbdc17f188eb906dc09cb0556bc6_darkside_elex_lockbit.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2025-04-17_a40bbbdc17f188eb906dc09cb0556bc6_darkside_elex_lockbit.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2025-04-17_a40bbbdc17f188eb906dc09cb0556bc6_darkside_elex_lockbit.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2025-04-17_a40bbbdc17f188eb906dc09cb0556bc6_darkside_elex_lockbit.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2025-04-17_a40bbbdc17f188eb906dc09cb0556bc6_darkside_elex_lockbit.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2025-04-17_a40bbbdc17f188eb906dc09cb0556bc6_darkside_elex_lockbit.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2025-04-17_a40bbbdc17f188eb906dc09cb0556bc6_darkside_elex_lockbit.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2025-04-17_a40bbbdc17f188eb906dc09cb0556bc6_darkside_elex_lockbit.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2025-04-17_a40bbbdc17f188eb906dc09cb0556bc6_darkside_elex_lockbit.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2025-04-17_a40bbbdc17f188eb906dc09cb0556bc6_darkside_elex_lockbit.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2025-04-17_a40bbbdc17f188eb906dc09cb0556bc6_darkside_elex_lockbit.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2025-04-17_a40bbbdc17f188eb906dc09cb0556bc6_darkside_elex_lockbit.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2025-04-17_a40bbbdc17f188eb906dc09cb0556bc6_darkside_elex_lockbit.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2025-04-17_a40bbbdc17f188eb906dc09cb0556bc6_darkside_elex_lockbit.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2025-04-17_a40bbbdc17f188eb906dc09cb0556bc6_darkside_elex_lockbit.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2025-04-17_a40bbbdc17f188eb906dc09cb0556bc6_darkside_elex_lockbit.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2025-04-17_a40bbbdc17f188eb906dc09cb0556bc6_darkside_elex_lockbit.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2025-04-17_a40bbbdc17f188eb906dc09cb0556bc6_darkside_elex_lockbit.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2025-04-17_a40bbbdc17f188eb906dc09cb0556bc6_darkside_elex_lockbit.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2025-04-17_a40bbbdc17f188eb906dc09cb0556bc6_darkside_elex_lockbit.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2025-04-17_a40bbbdc17f188eb906dc09cb0556bc6_darkside_elex_lockbit.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2025-04-17_a40bbbdc17f188eb906dc09cb0556bc6_darkside_elex_lockbit.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2025-04-17_a40bbbdc17f188eb906dc09cb0556bc6_darkside_elex_lockbit.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2025-04-17_a40bbbdc17f188eb906dc09cb0556bc6_darkside_elex_lockbit.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2025-04-17_a40bbbdc17f188eb906dc09cb0556bc6_darkside_elex_lockbit.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2025-04-17_a40bbbdc17f188eb906dc09cb0556bc6_darkside_elex_lockbit.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2025-04-17_a40bbbdc17f188eb906dc09cb0556bc6_darkside_elex_lockbit.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2025-04-17_a40bbbdc17f188eb906dc09cb0556bc6_darkside_elex_lockbit.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2025-04-17_a40bbbdc17f188eb906dc09cb0556bc6_darkside_elex_lockbit.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2025-04-17_a40bbbdc17f188eb906dc09cb0556bc6_darkside_elex_lockbit.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2025-04-17_a40bbbdc17f188eb906dc09cb0556bc6_darkside_elex_lockbit.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2025-04-17_a40bbbdc17f188eb906dc09cb0556bc6_darkside_elex_lockbit.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2025-04-17_a40bbbdc17f188eb906dc09cb0556bc6_darkside_elex_lockbit.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2025-04-17_a40bbbdc17f188eb906dc09cb0556bc6_darkside_elex_lockbit.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 5224 wrote to memory of 4548 N/A C:\Users\Admin\AppData\Local\Temp\2025-04-17_a40bbbdc17f188eb906dc09cb0556bc6_darkside_elex_lockbit.exe C:\Windows\splwow64.exe
PID 5224 wrote to memory of 4548 N/A C:\Users\Admin\AppData\Local\Temp\2025-04-17_a40bbbdc17f188eb906dc09cb0556bc6_darkside_elex_lockbit.exe C:\Windows\splwow64.exe
PID 512 wrote to memory of 5844 N/A C:\Windows\system32\printfilterpipelinesvc.exe C:\Program Files\Microsoft Office\root\Office16\ONENOTE.EXE
PID 512 wrote to memory of 5844 N/A C:\Windows\system32\printfilterpipelinesvc.exe C:\Program Files\Microsoft Office\root\Office16\ONENOTE.EXE
PID 5224 wrote to memory of 5072 N/A C:\Users\Admin\AppData\Local\Temp\2025-04-17_a40bbbdc17f188eb906dc09cb0556bc6_darkside_elex_lockbit.exe C:\ProgramData\9D89.tmp
PID 5224 wrote to memory of 5072 N/A C:\Users\Admin\AppData\Local\Temp\2025-04-17_a40bbbdc17f188eb906dc09cb0556bc6_darkside_elex_lockbit.exe C:\ProgramData\9D89.tmp
PID 5224 wrote to memory of 5072 N/A C:\Users\Admin\AppData\Local\Temp\2025-04-17_a40bbbdc17f188eb906dc09cb0556bc6_darkside_elex_lockbit.exe C:\ProgramData\9D89.tmp
PID 5224 wrote to memory of 5072 N/A C:\Users\Admin\AppData\Local\Temp\2025-04-17_a40bbbdc17f188eb906dc09cb0556bc6_darkside_elex_lockbit.exe C:\ProgramData\9D89.tmp
PID 5072 wrote to memory of 3720 N/A C:\ProgramData\9D89.tmp C:\Windows\SysWOW64\cmd.exe
PID 5072 wrote to memory of 3720 N/A C:\ProgramData\9D89.tmp C:\Windows\SysWOW64\cmd.exe
PID 5072 wrote to memory of 3720 N/A C:\ProgramData\9D89.tmp C:\Windows\SysWOW64\cmd.exe

Processes

C:\Users\Admin\AppData\Local\Temp\2025-04-17_a40bbbdc17f188eb906dc09cb0556bc6_darkside_elex_lockbit.exe

"C:\Users\Admin\AppData\Local\Temp\2025-04-17_a40bbbdc17f188eb906dc09cb0556bc6_darkside_elex_lockbit.exe"

C:\Windows\splwow64.exe

C:\Windows\splwow64.exe 12288

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k PrintWorkflow -s PrintWorkflowUserSvc

C:\Windows\system32\printfilterpipelinesvc.exe

C:\Windows\system32\printfilterpipelinesvc.exe -Embedding

C:\Program Files\Microsoft Office\root\Office16\ONENOTE.EXE

/insertdoc "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\{9F145DB6-A5A7-44F5-B55F-0BAA80895658}.xps" 133893748731780000

C:\ProgramData\9D89.tmp

"C:\ProgramData\9D89.tmp"

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /C DEL /F /Q C:\PROGRA~3\9D89.tmp >> NUL

Network

Country Destination Domain Proto
US 8.8.8.8:53 c.pki.goog udp
NL 173.194.69.94:80 c.pki.goog tcp

Files

memory/5224-2-0x0000000002F10000-0x0000000002F20000-memory.dmp

memory/5224-0-0x0000000002F10000-0x0000000002F20000-memory.dmp

memory/5224-1-0x0000000002F10000-0x0000000002F20000-memory.dmp

C:\$Recycle.Bin\S-1-5-21-3630502724-2561614198-3854231964-1000\XXXXXXXXXXX

MD5 051096a23fdb1707a1d0b9c92785fb2c
SHA1 949a6662a25d39374a8ac67ef6090072ff1fb166
SHA256 6f9f2af44823ec5925dca50e63059bf25cd0672f2e95720b8ffc5ffa234c4b13
SHA512 7eb243228acf0c155d4eb23ca2002138da53437052a0051b5289ddd1c461e79a6b964cd02c3ef4c10c596a19fb73d477a7a2ce10e60e76692507b15a0a31e72f

F:\$RECYCLE.BIN\S-1-5-21-3630502724-2561614198-3854231964-1000\DDDDDDDDDDD

MD5 91c2e2be400927cee551af06daf4468b
SHA1 321b3374210488d8b5d4d9bb3945ee92e4fc071a
SHA256 f9ee1977aff913b3d206d0c39f856e918997d201066d637e82795fb365a55cf1
SHA512 fba11dc92437a3d8a1a49863873038992d3f693e57c37fe90296666c236756cb44139f19bb93cd72acb60758159bc8b60d21adadfa0792333a668ef1b78eedf8

C:\ryNlsace9.README.txt

MD5 dd746ace17e44ace00885b91400f11d5
SHA1 4a0302d2dca400598f396e4230fdae71779cbeaa
SHA256 b27c3c8a30faf7c76483b7e5d964ae85046a9713caa46508ee7a1e31b7dc6272
SHA512 8ac26aa7262fdf1afdc74e604720a79ebde076c75f460d7d5f57ff4d81dedb1ad471eb114ddd428c1934029746f5c222339090680bc77a6ea09ce329e1da3ef1

memory/5224-3322-0x0000000002F10000-0x0000000002F20000-memory.dmp

memory/5224-3323-0x0000000002F10000-0x0000000002F20000-memory.dmp

memory/5224-3324-0x0000000002F10000-0x0000000002F20000-memory.dmp

C:\ProgramData\9D89.tmp

MD5 294e9f64cb1642dd89229fff0592856b
SHA1 97b148c27f3da29ba7b18d6aee8a0db9102f47c9
SHA256 917e115cc403e29b4388e0d175cbfac3e7e40ca1742299fbdb353847db2de7c2
SHA512 b87d531890bf1577b9b4af41dddb2cdbbfa164cf197bd5987df3a3075983645a3acba443e289b7bfd338422978a104f55298fbfe346872de0895bde44adc89cf

memory/5844-3340-0x00007FF9A4690000-0x00007FF9A46A0000-memory.dmp

memory/5844-3341-0x00007FF9A4690000-0x00007FF9A46A0000-memory.dmp

memory/5844-3342-0x00007FF9A4690000-0x00007FF9A46A0000-memory.dmp

memory/5844-3343-0x00007FF9A4690000-0x00007FF9A46A0000-memory.dmp

memory/5844-3344-0x00007FF9A4690000-0x00007FF9A46A0000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\DDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDD

MD5 62489e28ed9bc4742b7411e7790a044b
SHA1 64107ac0d45aafac5d3f4c46db3c31228641efd5
SHA256 2aab64f0533ef955108b7567207b710e10783a1061f2eda8c2869a609ff583ca
SHA512 7c8d11806ae0e49b69fe1ec98f4640d051fc975907d8572679773fd8c39070da84a38ed5c4a7957e42af980cee44832ed4d0aa2de17bbbab742d83a3b048e50b

memory/5844-3373-0x00007FF9A1EE0000-0x00007FF9A1EF0000-memory.dmp

memory/5844-3374-0x00007FF9A1EE0000-0x00007FF9A1EF0000-memory.dmp

C:\Users\Admin\Documents\OneNote Notebooks\My Notebook\Open Notebook.onetoc2

MD5 8b9e81755b0f9a83a780f78502cf7446
SHA1 0dd71ae0ca2fde9126f2fdf2c1f1809eddf5f430
SHA256 22964987df3bca416bb9b712fff85dc1b49f06b68d36e2c559eb973f59366e5e
SHA512 524287a4fa2b18cd0ce05d1f7f17a399acc96e8887daec85056f26f9d4853a9779910f5c7e1e8f38aabc9613ff38827b38a0c8652afb14eb17919d8b80995a59

Analysis: behavioral2

Detonation Overview

Submitted

2025-04-17 14:47

Reported

2025-04-17 14:50

Platform

win11-20250410-en

Max time kernel

147s

Max time network

147s

Command Line

"C:\Users\Admin\AppData\Local\Temp\2025-04-17_a40bbbdc17f188eb906dc09cb0556bc6_darkside_elex_lockbit.exe"

Signatures

Lockbit

ransomware lockbit

Lockbit family

lockbit

Renames multiple (548) files with added filename extension

ransomware

Deletes itself

Description Indicator Process Target
N/A N/A C:\ProgramData\D8CD.tmp N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\ProgramData\D8CD.tmp N/A

Reads user/profile data of web browsers

spyware stealer

Drops desktop.ini file(s)

Description Indicator Process Target
File opened for modification C:\$Recycle.Bin\S-1-5-21-2211465213-323295031-1970282057-1000\desktop.ini C:\Users\Admin\AppData\Local\Temp\2025-04-17_a40bbbdc17f188eb906dc09cb0556bc6_darkside_elex_lockbit.exe N/A
File opened for modification F:\$RECYCLE.BIN\S-1-5-21-2211465213-323295031-1970282057-1000\desktop.ini C:\Users\Admin\AppData\Local\Temp\2025-04-17_a40bbbdc17f188eb906dc09cb0556bc6_darkside_elex_lockbit.exe N/A

Indicator Removal: File Deletion

defense_evasion

Drops file in System32 directory

Description Indicator Process Target
File created C:\Windows\system32\spool\PRINTERS\00002.SPL C:\Windows\splwow64.exe N/A
File created C:\Windows\system32\spool\PRINTERS\PPmjeo7e92cxwelcqs74v64yl9c.TMP C:\Windows\system32\printfilterpipelinesvc.exe N/A
File created C:\Windows\system32\spool\PRINTERS\PPdczbfc057r1s2slz0yjmx1dy.TMP C:\Windows\system32\printfilterpipelinesvc.exe N/A
File created C:\Windows\system32\spool\PRINTERS\PPlf8xo3fwy6ngrch0h0d19093c.TMP C:\Windows\system32\printfilterpipelinesvc.exe N/A

Sets desktop wallpaper using registry

ransomware
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-2211465213-323295031-1970282057-1000\Control Panel\Desktop\Wallpaper = "C:\\ProgramData\\ryNlsace9.bmp" C:\Users\Admin\AppData\Local\Temp\2025-04-17_a40bbbdc17f188eb906dc09cb0556bc6_darkside_elex_lockbit.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-2211465213-323295031-1970282057-1000\Control Panel\Desktop\WallPaper = "C:\\ProgramData\\ryNlsace9.bmp" C:\Users\Admin\AppData\Local\Temp\2025-04-17_a40bbbdc17f188eb906dc09cb0556bc6_darkside_elex_lockbit.exe N/A

Suspicious use of NtSetInformationThreadHideFromDebugger

Description Indicator Process Target
N/A N/A C:\ProgramData\D8CD.tmp N/A

Enumerates physical storage devices

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\2025-04-17_a40bbbdc17f188eb906dc09cb0556bc6_darkside_elex_lockbit.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\ProgramData\D8CD.tmp N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A

Checks processor information in registry

Description Indicator Process Target
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString C:\Program Files\Microsoft Office\root\Office16\ONENOTE.EXE N/A
Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 C:\Program Files\Microsoft Office\root\Office16\ONENOTE.EXE N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz C:\Program Files\Microsoft Office\root\Office16\ONENOTE.EXE N/A

Enumerates system info in registry

Description Indicator Process Target
Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS C:\Program Files\Microsoft Office\root\Office16\ONENOTE.EXE N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily C:\Program Files\Microsoft Office\root\Office16\ONENOTE.EXE N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU C:\Program Files\Microsoft Office\root\Office16\ONENOTE.EXE N/A

Modifies Control Panel

defense_evasion
Description Indicator Process Target
Key created \REGISTRY\USER\S-1-5-21-2211465213-323295031-1970282057-1000\Control Panel\Desktop C:\Users\Admin\AppData\Local\Temp\2025-04-17_a40bbbdc17f188eb906dc09cb0556bc6_darkside_elex_lockbit.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-2211465213-323295031-1970282057-1000\Control Panel\Desktop\WallpaperStyle = "10" C:\Users\Admin\AppData\Local\Temp\2025-04-17_a40bbbdc17f188eb906dc09cb0556bc6_darkside_elex_lockbit.exe N/A

Modifies registry class

Description Indicator Process Target
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.ryNlsace9 C:\Users\Admin\AppData\Local\Temp\2025-04-17_a40bbbdc17f188eb906dc09cb0556bc6_darkside_elex_lockbit.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.ryNlsace9\ = "ryNlsace9" C:\Users\Admin\AppData\Local\Temp\2025-04-17_a40bbbdc17f188eb906dc09cb0556bc6_darkside_elex_lockbit.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\ryNlsace9\DefaultIcon C:\Users\Admin\AppData\Local\Temp\2025-04-17_a40bbbdc17f188eb906dc09cb0556bc6_darkside_elex_lockbit.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\ryNlsace9 C:\Users\Admin\AppData\Local\Temp\2025-04-17_a40bbbdc17f188eb906dc09cb0556bc6_darkside_elex_lockbit.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\ryNlsace9\DefaultIcon\ = "C:\\ProgramData\\ryNlsace9.ico" C:\Users\Admin\AppData\Local\Temp\2025-04-17_a40bbbdc17f188eb906dc09cb0556bc6_darkside_elex_lockbit.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\2025-04-17_a40bbbdc17f188eb906dc09cb0556bc6_darkside_elex_lockbit.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2025-04-17_a40bbbdc17f188eb906dc09cb0556bc6_darkside_elex_lockbit.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2025-04-17_a40bbbdc17f188eb906dc09cb0556bc6_darkside_elex_lockbit.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2025-04-17_a40bbbdc17f188eb906dc09cb0556bc6_darkside_elex_lockbit.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2025-04-17_a40bbbdc17f188eb906dc09cb0556bc6_darkside_elex_lockbit.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2025-04-17_a40bbbdc17f188eb906dc09cb0556bc6_darkside_elex_lockbit.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2025-04-17_a40bbbdc17f188eb906dc09cb0556bc6_darkside_elex_lockbit.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2025-04-17_a40bbbdc17f188eb906dc09cb0556bc6_darkside_elex_lockbit.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2025-04-17_a40bbbdc17f188eb906dc09cb0556bc6_darkside_elex_lockbit.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2025-04-17_a40bbbdc17f188eb906dc09cb0556bc6_darkside_elex_lockbit.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2025-04-17_a40bbbdc17f188eb906dc09cb0556bc6_darkside_elex_lockbit.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2025-04-17_a40bbbdc17f188eb906dc09cb0556bc6_darkside_elex_lockbit.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2025-04-17_a40bbbdc17f188eb906dc09cb0556bc6_darkside_elex_lockbit.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2025-04-17_a40bbbdc17f188eb906dc09cb0556bc6_darkside_elex_lockbit.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2025-04-17_a40bbbdc17f188eb906dc09cb0556bc6_darkside_elex_lockbit.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2025-04-17_a40bbbdc17f188eb906dc09cb0556bc6_darkside_elex_lockbit.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2025-04-17_a40bbbdc17f188eb906dc09cb0556bc6_darkside_elex_lockbit.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2025-04-17_a40bbbdc17f188eb906dc09cb0556bc6_darkside_elex_lockbit.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2025-04-17_a40bbbdc17f188eb906dc09cb0556bc6_darkside_elex_lockbit.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2025-04-17_a40bbbdc17f188eb906dc09cb0556bc6_darkside_elex_lockbit.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2025-04-17_a40bbbdc17f188eb906dc09cb0556bc6_darkside_elex_lockbit.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2025-04-17_a40bbbdc17f188eb906dc09cb0556bc6_darkside_elex_lockbit.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2025-04-17_a40bbbdc17f188eb906dc09cb0556bc6_darkside_elex_lockbit.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2025-04-17_a40bbbdc17f188eb906dc09cb0556bc6_darkside_elex_lockbit.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2025-04-17_a40bbbdc17f188eb906dc09cb0556bc6_darkside_elex_lockbit.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2025-04-17_a40bbbdc17f188eb906dc09cb0556bc6_darkside_elex_lockbit.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2025-04-17_a40bbbdc17f188eb906dc09cb0556bc6_darkside_elex_lockbit.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2025-04-17_a40bbbdc17f188eb906dc09cb0556bc6_darkside_elex_lockbit.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2025-04-17_a40bbbdc17f188eb906dc09cb0556bc6_darkside_elex_lockbit.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2025-04-17_a40bbbdc17f188eb906dc09cb0556bc6_darkside_elex_lockbit.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2025-04-17_a40bbbdc17f188eb906dc09cb0556bc6_darkside_elex_lockbit.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2025-04-17_a40bbbdc17f188eb906dc09cb0556bc6_darkside_elex_lockbit.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2025-04-17_a40bbbdc17f188eb906dc09cb0556bc6_darkside_elex_lockbit.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2025-04-17_a40bbbdc17f188eb906dc09cb0556bc6_darkside_elex_lockbit.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2025-04-17_a40bbbdc17f188eb906dc09cb0556bc6_darkside_elex_lockbit.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2025-04-17_a40bbbdc17f188eb906dc09cb0556bc6_darkside_elex_lockbit.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2025-04-17_a40bbbdc17f188eb906dc09cb0556bc6_darkside_elex_lockbit.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2025-04-17_a40bbbdc17f188eb906dc09cb0556bc6_darkside_elex_lockbit.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2025-04-17_a40bbbdc17f188eb906dc09cb0556bc6_darkside_elex_lockbit.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2025-04-17_a40bbbdc17f188eb906dc09cb0556bc6_darkside_elex_lockbit.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2025-04-17_a40bbbdc17f188eb906dc09cb0556bc6_darkside_elex_lockbit.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2025-04-17_a40bbbdc17f188eb906dc09cb0556bc6_darkside_elex_lockbit.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2025-04-17_a40bbbdc17f188eb906dc09cb0556bc6_darkside_elex_lockbit.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2025-04-17_a40bbbdc17f188eb906dc09cb0556bc6_darkside_elex_lockbit.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2025-04-17_a40bbbdc17f188eb906dc09cb0556bc6_darkside_elex_lockbit.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2025-04-17_a40bbbdc17f188eb906dc09cb0556bc6_darkside_elex_lockbit.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2025-04-17_a40bbbdc17f188eb906dc09cb0556bc6_darkside_elex_lockbit.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2025-04-17_a40bbbdc17f188eb906dc09cb0556bc6_darkside_elex_lockbit.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2025-04-17_a40bbbdc17f188eb906dc09cb0556bc6_darkside_elex_lockbit.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2025-04-17_a40bbbdc17f188eb906dc09cb0556bc6_darkside_elex_lockbit.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2025-04-17_a40bbbdc17f188eb906dc09cb0556bc6_darkside_elex_lockbit.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2025-04-17_a40bbbdc17f188eb906dc09cb0556bc6_darkside_elex_lockbit.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2025-04-17_a40bbbdc17f188eb906dc09cb0556bc6_darkside_elex_lockbit.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2025-04-17_a40bbbdc17f188eb906dc09cb0556bc6_darkside_elex_lockbit.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2025-04-17_a40bbbdc17f188eb906dc09cb0556bc6_darkside_elex_lockbit.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2025-04-17_a40bbbdc17f188eb906dc09cb0556bc6_darkside_elex_lockbit.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2025-04-17_a40bbbdc17f188eb906dc09cb0556bc6_darkside_elex_lockbit.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2025-04-17_a40bbbdc17f188eb906dc09cb0556bc6_darkside_elex_lockbit.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2025-04-17_a40bbbdc17f188eb906dc09cb0556bc6_darkside_elex_lockbit.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2025-04-17_a40bbbdc17f188eb906dc09cb0556bc6_darkside_elex_lockbit.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2025-04-17_a40bbbdc17f188eb906dc09cb0556bc6_darkside_elex_lockbit.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2025-04-17_a40bbbdc17f188eb906dc09cb0556bc6_darkside_elex_lockbit.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2025-04-17_a40bbbdc17f188eb906dc09cb0556bc6_darkside_elex_lockbit.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2025-04-17_a40bbbdc17f188eb906dc09cb0556bc6_darkside_elex_lockbit.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeAssignPrimaryTokenPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2025-04-17_a40bbbdc17f188eb906dc09cb0556bc6_darkside_elex_lockbit.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2025-04-17_a40bbbdc17f188eb906dc09cb0556bc6_darkside_elex_lockbit.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2025-04-17_a40bbbdc17f188eb906dc09cb0556bc6_darkside_elex_lockbit.exe N/A
Token: 36 N/A C:\Users\Admin\AppData\Local\Temp\2025-04-17_a40bbbdc17f188eb906dc09cb0556bc6_darkside_elex_lockbit.exe N/A
Token: SeImpersonatePrivilege N/A C:\Users\Admin\AppData\Local\Temp\2025-04-17_a40bbbdc17f188eb906dc09cb0556bc6_darkside_elex_lockbit.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2025-04-17_a40bbbdc17f188eb906dc09cb0556bc6_darkside_elex_lockbit.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2025-04-17_a40bbbdc17f188eb906dc09cb0556bc6_darkside_elex_lockbit.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Local\Temp\2025-04-17_a40bbbdc17f188eb906dc09cb0556bc6_darkside_elex_lockbit.exe N/A
Token: SeManageVolumePrivilege N/A C:\Users\Admin\AppData\Local\Temp\2025-04-17_a40bbbdc17f188eb906dc09cb0556bc6_darkside_elex_lockbit.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2025-04-17_a40bbbdc17f188eb906dc09cb0556bc6_darkside_elex_lockbit.exe N/A
Token: SeRestorePrivilege N/A C:\Users\Admin\AppData\Local\Temp\2025-04-17_a40bbbdc17f188eb906dc09cb0556bc6_darkside_elex_lockbit.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2025-04-17_a40bbbdc17f188eb906dc09cb0556bc6_darkside_elex_lockbit.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Users\Admin\AppData\Local\Temp\2025-04-17_a40bbbdc17f188eb906dc09cb0556bc6_darkside_elex_lockbit.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2025-04-17_a40bbbdc17f188eb906dc09cb0556bc6_darkside_elex_lockbit.exe N/A
Token: SeShutdownPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2025-04-17_a40bbbdc17f188eb906dc09cb0556bc6_darkside_elex_lockbit.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2025-04-17_a40bbbdc17f188eb906dc09cb0556bc6_darkside_elex_lockbit.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2025-04-17_a40bbbdc17f188eb906dc09cb0556bc6_darkside_elex_lockbit.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2025-04-17_a40bbbdc17f188eb906dc09cb0556bc6_darkside_elex_lockbit.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2025-04-17_a40bbbdc17f188eb906dc09cb0556bc6_darkside_elex_lockbit.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2025-04-17_a40bbbdc17f188eb906dc09cb0556bc6_darkside_elex_lockbit.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2025-04-17_a40bbbdc17f188eb906dc09cb0556bc6_darkside_elex_lockbit.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2025-04-17_a40bbbdc17f188eb906dc09cb0556bc6_darkside_elex_lockbit.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2025-04-17_a40bbbdc17f188eb906dc09cb0556bc6_darkside_elex_lockbit.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2025-04-17_a40bbbdc17f188eb906dc09cb0556bc6_darkside_elex_lockbit.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2025-04-17_a40bbbdc17f188eb906dc09cb0556bc6_darkside_elex_lockbit.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2025-04-17_a40bbbdc17f188eb906dc09cb0556bc6_darkside_elex_lockbit.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2025-04-17_a40bbbdc17f188eb906dc09cb0556bc6_darkside_elex_lockbit.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2025-04-17_a40bbbdc17f188eb906dc09cb0556bc6_darkside_elex_lockbit.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2025-04-17_a40bbbdc17f188eb906dc09cb0556bc6_darkside_elex_lockbit.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2025-04-17_a40bbbdc17f188eb906dc09cb0556bc6_darkside_elex_lockbit.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2025-04-17_a40bbbdc17f188eb906dc09cb0556bc6_darkside_elex_lockbit.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2025-04-17_a40bbbdc17f188eb906dc09cb0556bc6_darkside_elex_lockbit.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2025-04-17_a40bbbdc17f188eb906dc09cb0556bc6_darkside_elex_lockbit.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2025-04-17_a40bbbdc17f188eb906dc09cb0556bc6_darkside_elex_lockbit.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2025-04-17_a40bbbdc17f188eb906dc09cb0556bc6_darkside_elex_lockbit.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2025-04-17_a40bbbdc17f188eb906dc09cb0556bc6_darkside_elex_lockbit.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2025-04-17_a40bbbdc17f188eb906dc09cb0556bc6_darkside_elex_lockbit.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2025-04-17_a40bbbdc17f188eb906dc09cb0556bc6_darkside_elex_lockbit.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2025-04-17_a40bbbdc17f188eb906dc09cb0556bc6_darkside_elex_lockbit.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2025-04-17_a40bbbdc17f188eb906dc09cb0556bc6_darkside_elex_lockbit.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2025-04-17_a40bbbdc17f188eb906dc09cb0556bc6_darkside_elex_lockbit.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2025-04-17_a40bbbdc17f188eb906dc09cb0556bc6_darkside_elex_lockbit.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2025-04-17_a40bbbdc17f188eb906dc09cb0556bc6_darkside_elex_lockbit.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2025-04-17_a40bbbdc17f188eb906dc09cb0556bc6_darkside_elex_lockbit.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2025-04-17_a40bbbdc17f188eb906dc09cb0556bc6_darkside_elex_lockbit.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2025-04-17_a40bbbdc17f188eb906dc09cb0556bc6_darkside_elex_lockbit.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2025-04-17_a40bbbdc17f188eb906dc09cb0556bc6_darkside_elex_lockbit.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2025-04-17_a40bbbdc17f188eb906dc09cb0556bc6_darkside_elex_lockbit.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2025-04-17_a40bbbdc17f188eb906dc09cb0556bc6_darkside_elex_lockbit.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2025-04-17_a40bbbdc17f188eb906dc09cb0556bc6_darkside_elex_lockbit.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2025-04-17_a40bbbdc17f188eb906dc09cb0556bc6_darkside_elex_lockbit.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2025-04-17_a40bbbdc17f188eb906dc09cb0556bc6_darkside_elex_lockbit.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2025-04-17_a40bbbdc17f188eb906dc09cb0556bc6_darkside_elex_lockbit.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2025-04-17_a40bbbdc17f188eb906dc09cb0556bc6_darkside_elex_lockbit.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2025-04-17_a40bbbdc17f188eb906dc09cb0556bc6_darkside_elex_lockbit.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2025-04-17_a40bbbdc17f188eb906dc09cb0556bc6_darkside_elex_lockbit.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2025-04-17_a40bbbdc17f188eb906dc09cb0556bc6_darkside_elex_lockbit.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2025-04-17_a40bbbdc17f188eb906dc09cb0556bc6_darkside_elex_lockbit.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2025-04-17_a40bbbdc17f188eb906dc09cb0556bc6_darkside_elex_lockbit.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2025-04-17_a40bbbdc17f188eb906dc09cb0556bc6_darkside_elex_lockbit.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2025-04-17_a40bbbdc17f188eb906dc09cb0556bc6_darkside_elex_lockbit.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2025-04-17_a40bbbdc17f188eb906dc09cb0556bc6_darkside_elex_lockbit.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2025-04-17_a40bbbdc17f188eb906dc09cb0556bc6_darkside_elex_lockbit.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2025-04-17_a40bbbdc17f188eb906dc09cb0556bc6_darkside_elex_lockbit.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 1072 wrote to memory of 2536 N/A C:\Users\Admin\AppData\Local\Temp\2025-04-17_a40bbbdc17f188eb906dc09cb0556bc6_darkside_elex_lockbit.exe C:\Windows\splwow64.exe
PID 1072 wrote to memory of 2536 N/A C:\Users\Admin\AppData\Local\Temp\2025-04-17_a40bbbdc17f188eb906dc09cb0556bc6_darkside_elex_lockbit.exe C:\Windows\splwow64.exe
PID 1632 wrote to memory of 5668 N/A C:\Windows\system32\printfilterpipelinesvc.exe C:\Program Files\Microsoft Office\root\Office16\ONENOTE.EXE
PID 1632 wrote to memory of 5668 N/A C:\Windows\system32\printfilterpipelinesvc.exe C:\Program Files\Microsoft Office\root\Office16\ONENOTE.EXE
PID 1072 wrote to memory of 2512 N/A C:\Users\Admin\AppData\Local\Temp\2025-04-17_a40bbbdc17f188eb906dc09cb0556bc6_darkside_elex_lockbit.exe C:\ProgramData\D8CD.tmp
PID 1072 wrote to memory of 2512 N/A C:\Users\Admin\AppData\Local\Temp\2025-04-17_a40bbbdc17f188eb906dc09cb0556bc6_darkside_elex_lockbit.exe C:\ProgramData\D8CD.tmp
PID 1072 wrote to memory of 2512 N/A C:\Users\Admin\AppData\Local\Temp\2025-04-17_a40bbbdc17f188eb906dc09cb0556bc6_darkside_elex_lockbit.exe C:\ProgramData\D8CD.tmp
PID 1072 wrote to memory of 2512 N/A C:\Users\Admin\AppData\Local\Temp\2025-04-17_a40bbbdc17f188eb906dc09cb0556bc6_darkside_elex_lockbit.exe C:\ProgramData\D8CD.tmp
PID 2512 wrote to memory of 224 N/A C:\ProgramData\D8CD.tmp C:\Windows\SysWOW64\cmd.exe
PID 2512 wrote to memory of 224 N/A C:\ProgramData\D8CD.tmp C:\Windows\SysWOW64\cmd.exe
PID 2512 wrote to memory of 224 N/A C:\ProgramData\D8CD.tmp C:\Windows\SysWOW64\cmd.exe

Processes

C:\Users\Admin\AppData\Local\Temp\2025-04-17_a40bbbdc17f188eb906dc09cb0556bc6_darkside_elex_lockbit.exe

"C:\Users\Admin\AppData\Local\Temp\2025-04-17_a40bbbdc17f188eb906dc09cb0556bc6_darkside_elex_lockbit.exe"

C:\Windows\splwow64.exe

C:\Windows\splwow64.exe 12288

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k PrintWorkflow -s PrintWorkflowUserSvc

C:\Windows\system32\printfilterpipelinesvc.exe

C:\Windows\system32\printfilterpipelinesvc.exe -Embedding

C:\Program Files\Microsoft Office\root\Office16\ONENOTE.EXE

/insertdoc "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\{396F802C-5AD0-42F4-AC6D-341F303C780F}.xps" 133893748696820000

C:\ProgramData\D8CD.tmp

"C:\ProgramData\D8CD.tmp"

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /C DEL /F /Q C:\PROGRA~3\D8CD.tmp >> NUL

Network

Country Destination Domain Proto
NL 173.194.69.94:80 c.pki.goog tcp
US 52.111.229.48:443 tcp

Files

memory/1072-2-0x0000000002ED0000-0x0000000002EE0000-memory.dmp

memory/1072-1-0x0000000002ED0000-0x0000000002EE0000-memory.dmp

memory/1072-0-0x0000000002ED0000-0x0000000002EE0000-memory.dmp

C:\$Recycle.Bin\S-1-5-21-2211465213-323295031-1970282057-1000\DDDDDDDDDDD

MD5 5b29f8f875e5884cd50d2b0d78e11a4a
SHA1 506306954d75d9b10f3c0ed540ac1f5788f6f01a
SHA256 32ce674fb8b8783dc0dce03d5275bdc8d55fc1028a343be1783dc692e8cfa9f2
SHA512 9cccdd2f9af11b889a9ae1cc403ab4ab558e0013f3bf88a92d7486cf7ff08cc35590035e692ba87898ee6d5426bd00fc28e72ac048f79d2708a28318b50b59f6

C:\ryNlsace9.README.txt

MD5 dd746ace17e44ace00885b91400f11d5
SHA1 4a0302d2dca400598f396e4230fdae71779cbeaa
SHA256 b27c3c8a30faf7c76483b7e5d964ae85046a9713caa46508ee7a1e31b7dc6272
SHA512 8ac26aa7262fdf1afdc74e604720a79ebde076c75f460d7d5f57ff4d81dedb1ad471eb114ddd428c1934029746f5c222339090680bc77a6ea09ce329e1da3ef1

F:\$RECYCLE.BIN\S-1-5-21-2211465213-323295031-1970282057-1000\DDDDDDDDDDD

MD5 8cfa0036ead078efeaa13af7a1a9b251
SHA1 174c40b4ecd2aa0a00407d52238d6642817cd53d
SHA256 0637028e1c7e55ea425b8fb01346ce7641f728dbd148ed5374f635dd4bb055eb
SHA512 f5e89b522e18bc37e2b25e263eb1006474cd3bb2c7ebbabc483147ab7dbe508f4e59c67a9096d93e14278df47f39610d8f3096719b09159757c7edefbe7530ed

memory/1072-3694-0x0000000002ED0000-0x0000000002EE0000-memory.dmp

memory/1072-3695-0x0000000002ED0000-0x0000000002EE0000-memory.dmp

memory/1072-3696-0x0000000002ED0000-0x0000000002EE0000-memory.dmp

C:\ProgramData\D8CD.tmp

MD5 294e9f64cb1642dd89229fff0592856b
SHA1 97b148c27f3da29ba7b18d6aee8a0db9102f47c9
SHA256 917e115cc403e29b4388e0d175cbfac3e7e40ca1742299fbdb353847db2de7c2
SHA512 b87d531890bf1577b9b4af41dddb2cdbbfa164cf197bd5987df3a3075983645a3acba443e289b7bfd338422978a104f55298fbfe346872de0895bde44adc89cf

memory/5668-3712-0x00007FFA1BB90000-0x00007FFA1BBA0000-memory.dmp

memory/5668-3713-0x00007FFA1BB90000-0x00007FFA1BBA0000-memory.dmp

memory/5668-3715-0x00007FFA1BB90000-0x00007FFA1BBA0000-memory.dmp

memory/5668-3714-0x00007FFA1BB90000-0x00007FFA1BBA0000-memory.dmp

memory/5668-3716-0x00007FFA1BB90000-0x00007FFA1BBA0000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\EEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEE

MD5 6b151a0e40b16192f71111a1955f6cd8
SHA1 eae40d710c7a3380cbe139932ddceafed15cfb28
SHA256 6c600da172ca81b4de3465b49567a8418ae39e4f95a716b6c71ba7ad1e9453f3
SHA512 8fa184db60c31ff3ddb8dc59d3f49cf51a808df30de1ae896fc2f78b6bbd1ef34bb6023f466d5646c91ed28adb0be354221dd67d62e7a08746b0e2925da9a1c1

memory/5668-3745-0x00007FFA19500000-0x00007FFA19510000-memory.dmp

memory/5668-3746-0x00007FFA19500000-0x00007FFA19510000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\{59331D9A-B34B-4B38-8F0F-F72F95C89635}

MD5 aa80b83ca13191f59e4379bdfdabf870
SHA1 2695fd07e872a2bc2c424d6c2f0036a45ce3995f
SHA256 65586998772015a6c80d882928b5a4c1bfcc6da64f1b11324eeb34a4433645bc
SHA512 8b43d74a200fd98581d2275bdac1cccad77955dbe98abb0e42f114148d6ee6de61be6346894aa0f5f57f6142405437f653068058ed50c9f9942558b2447fc345

C:\Users\Admin\Documents\OneNote Notebooks\My Notebook\Open Notebook.onetoc2

MD5 2c0c4cba3d513ad56149bd5d25e7b922
SHA1 4f15bf945f1ab5c6d8901a58f158eab9fa4641c8
SHA256 01ebc0fa30c3f90486be974b2037eaa5756aa79b5cc992ab74b290990c09d343
SHA512 85676df3778a234acd1edd182e433e9d7ab474338d901781e7b81e4917d7ba361692693c304b57aa29fdab39f18eca87764e3365ea139f262b9832aedc64a24a