Malware Analysis Report

2025-05-05 20:48

Sample ID 250420-shvv3aywdz
Target 2025-04-20_971b1c13e0efcb5b4ff57b5c67dff89f_darkside_elex_lockbit
SHA256 f4b0e3079b13b0c117d358461348e4b15986b4b9173504605bc3035c53527df1
Tags
lockbit defense_evasion discovery ransomware spyware stealer
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V16

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

f4b0e3079b13b0c117d358461348e4b15986b4b9173504605bc3035c53527df1

Threat Level: Known bad

The file 2025-04-20_971b1c13e0efcb5b4ff57b5c67dff89f_darkside_elex_lockbit was found to be: Known bad.

Malicious Activity Summary

lockbit defense_evasion discovery ransomware spyware stealer

Lockbit family

Rule to detect Lockbit 3.0 ransomware Windows payload

Lockbit

Renames multiple (588) files with added filename extension

Renames multiple (681) files with added filename extension

Executes dropped EXE

Checks computer location settings

Reads user/profile data of web browsers

Deletes itself

Indicator Removal: File Deletion

Drops desktop.ini file(s)

Drops file in System32 directory

Sets desktop wallpaper using registry

Suspicious use of NtSetInformationThreadHideFromDebugger

System Location Discovery: System Language Discovery

Enumerates physical storage devices

Unsigned PE

Suspicious use of WriteProcessMemory

Modifies registry class

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Modifies Control Panel

Suspicious behavior: RenamesItself

Suspicious use of SetWindowsHookEx

Checks processor information in registry

Enumerates system info in registry

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2025-04-20 15:08

Signatures

Lockbit family

lockbit

Rule to detect Lockbit 3.0 ransomware Windows payload

Description Indicator Process Target
N/A N/A N/A N/A

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2025-04-20 15:08

Reported

2025-04-20 15:10

Platform

win10v2004-20250314-en

Max time kernel

148s

Max time network

147s

Command Line

"C:\Users\Admin\AppData\Local\Temp\2025-04-20_971b1c13e0efcb5b4ff57b5c67dff89f_darkside_elex_lockbit.exe"

Signatures

Lockbit

ransomware lockbit

Lockbit family

lockbit

Renames multiple (681) files with added filename extension

ransomware

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-83325578-304917428-1200496059-1000\Control Panel\International\Geo\Nation C:\ProgramData\A578.tmp N/A

Deletes itself

Description Indicator Process Target
N/A N/A C:\ProgramData\A578.tmp N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\ProgramData\A578.tmp N/A

Reads user/profile data of web browsers

spyware stealer

Drops desktop.ini file(s)

Description Indicator Process Target
File opened for modification F:\$RECYCLE.BIN\S-1-5-21-83325578-304917428-1200496059-1000\desktop.ini C:\Users\Admin\AppData\Local\Temp\2025-04-20_971b1c13e0efcb5b4ff57b5c67dff89f_darkside_elex_lockbit.exe N/A
File opened for modification C:\$Recycle.Bin\S-1-5-21-83325578-304917428-1200496059-1000\desktop.ini C:\Users\Admin\AppData\Local\Temp\2025-04-20_971b1c13e0efcb5b4ff57b5c67dff89f_darkside_elex_lockbit.exe N/A

Indicator Removal: File Deletion

defense_evasion

Drops file in System32 directory

Description Indicator Process Target
File created C:\Windows\system32\spool\PRINTERS\00002.SPL C:\Windows\splwow64.exe N/A
File created C:\Windows\system32\spool\PRINTERS\PPuwgr798dqir79b9560dv7mhyd.TMP C:\Windows\system32\printfilterpipelinesvc.exe N/A
File created C:\Windows\system32\spool\PRINTERS\PPb41ztq24o6zz5vys3_vn865nb.TMP C:\Windows\system32\printfilterpipelinesvc.exe N/A
File created C:\Windows\system32\spool\PRINTERS\PPd83s8epyppev0zk37qjtpdc4.TMP C:\Windows\system32\printfilterpipelinesvc.exe N/A

Sets desktop wallpaper using registry

ransomware
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-83325578-304917428-1200496059-1000\Control Panel\Desktop\WallPaper = "C:\\ProgramData\\V86sTiCVN.bmp" C:\Users\Admin\AppData\Local\Temp\2025-04-20_971b1c13e0efcb5b4ff57b5c67dff89f_darkside_elex_lockbit.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-83325578-304917428-1200496059-1000\Control Panel\Desktop\Wallpaper = "C:\\ProgramData\\V86sTiCVN.bmp" C:\Users\Admin\AppData\Local\Temp\2025-04-20_971b1c13e0efcb5b4ff57b5c67dff89f_darkside_elex_lockbit.exe N/A

Enumerates physical storage devices

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\2025-04-20_971b1c13e0efcb5b4ff57b5c67dff89f_darkside_elex_lockbit.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\ProgramData\A578.tmp N/A

Checks processor information in registry

Description Indicator Process Target
Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 C:\Program Files\Microsoft Office\root\Office16\ONENOTE.EXE N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz C:\Program Files\Microsoft Office\root\Office16\ONENOTE.EXE N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString C:\Program Files\Microsoft Office\root\Office16\ONENOTE.EXE N/A

Enumerates system info in registry

Description Indicator Process Target
Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS C:\Program Files\Microsoft Office\root\Office16\ONENOTE.EXE N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily C:\Program Files\Microsoft Office\root\Office16\ONENOTE.EXE N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU C:\Program Files\Microsoft Office\root\Office16\ONENOTE.EXE N/A

Modifies Control Panel

defense_evasion
Description Indicator Process Target
Key created \REGISTRY\USER\S-1-5-21-83325578-304917428-1200496059-1000\Control Panel\Desktop C:\Users\Admin\AppData\Local\Temp\2025-04-20_971b1c13e0efcb5b4ff57b5c67dff89f_darkside_elex_lockbit.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-83325578-304917428-1200496059-1000\Control Panel\Desktop\WallpaperStyle = "10" C:\Users\Admin\AppData\Local\Temp\2025-04-20_971b1c13e0efcb5b4ff57b5c67dff89f_darkside_elex_lockbit.exe N/A

Modifies registry class

Description Indicator Process Target
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.V86sTiCVN C:\Users\Admin\AppData\Local\Temp\2025-04-20_971b1c13e0efcb5b4ff57b5c67dff89f_darkside_elex_lockbit.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.V86sTiCVN\ = "V86sTiCVN" C:\Users\Admin\AppData\Local\Temp\2025-04-20_971b1c13e0efcb5b4ff57b5c67dff89f_darkside_elex_lockbit.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\V86sTiCVN\DefaultIcon C:\Users\Admin\AppData\Local\Temp\2025-04-20_971b1c13e0efcb5b4ff57b5c67dff89f_darkside_elex_lockbit.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\V86sTiCVN C:\Users\Admin\AppData\Local\Temp\2025-04-20_971b1c13e0efcb5b4ff57b5c67dff89f_darkside_elex_lockbit.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\V86sTiCVN\DefaultIcon\ = "C:\\ProgramData\\V86sTiCVN.ico" C:\Users\Admin\AppData\Local\Temp\2025-04-20_971b1c13e0efcb5b4ff57b5c67dff89f_darkside_elex_lockbit.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\2025-04-20_971b1c13e0efcb5b4ff57b5c67dff89f_darkside_elex_lockbit.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2025-04-20_971b1c13e0efcb5b4ff57b5c67dff89f_darkside_elex_lockbit.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2025-04-20_971b1c13e0efcb5b4ff57b5c67dff89f_darkside_elex_lockbit.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2025-04-20_971b1c13e0efcb5b4ff57b5c67dff89f_darkside_elex_lockbit.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2025-04-20_971b1c13e0efcb5b4ff57b5c67dff89f_darkside_elex_lockbit.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2025-04-20_971b1c13e0efcb5b4ff57b5c67dff89f_darkside_elex_lockbit.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2025-04-20_971b1c13e0efcb5b4ff57b5c67dff89f_darkside_elex_lockbit.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2025-04-20_971b1c13e0efcb5b4ff57b5c67dff89f_darkside_elex_lockbit.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2025-04-20_971b1c13e0efcb5b4ff57b5c67dff89f_darkside_elex_lockbit.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2025-04-20_971b1c13e0efcb5b4ff57b5c67dff89f_darkside_elex_lockbit.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2025-04-20_971b1c13e0efcb5b4ff57b5c67dff89f_darkside_elex_lockbit.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2025-04-20_971b1c13e0efcb5b4ff57b5c67dff89f_darkside_elex_lockbit.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2025-04-20_971b1c13e0efcb5b4ff57b5c67dff89f_darkside_elex_lockbit.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2025-04-20_971b1c13e0efcb5b4ff57b5c67dff89f_darkside_elex_lockbit.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2025-04-20_971b1c13e0efcb5b4ff57b5c67dff89f_darkside_elex_lockbit.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2025-04-20_971b1c13e0efcb5b4ff57b5c67dff89f_darkside_elex_lockbit.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2025-04-20_971b1c13e0efcb5b4ff57b5c67dff89f_darkside_elex_lockbit.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2025-04-20_971b1c13e0efcb5b4ff57b5c67dff89f_darkside_elex_lockbit.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2025-04-20_971b1c13e0efcb5b4ff57b5c67dff89f_darkside_elex_lockbit.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2025-04-20_971b1c13e0efcb5b4ff57b5c67dff89f_darkside_elex_lockbit.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2025-04-20_971b1c13e0efcb5b4ff57b5c67dff89f_darkside_elex_lockbit.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2025-04-20_971b1c13e0efcb5b4ff57b5c67dff89f_darkside_elex_lockbit.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2025-04-20_971b1c13e0efcb5b4ff57b5c67dff89f_darkside_elex_lockbit.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2025-04-20_971b1c13e0efcb5b4ff57b5c67dff89f_darkside_elex_lockbit.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2025-04-20_971b1c13e0efcb5b4ff57b5c67dff89f_darkside_elex_lockbit.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2025-04-20_971b1c13e0efcb5b4ff57b5c67dff89f_darkside_elex_lockbit.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2025-04-20_971b1c13e0efcb5b4ff57b5c67dff89f_darkside_elex_lockbit.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2025-04-20_971b1c13e0efcb5b4ff57b5c67dff89f_darkside_elex_lockbit.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2025-04-20_971b1c13e0efcb5b4ff57b5c67dff89f_darkside_elex_lockbit.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2025-04-20_971b1c13e0efcb5b4ff57b5c67dff89f_darkside_elex_lockbit.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2025-04-20_971b1c13e0efcb5b4ff57b5c67dff89f_darkside_elex_lockbit.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2025-04-20_971b1c13e0efcb5b4ff57b5c67dff89f_darkside_elex_lockbit.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2025-04-20_971b1c13e0efcb5b4ff57b5c67dff89f_darkside_elex_lockbit.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2025-04-20_971b1c13e0efcb5b4ff57b5c67dff89f_darkside_elex_lockbit.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2025-04-20_971b1c13e0efcb5b4ff57b5c67dff89f_darkside_elex_lockbit.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2025-04-20_971b1c13e0efcb5b4ff57b5c67dff89f_darkside_elex_lockbit.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2025-04-20_971b1c13e0efcb5b4ff57b5c67dff89f_darkside_elex_lockbit.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2025-04-20_971b1c13e0efcb5b4ff57b5c67dff89f_darkside_elex_lockbit.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2025-04-20_971b1c13e0efcb5b4ff57b5c67dff89f_darkside_elex_lockbit.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2025-04-20_971b1c13e0efcb5b4ff57b5c67dff89f_darkside_elex_lockbit.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2025-04-20_971b1c13e0efcb5b4ff57b5c67dff89f_darkside_elex_lockbit.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2025-04-20_971b1c13e0efcb5b4ff57b5c67dff89f_darkside_elex_lockbit.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2025-04-20_971b1c13e0efcb5b4ff57b5c67dff89f_darkside_elex_lockbit.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2025-04-20_971b1c13e0efcb5b4ff57b5c67dff89f_darkside_elex_lockbit.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2025-04-20_971b1c13e0efcb5b4ff57b5c67dff89f_darkside_elex_lockbit.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2025-04-20_971b1c13e0efcb5b4ff57b5c67dff89f_darkside_elex_lockbit.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2025-04-20_971b1c13e0efcb5b4ff57b5c67dff89f_darkside_elex_lockbit.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2025-04-20_971b1c13e0efcb5b4ff57b5c67dff89f_darkside_elex_lockbit.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2025-04-20_971b1c13e0efcb5b4ff57b5c67dff89f_darkside_elex_lockbit.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2025-04-20_971b1c13e0efcb5b4ff57b5c67dff89f_darkside_elex_lockbit.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2025-04-20_971b1c13e0efcb5b4ff57b5c67dff89f_darkside_elex_lockbit.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2025-04-20_971b1c13e0efcb5b4ff57b5c67dff89f_darkside_elex_lockbit.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2025-04-20_971b1c13e0efcb5b4ff57b5c67dff89f_darkside_elex_lockbit.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2025-04-20_971b1c13e0efcb5b4ff57b5c67dff89f_darkside_elex_lockbit.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2025-04-20_971b1c13e0efcb5b4ff57b5c67dff89f_darkside_elex_lockbit.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2025-04-20_971b1c13e0efcb5b4ff57b5c67dff89f_darkside_elex_lockbit.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2025-04-20_971b1c13e0efcb5b4ff57b5c67dff89f_darkside_elex_lockbit.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2025-04-20_971b1c13e0efcb5b4ff57b5c67dff89f_darkside_elex_lockbit.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2025-04-20_971b1c13e0efcb5b4ff57b5c67dff89f_darkside_elex_lockbit.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2025-04-20_971b1c13e0efcb5b4ff57b5c67dff89f_darkside_elex_lockbit.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2025-04-20_971b1c13e0efcb5b4ff57b5c67dff89f_darkside_elex_lockbit.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2025-04-20_971b1c13e0efcb5b4ff57b5c67dff89f_darkside_elex_lockbit.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2025-04-20_971b1c13e0efcb5b4ff57b5c67dff89f_darkside_elex_lockbit.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2025-04-20_971b1c13e0efcb5b4ff57b5c67dff89f_darkside_elex_lockbit.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeAssignPrimaryTokenPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2025-04-20_971b1c13e0efcb5b4ff57b5c67dff89f_darkside_elex_lockbit.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2025-04-20_971b1c13e0efcb5b4ff57b5c67dff89f_darkside_elex_lockbit.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2025-04-20_971b1c13e0efcb5b4ff57b5c67dff89f_darkside_elex_lockbit.exe N/A
Token: 36 N/A C:\Users\Admin\AppData\Local\Temp\2025-04-20_971b1c13e0efcb5b4ff57b5c67dff89f_darkside_elex_lockbit.exe N/A
Token: SeImpersonatePrivilege N/A C:\Users\Admin\AppData\Local\Temp\2025-04-20_971b1c13e0efcb5b4ff57b5c67dff89f_darkside_elex_lockbit.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2025-04-20_971b1c13e0efcb5b4ff57b5c67dff89f_darkside_elex_lockbit.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2025-04-20_971b1c13e0efcb5b4ff57b5c67dff89f_darkside_elex_lockbit.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Local\Temp\2025-04-20_971b1c13e0efcb5b4ff57b5c67dff89f_darkside_elex_lockbit.exe N/A
Token: SeManageVolumePrivilege N/A C:\Users\Admin\AppData\Local\Temp\2025-04-20_971b1c13e0efcb5b4ff57b5c67dff89f_darkside_elex_lockbit.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2025-04-20_971b1c13e0efcb5b4ff57b5c67dff89f_darkside_elex_lockbit.exe N/A
Token: SeRestorePrivilege N/A C:\Users\Admin\AppData\Local\Temp\2025-04-20_971b1c13e0efcb5b4ff57b5c67dff89f_darkside_elex_lockbit.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2025-04-20_971b1c13e0efcb5b4ff57b5c67dff89f_darkside_elex_lockbit.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Users\Admin\AppData\Local\Temp\2025-04-20_971b1c13e0efcb5b4ff57b5c67dff89f_darkside_elex_lockbit.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2025-04-20_971b1c13e0efcb5b4ff57b5c67dff89f_darkside_elex_lockbit.exe N/A
Token: SeShutdownPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2025-04-20_971b1c13e0efcb5b4ff57b5c67dff89f_darkside_elex_lockbit.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2025-04-20_971b1c13e0efcb5b4ff57b5c67dff89f_darkside_elex_lockbit.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2025-04-20_971b1c13e0efcb5b4ff57b5c67dff89f_darkside_elex_lockbit.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2025-04-20_971b1c13e0efcb5b4ff57b5c67dff89f_darkside_elex_lockbit.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2025-04-20_971b1c13e0efcb5b4ff57b5c67dff89f_darkside_elex_lockbit.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2025-04-20_971b1c13e0efcb5b4ff57b5c67dff89f_darkside_elex_lockbit.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2025-04-20_971b1c13e0efcb5b4ff57b5c67dff89f_darkside_elex_lockbit.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2025-04-20_971b1c13e0efcb5b4ff57b5c67dff89f_darkside_elex_lockbit.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2025-04-20_971b1c13e0efcb5b4ff57b5c67dff89f_darkside_elex_lockbit.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2025-04-20_971b1c13e0efcb5b4ff57b5c67dff89f_darkside_elex_lockbit.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2025-04-20_971b1c13e0efcb5b4ff57b5c67dff89f_darkside_elex_lockbit.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2025-04-20_971b1c13e0efcb5b4ff57b5c67dff89f_darkside_elex_lockbit.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2025-04-20_971b1c13e0efcb5b4ff57b5c67dff89f_darkside_elex_lockbit.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2025-04-20_971b1c13e0efcb5b4ff57b5c67dff89f_darkside_elex_lockbit.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2025-04-20_971b1c13e0efcb5b4ff57b5c67dff89f_darkside_elex_lockbit.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2025-04-20_971b1c13e0efcb5b4ff57b5c67dff89f_darkside_elex_lockbit.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2025-04-20_971b1c13e0efcb5b4ff57b5c67dff89f_darkside_elex_lockbit.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2025-04-20_971b1c13e0efcb5b4ff57b5c67dff89f_darkside_elex_lockbit.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2025-04-20_971b1c13e0efcb5b4ff57b5c67dff89f_darkside_elex_lockbit.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2025-04-20_971b1c13e0efcb5b4ff57b5c67dff89f_darkside_elex_lockbit.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2025-04-20_971b1c13e0efcb5b4ff57b5c67dff89f_darkside_elex_lockbit.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2025-04-20_971b1c13e0efcb5b4ff57b5c67dff89f_darkside_elex_lockbit.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2025-04-20_971b1c13e0efcb5b4ff57b5c67dff89f_darkside_elex_lockbit.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2025-04-20_971b1c13e0efcb5b4ff57b5c67dff89f_darkside_elex_lockbit.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2025-04-20_971b1c13e0efcb5b4ff57b5c67dff89f_darkside_elex_lockbit.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2025-04-20_971b1c13e0efcb5b4ff57b5c67dff89f_darkside_elex_lockbit.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2025-04-20_971b1c13e0efcb5b4ff57b5c67dff89f_darkside_elex_lockbit.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2025-04-20_971b1c13e0efcb5b4ff57b5c67dff89f_darkside_elex_lockbit.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2025-04-20_971b1c13e0efcb5b4ff57b5c67dff89f_darkside_elex_lockbit.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2025-04-20_971b1c13e0efcb5b4ff57b5c67dff89f_darkside_elex_lockbit.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2025-04-20_971b1c13e0efcb5b4ff57b5c67dff89f_darkside_elex_lockbit.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2025-04-20_971b1c13e0efcb5b4ff57b5c67dff89f_darkside_elex_lockbit.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2025-04-20_971b1c13e0efcb5b4ff57b5c67dff89f_darkside_elex_lockbit.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2025-04-20_971b1c13e0efcb5b4ff57b5c67dff89f_darkside_elex_lockbit.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2025-04-20_971b1c13e0efcb5b4ff57b5c67dff89f_darkside_elex_lockbit.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2025-04-20_971b1c13e0efcb5b4ff57b5c67dff89f_darkside_elex_lockbit.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2025-04-20_971b1c13e0efcb5b4ff57b5c67dff89f_darkside_elex_lockbit.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2025-04-20_971b1c13e0efcb5b4ff57b5c67dff89f_darkside_elex_lockbit.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2025-04-20_971b1c13e0efcb5b4ff57b5c67dff89f_darkside_elex_lockbit.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2025-04-20_971b1c13e0efcb5b4ff57b5c67dff89f_darkside_elex_lockbit.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2025-04-20_971b1c13e0efcb5b4ff57b5c67dff89f_darkside_elex_lockbit.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2025-04-20_971b1c13e0efcb5b4ff57b5c67dff89f_darkside_elex_lockbit.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2025-04-20_971b1c13e0efcb5b4ff57b5c67dff89f_darkside_elex_lockbit.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2025-04-20_971b1c13e0efcb5b4ff57b5c67dff89f_darkside_elex_lockbit.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2025-04-20_971b1c13e0efcb5b4ff57b5c67dff89f_darkside_elex_lockbit.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2025-04-20_971b1c13e0efcb5b4ff57b5c67dff89f_darkside_elex_lockbit.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2025-04-20_971b1c13e0efcb5b4ff57b5c67dff89f_darkside_elex_lockbit.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2025-04-20_971b1c13e0efcb5b4ff57b5c67dff89f_darkside_elex_lockbit.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2025-04-20_971b1c13e0efcb5b4ff57b5c67dff89f_darkside_elex_lockbit.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2025-04-20_971b1c13e0efcb5b4ff57b5c67dff89f_darkside_elex_lockbit.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2060 wrote to memory of 5672 N/A C:\Users\Admin\AppData\Local\Temp\2025-04-20_971b1c13e0efcb5b4ff57b5c67dff89f_darkside_elex_lockbit.exe C:\Windows\splwow64.exe
PID 2060 wrote to memory of 5672 N/A C:\Users\Admin\AppData\Local\Temp\2025-04-20_971b1c13e0efcb5b4ff57b5c67dff89f_darkside_elex_lockbit.exe C:\Windows\splwow64.exe
PID 736 wrote to memory of 1912 N/A C:\Windows\system32\printfilterpipelinesvc.exe C:\Program Files\Microsoft Office\root\Office16\ONENOTE.EXE
PID 736 wrote to memory of 1912 N/A C:\Windows\system32\printfilterpipelinesvc.exe C:\Program Files\Microsoft Office\root\Office16\ONENOTE.EXE
PID 2060 wrote to memory of 5604 N/A C:\Users\Admin\AppData\Local\Temp\2025-04-20_971b1c13e0efcb5b4ff57b5c67dff89f_darkside_elex_lockbit.exe C:\ProgramData\A578.tmp
PID 2060 wrote to memory of 5604 N/A C:\Users\Admin\AppData\Local\Temp\2025-04-20_971b1c13e0efcb5b4ff57b5c67dff89f_darkside_elex_lockbit.exe C:\ProgramData\A578.tmp
PID 2060 wrote to memory of 5604 N/A C:\Users\Admin\AppData\Local\Temp\2025-04-20_971b1c13e0efcb5b4ff57b5c67dff89f_darkside_elex_lockbit.exe C:\ProgramData\A578.tmp
PID 2060 wrote to memory of 5604 N/A C:\Users\Admin\AppData\Local\Temp\2025-04-20_971b1c13e0efcb5b4ff57b5c67dff89f_darkside_elex_lockbit.exe C:\ProgramData\A578.tmp
PID 5604 wrote to memory of 3932 N/A C:\ProgramData\A578.tmp C:\Windows\SysWOW64\cmd.exe
PID 5604 wrote to memory of 3932 N/A C:\ProgramData\A578.tmp C:\Windows\SysWOW64\cmd.exe
PID 5604 wrote to memory of 3932 N/A C:\ProgramData\A578.tmp C:\Windows\SysWOW64\cmd.exe

Processes

C:\Users\Admin\AppData\Local\Temp\2025-04-20_971b1c13e0efcb5b4ff57b5c67dff89f_darkside_elex_lockbit.exe

"C:\Users\Admin\AppData\Local\Temp\2025-04-20_971b1c13e0efcb5b4ff57b5c67dff89f_darkside_elex_lockbit.exe"

C:\Windows\splwow64.exe

C:\Windows\splwow64.exe 12288

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k PrintWorkflow -s PrintWorkflowUserSvc

C:\Windows\system32\printfilterpipelinesvc.exe

C:\Windows\system32\printfilterpipelinesvc.exe -Embedding

C:\Program Files\Microsoft Office\root\Office16\ONENOTE.EXE

/insertdoc "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\{C66AF106-2AD9-499B-8D48-B0783264C48A}.xps" 133896352981830000

C:\ProgramData\A578.tmp

"C:\ProgramData\A578.tmp"

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /C DEL /F /Q C:\PROGRA~3\A578.tmp >> NUL

Network

Country Destination Domain Proto
US 8.8.8.8:53 roaming.officeapps.live.com udp
IE 52.109.76.243:443 roaming.officeapps.live.com tcp
US 8.8.8.8:53 c.pki.goog udp
NL 173.194.69.94:80 c.pki.goog tcp

Files

memory/2060-2-0x00000000009F0000-0x0000000000A00000-memory.dmp

memory/2060-1-0x00000000009F0000-0x0000000000A00000-memory.dmp

memory/2060-0-0x00000000009F0000-0x0000000000A00000-memory.dmp

C:\$Recycle.Bin\S-1-5-21-83325578-304917428-1200496059-1000\XXXXXXXXXXX

MD5 742b51fd6c56a8790afbea809906af9d
SHA1 4b8bd3a25ca999a57e79692707d3eef71cb2e69d
SHA256 1250a685f398fac5cf7ccb91260706b10d5d631edf767b8972c5f7ff2724e450
SHA512 93035519c24c853a12183a480d8fa929627ab1cf00bcd1476618aa86c020b0a91fdc8bab0dd1be610d88e6b4e253336b559a2abfb41d015755ff14e6ecc76d9e

F:\$RECYCLE.BIN\S-1-5-21-83325578-304917428-1200496059-1000\EEEEEEEEEEE

MD5 c43c9774b98991bb1aa099bf4c6d8701
SHA1 a1973912db686d54bfff375fef881f1ccf9c2313
SHA256 aa0d5e67c8db0b6299654b512a167b66cf86e6b0ff47c76874281a6e90f62bd8
SHA512 55bda8296220bde7b6ab6f0290cac254c79bc8c324d0acf5bc5dc1b9a03a739d2ba7d6dceaf8e0d2e336731578071a73ca5d2acb9da474697c8d466214474a9a

C:\V86sTiCVN.README.txt

MD5 9edc91d12d8ee9e2e16f551f9d931c0b
SHA1 e70c4409bfe78728a7aca6a76649ba42457e5d9d
SHA256 23034115797924443bc8f71f34dfb7a1cdf0cddc5b4794b30ce7cefb254f4c22
SHA512 38782c7fa1023a92926a4ab993bde77b5d21e24eb5ab33520f400cd97fcfb1ab4067a8b6ca2257dc0c6499f2a00b0b11fef85ba5a448ab40a853f77047a1d10f

memory/2060-3562-0x00000000009F0000-0x0000000000A00000-memory.dmp

memory/2060-3563-0x00000000009F0000-0x0000000000A00000-memory.dmp

memory/2060-3564-0x00000000009F0000-0x0000000000A00000-memory.dmp

memory/1912-3576-0x00007FFB94210000-0x00007FFB94220000-memory.dmp

C:\ProgramData\A578.tmp

MD5 294e9f64cb1642dd89229fff0592856b
SHA1 97b148c27f3da29ba7b18d6aee8a0db9102f47c9
SHA256 917e115cc403e29b4388e0d175cbfac3e7e40ca1742299fbdb353847db2de7c2
SHA512 b87d531890bf1577b9b4af41dddb2cdbbfa164cf197bd5987df3a3075983645a3acba443e289b7bfd338422978a104f55298fbfe346872de0895bde44adc89cf

memory/1912-3581-0x00007FFB94210000-0x00007FFB94220000-memory.dmp

memory/1912-3580-0x00007FFB94210000-0x00007FFB94220000-memory.dmp

memory/1912-3583-0x00007FFB94210000-0x00007FFB94220000-memory.dmp

memory/1912-3584-0x00007FFB94210000-0x00007FFB94220000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\IIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIII

MD5 b5bb8f9f290bca94d108c8f10bfb887f
SHA1 f23798087b2ab760c1d0e1037a6e69aa532f2b8c
SHA256 9c8fdf0247a82c9bf459554053ae8baba3b4e2c68aa0002575fef4a7360f851f
SHA512 c79a04297e89b60fa296b14ca1b34778d42226b4d6cc15627a1a03db865f8f3c229edb68b43d6729546f7f18df9dffc12594e51e43aaaa1e543ce051dd195129

memory/1912-3613-0x00007FFB92120000-0x00007FFB92130000-memory.dmp

memory/1912-3614-0x00007FFB92120000-0x00007FFB92130000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\{1858CEE2-803E-4B52-8C34-34B883C8BAE7}

MD5 496e82b18f3b0d4fe6af88d30c847d26
SHA1 6942cb6d89d0942b2ec6fae18b727111546dc5cf
SHA256 a550a82aac7d1fbf4c871bf784de3330e1d64701b5a6016e766b520c2c927b04
SHA512 d3aecd59484bd593152b12e2418e0756673ca682a888c49f23ca06b6a9af261206b0b7781b8d1672680d5c839e959ccdca040dd4089885f9178112181212481b

C:\Users\Admin\Documents\OneNote Notebooks\My Notebook\Open Notebook.onetoc2

MD5 569dd0d01785ea3dbdef7f17de8b4bf6
SHA1 32ec87ade910bc7625e3b5eec77167af871b1875
SHA256 d9a49988fd026e7d0830ec08d295cf59d5c2b1690f3fbb5e3bd559a1fccbdc8b
SHA512 f5c780904ad262251dd02973fde0eb75fe72e38f670920f5d53c5dd81b4dc1b4f10cbbadc4d09502e5480050b45611bfcba18850a83c80d51b0d00c911c4ac19

Analysis: behavioral2

Detonation Overview

Submitted

2025-04-20 15:08

Reported

2025-04-20 15:10

Platform

win11-20250410-en

Max time kernel

147s

Max time network

140s

Command Line

"C:\Users\Admin\AppData\Local\Temp\2025-04-20_971b1c13e0efcb5b4ff57b5c67dff89f_darkside_elex_lockbit.exe"

Signatures

Lockbit

ransomware lockbit

Lockbit family

lockbit

Renames multiple (588) files with added filename extension

ransomware

Deletes itself

Description Indicator Process Target
N/A N/A C:\ProgramData\762B.tmp N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\ProgramData\762B.tmp N/A

Reads user/profile data of web browsers

spyware stealer

Drops desktop.ini file(s)

Description Indicator Process Target
File opened for modification C:\$Recycle.Bin\S-1-5-21-599783296-1627459723-2423478968-1000\desktop.ini C:\Users\Admin\AppData\Local\Temp\2025-04-20_971b1c13e0efcb5b4ff57b5c67dff89f_darkside_elex_lockbit.exe N/A
File opened for modification F:\$RECYCLE.BIN\S-1-5-21-599783296-1627459723-2423478968-1000\desktop.ini C:\Users\Admin\AppData\Local\Temp\2025-04-20_971b1c13e0efcb5b4ff57b5c67dff89f_darkside_elex_lockbit.exe N/A

Indicator Removal: File Deletion

defense_evasion

Drops file in System32 directory

Description Indicator Process Target
File created C:\Windows\system32\spool\PRINTERS\PPylp2z8n1_lxim73p5axvnyz0d.TMP C:\Windows\system32\printfilterpipelinesvc.exe N/A
File created C:\Windows\system32\spool\PRINTERS\00002.SPL C:\Windows\splwow64.exe N/A
File created C:\Windows\system32\spool\PRINTERS\PPsrhg0jf6q0gmu7ene452z0sm.TMP C:\Windows\system32\printfilterpipelinesvc.exe N/A
File created C:\Windows\system32\spool\PRINTERS\PPt3027ugp20_lvbwycbq7xv4bc.TMP C:\Windows\system32\printfilterpipelinesvc.exe N/A

Sets desktop wallpaper using registry

ransomware
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-599783296-1627459723-2423478968-1000\Control Panel\Desktop\WallPaper = "C:\\ProgramData\\V86sTiCVN.bmp" C:\Users\Admin\AppData\Local\Temp\2025-04-20_971b1c13e0efcb5b4ff57b5c67dff89f_darkside_elex_lockbit.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-599783296-1627459723-2423478968-1000\Control Panel\Desktop\Wallpaper = "C:\\ProgramData\\V86sTiCVN.bmp" C:\Users\Admin\AppData\Local\Temp\2025-04-20_971b1c13e0efcb5b4ff57b5c67dff89f_darkside_elex_lockbit.exe N/A

Enumerates physical storage devices

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\2025-04-20_971b1c13e0efcb5b4ff57b5c67dff89f_darkside_elex_lockbit.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\ProgramData\762B.tmp N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A

Checks processor information in registry

Description Indicator Process Target
Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 C:\Program Files\Microsoft Office\root\Office16\ONENOTE.EXE N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz C:\Program Files\Microsoft Office\root\Office16\ONENOTE.EXE N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString C:\Program Files\Microsoft Office\root\Office16\ONENOTE.EXE N/A

Enumerates system info in registry

Description Indicator Process Target
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily C:\Program Files\Microsoft Office\root\Office16\ONENOTE.EXE N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU C:\Program Files\Microsoft Office\root\Office16\ONENOTE.EXE N/A
Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS C:\Program Files\Microsoft Office\root\Office16\ONENOTE.EXE N/A

Modifies Control Panel

defense_evasion
Description Indicator Process Target
Key created \REGISTRY\USER\S-1-5-21-599783296-1627459723-2423478968-1000\Control Panel\Desktop C:\Users\Admin\AppData\Local\Temp\2025-04-20_971b1c13e0efcb5b4ff57b5c67dff89f_darkside_elex_lockbit.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-599783296-1627459723-2423478968-1000\Control Panel\Desktop\WallpaperStyle = "10" C:\Users\Admin\AppData\Local\Temp\2025-04-20_971b1c13e0efcb5b4ff57b5c67dff89f_darkside_elex_lockbit.exe N/A

Modifies registry class

Description Indicator Process Target
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.V86sTiCVN C:\Users\Admin\AppData\Local\Temp\2025-04-20_971b1c13e0efcb5b4ff57b5c67dff89f_darkside_elex_lockbit.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.V86sTiCVN\ = "V86sTiCVN" C:\Users\Admin\AppData\Local\Temp\2025-04-20_971b1c13e0efcb5b4ff57b5c67dff89f_darkside_elex_lockbit.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\V86sTiCVN\DefaultIcon C:\Users\Admin\AppData\Local\Temp\2025-04-20_971b1c13e0efcb5b4ff57b5c67dff89f_darkside_elex_lockbit.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\V86sTiCVN C:\Users\Admin\AppData\Local\Temp\2025-04-20_971b1c13e0efcb5b4ff57b5c67dff89f_darkside_elex_lockbit.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\V86sTiCVN\DefaultIcon\ = "C:\\ProgramData\\V86sTiCVN.ico" C:\Users\Admin\AppData\Local\Temp\2025-04-20_971b1c13e0efcb5b4ff57b5c67dff89f_darkside_elex_lockbit.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\2025-04-20_971b1c13e0efcb5b4ff57b5c67dff89f_darkside_elex_lockbit.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2025-04-20_971b1c13e0efcb5b4ff57b5c67dff89f_darkside_elex_lockbit.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2025-04-20_971b1c13e0efcb5b4ff57b5c67dff89f_darkside_elex_lockbit.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2025-04-20_971b1c13e0efcb5b4ff57b5c67dff89f_darkside_elex_lockbit.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2025-04-20_971b1c13e0efcb5b4ff57b5c67dff89f_darkside_elex_lockbit.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2025-04-20_971b1c13e0efcb5b4ff57b5c67dff89f_darkside_elex_lockbit.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2025-04-20_971b1c13e0efcb5b4ff57b5c67dff89f_darkside_elex_lockbit.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2025-04-20_971b1c13e0efcb5b4ff57b5c67dff89f_darkside_elex_lockbit.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2025-04-20_971b1c13e0efcb5b4ff57b5c67dff89f_darkside_elex_lockbit.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2025-04-20_971b1c13e0efcb5b4ff57b5c67dff89f_darkside_elex_lockbit.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2025-04-20_971b1c13e0efcb5b4ff57b5c67dff89f_darkside_elex_lockbit.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2025-04-20_971b1c13e0efcb5b4ff57b5c67dff89f_darkside_elex_lockbit.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2025-04-20_971b1c13e0efcb5b4ff57b5c67dff89f_darkside_elex_lockbit.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2025-04-20_971b1c13e0efcb5b4ff57b5c67dff89f_darkside_elex_lockbit.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2025-04-20_971b1c13e0efcb5b4ff57b5c67dff89f_darkside_elex_lockbit.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2025-04-20_971b1c13e0efcb5b4ff57b5c67dff89f_darkside_elex_lockbit.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2025-04-20_971b1c13e0efcb5b4ff57b5c67dff89f_darkside_elex_lockbit.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2025-04-20_971b1c13e0efcb5b4ff57b5c67dff89f_darkside_elex_lockbit.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2025-04-20_971b1c13e0efcb5b4ff57b5c67dff89f_darkside_elex_lockbit.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2025-04-20_971b1c13e0efcb5b4ff57b5c67dff89f_darkside_elex_lockbit.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2025-04-20_971b1c13e0efcb5b4ff57b5c67dff89f_darkside_elex_lockbit.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2025-04-20_971b1c13e0efcb5b4ff57b5c67dff89f_darkside_elex_lockbit.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2025-04-20_971b1c13e0efcb5b4ff57b5c67dff89f_darkside_elex_lockbit.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2025-04-20_971b1c13e0efcb5b4ff57b5c67dff89f_darkside_elex_lockbit.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2025-04-20_971b1c13e0efcb5b4ff57b5c67dff89f_darkside_elex_lockbit.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2025-04-20_971b1c13e0efcb5b4ff57b5c67dff89f_darkside_elex_lockbit.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2025-04-20_971b1c13e0efcb5b4ff57b5c67dff89f_darkside_elex_lockbit.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2025-04-20_971b1c13e0efcb5b4ff57b5c67dff89f_darkside_elex_lockbit.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2025-04-20_971b1c13e0efcb5b4ff57b5c67dff89f_darkside_elex_lockbit.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2025-04-20_971b1c13e0efcb5b4ff57b5c67dff89f_darkside_elex_lockbit.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2025-04-20_971b1c13e0efcb5b4ff57b5c67dff89f_darkside_elex_lockbit.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2025-04-20_971b1c13e0efcb5b4ff57b5c67dff89f_darkside_elex_lockbit.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2025-04-20_971b1c13e0efcb5b4ff57b5c67dff89f_darkside_elex_lockbit.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2025-04-20_971b1c13e0efcb5b4ff57b5c67dff89f_darkside_elex_lockbit.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2025-04-20_971b1c13e0efcb5b4ff57b5c67dff89f_darkside_elex_lockbit.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2025-04-20_971b1c13e0efcb5b4ff57b5c67dff89f_darkside_elex_lockbit.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2025-04-20_971b1c13e0efcb5b4ff57b5c67dff89f_darkside_elex_lockbit.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2025-04-20_971b1c13e0efcb5b4ff57b5c67dff89f_darkside_elex_lockbit.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2025-04-20_971b1c13e0efcb5b4ff57b5c67dff89f_darkside_elex_lockbit.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2025-04-20_971b1c13e0efcb5b4ff57b5c67dff89f_darkside_elex_lockbit.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2025-04-20_971b1c13e0efcb5b4ff57b5c67dff89f_darkside_elex_lockbit.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2025-04-20_971b1c13e0efcb5b4ff57b5c67dff89f_darkside_elex_lockbit.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2025-04-20_971b1c13e0efcb5b4ff57b5c67dff89f_darkside_elex_lockbit.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2025-04-20_971b1c13e0efcb5b4ff57b5c67dff89f_darkside_elex_lockbit.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2025-04-20_971b1c13e0efcb5b4ff57b5c67dff89f_darkside_elex_lockbit.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2025-04-20_971b1c13e0efcb5b4ff57b5c67dff89f_darkside_elex_lockbit.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2025-04-20_971b1c13e0efcb5b4ff57b5c67dff89f_darkside_elex_lockbit.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2025-04-20_971b1c13e0efcb5b4ff57b5c67dff89f_darkside_elex_lockbit.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2025-04-20_971b1c13e0efcb5b4ff57b5c67dff89f_darkside_elex_lockbit.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2025-04-20_971b1c13e0efcb5b4ff57b5c67dff89f_darkside_elex_lockbit.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2025-04-20_971b1c13e0efcb5b4ff57b5c67dff89f_darkside_elex_lockbit.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2025-04-20_971b1c13e0efcb5b4ff57b5c67dff89f_darkside_elex_lockbit.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2025-04-20_971b1c13e0efcb5b4ff57b5c67dff89f_darkside_elex_lockbit.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2025-04-20_971b1c13e0efcb5b4ff57b5c67dff89f_darkside_elex_lockbit.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2025-04-20_971b1c13e0efcb5b4ff57b5c67dff89f_darkside_elex_lockbit.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2025-04-20_971b1c13e0efcb5b4ff57b5c67dff89f_darkside_elex_lockbit.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2025-04-20_971b1c13e0efcb5b4ff57b5c67dff89f_darkside_elex_lockbit.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2025-04-20_971b1c13e0efcb5b4ff57b5c67dff89f_darkside_elex_lockbit.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2025-04-20_971b1c13e0efcb5b4ff57b5c67dff89f_darkside_elex_lockbit.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2025-04-20_971b1c13e0efcb5b4ff57b5c67dff89f_darkside_elex_lockbit.exe N/A
N/A N/A C:\Program Files\Microsoft Office\root\Office16\ONENOTE.EXE N/A
N/A N/A C:\Program Files\Microsoft Office\root\Office16\ONENOTE.EXE N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeAssignPrimaryTokenPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2025-04-20_971b1c13e0efcb5b4ff57b5c67dff89f_darkside_elex_lockbit.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2025-04-20_971b1c13e0efcb5b4ff57b5c67dff89f_darkside_elex_lockbit.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2025-04-20_971b1c13e0efcb5b4ff57b5c67dff89f_darkside_elex_lockbit.exe N/A
Token: 36 N/A C:\Users\Admin\AppData\Local\Temp\2025-04-20_971b1c13e0efcb5b4ff57b5c67dff89f_darkside_elex_lockbit.exe N/A
Token: SeImpersonatePrivilege N/A C:\Users\Admin\AppData\Local\Temp\2025-04-20_971b1c13e0efcb5b4ff57b5c67dff89f_darkside_elex_lockbit.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2025-04-20_971b1c13e0efcb5b4ff57b5c67dff89f_darkside_elex_lockbit.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2025-04-20_971b1c13e0efcb5b4ff57b5c67dff89f_darkside_elex_lockbit.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Local\Temp\2025-04-20_971b1c13e0efcb5b4ff57b5c67dff89f_darkside_elex_lockbit.exe N/A
Token: SeManageVolumePrivilege N/A C:\Users\Admin\AppData\Local\Temp\2025-04-20_971b1c13e0efcb5b4ff57b5c67dff89f_darkside_elex_lockbit.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2025-04-20_971b1c13e0efcb5b4ff57b5c67dff89f_darkside_elex_lockbit.exe N/A
Token: SeRestorePrivilege N/A C:\Users\Admin\AppData\Local\Temp\2025-04-20_971b1c13e0efcb5b4ff57b5c67dff89f_darkside_elex_lockbit.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2025-04-20_971b1c13e0efcb5b4ff57b5c67dff89f_darkside_elex_lockbit.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Users\Admin\AppData\Local\Temp\2025-04-20_971b1c13e0efcb5b4ff57b5c67dff89f_darkside_elex_lockbit.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2025-04-20_971b1c13e0efcb5b4ff57b5c67dff89f_darkside_elex_lockbit.exe N/A
Token: SeShutdownPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2025-04-20_971b1c13e0efcb5b4ff57b5c67dff89f_darkside_elex_lockbit.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2025-04-20_971b1c13e0efcb5b4ff57b5c67dff89f_darkside_elex_lockbit.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2025-04-20_971b1c13e0efcb5b4ff57b5c67dff89f_darkside_elex_lockbit.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2025-04-20_971b1c13e0efcb5b4ff57b5c67dff89f_darkside_elex_lockbit.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2025-04-20_971b1c13e0efcb5b4ff57b5c67dff89f_darkside_elex_lockbit.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2025-04-20_971b1c13e0efcb5b4ff57b5c67dff89f_darkside_elex_lockbit.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2025-04-20_971b1c13e0efcb5b4ff57b5c67dff89f_darkside_elex_lockbit.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2025-04-20_971b1c13e0efcb5b4ff57b5c67dff89f_darkside_elex_lockbit.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2025-04-20_971b1c13e0efcb5b4ff57b5c67dff89f_darkside_elex_lockbit.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2025-04-20_971b1c13e0efcb5b4ff57b5c67dff89f_darkside_elex_lockbit.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2025-04-20_971b1c13e0efcb5b4ff57b5c67dff89f_darkside_elex_lockbit.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2025-04-20_971b1c13e0efcb5b4ff57b5c67dff89f_darkside_elex_lockbit.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2025-04-20_971b1c13e0efcb5b4ff57b5c67dff89f_darkside_elex_lockbit.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2025-04-20_971b1c13e0efcb5b4ff57b5c67dff89f_darkside_elex_lockbit.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2025-04-20_971b1c13e0efcb5b4ff57b5c67dff89f_darkside_elex_lockbit.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2025-04-20_971b1c13e0efcb5b4ff57b5c67dff89f_darkside_elex_lockbit.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2025-04-20_971b1c13e0efcb5b4ff57b5c67dff89f_darkside_elex_lockbit.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2025-04-20_971b1c13e0efcb5b4ff57b5c67dff89f_darkside_elex_lockbit.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2025-04-20_971b1c13e0efcb5b4ff57b5c67dff89f_darkside_elex_lockbit.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2025-04-20_971b1c13e0efcb5b4ff57b5c67dff89f_darkside_elex_lockbit.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2025-04-20_971b1c13e0efcb5b4ff57b5c67dff89f_darkside_elex_lockbit.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2025-04-20_971b1c13e0efcb5b4ff57b5c67dff89f_darkside_elex_lockbit.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2025-04-20_971b1c13e0efcb5b4ff57b5c67dff89f_darkside_elex_lockbit.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2025-04-20_971b1c13e0efcb5b4ff57b5c67dff89f_darkside_elex_lockbit.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2025-04-20_971b1c13e0efcb5b4ff57b5c67dff89f_darkside_elex_lockbit.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2025-04-20_971b1c13e0efcb5b4ff57b5c67dff89f_darkside_elex_lockbit.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2025-04-20_971b1c13e0efcb5b4ff57b5c67dff89f_darkside_elex_lockbit.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2025-04-20_971b1c13e0efcb5b4ff57b5c67dff89f_darkside_elex_lockbit.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2025-04-20_971b1c13e0efcb5b4ff57b5c67dff89f_darkside_elex_lockbit.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2025-04-20_971b1c13e0efcb5b4ff57b5c67dff89f_darkside_elex_lockbit.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2025-04-20_971b1c13e0efcb5b4ff57b5c67dff89f_darkside_elex_lockbit.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2025-04-20_971b1c13e0efcb5b4ff57b5c67dff89f_darkside_elex_lockbit.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2025-04-20_971b1c13e0efcb5b4ff57b5c67dff89f_darkside_elex_lockbit.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2025-04-20_971b1c13e0efcb5b4ff57b5c67dff89f_darkside_elex_lockbit.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2025-04-20_971b1c13e0efcb5b4ff57b5c67dff89f_darkside_elex_lockbit.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2025-04-20_971b1c13e0efcb5b4ff57b5c67dff89f_darkside_elex_lockbit.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2025-04-20_971b1c13e0efcb5b4ff57b5c67dff89f_darkside_elex_lockbit.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2025-04-20_971b1c13e0efcb5b4ff57b5c67dff89f_darkside_elex_lockbit.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2025-04-20_971b1c13e0efcb5b4ff57b5c67dff89f_darkside_elex_lockbit.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2025-04-20_971b1c13e0efcb5b4ff57b5c67dff89f_darkside_elex_lockbit.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2025-04-20_971b1c13e0efcb5b4ff57b5c67dff89f_darkside_elex_lockbit.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2025-04-20_971b1c13e0efcb5b4ff57b5c67dff89f_darkside_elex_lockbit.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2025-04-20_971b1c13e0efcb5b4ff57b5c67dff89f_darkside_elex_lockbit.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2025-04-20_971b1c13e0efcb5b4ff57b5c67dff89f_darkside_elex_lockbit.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2025-04-20_971b1c13e0efcb5b4ff57b5c67dff89f_darkside_elex_lockbit.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2025-04-20_971b1c13e0efcb5b4ff57b5c67dff89f_darkside_elex_lockbit.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2025-04-20_971b1c13e0efcb5b4ff57b5c67dff89f_darkside_elex_lockbit.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2025-04-20_971b1c13e0efcb5b4ff57b5c67dff89f_darkside_elex_lockbit.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2025-04-20_971b1c13e0efcb5b4ff57b5c67dff89f_darkside_elex_lockbit.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2025-04-20_971b1c13e0efcb5b4ff57b5c67dff89f_darkside_elex_lockbit.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 3020 wrote to memory of 3968 N/A C:\Users\Admin\AppData\Local\Temp\2025-04-20_971b1c13e0efcb5b4ff57b5c67dff89f_darkside_elex_lockbit.exe C:\Windows\splwow64.exe
PID 3020 wrote to memory of 3968 N/A C:\Users\Admin\AppData\Local\Temp\2025-04-20_971b1c13e0efcb5b4ff57b5c67dff89f_darkside_elex_lockbit.exe C:\Windows\splwow64.exe
PID 5080 wrote to memory of 3708 N/A C:\Windows\system32\printfilterpipelinesvc.exe C:\Program Files\Microsoft Office\root\Office16\ONENOTE.EXE
PID 5080 wrote to memory of 3708 N/A C:\Windows\system32\printfilterpipelinesvc.exe C:\Program Files\Microsoft Office\root\Office16\ONENOTE.EXE
PID 3020 wrote to memory of 4796 N/A C:\Users\Admin\AppData\Local\Temp\2025-04-20_971b1c13e0efcb5b4ff57b5c67dff89f_darkside_elex_lockbit.exe C:\ProgramData\762B.tmp
PID 3020 wrote to memory of 4796 N/A C:\Users\Admin\AppData\Local\Temp\2025-04-20_971b1c13e0efcb5b4ff57b5c67dff89f_darkside_elex_lockbit.exe C:\ProgramData\762B.tmp
PID 3020 wrote to memory of 4796 N/A C:\Users\Admin\AppData\Local\Temp\2025-04-20_971b1c13e0efcb5b4ff57b5c67dff89f_darkside_elex_lockbit.exe C:\ProgramData\762B.tmp
PID 3020 wrote to memory of 4796 N/A C:\Users\Admin\AppData\Local\Temp\2025-04-20_971b1c13e0efcb5b4ff57b5c67dff89f_darkside_elex_lockbit.exe C:\ProgramData\762B.tmp
PID 4796 wrote to memory of 3552 N/A C:\ProgramData\762B.tmp C:\Windows\SysWOW64\cmd.exe
PID 4796 wrote to memory of 3552 N/A C:\ProgramData\762B.tmp C:\Windows\SysWOW64\cmd.exe
PID 4796 wrote to memory of 3552 N/A C:\ProgramData\762B.tmp C:\Windows\SysWOW64\cmd.exe

Processes

C:\Users\Admin\AppData\Local\Temp\2025-04-20_971b1c13e0efcb5b4ff57b5c67dff89f_darkside_elex_lockbit.exe

"C:\Users\Admin\AppData\Local\Temp\2025-04-20_971b1c13e0efcb5b4ff57b5c67dff89f_darkside_elex_lockbit.exe"

C:\Windows\splwow64.exe

C:\Windows\splwow64.exe 12288

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k PrintWorkflow -s PrintWorkflowUserSvc

C:\Windows\system32\printfilterpipelinesvc.exe

C:\Windows\system32\printfilterpipelinesvc.exe -Embedding

C:\Program Files\Microsoft Office\root\Office16\ONENOTE.EXE

/insertdoc "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\{FCB93997-9C46-465A-993F-DAF0EBFE2238}.xps" 133896352967590000

C:\ProgramData\762B.tmp

"C:\ProgramData\762B.tmp"

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /C DEL /F /Q C:\PROGRA~3\762B.tmp >> NUL

Network

Country Destination Domain Proto
IE 52.109.76.243:443 roaming.officeapps.live.com tcp
NL 173.194.69.94:80 c.pki.goog tcp

Files

memory/3020-0-0x00000000031D0000-0x00000000031E0000-memory.dmp

memory/3020-2-0x00000000031D0000-0x00000000031E0000-memory.dmp

memory/3020-1-0x00000000031D0000-0x00000000031E0000-memory.dmp

C:\$Recycle.Bin\S-1-5-21-599783296-1627459723-2423478968-1000\JJJJJJJJJJJ

MD5 91033b3d59f65017a529bb0a109b7c07
SHA1 7cb56754e15310008efc439566740847314173f2
SHA256 d20428a5b6eb0bcd2558fcbd3ecab31d89451dbdd3956336f05e112a04444390
SHA512 09bef8b5ac06d7723bd41e47ee0508b75f90d235ecfe120cb513a4293dfa9c1aa15f4097d79508ad49f65f12767f7ababfedb6565848225a033af87b8db71695

F:\$RECYCLE.BIN\S-1-5-21-599783296-1627459723-2423478968-1000\DDDDDDDDDDD

MD5 9b01fbca2b2c155459eb316b38b47e70
SHA1 266eb2bc748e764ae13672c90fe378a3e5257c1e
SHA256 1c10b1797b4df711af5e3aeed5a6b9f40b109b31e75c97117a3c70e30827f5cc
SHA512 1c89e24f0500e49fde33c50f26642927ac9ff416aa85eebfc3fbb6ae82911f2244aa5dc5d8339bdea19b64859aabb000c383a000ab753cef07623bb0831e30ce

C:\Users\V86sTiCVN.README.txt

MD5 b68e8700aaef67efa52ca6cc001e1ebc
SHA1 814a1dabc523fb9db85484e5df51d9e9a191593c
SHA256 617decb61b0a22b3bc50423b030e37df13d32f3c096dbf37d7e03cb9bd8b4eb2
SHA512 29f6d12968fe911cadfde2932c3ebffab71570b6fefd42dcc22aa2a595d8c8df29c29e41c4667a1a37f2de4f22fe4b0fa7969468d48f6351b13796337c6ad1fe

memory/3020-3559-0x00000000031D0000-0x00000000031E0000-memory.dmp

memory/3020-3560-0x00000000031D0000-0x00000000031E0000-memory.dmp

memory/3020-3561-0x00000000031D0000-0x00000000031E0000-memory.dmp

C:\ProgramData\762B.tmp

MD5 294e9f64cb1642dd89229fff0592856b
SHA1 97b148c27f3da29ba7b18d6aee8a0db9102f47c9
SHA256 917e115cc403e29b4388e0d175cbfac3e7e40ca1742299fbdb353847db2de7c2
SHA512 b87d531890bf1577b9b4af41dddb2cdbbfa164cf197bd5987df3a3075983645a3acba443e289b7bfd338422978a104f55298fbfe346872de0895bde44adc89cf

memory/3708-3576-0x00007FF930B50000-0x00007FF930B60000-memory.dmp

memory/3708-3578-0x00007FF930B50000-0x00007FF930B60000-memory.dmp

memory/3708-3577-0x00007FF930B50000-0x00007FF930B60000-memory.dmp

memory/3708-3580-0x00007FF930B50000-0x00007FF930B60000-memory.dmp

memory/3708-3581-0x00007FF930B50000-0x00007FF930B60000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\CCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCC

MD5 e3d37add22b687d836ff72de86572702
SHA1 eeadedb1e7215a96bffbb3945dff05e052c82d93
SHA256 f5f3bc9e35d876bae48df6de82392418e2d4416f928325722d68133a4674740f
SHA512 5af379bccdcfde0ab792a1a92d9a114435e46ba58b8271da258926835ba6904aa9941a050f8f364b0ac84ba7ee932f838e01bf500c909ce8f8fb67423c38d01e

memory/3708-3610-0x00007FF92E190000-0x00007FF92E1A0000-memory.dmp

memory/3708-3611-0x00007FF92E190000-0x00007FF92E1A0000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\{D3178B67-1392-4681-9BAC-761DD79E0879}

MD5 6881b836a342607405f90ca9b88f3d3a
SHA1 1a4b4e5b3e751307122e85a75558436c9bea67c0
SHA256 7797b4fcab5dc6a637a8a97683e9b1e30e74d5ada65d6f0b6f4379f9c0c8d931
SHA512 82c7b72df66a69e34e5ce84ade1d8a772387ad4649e41740e49865cde8ce362c7c02fce828c1226468442155ffa34cef65b3036f4cbe1c57453a1ef7a6f282e5

C:\Users\Admin\Documents\OneNote Notebooks\My Notebook\Open Notebook.onetoc2

MD5 e28e8cf7fbc1b3c3117e501e7cefba32
SHA1 d677e0c9940dffa2815c746443d2e77d88780770
SHA256 fcc695367e4acddcf6ec4fba23b0777c558ebfb0b170f82751a7584bac0c9aba
SHA512 b35104077a57da5930df15b96d6c58a8c113a6eebe2d8c82423c84bb42923cf34dcb52ba72db7d5a6fd2cf6da7ba76442a02e8a8d1772eca2022bbba60b0d6e9