Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    143s
  • max time network
    105s
  • platform
    windows7_x64
  • resource
    win7-20230220-en
  • resource tags

    arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
  • submitted
    18/05/2023, 13:44

General

  • Target

    202305173caa52bf3388a5a37efe69ef1ff8055edarkside.exe

  • Size

    146KB

  • MD5

    3caa52bf3388a5a37efe69ef1ff8055e

  • SHA1

    258a6ea8a43e98653e4e7095dbc2ddf6b8a196e5

  • SHA256

    a8fe7e11f97a293db5fda072cc9e64a161c76ababd37754acce5ccd6dfa30d1c

  • SHA512

    606df9ba4077bb9c2bc4004a437354ea6343e730e1efb466103de5b2dc6b0584384e7b8d4886d973ec5b978112553349e17287b11f9c6d8c3ee38b33b74fdde5

  • SSDEEP

    3072:HqJogYkcSNm9V7DEqkByaf4I2jH4sT6T:Hq2kc4m9tDERBl76H4sT

Malware Config

Signatures

  • Renames multiple (341) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

  • Modifies extensions of user files 21 IoCs

    Ransomware generally changes the extension on encrypted files.

  • Deletes itself 1 IoCs
  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 1 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Drops desktop.ini file(s) 1 IoCs
  • Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious behavior: EnumeratesProcesses 16 IoCs
  • Suspicious behavior: RenamesItself 26 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of WriteProcessMemory 9 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\202305173caa52bf3388a5a37efe69ef1ff8055edarkside.exe
    "C:\Users\Admin\AppData\Local\Temp\202305173caa52bf3388a5a37efe69ef1ff8055edarkside.exe"
    1⤵
    • Modifies extensions of user files
    • Loads dropped DLL
    • Drops desktop.ini file(s)
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:1264
    • C:\ProgramData\4B34.tmp
      "C:\ProgramData\4B34.tmp"
      2⤵
      • Deletes itself
      • Executes dropped EXE
      • Suspicious use of NtSetInformationThreadHideFromDebugger
      • Suspicious behavior: RenamesItself
      • Suspicious use of WriteProcessMemory
      PID:1972
      • C:\Windows\SysWOW64\cmd.exe
        "C:\Windows\System32\cmd.exe" /C DEL /F /Q C:\PROGRA~3\4B34.tmp >> NUL
        3⤵
          PID:2028
    • C:\Windows\system32\AUDIODG.EXE
      C:\Windows\system32\AUDIODG.EXE 0x154
      1⤵
        PID:268

      Network

      MITRE ATT&CK Enterprise v6

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\$Recycle.Bin\S-1-5-21-3499517378-2376672570-1134980332-1000\AAAAAAAAAAA

        Filesize

        129B

        MD5

        56fb34b13140d5dff7bb28bcb5acbf98

        SHA1

        8265119e224189291d18c84ca8dab72dab115287

        SHA256

        546835c8ad217464e0e8c9deb147c31fb4165db72139c887b485d902e3e073d0

        SHA512

        38456a188f1eaf675904b20d6cda790941d0e2cfe498ae1dd18564b19974a95b3f33f6e2cbcdb4c863cbf91b2cadf241c7cc84bdddad7d1af24bef2b449b3a82

      • C:\$Recycle.Bin\S-1-5-21-3499517378-2376672570-1134980332-1000\BBBBBBBBBBB

        Filesize

        129B

        MD5

        56fb34b13140d5dff7bb28bcb5acbf98

        SHA1

        8265119e224189291d18c84ca8dab72dab115287

        SHA256

        546835c8ad217464e0e8c9deb147c31fb4165db72139c887b485d902e3e073d0

        SHA512

        38456a188f1eaf675904b20d6cda790941d0e2cfe498ae1dd18564b19974a95b3f33f6e2cbcdb4c863cbf91b2cadf241c7cc84bdddad7d1af24bef2b449b3a82

      • C:\$Recycle.Bin\S-1-5-21-3499517378-2376672570-1134980332-1000\CCCCCCCCCCC

        Filesize

        129B

        MD5

        56fb34b13140d5dff7bb28bcb5acbf98

        SHA1

        8265119e224189291d18c84ca8dab72dab115287

        SHA256

        546835c8ad217464e0e8c9deb147c31fb4165db72139c887b485d902e3e073d0

        SHA512

        38456a188f1eaf675904b20d6cda790941d0e2cfe498ae1dd18564b19974a95b3f33f6e2cbcdb4c863cbf91b2cadf241c7cc84bdddad7d1af24bef2b449b3a82

      • C:\$Recycle.Bin\S-1-5-21-3499517378-2376672570-1134980332-1000\DDDDDDDDDDD

        Filesize

        129B

        MD5

        56fb34b13140d5dff7bb28bcb5acbf98

        SHA1

        8265119e224189291d18c84ca8dab72dab115287

        SHA256

        546835c8ad217464e0e8c9deb147c31fb4165db72139c887b485d902e3e073d0

        SHA512

        38456a188f1eaf675904b20d6cda790941d0e2cfe498ae1dd18564b19974a95b3f33f6e2cbcdb4c863cbf91b2cadf241c7cc84bdddad7d1af24bef2b449b3a82

      • C:\$Recycle.Bin\S-1-5-21-3499517378-2376672570-1134980332-1000\DDDDDDDDDDD

        Filesize

        129B

        MD5

        56fb34b13140d5dff7bb28bcb5acbf98

        SHA1

        8265119e224189291d18c84ca8dab72dab115287

        SHA256

        546835c8ad217464e0e8c9deb147c31fb4165db72139c887b485d902e3e073d0

        SHA512

        38456a188f1eaf675904b20d6cda790941d0e2cfe498ae1dd18564b19974a95b3f33f6e2cbcdb4c863cbf91b2cadf241c7cc84bdddad7d1af24bef2b449b3a82

      • C:\$Recycle.Bin\S-1-5-21-3499517378-2376672570-1134980332-1000\EEEEEEEEEEE

        Filesize

        129B

        MD5

        56fb34b13140d5dff7bb28bcb5acbf98

        SHA1

        8265119e224189291d18c84ca8dab72dab115287

        SHA256

        546835c8ad217464e0e8c9deb147c31fb4165db72139c887b485d902e3e073d0

        SHA512

        38456a188f1eaf675904b20d6cda790941d0e2cfe498ae1dd18564b19974a95b3f33f6e2cbcdb4c863cbf91b2cadf241c7cc84bdddad7d1af24bef2b449b3a82

      • C:\$Recycle.Bin\S-1-5-21-3499517378-2376672570-1134980332-1000\FFFFFFFFFFF

        Filesize

        129B

        MD5

        56fb34b13140d5dff7bb28bcb5acbf98

        SHA1

        8265119e224189291d18c84ca8dab72dab115287

        SHA256

        546835c8ad217464e0e8c9deb147c31fb4165db72139c887b485d902e3e073d0

        SHA512

        38456a188f1eaf675904b20d6cda790941d0e2cfe498ae1dd18564b19974a95b3f33f6e2cbcdb4c863cbf91b2cadf241c7cc84bdddad7d1af24bef2b449b3a82

      • C:\$Recycle.Bin\S-1-5-21-3499517378-2376672570-1134980332-1000\GGGGGGGGGGG

        Filesize

        129B

        MD5

        56fb34b13140d5dff7bb28bcb5acbf98

        SHA1

        8265119e224189291d18c84ca8dab72dab115287

        SHA256

        546835c8ad217464e0e8c9deb147c31fb4165db72139c887b485d902e3e073d0

        SHA512

        38456a188f1eaf675904b20d6cda790941d0e2cfe498ae1dd18564b19974a95b3f33f6e2cbcdb4c863cbf91b2cadf241c7cc84bdddad7d1af24bef2b449b3a82

      • C:\$Recycle.Bin\S-1-5-21-3499517378-2376672570-1134980332-1000\HHHHHHHHHHH

        Filesize

        129B

        MD5

        56fb34b13140d5dff7bb28bcb5acbf98

        SHA1

        8265119e224189291d18c84ca8dab72dab115287

        SHA256

        546835c8ad217464e0e8c9deb147c31fb4165db72139c887b485d902e3e073d0

        SHA512

        38456a188f1eaf675904b20d6cda790941d0e2cfe498ae1dd18564b19974a95b3f33f6e2cbcdb4c863cbf91b2cadf241c7cc84bdddad7d1af24bef2b449b3a82

      • C:\$Recycle.Bin\S-1-5-21-3499517378-2376672570-1134980332-1000\IIIIIIIIIII

        Filesize

        129B

        MD5

        56fb34b13140d5dff7bb28bcb5acbf98

        SHA1

        8265119e224189291d18c84ca8dab72dab115287

        SHA256

        546835c8ad217464e0e8c9deb147c31fb4165db72139c887b485d902e3e073d0

        SHA512

        38456a188f1eaf675904b20d6cda790941d0e2cfe498ae1dd18564b19974a95b3f33f6e2cbcdb4c863cbf91b2cadf241c7cc84bdddad7d1af24bef2b449b3a82

      • C:\$Recycle.Bin\S-1-5-21-3499517378-2376672570-1134980332-1000\JJJJJJJJJJJ

        Filesize

        129B

        MD5

        56fb34b13140d5dff7bb28bcb5acbf98

        SHA1

        8265119e224189291d18c84ca8dab72dab115287

        SHA256

        546835c8ad217464e0e8c9deb147c31fb4165db72139c887b485d902e3e073d0

        SHA512

        38456a188f1eaf675904b20d6cda790941d0e2cfe498ae1dd18564b19974a95b3f33f6e2cbcdb4c863cbf91b2cadf241c7cc84bdddad7d1af24bef2b449b3a82

      • C:\$Recycle.Bin\S-1-5-21-3499517378-2376672570-1134980332-1000\KKKKKKKKKKK

        Filesize

        129B

        MD5

        56fb34b13140d5dff7bb28bcb5acbf98

        SHA1

        8265119e224189291d18c84ca8dab72dab115287

        SHA256

        546835c8ad217464e0e8c9deb147c31fb4165db72139c887b485d902e3e073d0

        SHA512

        38456a188f1eaf675904b20d6cda790941d0e2cfe498ae1dd18564b19974a95b3f33f6e2cbcdb4c863cbf91b2cadf241c7cc84bdddad7d1af24bef2b449b3a82

      • C:\$Recycle.Bin\S-1-5-21-3499517378-2376672570-1134980332-1000\LLLLLLLLLLL

        Filesize

        129B

        MD5

        56fb34b13140d5dff7bb28bcb5acbf98

        SHA1

        8265119e224189291d18c84ca8dab72dab115287

        SHA256

        546835c8ad217464e0e8c9deb147c31fb4165db72139c887b485d902e3e073d0

        SHA512

        38456a188f1eaf675904b20d6cda790941d0e2cfe498ae1dd18564b19974a95b3f33f6e2cbcdb4c863cbf91b2cadf241c7cc84bdddad7d1af24bef2b449b3a82

      • C:\$Recycle.Bin\S-1-5-21-3499517378-2376672570-1134980332-1000\MMMMMMMMMMM

        Filesize

        129B

        MD5

        56fb34b13140d5dff7bb28bcb5acbf98

        SHA1

        8265119e224189291d18c84ca8dab72dab115287

        SHA256

        546835c8ad217464e0e8c9deb147c31fb4165db72139c887b485d902e3e073d0

        SHA512

        38456a188f1eaf675904b20d6cda790941d0e2cfe498ae1dd18564b19974a95b3f33f6e2cbcdb4c863cbf91b2cadf241c7cc84bdddad7d1af24bef2b449b3a82

      • C:\$Recycle.Bin\S-1-5-21-3499517378-2376672570-1134980332-1000\NNNNNNNNNNN

        Filesize

        129B

        MD5

        56fb34b13140d5dff7bb28bcb5acbf98

        SHA1

        8265119e224189291d18c84ca8dab72dab115287

        SHA256

        546835c8ad217464e0e8c9deb147c31fb4165db72139c887b485d902e3e073d0

        SHA512

        38456a188f1eaf675904b20d6cda790941d0e2cfe498ae1dd18564b19974a95b3f33f6e2cbcdb4c863cbf91b2cadf241c7cc84bdddad7d1af24bef2b449b3a82

      • C:\$Recycle.Bin\S-1-5-21-3499517378-2376672570-1134980332-1000\OOOOOOOOOOO

        Filesize

        129B

        MD5

        56fb34b13140d5dff7bb28bcb5acbf98

        SHA1

        8265119e224189291d18c84ca8dab72dab115287

        SHA256

        546835c8ad217464e0e8c9deb147c31fb4165db72139c887b485d902e3e073d0

        SHA512

        38456a188f1eaf675904b20d6cda790941d0e2cfe498ae1dd18564b19974a95b3f33f6e2cbcdb4c863cbf91b2cadf241c7cc84bdddad7d1af24bef2b449b3a82

      • C:\$Recycle.Bin\S-1-5-21-3499517378-2376672570-1134980332-1000\PPPPPPPPPPP

        Filesize

        129B

        MD5

        56fb34b13140d5dff7bb28bcb5acbf98

        SHA1

        8265119e224189291d18c84ca8dab72dab115287

        SHA256

        546835c8ad217464e0e8c9deb147c31fb4165db72139c887b485d902e3e073d0

        SHA512

        38456a188f1eaf675904b20d6cda790941d0e2cfe498ae1dd18564b19974a95b3f33f6e2cbcdb4c863cbf91b2cadf241c7cc84bdddad7d1af24bef2b449b3a82

      • C:\$Recycle.Bin\S-1-5-21-3499517378-2376672570-1134980332-1000\QQQQQQQQQQQ

        Filesize

        129B

        MD5

        56fb34b13140d5dff7bb28bcb5acbf98

        SHA1

        8265119e224189291d18c84ca8dab72dab115287

        SHA256

        546835c8ad217464e0e8c9deb147c31fb4165db72139c887b485d902e3e073d0

        SHA512

        38456a188f1eaf675904b20d6cda790941d0e2cfe498ae1dd18564b19974a95b3f33f6e2cbcdb4c863cbf91b2cadf241c7cc84bdddad7d1af24bef2b449b3a82

      • C:\$Recycle.Bin\S-1-5-21-3499517378-2376672570-1134980332-1000\RRRRRRRRRRR

        Filesize

        129B

        MD5

        56fb34b13140d5dff7bb28bcb5acbf98

        SHA1

        8265119e224189291d18c84ca8dab72dab115287

        SHA256

        546835c8ad217464e0e8c9deb147c31fb4165db72139c887b485d902e3e073d0

        SHA512

        38456a188f1eaf675904b20d6cda790941d0e2cfe498ae1dd18564b19974a95b3f33f6e2cbcdb4c863cbf91b2cadf241c7cc84bdddad7d1af24bef2b449b3a82

      • C:\$Recycle.Bin\S-1-5-21-3499517378-2376672570-1134980332-1000\SSSSSSSSSSS

        Filesize

        129B

        MD5

        56fb34b13140d5dff7bb28bcb5acbf98

        SHA1

        8265119e224189291d18c84ca8dab72dab115287

        SHA256

        546835c8ad217464e0e8c9deb147c31fb4165db72139c887b485d902e3e073d0

        SHA512

        38456a188f1eaf675904b20d6cda790941d0e2cfe498ae1dd18564b19974a95b3f33f6e2cbcdb4c863cbf91b2cadf241c7cc84bdddad7d1af24bef2b449b3a82

      • C:\$Recycle.Bin\S-1-5-21-3499517378-2376672570-1134980332-1000\TTTTTTTTTTT

        Filesize

        129B

        MD5

        56fb34b13140d5dff7bb28bcb5acbf98

        SHA1

        8265119e224189291d18c84ca8dab72dab115287

        SHA256

        546835c8ad217464e0e8c9deb147c31fb4165db72139c887b485d902e3e073d0

        SHA512

        38456a188f1eaf675904b20d6cda790941d0e2cfe498ae1dd18564b19974a95b3f33f6e2cbcdb4c863cbf91b2cadf241c7cc84bdddad7d1af24bef2b449b3a82

      • C:\$Recycle.Bin\S-1-5-21-3499517378-2376672570-1134980332-1000\UUUUUUUUUUU

        Filesize

        129B

        MD5

        56fb34b13140d5dff7bb28bcb5acbf98

        SHA1

        8265119e224189291d18c84ca8dab72dab115287

        SHA256

        546835c8ad217464e0e8c9deb147c31fb4165db72139c887b485d902e3e073d0

        SHA512

        38456a188f1eaf675904b20d6cda790941d0e2cfe498ae1dd18564b19974a95b3f33f6e2cbcdb4c863cbf91b2cadf241c7cc84bdddad7d1af24bef2b449b3a82

      • C:\$Recycle.Bin\S-1-5-21-3499517378-2376672570-1134980332-1000\VVVVVVVVVVV

        Filesize

        129B

        MD5

        56fb34b13140d5dff7bb28bcb5acbf98

        SHA1

        8265119e224189291d18c84ca8dab72dab115287

        SHA256

        546835c8ad217464e0e8c9deb147c31fb4165db72139c887b485d902e3e073d0

        SHA512

        38456a188f1eaf675904b20d6cda790941d0e2cfe498ae1dd18564b19974a95b3f33f6e2cbcdb4c863cbf91b2cadf241c7cc84bdddad7d1af24bef2b449b3a82

      • C:\$Recycle.Bin\S-1-5-21-3499517378-2376672570-1134980332-1000\WWWWWWWWWWW

        Filesize

        129B

        MD5

        56fb34b13140d5dff7bb28bcb5acbf98

        SHA1

        8265119e224189291d18c84ca8dab72dab115287

        SHA256

        546835c8ad217464e0e8c9deb147c31fb4165db72139c887b485d902e3e073d0

        SHA512

        38456a188f1eaf675904b20d6cda790941d0e2cfe498ae1dd18564b19974a95b3f33f6e2cbcdb4c863cbf91b2cadf241c7cc84bdddad7d1af24bef2b449b3a82

      • C:\$Recycle.Bin\S-1-5-21-3499517378-2376672570-1134980332-1000\XXXXXXXXXXX

        Filesize

        129B

        MD5

        56fb34b13140d5dff7bb28bcb5acbf98

        SHA1

        8265119e224189291d18c84ca8dab72dab115287

        SHA256

        546835c8ad217464e0e8c9deb147c31fb4165db72139c887b485d902e3e073d0

        SHA512

        38456a188f1eaf675904b20d6cda790941d0e2cfe498ae1dd18564b19974a95b3f33f6e2cbcdb4c863cbf91b2cadf241c7cc84bdddad7d1af24bef2b449b3a82

      • C:\$Recycle.Bin\S-1-5-21-3499517378-2376672570-1134980332-1000\YYYYYYYYYYY

        Filesize

        129B

        MD5

        56fb34b13140d5dff7bb28bcb5acbf98

        SHA1

        8265119e224189291d18c84ca8dab72dab115287

        SHA256

        546835c8ad217464e0e8c9deb147c31fb4165db72139c887b485d902e3e073d0

        SHA512

        38456a188f1eaf675904b20d6cda790941d0e2cfe498ae1dd18564b19974a95b3f33f6e2cbcdb4c863cbf91b2cadf241c7cc84bdddad7d1af24bef2b449b3a82

      • C:\$Recycle.Bin\S-1-5-21-3499517378-2376672570-1134980332-1000\desktop.ini

        Filesize

        129B

        MD5

        56fb34b13140d5dff7bb28bcb5acbf98

        SHA1

        8265119e224189291d18c84ca8dab72dab115287

        SHA256

        546835c8ad217464e0e8c9deb147c31fb4165db72139c887b485d902e3e073d0

        SHA512

        38456a188f1eaf675904b20d6cda790941d0e2cfe498ae1dd18564b19974a95b3f33f6e2cbcdb4c863cbf91b2cadf241c7cc84bdddad7d1af24bef2b449b3a82

      • C:\ProgramData\4B34.tmp

        Filesize

        14KB

        MD5

        294e9f64cb1642dd89229fff0592856b

        SHA1

        97b148c27f3da29ba7b18d6aee8a0db9102f47c9

        SHA256

        917e115cc403e29b4388e0d175cbfac3e7e40ca1742299fbdb353847db2de7c2

        SHA512

        b87d531890bf1577b9b4af41dddb2cdbbfa164cf197bd5987df3a3075983645a3acba443e289b7bfd338422978a104f55298fbfe346872de0895bde44adc89cf

      • C:\ProgramData\4B34.tmp

        Filesize

        14KB

        MD5

        294e9f64cb1642dd89229fff0592856b

        SHA1

        97b148c27f3da29ba7b18d6aee8a0db9102f47c9

        SHA256

        917e115cc403e29b4388e0d175cbfac3e7e40ca1742299fbdb353847db2de7c2

        SHA512

        b87d531890bf1577b9b4af41dddb2cdbbfa164cf197bd5987df3a3075983645a3acba443e289b7bfd338422978a104f55298fbfe346872de0895bde44adc89cf

      • C:\Users\Admin\AppData\Local\Temp\DDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDD

        Filesize

        146KB

        MD5

        2c934a1e961b8a71cb6b2a665adeee8b

        SHA1

        bc920419e80453ce707f1a5e28f81361e8c6c56c

        SHA256

        8f5bd9207fe5341990c45c18f1a0ff00a84d614b35c54e163383e57a25716d18

        SHA512

        df58b60f7d06a7ccf1440fab5d7e959a0e9e3099ba98e1ff606d5c87433805400694516350d0965d35d332096e8ae67623b4bc6e676bba3ea22c931c2fc2b0be

      • C:\XHv8ix3OM.README.txt

        Filesize

        411B

        MD5

        aafbde6cf673785b520c3148d7c3c685

        SHA1

        0ef0c1ccc0f2a0612bcf307374b9d6ee0ca33e75

        SHA256

        76c3e73496d7c44c23249270d52212f24578a2e92fcf75acf054f3850e12f90d

        SHA512

        74564e78ea36f025dab73c87db0473b8be82bd2584d26f69a3ccbd3c44e4b88275d12ab2d5740924fa8b2c4e5724638506e3fc4593cf35e8e18fd0ce30088ce1

      • \ProgramData\4B34.tmp

        Filesize

        14KB

        MD5

        294e9f64cb1642dd89229fff0592856b

        SHA1

        97b148c27f3da29ba7b18d6aee8a0db9102f47c9

        SHA256

        917e115cc403e29b4388e0d175cbfac3e7e40ca1742299fbdb353847db2de7c2

        SHA512

        b87d531890bf1577b9b4af41dddb2cdbbfa164cf197bd5987df3a3075983645a3acba443e289b7bfd338422978a104f55298fbfe346872de0895bde44adc89cf

      • memory/1264-132-0x0000000000A10000-0x0000000000A50000-memory.dmp

        Filesize

        256KB

      • memory/1264-137-0x0000000000A10000-0x0000000000A50000-memory.dmp

        Filesize

        256KB

      • memory/1264-879-0x0000000000A10000-0x0000000000A50000-memory.dmp

        Filesize

        256KB

      • memory/1972-914-0x0000000002295000-0x00000000022B3000-memory.dmp

        Filesize

        120KB