Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
143s -
max time network
159s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
26/03/2024, 14:28
Behavioral task
behavioral1
Sample
2024-03-26_679475b7a73405dd0c3fd038d0b107b8_darkside.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
2024-03-26_679475b7a73405dd0c3fd038d0b107b8_darkside.exe
Resource
win10v2004-20240226-en
General
-
Target
2024-03-26_679475b7a73405dd0c3fd038d0b107b8_darkside.exe
-
Size
147KB
-
MD5
679475b7a73405dd0c3fd038d0b107b8
-
SHA1
f5c824f8c8c1fe065aead63f8d56a7682eaece36
-
SHA256
415478012f448676e8a262afbcdc76d67763c87fab99d93c3db1612430f0d89d
-
SHA512
39d3ca516862b52daa16c7363b8fa41363e3271f6eff812b85140b8de8bb8f30d82cefda12012f1b05cee82e7731b6f70d1b65b241f536d3cc6b22da746b8441
-
SSDEEP
1536:ezICS4AAwczUUf8y8gvMH+1zGSNAojMP95D1xDquSYEuwkC7106P7ZqHjuJF6Uyz:FqJogYkcSNm9V7DlScwF75ZqDuCT
Malware Config
Signatures
-
Renames multiple (177) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\International\Geo\Nation CABE.tmp -
Deletes itself 1 IoCs
pid Process 4920 CABE.tmp -
Executes dropped EXE 1 IoCs
pid Process 4920 CABE.tmp -
Drops desktop.ini file(s) 2 IoCs
description ioc Process File opened for modification C:\$Recycle.Bin\S-1-5-21-3808065738-1666277613-1125846146-1000\desktop.ini 2024-03-26_679475b7a73405dd0c3fd038d0b107b8_darkside.exe File opened for modification F:\$RECYCLE.BIN\S-1-5-21-3808065738-1666277613-1125846146-1000\desktop.ini 2024-03-26_679475b7a73405dd0c3fd038d0b107b8_darkside.exe -
Drops file in System32 directory 4 IoCs
description ioc Process File created C:\Windows\system32\spool\PRINTERS\00002.SPL splwow64.exe File created C:\Windows\system32\spool\PRINTERS\PP87h8arlil2r5vmq0hu7r9_lwc.TMP printfilterpipelinesvc.exe File created C:\Windows\system32\spool\PRINTERS\PP2tm0f4rz76295252h1gd4catc.TMP printfilterpipelinesvc.exe File created C:\Windows\system32\spool\PRINTERS\PPu7j7abogh8d8bzfs5z12_4lwd.TMP printfilterpipelinesvc.exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
pid Process 4920 CABE.tmp -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 ONENOTE.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz ONENOTE.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString ONENOTE.EXE -
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS ONENOTE.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily ONENOTE.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU ONENOTE.EXE -
Suspicious behavior: EnumeratesProcesses 18 IoCs
pid Process 1948 2024-03-26_679475b7a73405dd0c3fd038d0b107b8_darkside.exe 1948 2024-03-26_679475b7a73405dd0c3fd038d0b107b8_darkside.exe 1948 2024-03-26_679475b7a73405dd0c3fd038d0b107b8_darkside.exe 1948 2024-03-26_679475b7a73405dd0c3fd038d0b107b8_darkside.exe 1948 2024-03-26_679475b7a73405dd0c3fd038d0b107b8_darkside.exe 1948 2024-03-26_679475b7a73405dd0c3fd038d0b107b8_darkside.exe 1948 2024-03-26_679475b7a73405dd0c3fd038d0b107b8_darkside.exe 1948 2024-03-26_679475b7a73405dd0c3fd038d0b107b8_darkside.exe 1948 2024-03-26_679475b7a73405dd0c3fd038d0b107b8_darkside.exe 1948 2024-03-26_679475b7a73405dd0c3fd038d0b107b8_darkside.exe 1948 2024-03-26_679475b7a73405dd0c3fd038d0b107b8_darkside.exe 1948 2024-03-26_679475b7a73405dd0c3fd038d0b107b8_darkside.exe 1948 2024-03-26_679475b7a73405dd0c3fd038d0b107b8_darkside.exe 1948 2024-03-26_679475b7a73405dd0c3fd038d0b107b8_darkside.exe 1948 2024-03-26_679475b7a73405dd0c3fd038d0b107b8_darkside.exe 1948 2024-03-26_679475b7a73405dd0c3fd038d0b107b8_darkside.exe 2900 ONENOTE.EXE 2900 ONENOTE.EXE -
Suspicious behavior: RenamesItself 26 IoCs
pid Process 4920 CABE.tmp 4920 CABE.tmp 4920 CABE.tmp 4920 CABE.tmp 4920 CABE.tmp 4920 CABE.tmp 4920 CABE.tmp 4920 CABE.tmp 4920 CABE.tmp 4920 CABE.tmp 4920 CABE.tmp 4920 CABE.tmp 4920 CABE.tmp 4920 CABE.tmp 4920 CABE.tmp 4920 CABE.tmp 4920 CABE.tmp 4920 CABE.tmp 4920 CABE.tmp 4920 CABE.tmp 4920 CABE.tmp 4920 CABE.tmp 4920 CABE.tmp 4920 CABE.tmp 4920 CABE.tmp 4920 CABE.tmp -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeAssignPrimaryTokenPrivilege 1948 2024-03-26_679475b7a73405dd0c3fd038d0b107b8_darkside.exe Token: SeBackupPrivilege 1948 2024-03-26_679475b7a73405dd0c3fd038d0b107b8_darkside.exe Token: SeDebugPrivilege 1948 2024-03-26_679475b7a73405dd0c3fd038d0b107b8_darkside.exe Token: 36 1948 2024-03-26_679475b7a73405dd0c3fd038d0b107b8_darkside.exe Token: SeImpersonatePrivilege 1948 2024-03-26_679475b7a73405dd0c3fd038d0b107b8_darkside.exe Token: SeIncBasePriorityPrivilege 1948 2024-03-26_679475b7a73405dd0c3fd038d0b107b8_darkside.exe Token: SeIncreaseQuotaPrivilege 1948 2024-03-26_679475b7a73405dd0c3fd038d0b107b8_darkside.exe Token: 33 1948 2024-03-26_679475b7a73405dd0c3fd038d0b107b8_darkside.exe Token: SeManageVolumePrivilege 1948 2024-03-26_679475b7a73405dd0c3fd038d0b107b8_darkside.exe Token: SeProfSingleProcessPrivilege 1948 2024-03-26_679475b7a73405dd0c3fd038d0b107b8_darkside.exe Token: SeRestorePrivilege 1948 2024-03-26_679475b7a73405dd0c3fd038d0b107b8_darkside.exe Token: SeSecurityPrivilege 1948 2024-03-26_679475b7a73405dd0c3fd038d0b107b8_darkside.exe Token: SeSystemProfilePrivilege 1948 2024-03-26_679475b7a73405dd0c3fd038d0b107b8_darkside.exe Token: SeTakeOwnershipPrivilege 1948 2024-03-26_679475b7a73405dd0c3fd038d0b107b8_darkside.exe Token: SeShutdownPrivilege 1948 2024-03-26_679475b7a73405dd0c3fd038d0b107b8_darkside.exe Token: SeDebugPrivilege 1948 2024-03-26_679475b7a73405dd0c3fd038d0b107b8_darkside.exe Token: SeBackupPrivilege 1948 2024-03-26_679475b7a73405dd0c3fd038d0b107b8_darkside.exe Token: SeBackupPrivilege 1948 2024-03-26_679475b7a73405dd0c3fd038d0b107b8_darkside.exe Token: SeSecurityPrivilege 1948 2024-03-26_679475b7a73405dd0c3fd038d0b107b8_darkside.exe Token: SeSecurityPrivilege 1948 2024-03-26_679475b7a73405dd0c3fd038d0b107b8_darkside.exe Token: SeBackupPrivilege 1948 2024-03-26_679475b7a73405dd0c3fd038d0b107b8_darkside.exe Token: SeBackupPrivilege 1948 2024-03-26_679475b7a73405dd0c3fd038d0b107b8_darkside.exe Token: SeSecurityPrivilege 1948 2024-03-26_679475b7a73405dd0c3fd038d0b107b8_darkside.exe Token: SeSecurityPrivilege 1948 2024-03-26_679475b7a73405dd0c3fd038d0b107b8_darkside.exe Token: SeBackupPrivilege 1948 2024-03-26_679475b7a73405dd0c3fd038d0b107b8_darkside.exe Token: SeBackupPrivilege 1948 2024-03-26_679475b7a73405dd0c3fd038d0b107b8_darkside.exe Token: SeSecurityPrivilege 1948 2024-03-26_679475b7a73405dd0c3fd038d0b107b8_darkside.exe Token: SeSecurityPrivilege 1948 2024-03-26_679475b7a73405dd0c3fd038d0b107b8_darkside.exe Token: SeBackupPrivilege 1948 2024-03-26_679475b7a73405dd0c3fd038d0b107b8_darkside.exe Token: SeBackupPrivilege 1948 2024-03-26_679475b7a73405dd0c3fd038d0b107b8_darkside.exe Token: SeSecurityPrivilege 1948 2024-03-26_679475b7a73405dd0c3fd038d0b107b8_darkside.exe Token: SeSecurityPrivilege 1948 2024-03-26_679475b7a73405dd0c3fd038d0b107b8_darkside.exe Token: SeBackupPrivilege 1948 2024-03-26_679475b7a73405dd0c3fd038d0b107b8_darkside.exe Token: SeBackupPrivilege 1948 2024-03-26_679475b7a73405dd0c3fd038d0b107b8_darkside.exe Token: SeSecurityPrivilege 1948 2024-03-26_679475b7a73405dd0c3fd038d0b107b8_darkside.exe Token: SeSecurityPrivilege 1948 2024-03-26_679475b7a73405dd0c3fd038d0b107b8_darkside.exe Token: SeBackupPrivilege 1948 2024-03-26_679475b7a73405dd0c3fd038d0b107b8_darkside.exe Token: SeBackupPrivilege 1948 2024-03-26_679475b7a73405dd0c3fd038d0b107b8_darkside.exe Token: SeSecurityPrivilege 1948 2024-03-26_679475b7a73405dd0c3fd038d0b107b8_darkside.exe Token: SeSecurityPrivilege 1948 2024-03-26_679475b7a73405dd0c3fd038d0b107b8_darkside.exe Token: SeBackupPrivilege 1948 2024-03-26_679475b7a73405dd0c3fd038d0b107b8_darkside.exe Token: SeBackupPrivilege 1948 2024-03-26_679475b7a73405dd0c3fd038d0b107b8_darkside.exe Token: SeSecurityPrivilege 1948 2024-03-26_679475b7a73405dd0c3fd038d0b107b8_darkside.exe Token: SeSecurityPrivilege 1948 2024-03-26_679475b7a73405dd0c3fd038d0b107b8_darkside.exe Token: SeBackupPrivilege 1948 2024-03-26_679475b7a73405dd0c3fd038d0b107b8_darkside.exe Token: SeBackupPrivilege 1948 2024-03-26_679475b7a73405dd0c3fd038d0b107b8_darkside.exe Token: SeSecurityPrivilege 1948 2024-03-26_679475b7a73405dd0c3fd038d0b107b8_darkside.exe Token: SeSecurityPrivilege 1948 2024-03-26_679475b7a73405dd0c3fd038d0b107b8_darkside.exe Token: SeBackupPrivilege 1948 2024-03-26_679475b7a73405dd0c3fd038d0b107b8_darkside.exe Token: SeBackupPrivilege 1948 2024-03-26_679475b7a73405dd0c3fd038d0b107b8_darkside.exe Token: SeSecurityPrivilege 1948 2024-03-26_679475b7a73405dd0c3fd038d0b107b8_darkside.exe Token: SeSecurityPrivilege 1948 2024-03-26_679475b7a73405dd0c3fd038d0b107b8_darkside.exe Token: SeBackupPrivilege 1948 2024-03-26_679475b7a73405dd0c3fd038d0b107b8_darkside.exe Token: SeBackupPrivilege 1948 2024-03-26_679475b7a73405dd0c3fd038d0b107b8_darkside.exe Token: SeSecurityPrivilege 1948 2024-03-26_679475b7a73405dd0c3fd038d0b107b8_darkside.exe Token: SeSecurityPrivilege 1948 2024-03-26_679475b7a73405dd0c3fd038d0b107b8_darkside.exe Token: SeBackupPrivilege 1948 2024-03-26_679475b7a73405dd0c3fd038d0b107b8_darkside.exe Token: SeBackupPrivilege 1948 2024-03-26_679475b7a73405dd0c3fd038d0b107b8_darkside.exe Token: SeSecurityPrivilege 1948 2024-03-26_679475b7a73405dd0c3fd038d0b107b8_darkside.exe Token: SeSecurityPrivilege 1948 2024-03-26_679475b7a73405dd0c3fd038d0b107b8_darkside.exe Token: SeBackupPrivilege 1948 2024-03-26_679475b7a73405dd0c3fd038d0b107b8_darkside.exe Token: SeBackupPrivilege 1948 2024-03-26_679475b7a73405dd0c3fd038d0b107b8_darkside.exe Token: SeSecurityPrivilege 1948 2024-03-26_679475b7a73405dd0c3fd038d0b107b8_darkside.exe Token: SeSecurityPrivilege 1948 2024-03-26_679475b7a73405dd0c3fd038d0b107b8_darkside.exe -
Suspicious use of SetWindowsHookEx 13 IoCs
pid Process 2900 ONENOTE.EXE 2900 ONENOTE.EXE 2900 ONENOTE.EXE 2900 ONENOTE.EXE 2900 ONENOTE.EXE 2900 ONENOTE.EXE 2900 ONENOTE.EXE 2900 ONENOTE.EXE 2900 ONENOTE.EXE 2900 ONENOTE.EXE 2900 ONENOTE.EXE 2900 ONENOTE.EXE 2900 ONENOTE.EXE -
Suspicious use of WriteProcessMemory 11 IoCs
description pid Process procid_target PID 1948 wrote to memory of 1484 1948 2024-03-26_679475b7a73405dd0c3fd038d0b107b8_darkside.exe 108 PID 1948 wrote to memory of 1484 1948 2024-03-26_679475b7a73405dd0c3fd038d0b107b8_darkside.exe 108 PID 1692 wrote to memory of 2900 1692 printfilterpipelinesvc.exe 113 PID 1692 wrote to memory of 2900 1692 printfilterpipelinesvc.exe 113 PID 1948 wrote to memory of 4920 1948 2024-03-26_679475b7a73405dd0c3fd038d0b107b8_darkside.exe 114 PID 1948 wrote to memory of 4920 1948 2024-03-26_679475b7a73405dd0c3fd038d0b107b8_darkside.exe 114 PID 1948 wrote to memory of 4920 1948 2024-03-26_679475b7a73405dd0c3fd038d0b107b8_darkside.exe 114 PID 1948 wrote to memory of 4920 1948 2024-03-26_679475b7a73405dd0c3fd038d0b107b8_darkside.exe 114 PID 4920 wrote to memory of 4648 4920 CABE.tmp 115 PID 4920 wrote to memory of 4648 4920 CABE.tmp 115 PID 4920 wrote to memory of 4648 4920 CABE.tmp 115
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-03-26_679475b7a73405dd0c3fd038d0b107b8_darkside.exe"C:\Users\Admin\AppData\Local\Temp\2024-03-26_679475b7a73405dd0c3fd038d0b107b8_darkside.exe"1⤵
- Drops desktop.ini file(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1948 -
C:\Windows\splwow64.exeC:\Windows\splwow64.exe 122882⤵
- Drops file in System32 directory
PID:1484
-
-
C:\ProgramData\CABE.tmp"C:\ProgramData\CABE.tmp"2⤵
- Checks computer location settings
- Deletes itself
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:4920 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C DEL /F /Q C:\PROGRA~3\CABE.tmp >> NUL3⤵PID:4648
-
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k PrintWorkflow -s PrintWorkflowUserSvc1⤵PID:3616
-
C:\Windows\system32\printfilterpipelinesvc.exeC:\Windows\system32\printfilterpipelinesvc.exe -Embedding1⤵
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:1692 -
C:\Program Files\Microsoft Office\root\Office16\ONENOTE.EXE/insertdoc "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\{D80E64F6-B099-473D-AEBA-78081BFE185C}.xps" 1335593693062000002⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:2900
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=5244 --field-trial-handle=3240,i,13319578961094268484,16557498665191861597,262144 --variations-seed-version /prefetch:81⤵PID:1448
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
129B
MD5fa76529325bb7ce7b1685c6b4106f64f
SHA12663ea019f1d26d33104902e1b9ad0f2ea522a37
SHA25659fb3ff5778cc0a6518db2b1914e9c4a1fa8d35dd2141926bac6c70ac5bdbc5e
SHA512f919cf8b9a2e976cae242e1b0eafcc1d3178322e541228cd323b073ae99922300b946f2218549e5660a5277e0285937e6de7a0f31a97debb8ad74e8778f0a6ec
-
Filesize
1KB
MD59312c93cec7c860dd1a5b64f3bc4c015
SHA19b7775eaec5e9ecebb478fc782a93080cffb2c21
SHA2569ca0843f0fc836986f969e2e5ee11a99094ba4603c655d28b25f283bc71574ab
SHA512a95c07941b2e4eeb50683bd1c862c7d9f158d69db08711ff097a374ca24e6f5ac67391be372eb4ea47e6a4d3b91409d0f54b81788cb1649fe459e69b8fc51d86
-
Filesize
14KB
MD5294e9f64cb1642dd89229fff0592856b
SHA197b148c27f3da29ba7b18d6aee8a0db9102f47c9
SHA256917e115cc403e29b4388e0d175cbfac3e7e40ca1742299fbdb353847db2de7c2
SHA512b87d531890bf1577b9b4af41dddb2cdbbfa164cf197bd5987df3a3075983645a3acba443e289b7bfd338422978a104f55298fbfe346872de0895bde44adc89cf
-
Filesize
147KB
MD5ed0549ac9da0c7ca24bb4b5b07ad95cf
SHA1172bfbfb8e5f5bc2ada346cee53da59d56c5b69c
SHA2567ac3d59ee7b402519e8b9dee7c50cf8c972da2bc04c70469c3390fb24da86a03
SHA512a48f95cea2f3eb5c51c965709cf503f80323864d626e21151dff2b64335daef32eea0cbc5aac45dd42c3a464e4dc7efa01766e58b802bd32e6262626f07d7bea
-
Filesize
4KB
MD5b91d6872981b441c98da099542fbadbe
SHA1e9dea52a07068562df2a860dc3942f6d16ed4fb0
SHA256722d7a8a95c476b88569cd910bddbd3df264faed3500e9007cdac1d71f1de8a9
SHA5126faf850a0ad4fa0a6bfdab6287096bd13ea2c1b8bba6c0e2e20e6f8c98e21bb944894fbdc3af8c09189a87f5da22205ee99bc69988c58ceab8616c5f111551b8
-
Filesize
4KB
MD5283ec8501824a683aa7eb757cd7f6080
SHA1c74d0d2155f246ded3ef5e07724e5de0df489742
SHA2568d5f86b86b4db98a40e43b0ffee2b1dbabeb420fc057830afe48cbac6144c069
SHA5129c6ee878b8f5a764ac90efbd413155490fde9294103582b9d4fa0943407b7b0ef1e015bbf54f80a11619519e9f5ffde91deca20723cfa9fcc42487678572c8fa
-
Filesize
129B
MD5096f8719bdcf7aa467454b6d98c1dd8a
SHA167e6a6036bfda91bf39b625b66bda35c7b268769
SHA2565f68421adbd2736b6f498f741b0a542e6ec4808a2083bbe5d870e342d5db1efd
SHA5128e803b81185c458fa172dd5b77474e148519fd94709f8ddf24d8945c4961284ee3d71819f9566be825f8fdbc1b498a8a6eb40647a4c46df3262774c1b344e366