Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    143s
  • max time network
    159s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240226-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
  • submitted
    26/03/2024, 14:28

General

  • Target

    2024-03-26_679475b7a73405dd0c3fd038d0b107b8_darkside.exe

  • Size

    147KB

  • MD5

    679475b7a73405dd0c3fd038d0b107b8

  • SHA1

    f5c824f8c8c1fe065aead63f8d56a7682eaece36

  • SHA256

    415478012f448676e8a262afbcdc76d67763c87fab99d93c3db1612430f0d89d

  • SHA512

    39d3ca516862b52daa16c7363b8fa41363e3271f6eff812b85140b8de8bb8f30d82cefda12012f1b05cee82e7731b6f70d1b65b241f536d3cc6b22da746b8441

  • SSDEEP

    1536:ezICS4AAwczUUf8y8gvMH+1zGSNAojMP95D1xDquSYEuwkC7106P7ZqHjuJF6Uyz:FqJogYkcSNm9V7DlScwF75ZqDuCT

Score
9/10

Malware Config

Signatures

  • Renames multiple (177) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself 1 IoCs
  • Executes dropped EXE 1 IoCs
  • Drops desktop.ini file(s) 2 IoCs
  • Drops file in System32 directory 4 IoCs
  • Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Checks processor information in registry 2 TTPs 3 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Suspicious behavior: EnumeratesProcesses 18 IoCs
  • Suspicious behavior: RenamesItself 26 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of SetWindowsHookEx 13 IoCs
  • Suspicious use of WriteProcessMemory 11 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2024-03-26_679475b7a73405dd0c3fd038d0b107b8_darkside.exe
    "C:\Users\Admin\AppData\Local\Temp\2024-03-26_679475b7a73405dd0c3fd038d0b107b8_darkside.exe"
    1⤵
    • Drops desktop.ini file(s)
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:1948
    • C:\Windows\splwow64.exe
      C:\Windows\splwow64.exe 12288
      2⤵
      • Drops file in System32 directory
      PID:1484
    • C:\ProgramData\CABE.tmp
      "C:\ProgramData\CABE.tmp"
      2⤵
      • Checks computer location settings
      • Deletes itself
      • Executes dropped EXE
      • Suspicious use of NtSetInformationThreadHideFromDebugger
      • Suspicious behavior: RenamesItself
      • Suspicious use of WriteProcessMemory
      PID:4920
      • C:\Windows\SysWOW64\cmd.exe
        "C:\Windows\System32\cmd.exe" /C DEL /F /Q C:\PROGRA~3\CABE.tmp >> NUL
        3⤵
          PID:4648
    • C:\Windows\system32\svchost.exe
      C:\Windows\system32\svchost.exe -k PrintWorkflow -s PrintWorkflowUserSvc
      1⤵
        PID:3616
      • C:\Windows\system32\printfilterpipelinesvc.exe
        C:\Windows\system32\printfilterpipelinesvc.exe -Embedding
        1⤵
        • Drops file in System32 directory
        • Suspicious use of WriteProcessMemory
        PID:1692
        • C:\Program Files\Microsoft Office\root\Office16\ONENOTE.EXE
          /insertdoc "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\{D80E64F6-B099-473D-AEBA-78081BFE185C}.xps" 133559369306200000
          2⤵
          • Checks processor information in registry
          • Enumerates system info in registry
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of SetWindowsHookEx
          PID:2900
      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=5244 --field-trial-handle=3240,i,13319578961094268484,16557498665191861597,262144 --variations-seed-version /prefetch:8
        1⤵
          PID:1448

        Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\$Recycle.Bin\S-1-5-21-3808065738-1666277613-1125846146-1000\AAAAAAAAAAA

          Filesize

          129B

          MD5

          fa76529325bb7ce7b1685c6b4106f64f

          SHA1

          2663ea019f1d26d33104902e1b9ad0f2ea522a37

          SHA256

          59fb3ff5778cc0a6518db2b1914e9c4a1fa8d35dd2141926bac6c70ac5bdbc5e

          SHA512

          f919cf8b9a2e976cae242e1b0eafcc1d3178322e541228cd323b073ae99922300b946f2218549e5660a5277e0285937e6de7a0f31a97debb8ad74e8778f0a6ec

        • C:\LpNCD6Y5q.README.txt

          Filesize

          1KB

          MD5

          9312c93cec7c860dd1a5b64f3bc4c015

          SHA1

          9b7775eaec5e9ecebb478fc782a93080cffb2c21

          SHA256

          9ca0843f0fc836986f969e2e5ee11a99094ba4603c655d28b25f283bc71574ab

          SHA512

          a95c07941b2e4eeb50683bd1c862c7d9f158d69db08711ff097a374ca24e6f5ac67391be372eb4ea47e6a4d3b91409d0f54b81788cb1649fe459e69b8fc51d86

        • C:\ProgramData\CABE.tmp

          Filesize

          14KB

          MD5

          294e9f64cb1642dd89229fff0592856b

          SHA1

          97b148c27f3da29ba7b18d6aee8a0db9102f47c9

          SHA256

          917e115cc403e29b4388e0d175cbfac3e7e40ca1742299fbdb353847db2de7c2

          SHA512

          b87d531890bf1577b9b4af41dddb2cdbbfa164cf197bd5987df3a3075983645a3acba443e289b7bfd338422978a104f55298fbfe346872de0895bde44adc89cf

        • C:\Users\Admin\AppData\Local\Temp\DDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDD

          Filesize

          147KB

          MD5

          ed0549ac9da0c7ca24bb4b5b07ad95cf

          SHA1

          172bfbfb8e5f5bc2ada346cee53da59d56c5b69c

          SHA256

          7ac3d59ee7b402519e8b9dee7c50cf8c972da2bc04c70469c3390fb24da86a03

          SHA512

          a48f95cea2f3eb5c51c965709cf503f80323864d626e21151dff2b64335daef32eea0cbc5aac45dd42c3a464e4dc7efa01766e58b802bd32e6262626f07d7bea

        • C:\Users\Admin\AppData\Local\Temp\{34BC43CC-2A26-486E-A809-F2FA52A0A647}

          Filesize

          4KB

          MD5

          b91d6872981b441c98da099542fbadbe

          SHA1

          e9dea52a07068562df2a860dc3942f6d16ed4fb0

          SHA256

          722d7a8a95c476b88569cd910bddbd3df264faed3500e9007cdac1d71f1de8a9

          SHA512

          6faf850a0ad4fa0a6bfdab6287096bd13ea2c1b8bba6c0e2e20e6f8c98e21bb944894fbdc3af8c09189a87f5da22205ee99bc69988c58ceab8616c5f111551b8

        • C:\Users\Admin\Documents\OneNote Notebooks\My Notebook\Open Notebook.onetoc2

          Filesize

          4KB

          MD5

          283ec8501824a683aa7eb757cd7f6080

          SHA1

          c74d0d2155f246ded3ef5e07724e5de0df489742

          SHA256

          8d5f86b86b4db98a40e43b0ffee2b1dbabeb420fc057830afe48cbac6144c069

          SHA512

          9c6ee878b8f5a764ac90efbd413155490fde9294103582b9d4fa0943407b7b0ef1e015bbf54f80a11619519e9f5ffde91deca20723cfa9fcc42487678572c8fa

        • F:\$RECYCLE.BIN\S-1-5-21-3808065738-1666277613-1125846146-1000\DDDDDDDDDDD

          Filesize

          129B

          MD5

          096f8719bdcf7aa467454b6d98c1dd8a

          SHA1

          67e6a6036bfda91bf39b625b66bda35c7b268769

          SHA256

          5f68421adbd2736b6f498f741b0a542e6ec4808a2083bbe5d870e342d5db1efd

          SHA512

          8e803b81185c458fa172dd5b77474e148519fd94709f8ddf24d8945c4961284ee3d71819f9566be825f8fdbc1b498a8a6eb40647a4c46df3262774c1b344e366

        • memory/1948-330-0x0000000003240000-0x0000000003250000-memory.dmp

          Filesize

          64KB

        • memory/1948-331-0x0000000003240000-0x0000000003250000-memory.dmp

          Filesize

          64KB

        • memory/1948-332-0x0000000003240000-0x0000000003250000-memory.dmp

          Filesize

          64KB

        • memory/1948-0-0x0000000003240000-0x0000000003250000-memory.dmp

          Filesize

          64KB

        • memory/1948-2-0x0000000003240000-0x0000000003250000-memory.dmp

          Filesize

          64KB

        • memory/1948-1-0x0000000003240000-0x0000000003250000-memory.dmp

          Filesize

          64KB

        • memory/2900-352-0x00007FF9A6730000-0x00007FF9A6925000-memory.dmp

          Filesize

          2.0MB

        • memory/2900-396-0x00007FF964470000-0x00007FF964480000-memory.dmp

          Filesize

          64KB

        • memory/2900-348-0x00007FF9667B0000-0x00007FF9667C0000-memory.dmp

          Filesize

          64KB

        • memory/2900-351-0x00007FF9667B0000-0x00007FF9667C0000-memory.dmp

          Filesize

          64KB

        • memory/2900-350-0x00007FF9A6730000-0x00007FF9A6925000-memory.dmp

          Filesize

          2.0MB

        • memory/2900-345-0x00007FF9A6730000-0x00007FF9A6925000-memory.dmp

          Filesize

          2.0MB

        • memory/2900-354-0x00007FF9A6730000-0x00007FF9A6925000-memory.dmp

          Filesize

          2.0MB

        • memory/2900-347-0x00007FF9A6730000-0x00007FF9A6925000-memory.dmp

          Filesize

          2.0MB

        • memory/2900-359-0x00007FF9A6730000-0x00007FF9A6925000-memory.dmp

          Filesize

          2.0MB

        • memory/2900-357-0x00007FF9A6730000-0x00007FF9A6925000-memory.dmp

          Filesize

          2.0MB

        • memory/2900-383-0x00007FF9A6730000-0x00007FF9A6925000-memory.dmp

          Filesize

          2.0MB

        • memory/2900-421-0x00007FF9A6730000-0x00007FF9A6925000-memory.dmp

          Filesize

          2.0MB

        • memory/2900-420-0x00007FF9A6730000-0x00007FF9A6925000-memory.dmp

          Filesize

          2.0MB

        • memory/2900-419-0x00007FF9A6730000-0x00007FF9A6925000-memory.dmp

          Filesize

          2.0MB

        • memory/2900-343-0x00007FF9667B0000-0x00007FF9667C0000-memory.dmp

          Filesize

          64KB

        • memory/2900-344-0x00007FF9667B0000-0x00007FF9667C0000-memory.dmp

          Filesize

          64KB

        • memory/2900-346-0x00007FF9667B0000-0x00007FF9667C0000-memory.dmp

          Filesize

          64KB

        • memory/2900-397-0x00007FF964470000-0x00007FF964480000-memory.dmp

          Filesize

          64KB

        • memory/2900-349-0x00007FF9A6730000-0x00007FF9A6925000-memory.dmp

          Filesize

          2.0MB

        • memory/4920-394-0x000000007FDE0000-0x000000007FDE1000-memory.dmp

          Filesize

          4KB

        • memory/4920-395-0x000000007FE00000-0x000000007FE01000-memory.dmp

          Filesize

          4KB

        • memory/4920-388-0x000000007FE40000-0x000000007FE41000-memory.dmp

          Filesize

          4KB

        • memory/4920-385-0x0000000002450000-0x0000000002460000-memory.dmp

          Filesize

          64KB

        • memory/4920-387-0x000000007FDC0000-0x000000007FDC1000-memory.dmp

          Filesize

          4KB

        • memory/4920-386-0x000000007FE20000-0x000000007FE21000-memory.dmp

          Filesize

          4KB

        • memory/4920-384-0x0000000002450000-0x0000000002460000-memory.dmp

          Filesize

          64KB