Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
143s -
max time network
159s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
-
submitted
26/03/2024, 14:28
General
-
Target
2024-03-26_679475b7a73405dd0c3fd038d0b107b8_darkside.exe
-
Size
147KB
-
MD5
679475b7a73405dd0c3fd038d0b107b8
-
SHA1
f5c824f8c8c1fe065aead63f8d56a7682eaece36
-
SHA256
415478012f448676e8a262afbcdc76d67763c87fab99d93c3db1612430f0d89d
-
SHA512
39d3ca516862b52daa16c7363b8fa41363e3271f6eff812b85140b8de8bb8f30d82cefda12012f1b05cee82e7731b6f70d1b65b241f536d3cc6b22da746b8441
-
SSDEEP
1536:ezICS4AAwczUUf8y8gvMH+1zGSNAojMP95D1xDquSYEuwkC7106P7ZqHjuJF6Uyz:FqJogYkcSNm9V7DlScwF75ZqDuCT
Malware Config
Signatures
-
Renames multiple (177) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
-
Deletes itself 1 IoCs
-
Executes dropped EXE 1 IoCs
-
Drops desktop.ini file(s) 2 IoCs
-
Drops file in System32 directory 4 IoCs
-
Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
-
Enumerates system info in registry 2 TTPs 3 IoCs
-
Suspicious behavior: EnumeratesProcesses 18 IoCs
-
Suspicious behavior: RenamesItself 26 IoCs
-
Suspicious use of AdjustPrivilegeToken 64 IoCs
-
Suspicious use of SetWindowsHookEx 13 IoCs
-
Suspicious use of WriteProcessMemory 11 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-03-26_679475b7a73405dd0c3fd038d0b107b8_darkside.exe"C:\Users\Admin\AppData\Local\Temp\2024-03-26_679475b7a73405dd0c3fd038d0b107b8_darkside.exe"1⤵
- Drops desktop.ini file(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\splwow64.exeC:\Windows\splwow64.exe 122882⤵
- Drops file in System32 directory
-
-
C:\ProgramData\CABE.tmp"C:\ProgramData\CABE.tmp"2⤵
- Checks computer location settings
- Deletes itself
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C DEL /F /Q C:\PROGRA~3\CABE.tmp >> NUL3⤵
-
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k PrintWorkflow -s PrintWorkflowUserSvc1⤵
-
C:\Windows\system32\printfilterpipelinesvc.exeC:\Windows\system32\printfilterpipelinesvc.exe -Embedding1⤵
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Microsoft Office\root\Office16\ONENOTE.EXE/insertdoc "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\{D80E64F6-B099-473D-AEBA-78081BFE185C}.xps" 1335593693062000002⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=5244 --field-trial-handle=3240,i,13319578961094268484,16557498665191861597,262144 --variations-seed-version /prefetch:81⤵
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
129B
MD5fa76529325bb7ce7b1685c6b4106f64f
SHA12663ea019f1d26d33104902e1b9ad0f2ea522a37
SHA25659fb3ff5778cc0a6518db2b1914e9c4a1fa8d35dd2141926bac6c70ac5bdbc5e
SHA512f919cf8b9a2e976cae242e1b0eafcc1d3178322e541228cd323b073ae99922300b946f2218549e5660a5277e0285937e6de7a0f31a97debb8ad74e8778f0a6ec
-
Filesize
1KB
MD59312c93cec7c860dd1a5b64f3bc4c015
SHA19b7775eaec5e9ecebb478fc782a93080cffb2c21
SHA2569ca0843f0fc836986f969e2e5ee11a99094ba4603c655d28b25f283bc71574ab
SHA512a95c07941b2e4eeb50683bd1c862c7d9f158d69db08711ff097a374ca24e6f5ac67391be372eb4ea47e6a4d3b91409d0f54b81788cb1649fe459e69b8fc51d86
-
Filesize
14KB
MD5294e9f64cb1642dd89229fff0592856b
SHA197b148c27f3da29ba7b18d6aee8a0db9102f47c9
SHA256917e115cc403e29b4388e0d175cbfac3e7e40ca1742299fbdb353847db2de7c2
SHA512b87d531890bf1577b9b4af41dddb2cdbbfa164cf197bd5987df3a3075983645a3acba443e289b7bfd338422978a104f55298fbfe346872de0895bde44adc89cf
-
Filesize
147KB
MD5ed0549ac9da0c7ca24bb4b5b07ad95cf
SHA1172bfbfb8e5f5bc2ada346cee53da59d56c5b69c
SHA2567ac3d59ee7b402519e8b9dee7c50cf8c972da2bc04c70469c3390fb24da86a03
SHA512a48f95cea2f3eb5c51c965709cf503f80323864d626e21151dff2b64335daef32eea0cbc5aac45dd42c3a464e4dc7efa01766e58b802bd32e6262626f07d7bea
-
Filesize
4KB
MD5b91d6872981b441c98da099542fbadbe
SHA1e9dea52a07068562df2a860dc3942f6d16ed4fb0
SHA256722d7a8a95c476b88569cd910bddbd3df264faed3500e9007cdac1d71f1de8a9
SHA5126faf850a0ad4fa0a6bfdab6287096bd13ea2c1b8bba6c0e2e20e6f8c98e21bb944894fbdc3af8c09189a87f5da22205ee99bc69988c58ceab8616c5f111551b8
-
Filesize
4KB
MD5283ec8501824a683aa7eb757cd7f6080
SHA1c74d0d2155f246ded3ef5e07724e5de0df489742
SHA2568d5f86b86b4db98a40e43b0ffee2b1dbabeb420fc057830afe48cbac6144c069
SHA5129c6ee878b8f5a764ac90efbd413155490fde9294103582b9d4fa0943407b7b0ef1e015bbf54f80a11619519e9f5ffde91deca20723cfa9fcc42487678572c8fa
-
Filesize
129B
MD5096f8719bdcf7aa467454b6d98c1dd8a
SHA167e6a6036bfda91bf39b625b66bda35c7b268769
SHA2565f68421adbd2736b6f498f741b0a542e6ec4808a2083bbe5d870e342d5db1efd
SHA5128e803b81185c458fa172dd5b77474e148519fd94709f8ddf24d8945c4961284ee3d71819f9566be825f8fdbc1b498a8a6eb40647a4c46df3262774c1b344e366
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
2.0MB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
2.0MB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
64KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
64KB