Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

10

Static

static

10

2024-04-26...de.exe

windows7-x64

9

2024-04-26...de.exe

windows10-2004-x64

9

Resubmissions

29/04/2024, 16:10

240429-tmdysaeg49 10

26/04/2024, 11:49

240426-ny1zssfh37 10

Analysis

  • max time kernel
    148s
  • max time network
    42s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240419-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system
  • submitted
    26/04/2024, 11:49

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    2024-04-26_6fd558cf3add096970e15d1e62ca1957_darkside.exe

  • Size

    194KB

  • MD5

    6fd558cf3add096970e15d1e62ca1957

  • SHA1

    78e95fabcfe8ef7bb6419f8456deccc3d5fa4c23

  • SHA256

    41e187191625d749b89a11bc04fc0b2a3b9bd638035d05b39365c47ab36d1898

  • SHA512

    fac7efe9b76f9b6a917f8751f5be64ad8e067e5404fe05f3e9d7781ea3661a06c0baaac676a6023eb4a0b7f01bc2bb2d64d572f85aec8ad8de35cc7f106e1fdc

  • SSDEEP

    3072:n6glyuxE4GsUPnliByocWepMhJL4BFkTGX:n6gDBGpvEByocWeyhJL4UK

Score
9/10
ransomwarespywarestealer

Malware Config

Signatures

  • Renames multiple (613) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

    ransomware
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself 1 IoCs
  • Executes dropped EXE 1 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Drops desktop.ini file(s) 2 IoCs
  • Drops file in System32 directory 4 IoCs
  • Sets desktop wallpaper using registry 2 TTPs 2 IoCs
    ransomware
  • Suspicious use of NtSetInformationThreadHideFromDebugger 5 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Checks processor information in registry 2 TTPs 3 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Modifies Control Panel 2 IoCs
    evasion
  • Modifies registry class 5 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: RenamesItself 26 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of SetWindowsHookEx 13 IoCs
  • Suspicious use of WriteProcessMemory 11 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2024-04-26_6fd558cf3add096970e15d1e62ca1957_darkside.exe
    "C:\Users\Admin\AppData\Local\Temp\2024-04-26_6fd558cf3add096970e15d1e62ca1957_darkside.exe"
    1⤵
    • Drops desktop.ini file(s)
    • Sets desktop wallpaper using registry
    • Suspicious use of NtSetInformationThreadHideFromDebugger
    • Modifies Control Panel
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:4872
    • C:\Windows\splwow64.exe
      C:\Windows\splwow64.exe 12288
      2⤵
      • Drops file in System32 directory
      PID:972
    • C:\ProgramData\7967.tmp
      "C:\ProgramData\7967.tmp"
      2⤵
      • Checks computer location settings
      • Deletes itself
      • Executes dropped EXE
      • Suspicious use of NtSetInformationThreadHideFromDebugger
      • Suspicious behavior: RenamesItself
      • Suspicious use of WriteProcessMemory
      PID:1540
      • C:\Windows\SysWOW64\cmd.exe
        "C:\Windows\System32\cmd.exe" /C DEL /F /Q C:\PROGRA~3\7967.tmp >> NUL
        3⤵
          PID:1860
    • C:\Windows\system32\svchost.exe
      C:\Windows\system32\svchost.exe -k PrintWorkflow -s PrintWorkflowUserSvc
      1⤵
        PID:2364
      • C:\Windows\system32\printfilterpipelinesvc.exe
        C:\Windows\system32\printfilterpipelinesvc.exe -Embedding
        1⤵
        • Drops file in System32 directory
        • Suspicious use of WriteProcessMemory
        PID:2760
        • C:\Program Files\Microsoft Office\root\Office16\ONENOTE.EXE
          /insertdoc "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\{693C7251-2260-49CF-8806-AAAD4F80DC23}.xps" 133586059015850000
          2⤵
          • Checks processor information in registry
          • Enumerates system info in registry
          • Suspicious use of SetWindowsHookEx
          PID:3824

      Network

      MITRE ATT&CK Enterprise v15

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\$Recycle.Bin\S-1-5-21-3411335054-1982420046-2118495756-1000\LLLLLLLLLLL
        Filesize

        129B

        MD5

        5ec6de754a5754098a8fbfd52c49d0a7

        SHA1

        0cf4bfc70aecfa28410be75871aac3d62121bdcf

        SHA256

        35abe806c912487d38d3b25bd06f77161ae924a597738316d19bbd5607e2c0b3

        SHA512

        48dc5fa2ce6e1b47f54719b108c0ec4585b931c098bd2074b50ba6fbba3825cee654af6a904dbc8367acd430c23407d6fca4d2a853a4175f97d2fadee6d6ee24

        Download Submit

      • C:\AAtvmKv4L.README.txt
        Filesize

        434B

        MD5

        b4709a56b9d7f431da172316cda720be

        SHA1

        d2132f7129a7003ec4c0392f0f08cd24ea353da6

        SHA256

        192d1e6078570865531e8a4c9840a483c4a2ac35fe468107284991f6da813191

        SHA512

        e390d51e95db5e56c666a2895dc87dab41d97e7ce3c0df1f2466abf14a651167232521ab5f52746d16bab0ef14e6c0ee9dcfe29894604d695b0d064909378227

        Download Submit

      • C:\ProgramData\7967.tmp
        Filesize

        14KB

        MD5

        294e9f64cb1642dd89229fff0592856b

        SHA1

        97b148c27f3da29ba7b18d6aee8a0db9102f47c9

        SHA256

        917e115cc403e29b4388e0d175cbfac3e7e40ca1742299fbdb353847db2de7c2

        SHA512

        b87d531890bf1577b9b4af41dddb2cdbbfa164cf197bd5987df3a3075983645a3acba443e289b7bfd338422978a104f55298fbfe346872de0895bde44adc89cf

        Download Submit

      • C:\Users\Admin\AppData\Local\Temp\DDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDD
        Filesize

        194KB

        MD5

        3a1a203270abd8255404752130594075

        SHA1

        dd85b47591fe25f346175a5045a2601517bf09fb

        SHA256

        759b8f458dd2bc72760789a9fcbe9ec7458b3f65864d3311861e79584a5c19c6

        SHA512

        60481bb99f1f86b1967a9fdb10690a94eb3efdadebd62ed6f4e5268bf4764cdfa862fe209e40bddf1ba500b17b780ed9365e80c900c1d667dfae445be12ee08c

        Download Submit

      • C:\Users\Admin\Documents\OneNote Notebooks\My Notebook\Open Notebook.onetoc2
        Filesize

        4KB

        MD5

        eeb7e9e3adbaddc271aeb35fe0fef79b

        SHA1

        86e9d81820239f378ffa56925cba68ed0aa36cb7

        SHA256

        ff0ed74d71b9ffbe58a71a32947ef02dcb42837a42419f3928e3511a0946bd6e

        SHA512

        a7dc0fe9ed169a28fad28449dd875d898ebececf420c5c4eac79e4c5c7f5b4342b47790c0627f1499a55a784767bd0f34b111a90e628dcca3435e170dfca236a

        Download Submit

      • F:\$RECYCLE.BIN\S-1-5-21-3411335054-1982420046-2118495756-1000\DDDDDDDDDDD
        Filesize

        129B

        MD5

        089fa242fc45e66b46636b9d33c5f081

        SHA1

        8a41fd7b3f64f6f13fa376cd2be77f4d6c505b09

        SHA256

        1db6eeb416212c45ed42a3179fac8c04af1e42ff340791bf770d6215827864d3

        SHA512

        297f7c494ce1b58415a6a0b1023126180e7b5ca770d72d1e3b3045891472024bbf1d4cb59f78d9583a066d1a75f2cc3d7b02fef8fa91fa0122173de9e6db2602

        Download Submit

      • memory/3824-2803-0x00007FFAB0C10000-0x00007FFAB0C20000-memory.dmp

        Filesize

        64KB

        Download

      • memory/3824-2806-0x00007FFAB0C10000-0x00007FFAB0C20000-memory.dmp

        Filesize

        64KB

        Download

      • memory/3824-2805-0x00007FFAB0C10000-0x00007FFAB0C20000-memory.dmp

        Filesize

        64KB

        Download

      • memory/3824-2807-0x00007FFAB0C10000-0x00007FFAB0C20000-memory.dmp

        Filesize

        64KB

        Download

      • memory/3824-2808-0x00007FFAB0C10000-0x00007FFAB0C20000-memory.dmp

        Filesize

        64KB

        Download

      • memory/3824-2837-0x00007FFAAE470000-0x00007FFAAE480000-memory.dmp

        Filesize

        64KB

        Download

      • memory/3824-2838-0x00007FFAAE470000-0x00007FFAAE480000-memory.dmp

        Filesize

        64KB

        Download

      • memory/4872-2-0x0000000002F00000-0x0000000002F10000-memory.dmp

        Filesize

        64KB

        Download

      • memory/4872-0-0x0000000002F00000-0x0000000002F10000-memory.dmp

        Filesize

        64KB

        Download

      • memory/4872-1-0x0000000002F00000-0x0000000002F10000-memory.dmp

        Filesize

        64KB

        Download