Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
120s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system -
submitted
01/08/2024, 00:57
Behavioral task
behavioral1
Sample
2024-08-01_632207284b8cf84f06a93b82d4d553b2_darkside.exe
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
2024-08-01_632207284b8cf84f06a93b82d4d553b2_darkside.exe
Resource
win10v2004-20240730-en
General
-
Target
2024-08-01_632207284b8cf84f06a93b82d4d553b2_darkside.exe
-
Size
155KB
-
MD5
632207284b8cf84f06a93b82d4d553b2
-
SHA1
a873523884cea9e5148f9d26a4c66c34641b53fd
-
SHA256
b0d1198b2021752acb56ec59912b67e48a61e9d5f2337ec889ae6a6b3cac5bdd
-
SHA512
d4bbd18d467fbc270a0707018f04dbbab518a6c7e31780a1c9ecc4f9562667948b355dc46a6e075cda474ee3e62a3b222adc21567e68a94cdfe5100cd3b074fc
-
SSDEEP
3072:UqJogYkcSNm9V7Dgji53yFLCJKw8zh1rZbT:Uq2kc4m9tDg+oFoKwU1l
Malware Config
Extracted
C:\NjuwGaZ6g.README.txt
https://tether.to/
Signatures
-
Renames multiple (342) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Deletes itself 1 IoCs
pid Process 3016 D21E.tmp -
Executes dropped EXE 1 IoCs
pid Process 3016 D21E.tmp -
Loads dropped DLL 1 IoCs
pid Process 2136 2024-08-01_632207284b8cf84f06a93b82d4d553b2_darkside.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Drops desktop.ini file(s) 2 IoCs
description ioc Process File opened for modification C:\$Recycle.Bin\S-1-5-21-1506706701-1246725540-2219210854-1000\desktop.ini 2024-08-01_632207284b8cf84f06a93b82d4d553b2_darkside.exe File opened for modification F:\$RECYCLE.BIN\S-1-5-21-1506706701-1246725540-2219210854-1000\desktop.ini 2024-08-01_632207284b8cf84f06a93b82d4d553b2_darkside.exe -
Indicator Removal: File Deletion 1 TTPs
Adversaries may delete files left behind by the actions of their intrusion activity.
-
Sets desktop wallpaper using registry 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Control Panel\Desktop\WallPaper = "C:\\ProgramData\\NjuwGaZ6g.bmp" 2024-08-01_632207284b8cf84f06a93b82d4d553b2_darkside.exe Set value (str) \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Control Panel\Desktop\Wallpaper = "C:\\ProgramData\\NjuwGaZ6g.bmp" 2024-08-01_632207284b8cf84f06a93b82d4d553b2_darkside.exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
pid Process 3016 D21E.tmp -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2024-08-01_632207284b8cf84f06a93b82d4d553b2_darkside.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D21E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe -
Modifies Control Panel 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Control Panel\Desktop 2024-08-01_632207284b8cf84f06a93b82d4d553b2_darkside.exe Set value (str) \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Control Panel\Desktop\WallpaperStyle = "10" 2024-08-01_632207284b8cf84f06a93b82d4d553b2_darkside.exe -
Modifies registry class 5 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\NjuwGaZ6g 2024-08-01_632207284b8cf84f06a93b82d4d553b2_darkside.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\NjuwGaZ6g\DefaultIcon\ = "C:\\ProgramData\\NjuwGaZ6g.ico" 2024-08-01_632207284b8cf84f06a93b82d4d553b2_darkside.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.NjuwGaZ6g 2024-08-01_632207284b8cf84f06a93b82d4d553b2_darkside.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.NjuwGaZ6g\ = "NjuwGaZ6g" 2024-08-01_632207284b8cf84f06a93b82d4d553b2_darkside.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\NjuwGaZ6g\DefaultIcon 2024-08-01_632207284b8cf84f06a93b82d4d553b2_darkside.exe -
Suspicious behavior: EnumeratesProcesses 14 IoCs
pid Process 2136 2024-08-01_632207284b8cf84f06a93b82d4d553b2_darkside.exe 2136 2024-08-01_632207284b8cf84f06a93b82d4d553b2_darkside.exe 2136 2024-08-01_632207284b8cf84f06a93b82d4d553b2_darkside.exe 2136 2024-08-01_632207284b8cf84f06a93b82d4d553b2_darkside.exe 2136 2024-08-01_632207284b8cf84f06a93b82d4d553b2_darkside.exe 2136 2024-08-01_632207284b8cf84f06a93b82d4d553b2_darkside.exe 2136 2024-08-01_632207284b8cf84f06a93b82d4d553b2_darkside.exe 2136 2024-08-01_632207284b8cf84f06a93b82d4d553b2_darkside.exe 2136 2024-08-01_632207284b8cf84f06a93b82d4d553b2_darkside.exe 2136 2024-08-01_632207284b8cf84f06a93b82d4d553b2_darkside.exe 2136 2024-08-01_632207284b8cf84f06a93b82d4d553b2_darkside.exe 2136 2024-08-01_632207284b8cf84f06a93b82d4d553b2_darkside.exe 2136 2024-08-01_632207284b8cf84f06a93b82d4d553b2_darkside.exe 2136 2024-08-01_632207284b8cf84f06a93b82d4d553b2_darkside.exe -
Suspicious behavior: RenamesItself 26 IoCs
pid Process 3016 D21E.tmp 3016 D21E.tmp 3016 D21E.tmp 3016 D21E.tmp 3016 D21E.tmp 3016 D21E.tmp 3016 D21E.tmp 3016 D21E.tmp 3016 D21E.tmp 3016 D21E.tmp 3016 D21E.tmp 3016 D21E.tmp 3016 D21E.tmp 3016 D21E.tmp 3016 D21E.tmp 3016 D21E.tmp 3016 D21E.tmp 3016 D21E.tmp 3016 D21E.tmp 3016 D21E.tmp 3016 D21E.tmp 3016 D21E.tmp 3016 D21E.tmp 3016 D21E.tmp 3016 D21E.tmp 3016 D21E.tmp -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeAssignPrimaryTokenPrivilege 2136 2024-08-01_632207284b8cf84f06a93b82d4d553b2_darkside.exe Token: SeBackupPrivilege 2136 2024-08-01_632207284b8cf84f06a93b82d4d553b2_darkside.exe Token: SeDebugPrivilege 2136 2024-08-01_632207284b8cf84f06a93b82d4d553b2_darkside.exe Token: 36 2136 2024-08-01_632207284b8cf84f06a93b82d4d553b2_darkside.exe Token: SeImpersonatePrivilege 2136 2024-08-01_632207284b8cf84f06a93b82d4d553b2_darkside.exe Token: SeIncBasePriorityPrivilege 2136 2024-08-01_632207284b8cf84f06a93b82d4d553b2_darkside.exe Token: SeIncreaseQuotaPrivilege 2136 2024-08-01_632207284b8cf84f06a93b82d4d553b2_darkside.exe Token: 33 2136 2024-08-01_632207284b8cf84f06a93b82d4d553b2_darkside.exe Token: SeManageVolumePrivilege 2136 2024-08-01_632207284b8cf84f06a93b82d4d553b2_darkside.exe Token: SeProfSingleProcessPrivilege 2136 2024-08-01_632207284b8cf84f06a93b82d4d553b2_darkside.exe Token: SeRestorePrivilege 2136 2024-08-01_632207284b8cf84f06a93b82d4d553b2_darkside.exe Token: SeSecurityPrivilege 2136 2024-08-01_632207284b8cf84f06a93b82d4d553b2_darkside.exe Token: SeSystemProfilePrivilege 2136 2024-08-01_632207284b8cf84f06a93b82d4d553b2_darkside.exe Token: SeTakeOwnershipPrivilege 2136 2024-08-01_632207284b8cf84f06a93b82d4d553b2_darkside.exe Token: SeShutdownPrivilege 2136 2024-08-01_632207284b8cf84f06a93b82d4d553b2_darkside.exe Token: SeDebugPrivilege 2136 2024-08-01_632207284b8cf84f06a93b82d4d553b2_darkside.exe Token: SeBackupPrivilege 2136 2024-08-01_632207284b8cf84f06a93b82d4d553b2_darkside.exe Token: SeBackupPrivilege 2136 2024-08-01_632207284b8cf84f06a93b82d4d553b2_darkside.exe Token: SeSecurityPrivilege 2136 2024-08-01_632207284b8cf84f06a93b82d4d553b2_darkside.exe Token: SeSecurityPrivilege 2136 2024-08-01_632207284b8cf84f06a93b82d4d553b2_darkside.exe Token: SeBackupPrivilege 2136 2024-08-01_632207284b8cf84f06a93b82d4d553b2_darkside.exe Token: SeBackupPrivilege 2136 2024-08-01_632207284b8cf84f06a93b82d4d553b2_darkside.exe Token: SeSecurityPrivilege 2136 2024-08-01_632207284b8cf84f06a93b82d4d553b2_darkside.exe Token: SeSecurityPrivilege 2136 2024-08-01_632207284b8cf84f06a93b82d4d553b2_darkside.exe Token: SeBackupPrivilege 2136 2024-08-01_632207284b8cf84f06a93b82d4d553b2_darkside.exe Token: SeBackupPrivilege 2136 2024-08-01_632207284b8cf84f06a93b82d4d553b2_darkside.exe Token: SeSecurityPrivilege 2136 2024-08-01_632207284b8cf84f06a93b82d4d553b2_darkside.exe Token: SeSecurityPrivilege 2136 2024-08-01_632207284b8cf84f06a93b82d4d553b2_darkside.exe Token: SeBackupPrivilege 2136 2024-08-01_632207284b8cf84f06a93b82d4d553b2_darkside.exe Token: SeBackupPrivilege 2136 2024-08-01_632207284b8cf84f06a93b82d4d553b2_darkside.exe Token: SeSecurityPrivilege 2136 2024-08-01_632207284b8cf84f06a93b82d4d553b2_darkside.exe Token: SeSecurityPrivilege 2136 2024-08-01_632207284b8cf84f06a93b82d4d553b2_darkside.exe Token: SeBackupPrivilege 2136 2024-08-01_632207284b8cf84f06a93b82d4d553b2_darkside.exe Token: SeBackupPrivilege 2136 2024-08-01_632207284b8cf84f06a93b82d4d553b2_darkside.exe Token: SeSecurityPrivilege 2136 2024-08-01_632207284b8cf84f06a93b82d4d553b2_darkside.exe Token: SeSecurityPrivilege 2136 2024-08-01_632207284b8cf84f06a93b82d4d553b2_darkside.exe Token: SeBackupPrivilege 2136 2024-08-01_632207284b8cf84f06a93b82d4d553b2_darkside.exe Token: SeBackupPrivilege 2136 2024-08-01_632207284b8cf84f06a93b82d4d553b2_darkside.exe Token: SeSecurityPrivilege 2136 2024-08-01_632207284b8cf84f06a93b82d4d553b2_darkside.exe Token: SeSecurityPrivilege 2136 2024-08-01_632207284b8cf84f06a93b82d4d553b2_darkside.exe Token: SeBackupPrivilege 2136 2024-08-01_632207284b8cf84f06a93b82d4d553b2_darkside.exe Token: SeBackupPrivilege 2136 2024-08-01_632207284b8cf84f06a93b82d4d553b2_darkside.exe Token: SeSecurityPrivilege 2136 2024-08-01_632207284b8cf84f06a93b82d4d553b2_darkside.exe Token: SeSecurityPrivilege 2136 2024-08-01_632207284b8cf84f06a93b82d4d553b2_darkside.exe Token: SeBackupPrivilege 2136 2024-08-01_632207284b8cf84f06a93b82d4d553b2_darkside.exe Token: SeBackupPrivilege 2136 2024-08-01_632207284b8cf84f06a93b82d4d553b2_darkside.exe Token: SeSecurityPrivilege 2136 2024-08-01_632207284b8cf84f06a93b82d4d553b2_darkside.exe Token: SeSecurityPrivilege 2136 2024-08-01_632207284b8cf84f06a93b82d4d553b2_darkside.exe Token: SeBackupPrivilege 2136 2024-08-01_632207284b8cf84f06a93b82d4d553b2_darkside.exe Token: SeBackupPrivilege 2136 2024-08-01_632207284b8cf84f06a93b82d4d553b2_darkside.exe Token: SeSecurityPrivilege 2136 2024-08-01_632207284b8cf84f06a93b82d4d553b2_darkside.exe Token: SeSecurityPrivilege 2136 2024-08-01_632207284b8cf84f06a93b82d4d553b2_darkside.exe Token: SeBackupPrivilege 2136 2024-08-01_632207284b8cf84f06a93b82d4d553b2_darkside.exe Token: SeBackupPrivilege 2136 2024-08-01_632207284b8cf84f06a93b82d4d553b2_darkside.exe Token: SeSecurityPrivilege 2136 2024-08-01_632207284b8cf84f06a93b82d4d553b2_darkside.exe Token: SeSecurityPrivilege 2136 2024-08-01_632207284b8cf84f06a93b82d4d553b2_darkside.exe Token: SeBackupPrivilege 2136 2024-08-01_632207284b8cf84f06a93b82d4d553b2_darkside.exe Token: SeBackupPrivilege 2136 2024-08-01_632207284b8cf84f06a93b82d4d553b2_darkside.exe Token: SeSecurityPrivilege 2136 2024-08-01_632207284b8cf84f06a93b82d4d553b2_darkside.exe Token: SeSecurityPrivilege 2136 2024-08-01_632207284b8cf84f06a93b82d4d553b2_darkside.exe Token: SeBackupPrivilege 2136 2024-08-01_632207284b8cf84f06a93b82d4d553b2_darkside.exe Token: SeBackupPrivilege 2136 2024-08-01_632207284b8cf84f06a93b82d4d553b2_darkside.exe Token: SeSecurityPrivilege 2136 2024-08-01_632207284b8cf84f06a93b82d4d553b2_darkside.exe Token: SeSecurityPrivilege 2136 2024-08-01_632207284b8cf84f06a93b82d4d553b2_darkside.exe -
Suspicious use of WriteProcessMemory 9 IoCs
description pid Process procid_target PID 2136 wrote to memory of 3016 2136 2024-08-01_632207284b8cf84f06a93b82d4d553b2_darkside.exe 33 PID 2136 wrote to memory of 3016 2136 2024-08-01_632207284b8cf84f06a93b82d4d553b2_darkside.exe 33 PID 2136 wrote to memory of 3016 2136 2024-08-01_632207284b8cf84f06a93b82d4d553b2_darkside.exe 33 PID 2136 wrote to memory of 3016 2136 2024-08-01_632207284b8cf84f06a93b82d4d553b2_darkside.exe 33 PID 2136 wrote to memory of 3016 2136 2024-08-01_632207284b8cf84f06a93b82d4d553b2_darkside.exe 33 PID 3016 wrote to memory of 1788 3016 D21E.tmp 34 PID 3016 wrote to memory of 1788 3016 D21E.tmp 34 PID 3016 wrote to memory of 1788 3016 D21E.tmp 34 PID 3016 wrote to memory of 1788 3016 D21E.tmp 34
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-08-01_632207284b8cf84f06a93b82d4d553b2_darkside.exe"C:\Users\Admin\AppData\Local\Temp\2024-08-01_632207284b8cf84f06a93b82d4d553b2_darkside.exe"1⤵
- Loads dropped DLL
- Drops desktop.ini file(s)
- Sets desktop wallpaper using registry
- System Location Discovery: System Language Discovery
- Modifies Control Panel
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2136 -
C:\ProgramData\D21E.tmp"C:\ProgramData\D21E.tmp"2⤵
- Deletes itself
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:3016 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C DEL /F /Q C:\PROGRA~3\D21E.tmp >> NUL3⤵
- System Location Discovery: System Language Discovery
PID:1788
-
-
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x14c1⤵PID:1980
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
129B
MD5f7fab6072b96fde0ae8f3ebd1b4b9f8d
SHA146a48b1984923acd94cbb50200dd39fdecb83c39
SHA256a83a9dec8b69cd5ecac150d56455df85bf8e03d20441fb69a312aedd38f448df
SHA512f9363c9a7f0ff5be155a2950b2cee89ef450b9e3a141070b8a89552de452d83d3415eb5b4d577e89dfd58da7abe5e29c9e66005feb745f88b3f58d03f3b0dee3
-
Filesize
7KB
MD53bfa3f7119c8a9e8c9572c94db97283f
SHA1879beacbe243ab37564a322bf71b92a5a24ad7b4
SHA2560c496bc31a204d2a33dcb73a95794961527c0cbc4864dae676158edef6894725
SHA512fdb4f4fa04735e1945e099170fd45db8026e138d2ce42181ddd0fed6a157c3da514197d865337d447349bf58ec8b08702d00118156c05cbce89cb026d9fb27ec
-
Filesize
155KB
MD5c00ee33cc01fd65bbad5f1f704876e85
SHA1812badd9b2d38cf59a743f0cbee71fbdfd4a564d
SHA25679f91ab22c55e0bf486fadd44e8b38ba14faec9070882968155283a81db88d3e
SHA512f2785e134a0af56a4c5c1439b68c003ee93dea87effa71cd7f52f815bb86da3965d573bfddc8c54271401ddbac114bf8471e0c80137fadaa04a644d05445c0dc
-
Filesize
129B
MD5be642c3f00f7e84ee83e9b752f697d68
SHA17bf12318d631c9c7748e12c93ec740f2dd59efd9
SHA256b047356621a5f3c4cb3606e1dfcaf9868ca8a1fb8998c538572a023292d831ed
SHA5121cd629012a2fce55d70561c0adc9a4e29797fbcfc97ec2ef5e4e3d26b7584a32c0aaac97e93b5919bda4cda1691df0b82c72fd966c1e477d838d7ccdd6387a05
-
Filesize
14KB
MD5294e9f64cb1642dd89229fff0592856b
SHA197b148c27f3da29ba7b18d6aee8a0db9102f47c9
SHA256917e115cc403e29b4388e0d175cbfac3e7e40ca1742299fbdb353847db2de7c2
SHA512b87d531890bf1577b9b4af41dddb2cdbbfa164cf197bd5987df3a3075983645a3acba443e289b7bfd338422978a104f55298fbfe346872de0895bde44adc89cf