Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

10

Static

static

10

2024-08-01...de.exe

windows7-x64

9

2024-08-01...de.exe

windows10-2004-x64

9

Analysis

  • max time kernel
    149s
  • max time network
    150s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240730-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240730-enlocale:en-usos:windows10-2004-x64system
  • submitted
    01/08/2024, 13:01

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    2024-08-01_ba0f3824fd072544573c12333c62f98c_darkside.exe

  • Size

    146KB

  • MD5

    ba0f3824fd072544573c12333c62f98c

  • SHA1

    072e25f82f2e9ae80358c4bab85f12635051cf0b

  • SHA256

    932448031d067a602b8000e2ecdc6541d2d3e085b276d7db84785e1511b65b07

  • SHA512

    a8e7dea7ac6cb66a1293a26f0c41de483673885d7ff44e43efd28e1dd10d48172817a2c78a3312f8ac0ce22f6f385f56c39905699682101b3a2ca70b8205e917

  • SSDEEP

    1536:KzICS4AAwczUUf8y8gvMH+1zGSNAojMP95D1xD7uGRWaa9aZoRspbQuIUyz:5qJogYkcSNm9V7Dq4SuIT

Score
9/10
defense_evasiondiscoveryransomwarespywarestealer

Malware Config

Signatures

  • Renames multiple (671) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

    ransomware
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself 1 IoCs
  • Executes dropped EXE 1 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Drops desktop.ini file(s) 2 IoCs
  • Indicator Removal: File Deletion 1 TTPs

    Adversaries may delete files left behind by the actions of their intrusion activity.

    defense_evasion
  • Drops file in System32 directory 4 IoCs
  • Suspicious use of NtSetInformationThreadHideFromDebugger 6 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Checks processor information in registry 2 TTPs 3 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: RenamesItself 26 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of SetWindowsHookEx 13 IoCs
  • Suspicious use of WriteProcessMemory 11 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2024-08-01_ba0f3824fd072544573c12333c62f98c_darkside.exe
    "C:\Users\Admin\AppData\Local\Temp\2024-08-01_ba0f3824fd072544573c12333c62f98c_darkside.exe"
    1⤵
    • Drops desktop.ini file(s)
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:4028
    • C:\Windows\splwow64.exe
      C:\Windows\splwow64.exe 12288
      2⤵
      • Drops file in System32 directory
      PID:4948
    • C:\ProgramData\FA7E.tmp
      "C:\ProgramData\FA7E.tmp"
      2⤵
      • Checks computer location settings
      • Deletes itself
      • Executes dropped EXE
      • Suspicious use of NtSetInformationThreadHideFromDebugger
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: RenamesItself
      • Suspicious use of WriteProcessMemory
      PID:3100
      • C:\Windows\SysWOW64\cmd.exe
        "C:\Windows\System32\cmd.exe" /C DEL /F /Q C:\PROGRA~3\FA7E.tmp >> NUL
        3⤵
        • System Location Discovery: System Language Discovery
        PID:2660
  • C:\Windows\system32\svchost.exe
    C:\Windows\system32\svchost.exe -k PrintWorkflow -s PrintWorkflowUserSvc
    1⤵
      PID:516
    • C:\Windows\system32\printfilterpipelinesvc.exe
      C:\Windows\system32\printfilterpipelinesvc.exe -Embedding
      1⤵
      • Drops file in System32 directory
      • Suspicious use of WriteProcessMemory
      PID:2816
      • C:\Program Files\Microsoft Office\root\Office16\ONENOTE.EXE
        /insertdoc "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\{489B13BB-B9D0-4BFC-BB2B-9F06EB586FEE}.xps" 133669909138660000
        2⤵
        • Checks processor information in registry
        • Enumerates system info in registry
        • Suspicious use of SetWindowsHookEx
        PID:2960

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\$Recycle.Bin\S-1-5-21-857544305-989156968-2929034274-1000\SSSSSSSSSSS
      Filesize

      129B

      MD5

      852adbc158fed5560205070372614959

      SHA1

      752927d3585a7ee834e1698ca7ebf816a8ef893c

      SHA256

      352de4ab0b57100f91b08646d787d73bf2fdb179daeb4afdad57b988ec0ddc62

      SHA512

      7cd81b0177aefb6f01e9fd39b5b4f4311ee25c275b1ffd03c1b72db6aca639705c054e1a415a382863f19bf7f78db6706c04b8cb5e4f16454c014c45609d471a

      Download Submit

    • C:\ProgramData\FA7E.tmp
      Filesize

      14KB

      MD5

      294e9f64cb1642dd89229fff0592856b

      SHA1

      97b148c27f3da29ba7b18d6aee8a0db9102f47c9

      SHA256

      917e115cc403e29b4388e0d175cbfac3e7e40ca1742299fbdb353847db2de7c2

      SHA512

      b87d531890bf1577b9b4af41dddb2cdbbfa164cf197bd5987df3a3075983645a3acba443e289b7bfd338422978a104f55298fbfe346872de0895bde44adc89cf

      Download Submit

    • C:\Users\Admin\AppData\Local\Temp\EEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEE
      Filesize

      146KB

      MD5

      eb2ec7c2b5aa6b290bee8700ae285657

      SHA1

      4c8168274a50ec6a1d4aa8cfd24d9661d6acd6a2

      SHA256

      3e62dce03ec0b32a8c4a03fdcb88ad08e697ad8079660c8978c05604cb56946a

      SHA512

      5a6e1550c5817a7c2395cf556fbd6f15b4c8bda5e86f326320c4315e431cae1a3eea16ee94ea7e2b3ddb391d243e3486f9390a90564cdad29b37f8a662083901

      Download Submit

    • C:\Users\Admin\Documents\OneNote Notebooks\My Notebook\Open Notebook.onetoc2
      Filesize

      4KB

      MD5

      2b3bdece013426ab493cf4b2e26d3122

      SHA1

      1b56f48c7b1a704466ec45f994837d77ac84acd0

      SHA256

      f4217a766637fea368521c98de567e1b31a5f5388b2f69e95d237f7691dcaaa2

      SHA512

      aac6644ffff55f73887f9f0c9f1e031c4e1423ff84b10e2103f1ff12582f8b9343330679943dd8b85e60c1107a7fe12b2a4f6f982dd6e34795fd48372dbcc650

      Download Submit

    • C:\VeA5vab0N.README.txt
      Filesize

      942B

      MD5

      e20a9014ed71b2c304bb87faab2fdf6b

      SHA1

      c1cce70fa33ec7cfd52187acc490f0130f424012

      SHA256

      ef9c4c4228714c697598358afe82b9a6a1e513947cff238d9b3c0a9bf92498fd

      SHA512

      7503f63eeed77320b182f3cc55a3cc6eca6f9dbfac51b5c6bf6ddf1be8a3d2f510eecbb8fbcee3c513aaee1e9b37195f2250da8b40f934993d7b596a59cab802

      Download Submit

    • F:\$RECYCLE.BIN\S-1-5-21-857544305-989156968-2929034274-1000\DDDDDDDDDDD
      Filesize

      129B

      MD5

      2c50e6ad1beb03ca21f71353c4caf6a2

      SHA1

      61e73ba066f34ef10aec2856c3b9a5122aeb695f

      SHA256

      828c9f0162284ca7d07215aefd50d554f8554dbd8adc7cfeccf4bf4e6f9d9316

      SHA512

      9c5adf98f0c5175eae51052b8fd1e2b4583ebc3bf9edf7a6dbeaf97b364c9b11a29246e08a2c651b4483d204a33f80ccecac5c10ea07e898109e0bfd6b207290

      Download Submit

    • memory/2960-3264-0x00007FFC367D0000-0x00007FFC367E0000-memory.dmp

      Filesize

      64KB

      Download

    • memory/2960-3263-0x00007FFC367D0000-0x00007FFC367E0000-memory.dmp

      Filesize

      64KB

      Download

    • memory/2960-3262-0x00007FFC367D0000-0x00007FFC367E0000-memory.dmp

      Filesize

      64KB

      Download

    • memory/2960-3265-0x00007FFC367D0000-0x00007FFC367E0000-memory.dmp

      Filesize

      64KB

      Download

    • memory/2960-3266-0x00007FFC367D0000-0x00007FFC367E0000-memory.dmp

      Filesize

      64KB

      Download

    • memory/2960-3295-0x00007FFC345C0000-0x00007FFC345D0000-memory.dmp

      Filesize

      64KB

      Download

    • memory/2960-3296-0x00007FFC345C0000-0x00007FFC345D0000-memory.dmp

      Filesize

      64KB

      Download

    • memory/4028-2-0x0000000002FB0000-0x0000000002FC0000-memory.dmp

      Filesize

      64KB

      Download

    • memory/4028-0-0x0000000002FB0000-0x0000000002FC0000-memory.dmp

      Filesize

      64KB

      Download

    • memory/4028-1-0x0000000002FB0000-0x0000000002FC0000-memory.dmp

      Filesize

      64KB

      Download