Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
148s -
max time network
128s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
-
submitted
03/08/2024, 13:33
General
-
Target
2024-08-03_7e503c206e57f0295da017914a957d04_darkside.exe
-
Size
150KB
-
MD5
7e503c206e57f0295da017914a957d04
-
SHA1
96c375b9c57292db73c7ef2f2df16cf7be1604bb
-
SHA256
274844568a6a9ce334d71efeac21f528d7b54b2cd4377c978cc1270c6ad986c4
-
SHA512
cd4889ae107c54df854042e030eb431664d4db9d6dc908d1f1910ca49b89d247222f9d19440fcc2d9a120c95b56cd694750072ab9486eea961b8c33391344c1c
-
SSDEEP
3072:6qJogYkcSNm9V7DPaGkxDSzGmblnDPET:6q2kc4m9tDyNDSrdj
Malware Config
Extracted
C:\wlJ8FiR2h.README.txt
lockbit
http://lockbitsupt7nr3fa6e7xyb73lk6bw6rcneqhoyblniiabj4uwvzapqd.onion
http://lockbitsupuhswh4izvoucoxsbnotkmgq6durg7kficg6u33zfvq3oyd.onion
http://lockbitsupn2h6be2cnqpvncyhj4rgmnwn44633hnzzmtxdvjoqlp7yd.onion
http://lockbitsupp.uz
http://lockbitapt2yfbt7lchxejug47kmqvqqxvvjpqkmevv4l3azl3gy6pyd.onion
http://lockbitapt5x4zkjbcqmz6frdhecqqgadevyiwqxukksspnlidyvd7qd.onion
http://lockbitapt6vx57t3eeqjofwgcglmutr3a35nygvokja5uuccip4ykyd.onion
http://lockbitapt34kvrip6xojylohhxrwsvpzdffgs5z4pbbsywnzsbdguqd.onion
http://lockbitaptc2iq4atewz2ise62q63wfktyrl4qtwuk5qax262kgtzjqd.onion
http://lockbitaptjpikdqjynvgozhgc6bgetgucdk5xjacozeaawihmoio6yd.onion
http://lockbitaptq7ephv2oigdncfhtwhpqgwmqojnxqdyhprxxfpcllqdxad.onion
http://lockbitaptstzf3er2lz6ku3xuifafq2yh5lmiqj5ncur6rtlmkteiqd.onion
http://lockbitaptoofrpignlz6dt2wqqc5z3a4evjevoa3eqdfcntxad5lmyd.onion
Signatures
-
Lockbit
Ransomware family with multiple variants released since late 2019.
-
Renames multiple (605) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
-
Deletes itself 1 IoCs
-
Executes dropped EXE 1 IoCs
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Drops desktop.ini file(s) 2 IoCs
-
Indicator Removal: File Deletion 1 TTPs
Adversaries may delete files left behind by the actions of their intrusion activity.
-
Drops file in System32 directory 4 IoCs
-
Sets desktop wallpaper using registry 2 TTPs 2 IoCs
-
Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
-
Enumerates system info in registry 2 TTPs 3 IoCs
-
Modifies Control Panel 2 IoCs
-
Modifies registry class 5 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious behavior: RenamesItself 26 IoCs
-
Suspicious use of AdjustPrivilegeToken 64 IoCs
-
Suspicious use of SetWindowsHookEx 13 IoCs
-
Suspicious use of WriteProcessMemory 11 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-08-03_7e503c206e57f0295da017914a957d04_darkside.exe"C:\Users\Admin\AppData\Local\Temp\2024-08-03_7e503c206e57f0295da017914a957d04_darkside.exe"1⤵
- Drops desktop.ini file(s)
- Sets desktop wallpaper using registry
- System Location Discovery: System Language Discovery
- Modifies Control Panel
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\splwow64.exeC:\Windows\splwow64.exe 122882⤵
- Drops file in System32 directory
-
-
C:\ProgramData\F974.tmp"C:\ProgramData\F974.tmp"2⤵
- Checks computer location settings
- Deletes itself
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C DEL /F /Q C:\PROGRA~3\F974.tmp >> NUL3⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k PrintWorkflow -s PrintWorkflowUserSvc1⤵
-
C:\Windows\system32\printfilterpipelinesvc.exeC:\Windows\system32\printfilterpipelinesvc.exe -Embedding1⤵
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Microsoft Office\root\Office16\ONENOTE.EXE/insertdoc "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\{9ED6AA39-9CAB-4256-AD23-6CE7D13F5DE4}.xps" 1336716562942900002⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious use of SetWindowsHookEx
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
129B
MD55f42382fdffa55ba5f972c492a2f142e
SHA1fa23827676eaf64a53f1e4e2ff3db49077c4500f
SHA256856c1bf4f03907c77962dedb371f4240ede6805eeef2a38d2975bc3e445b3166
SHA5127f8e129622eff4e6c791426f3348ebcbfa54ff197178182b52f3c580026d9e2291b08a1d9d2a1d32e62bb23e2444ea713ca84cb96b029b002e43bab3a280da29
-
Filesize
14KB
MD5294e9f64cb1642dd89229fff0592856b
SHA197b148c27f3da29ba7b18d6aee8a0db9102f47c9
SHA256917e115cc403e29b4388e0d175cbfac3e7e40ca1742299fbdb353847db2de7c2
SHA512b87d531890bf1577b9b4af41dddb2cdbbfa164cf197bd5987df3a3075983645a3acba443e289b7bfd338422978a104f55298fbfe346872de0895bde44adc89cf
-
Filesize
150KB
MD5e28a4a0ba9147b047ec2885dbd9801b5
SHA162c7c68f85c86fb83e6dbddab20501fdcd44ba03
SHA256684da9a6f58b80d89a757937ef05a6fdf20ec98ea9f6b13bdb5d2dfc014871be
SHA512b146c15d8c267e43c0b153d49d631e237415acaee4e46d636601985d0862c4990800ee3ef2398d87da53fe03ea116eac586abd6142894848a8ad76081c76c581
-
Filesize
4KB
MD55fd604a390ee8bc01db21cdf8347f892
SHA1f6766de209ec5afa698028df3b975a7a846190e0
SHA256e74bf07f6e4120f9d1c4739d564066dc23c137d4b64f6d42fe5d911707f9daed
SHA512753d06cd04cb5b9b8bdeeb9f116be954b7b0ac75767ccf5c1f7c7873fae14f0aa4837abbe3e7944932a9c713d2e59daff0b356dc2fbab082ce0b7bc74448527d
-
Filesize
4KB
MD519f8cb64cbf3e563560fa550763d63ea
SHA188314e21ef20959724fa4c2330f623cdfe104c0a
SHA2564027ae8583aba4de66863e4856957559ccca77e62a53021c9f1580aaa5d7a895
SHA51213e7353f3d5ff4110a95e65b3b6b04431c4e0d1c815f7c5dda8d23cfa3d8746d28570000f71ef104b30f13331e631e27dd6fc7079a480014d55822903598c4d4
-
Filesize
3KB
MD5b9674de0868a93e9121bdb1d02d80130
SHA179d692fd03d3110a4358e2cc7442af9517489f3f
SHA2569268d24e96639cf4c0e8d74f9769092b415015692ea528820faaded6fc5b052c
SHA512b3264ad33eddedb2c18da883e2345247c762adc8a604991fce931cba06b86c361d23fa121e79d6c69948a2d5b9c1613139f401b971360d9d684abb5a61543c02
-
Filesize
129B
MD54a1046952d52baa87b2ff248eee221ed
SHA193a50fd18f5257a6da1d4e81d0e14a53db55b4c1
SHA2561d266656c4b652bc5e27f6e0ef10ba6ee2bb3b82196fe3909924b9e6ff413f36
SHA512cb2dcba2bd9155a70cd64444972a2a837582a050e96a5f0928b005435b48e8faddbf60a7bd1e3db96630debaf1770ebd8d25b39c60c2bdf93fc66e92ddff2eb8
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB