Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
145s -
max time network
135s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
-
submitted
24/09/2024, 01:36
General
-
Target
2024-09-24_8f07589938ea42db794ebef25c755965_darkside.exe
-
Size
147KB
-
MD5
8f07589938ea42db794ebef25c755965
-
SHA1
aa6f9576dfc56a6fccb37d9e70ed0bb441e084e8
-
SHA256
8cdabda0c32376426e32048c867b7d66d9df6a3f0da53baef67e1a30abd444b7
-
SHA512
79e553062ea5e4de34245bc9e8e6a26db2823cd12d51995e401ebfe47ece36a0a7819a2cad79bf14894a1ca30c9a3587a6101b7e8c3ae1432351deebe8fd86e8
-
SSDEEP
1536:ZzICS4AAwczUUf8y8gvMH+1zGSNAojMP95D1xDYediJW5QdpkLMuAkHiWIlqUyz:iqJogYkcSNm9V7DFEW5QAQrRW2qT
Malware Config
Extracted
C:\LOyx4shPX.README.txt
Signatures
-
Renames multiple (149) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
-
Deletes itself 1 IoCs
-
Executes dropped EXE 1 IoCs
-
Drops desktop.ini file(s) 2 IoCs
-
Indicator Removal: File Deletion 1 TTPs
Adversaries may delete files left behind by the actions of their intrusion activity.
-
Drops file in System32 directory 4 IoCs
-
Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
-
Enumerates system info in registry 2 TTPs 3 IoCs
-
Suspicious behavior: EnumeratesProcesses 14 IoCs
-
Suspicious behavior: RenamesItself 26 IoCs
-
Suspicious use of AdjustPrivilegeToken 64 IoCs
-
Suspicious use of SetWindowsHookEx 13 IoCs
-
Suspicious use of WriteProcessMemory 11 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-09-24_8f07589938ea42db794ebef25c755965_darkside.exe"C:\Users\Admin\AppData\Local\Temp\2024-09-24_8f07589938ea42db794ebef25c755965_darkside.exe"1⤵
- Drops desktop.ini file(s)
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\splwow64.exeC:\Windows\splwow64.exe 122882⤵
- Drops file in System32 directory
-
-
C:\ProgramData\9454.tmp"C:\ProgramData\9454.tmp"2⤵
- Checks computer location settings
- Deletes itself
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C DEL /F /Q C:\PROGRA~3\9454.tmp >> NUL3⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --field-trial-handle=4512,i,16315016104747277319,5510969007830467313,262144 --variations-seed-version --mojo-platform-channel-handle=4212 /prefetch:81⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k PrintWorkflow -s PrintWorkflowUserSvc1⤵
-
C:\Windows\system32\printfilterpipelinesvc.exeC:\Windows\system32\printfilterpipelinesvc.exe -Embedding1⤵
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Microsoft Office\root\Office16\ONENOTE.EXE/insertdoc "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\{DBD05063-CDF3-44C8-B8C2-9AA2A457BD91}.xps" 1337161541528700002⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
129B
MD5ba6190a28367c036aa87d9406cb33ce7
SHA189b72d4732c8e4924615fbb9386c6ff824ca6319
SHA25690498b27cd6c0a37cf59b591a74f892d4cb6dc44a8b02cd5f4ff194badbd8582
SHA51225d373f60e549c00fa66ba27a3b5c13d3775807df92a6a6bae4614426071158dab7556835a6d3419de060e1d3c2b42469285775457d44f73b1239350560f0e04
-
Filesize
1KB
MD588cf2517f115408ab7aed8c749642095
SHA118d3e6939413777568c48969d034325dac990826
SHA256db34f0ce8a7806f24be30cbb2fbfe4b1d2a54fc0aa15f1a6bb0bb8732222ae77
SHA512027517ca25064985f7f085704e0a77622d86cdc390e386ebfef8f758b6b0bf4f9dad9f088478900a6d399f8bb95d0197949ff62b71f2815cbdecb7909f43aad3
-
Filesize
14KB
MD5294e9f64cb1642dd89229fff0592856b
SHA197b148c27f3da29ba7b18d6aee8a0db9102f47c9
SHA256917e115cc403e29b4388e0d175cbfac3e7e40ca1742299fbdb353847db2de7c2
SHA512b87d531890bf1577b9b4af41dddb2cdbbfa164cf197bd5987df3a3075983645a3acba443e289b7bfd338422978a104f55298fbfe346872de0895bde44adc89cf
-
Filesize
147KB
MD5beb04a90c77786bb49e299796882a0f8
SHA1357874420f9766aa0da60b69e473bc0eebacac62
SHA25626a37b3cd888c5d637f8c701be3c94fc7749e87f769b8c2f7ec96a2d17537cc8
SHA5122ba01c3d8d02dc02ca17607f6a5ed10cf8eb48619ce1400fdba2eb6d5a2d90e7fcae2c80108f9eda82fcbcf43892335dbdf4c098781c37aa280340d8715a9d9a
-
Filesize
4KB
MD559aebd5b318d78086fb883a6c418189a
SHA1c74a4d31780acefe95efbae4df677ac716e40cb9
SHA2562254f204e7f23a6425160d5b04847625846910a84edd5599fae893123eb508b9
SHA5126057a4140c3b720fa34da6970a04d1b8c28f15276fdd84d6daf59d4dc0f5162b1b74fa95bab3fc63dd4c9f0ebf7da747a1e3fd985353ae3834ee0ece8f70fe56
-
Filesize
4KB
MD5daedef3f9fba945c4959fbd126b80faa
SHA142c121d50657670257089936db5f9b24407d9355
SHA256a4e451b87cb3baee40db83d6c4105b1bd8985b0fd52468defb3b039e00155dff
SHA51271a12cd74a014941e62c045ddead3b26cac16e9fd674175a8fe59545bde9f1d6e99ccb93a03bc186a1d970cac7290409dd58c5d29ebb5a5cd233a5c2a1d793d2
-
Filesize
129B
MD5620a19effe07d3328cc5452da2fbe35c
SHA192bffb84d59818d50d44c33dca2c8327357c9793
SHA25631955afe48c75ed2a886d0081e523333db89c87f12810e309e2440779c7a0bef
SHA512436cbce449286ac986d32108836b42c8d4e4e6513453d781900cbf505f410e4a1f06a6c6f70e928e0d08d866b979fb2e8f3082752347697d2b59afdee54ebda8
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB