Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
117s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
27/11/2024, 02:25
Behavioral task
behavioral1
Sample
2024-11-27_12ee1481a91f84a0bc71b45aa00844b0_darkside.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
2024-11-27_12ee1481a91f84a0bc71b45aa00844b0_darkside.exe
Resource
win10v2004-20241007-en
General
-
Target
2024-11-27_12ee1481a91f84a0bc71b45aa00844b0_darkside.exe
-
Size
156KB
-
MD5
12ee1481a91f84a0bc71b45aa00844b0
-
SHA1
309d2273d6875c14acb8976c429e022d9ed5a6ee
-
SHA256
421f922658b985855a580ad3d6736c55817d252a9d6104c944786f7aae393b6b
-
SHA512
e3293bc77e8177f7abc3a8b51ce05c20941735f9f3c9902201c8f7907529a25d3e1654704b7163324a6ed3b8604e6002ddcc7aa79ef2a8ec609ea548d160075a
-
SSDEEP
3072:+DDDDDDDDDDDDDDDDDDDE45d/t6sVkgZqltP3368JmSLTFh1zgH3/W:I5d/zugZqll30SD1gH3
Malware Config
Signatures
-
Deletes itself 1 IoCs
pid Process 532 BFA7.tmp -
Executes dropped EXE 1 IoCs
pid Process 532 BFA7.tmp -
Loads dropped DLL 1 IoCs
pid Process 1972 2024-11-27_12ee1481a91f84a0bc71b45aa00844b0_darkside.exe -
Drops desktop.ini file(s) 2 IoCs
description ioc Process File opened for modification C:\$Recycle.Bin\S-1-5-21-2872745919-2748461613-2989606286-1000\desktop.ini 2024-11-27_12ee1481a91f84a0bc71b45aa00844b0_darkside.exe File opened for modification F:\$RECYCLE.BIN\S-1-5-21-2872745919-2748461613-2989606286-1000\desktop.ini 2024-11-27_12ee1481a91f84a0bc71b45aa00844b0_darkside.exe -
Indicator Removal: File Deletion 1 TTPs
Adversaries may delete files left behind by the actions of their intrusion activity.
-
Suspicious use of NtSetInformationThreadHideFromDebugger 12 IoCs
pid Process 1972 2024-11-27_12ee1481a91f84a0bc71b45aa00844b0_darkside.exe 1972 2024-11-27_12ee1481a91f84a0bc71b45aa00844b0_darkside.exe 1972 2024-11-27_12ee1481a91f84a0bc71b45aa00844b0_darkside.exe 1972 2024-11-27_12ee1481a91f84a0bc71b45aa00844b0_darkside.exe 1972 2024-11-27_12ee1481a91f84a0bc71b45aa00844b0_darkside.exe 1972 2024-11-27_12ee1481a91f84a0bc71b45aa00844b0_darkside.exe 532 BFA7.tmp 532 BFA7.tmp 532 BFA7.tmp 532 BFA7.tmp 532 BFA7.tmp 532 BFA7.tmp -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2024-11-27_12ee1481a91f84a0bc71b45aa00844b0_darkside.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BFA7.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe -
Suspicious behavior: EnumeratesProcesses 12 IoCs
pid Process 1972 2024-11-27_12ee1481a91f84a0bc71b45aa00844b0_darkside.exe 1972 2024-11-27_12ee1481a91f84a0bc71b45aa00844b0_darkside.exe 1972 2024-11-27_12ee1481a91f84a0bc71b45aa00844b0_darkside.exe 1972 2024-11-27_12ee1481a91f84a0bc71b45aa00844b0_darkside.exe 1972 2024-11-27_12ee1481a91f84a0bc71b45aa00844b0_darkside.exe 1972 2024-11-27_12ee1481a91f84a0bc71b45aa00844b0_darkside.exe 1972 2024-11-27_12ee1481a91f84a0bc71b45aa00844b0_darkside.exe 1972 2024-11-27_12ee1481a91f84a0bc71b45aa00844b0_darkside.exe 1972 2024-11-27_12ee1481a91f84a0bc71b45aa00844b0_darkside.exe 1972 2024-11-27_12ee1481a91f84a0bc71b45aa00844b0_darkside.exe 1972 2024-11-27_12ee1481a91f84a0bc71b45aa00844b0_darkside.exe 1972 2024-11-27_12ee1481a91f84a0bc71b45aa00844b0_darkside.exe -
Suspicious behavior: RenamesItself 26 IoCs
pid Process 532 BFA7.tmp 532 BFA7.tmp 532 BFA7.tmp 532 BFA7.tmp 532 BFA7.tmp 532 BFA7.tmp 532 BFA7.tmp 532 BFA7.tmp 532 BFA7.tmp 532 BFA7.tmp 532 BFA7.tmp 532 BFA7.tmp 532 BFA7.tmp 532 BFA7.tmp 532 BFA7.tmp 532 BFA7.tmp 532 BFA7.tmp 532 BFA7.tmp 532 BFA7.tmp 532 BFA7.tmp 532 BFA7.tmp 532 BFA7.tmp 532 BFA7.tmp 532 BFA7.tmp 532 BFA7.tmp 532 BFA7.tmp -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeAssignPrimaryTokenPrivilege 1972 2024-11-27_12ee1481a91f84a0bc71b45aa00844b0_darkside.exe Token: SeBackupPrivilege 1972 2024-11-27_12ee1481a91f84a0bc71b45aa00844b0_darkside.exe Token: SeDebugPrivilege 1972 2024-11-27_12ee1481a91f84a0bc71b45aa00844b0_darkside.exe Token: 36 1972 2024-11-27_12ee1481a91f84a0bc71b45aa00844b0_darkside.exe Token: SeImpersonatePrivilege 1972 2024-11-27_12ee1481a91f84a0bc71b45aa00844b0_darkside.exe Token: SeIncBasePriorityPrivilege 1972 2024-11-27_12ee1481a91f84a0bc71b45aa00844b0_darkside.exe Token: SeIncreaseQuotaPrivilege 1972 2024-11-27_12ee1481a91f84a0bc71b45aa00844b0_darkside.exe Token: 33 1972 2024-11-27_12ee1481a91f84a0bc71b45aa00844b0_darkside.exe Token: SeManageVolumePrivilege 1972 2024-11-27_12ee1481a91f84a0bc71b45aa00844b0_darkside.exe Token: SeProfSingleProcessPrivilege 1972 2024-11-27_12ee1481a91f84a0bc71b45aa00844b0_darkside.exe Token: SeRestorePrivilege 1972 2024-11-27_12ee1481a91f84a0bc71b45aa00844b0_darkside.exe Token: SeSecurityPrivilege 1972 2024-11-27_12ee1481a91f84a0bc71b45aa00844b0_darkside.exe Token: SeSystemProfilePrivilege 1972 2024-11-27_12ee1481a91f84a0bc71b45aa00844b0_darkside.exe Token: SeTakeOwnershipPrivilege 1972 2024-11-27_12ee1481a91f84a0bc71b45aa00844b0_darkside.exe Token: SeShutdownPrivilege 1972 2024-11-27_12ee1481a91f84a0bc71b45aa00844b0_darkside.exe Token: SeDebugPrivilege 1972 2024-11-27_12ee1481a91f84a0bc71b45aa00844b0_darkside.exe Token: SeBackupPrivilege 2732 vssvc.exe Token: SeRestorePrivilege 2732 vssvc.exe Token: SeAuditPrivilege 2732 vssvc.exe Token: SeBackupPrivilege 1972 2024-11-27_12ee1481a91f84a0bc71b45aa00844b0_darkside.exe Token: SeBackupPrivilege 1972 2024-11-27_12ee1481a91f84a0bc71b45aa00844b0_darkside.exe Token: SeSecurityPrivilege 1972 2024-11-27_12ee1481a91f84a0bc71b45aa00844b0_darkside.exe Token: SeSecurityPrivilege 1972 2024-11-27_12ee1481a91f84a0bc71b45aa00844b0_darkside.exe Token: SeBackupPrivilege 1972 2024-11-27_12ee1481a91f84a0bc71b45aa00844b0_darkside.exe Token: SeBackupPrivilege 1972 2024-11-27_12ee1481a91f84a0bc71b45aa00844b0_darkside.exe Token: SeSecurityPrivilege 1972 2024-11-27_12ee1481a91f84a0bc71b45aa00844b0_darkside.exe Token: SeSecurityPrivilege 1972 2024-11-27_12ee1481a91f84a0bc71b45aa00844b0_darkside.exe Token: SeBackupPrivilege 1972 2024-11-27_12ee1481a91f84a0bc71b45aa00844b0_darkside.exe Token: SeBackupPrivilege 1972 2024-11-27_12ee1481a91f84a0bc71b45aa00844b0_darkside.exe Token: SeSecurityPrivilege 1972 2024-11-27_12ee1481a91f84a0bc71b45aa00844b0_darkside.exe Token: SeSecurityPrivilege 1972 2024-11-27_12ee1481a91f84a0bc71b45aa00844b0_darkside.exe Token: SeBackupPrivilege 1972 2024-11-27_12ee1481a91f84a0bc71b45aa00844b0_darkside.exe Token: SeBackupPrivilege 1972 2024-11-27_12ee1481a91f84a0bc71b45aa00844b0_darkside.exe Token: SeSecurityPrivilege 1972 2024-11-27_12ee1481a91f84a0bc71b45aa00844b0_darkside.exe Token: SeSecurityPrivilege 1972 2024-11-27_12ee1481a91f84a0bc71b45aa00844b0_darkside.exe Token: SeBackupPrivilege 1972 2024-11-27_12ee1481a91f84a0bc71b45aa00844b0_darkside.exe Token: SeBackupPrivilege 1972 2024-11-27_12ee1481a91f84a0bc71b45aa00844b0_darkside.exe Token: SeSecurityPrivilege 1972 2024-11-27_12ee1481a91f84a0bc71b45aa00844b0_darkside.exe Token: SeSecurityPrivilege 1972 2024-11-27_12ee1481a91f84a0bc71b45aa00844b0_darkside.exe Token: SeBackupPrivilege 1972 2024-11-27_12ee1481a91f84a0bc71b45aa00844b0_darkside.exe Token: SeBackupPrivilege 1972 2024-11-27_12ee1481a91f84a0bc71b45aa00844b0_darkside.exe Token: SeSecurityPrivilege 1972 2024-11-27_12ee1481a91f84a0bc71b45aa00844b0_darkside.exe Token: SeSecurityPrivilege 1972 2024-11-27_12ee1481a91f84a0bc71b45aa00844b0_darkside.exe Token: SeBackupPrivilege 1972 2024-11-27_12ee1481a91f84a0bc71b45aa00844b0_darkside.exe Token: SeBackupPrivilege 1972 2024-11-27_12ee1481a91f84a0bc71b45aa00844b0_darkside.exe Token: SeSecurityPrivilege 1972 2024-11-27_12ee1481a91f84a0bc71b45aa00844b0_darkside.exe Token: SeSecurityPrivilege 1972 2024-11-27_12ee1481a91f84a0bc71b45aa00844b0_darkside.exe Token: SeBackupPrivilege 1972 2024-11-27_12ee1481a91f84a0bc71b45aa00844b0_darkside.exe Token: SeBackupPrivilege 1972 2024-11-27_12ee1481a91f84a0bc71b45aa00844b0_darkside.exe Token: SeSecurityPrivilege 1972 2024-11-27_12ee1481a91f84a0bc71b45aa00844b0_darkside.exe Token: SeSecurityPrivilege 1972 2024-11-27_12ee1481a91f84a0bc71b45aa00844b0_darkside.exe Token: SeBackupPrivilege 1972 2024-11-27_12ee1481a91f84a0bc71b45aa00844b0_darkside.exe Token: SeBackupPrivilege 1972 2024-11-27_12ee1481a91f84a0bc71b45aa00844b0_darkside.exe Token: SeSecurityPrivilege 1972 2024-11-27_12ee1481a91f84a0bc71b45aa00844b0_darkside.exe Token: SeSecurityPrivilege 1972 2024-11-27_12ee1481a91f84a0bc71b45aa00844b0_darkside.exe Token: SeBackupPrivilege 1972 2024-11-27_12ee1481a91f84a0bc71b45aa00844b0_darkside.exe Token: SeBackupPrivilege 1972 2024-11-27_12ee1481a91f84a0bc71b45aa00844b0_darkside.exe Token: SeSecurityPrivilege 1972 2024-11-27_12ee1481a91f84a0bc71b45aa00844b0_darkside.exe Token: SeSecurityPrivilege 1972 2024-11-27_12ee1481a91f84a0bc71b45aa00844b0_darkside.exe Token: SeBackupPrivilege 1972 2024-11-27_12ee1481a91f84a0bc71b45aa00844b0_darkside.exe Token: SeBackupPrivilege 1972 2024-11-27_12ee1481a91f84a0bc71b45aa00844b0_darkside.exe Token: SeSecurityPrivilege 1972 2024-11-27_12ee1481a91f84a0bc71b45aa00844b0_darkside.exe Token: SeSecurityPrivilege 1972 2024-11-27_12ee1481a91f84a0bc71b45aa00844b0_darkside.exe Token: SeBackupPrivilege 1972 2024-11-27_12ee1481a91f84a0bc71b45aa00844b0_darkside.exe -
Suspicious use of WriteProcessMemory 9 IoCs
description pid Process procid_target PID 1972 wrote to memory of 532 1972 2024-11-27_12ee1481a91f84a0bc71b45aa00844b0_darkside.exe 33 PID 1972 wrote to memory of 532 1972 2024-11-27_12ee1481a91f84a0bc71b45aa00844b0_darkside.exe 33 PID 1972 wrote to memory of 532 1972 2024-11-27_12ee1481a91f84a0bc71b45aa00844b0_darkside.exe 33 PID 1972 wrote to memory of 532 1972 2024-11-27_12ee1481a91f84a0bc71b45aa00844b0_darkside.exe 33 PID 1972 wrote to memory of 532 1972 2024-11-27_12ee1481a91f84a0bc71b45aa00844b0_darkside.exe 33 PID 532 wrote to memory of 2080 532 BFA7.tmp 37 PID 532 wrote to memory of 2080 532 BFA7.tmp 37 PID 532 wrote to memory of 2080 532 BFA7.tmp 37 PID 532 wrote to memory of 2080 532 BFA7.tmp 37 -
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-11-27_12ee1481a91f84a0bc71b45aa00844b0_darkside.exe"C:\Users\Admin\AppData\Local\Temp\2024-11-27_12ee1481a91f84a0bc71b45aa00844b0_darkside.exe"1⤵
- Loads dropped DLL
- Drops desktop.ini file(s)
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1972 -
C:\ProgramData\BFA7.tmp"C:\ProgramData\BFA7.tmp"2⤵
- Deletes itself
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:532 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C DEL /F /Q C:\PROGRA~3\BFA7.tmp >> NUL3⤵
- System Location Discovery: System Language Discovery
PID:2080
-
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2732
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x14c1⤵PID:1340
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
129B
MD58949b1b9e6aa1c50299498df74d91251
SHA1b837ccc32337437da7dc5e835604933da0ab2249
SHA256f17ebcd3e0a2c7b25965deb9ef1166cd27f73afb7936a2f6410540cfd334243f
SHA512da3b4536fda6c17af1dea5980c8e573ec487a4b415667f2c45604247f3df1584e0e02054ee7167ca3ae44dddc08e71d122a732432f4a2e2c13e01469da8db630
-
Filesize
156KB
MD5d189fec3bea87c9baf4cbe1ffdf1a072
SHA1b7258027c244b63e575ed88a06c8a2484d19a3db
SHA256f539e03b118a72d39175eb5d4cef5a558dea3438fde48eeff750f3a3052679cb
SHA51251e5c897757cb0cb94f2016e9e515b40ad7ad71c128362df07948eb668c931b6d80284131882842400c6a6cc9101cfe21893afe154e52e555c422d3cbdfb4c36
-
Filesize
129B
MD5cd12c65d5abf87cb09f004b6f50e7d1b
SHA1bb42bad8112ca4123a29a75746fa7dbe1e9c361f
SHA256f2a0ad093c49209ab25ee1ecd82f491a256783a35eb6b61af33ba25367dfaf8c
SHA512ac57043bca7319f96921c1620d7d2a1f09ae166fede45a5aed4e1e768dbfbdca3d56ea3584d0f08ca633f7cf6fddd6f88791fd283c481529fcc42746eecbb1ae
-
Filesize
14KB
MD5294e9f64cb1642dd89229fff0592856b
SHA197b148c27f3da29ba7b18d6aee8a0db9102f47c9
SHA256917e115cc403e29b4388e0d175cbfac3e7e40ca1742299fbdb353847db2de7c2
SHA512b87d531890bf1577b9b4af41dddb2cdbbfa164cf197bd5987df3a3075983645a3acba443e289b7bfd338422978a104f55298fbfe346872de0895bde44adc89cf