Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
147s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
31/12/2024, 10:26
General
-
Target
2024-12-31_a8e100a287fad6eb312b6b2c6448aa20_darkside.exe
-
Size
153KB
-
MD5
a8e100a287fad6eb312b6b2c6448aa20
-
SHA1
174c8426032637a4f0de8d3c9d5b47c2d337bf9f
-
SHA256
03ad161d9a00bfd11d266336a02c63017819978cd574c1d2105db590e27b3816
-
SHA512
875185cfdacd5efcf9630228aeb7b71bddd01c4b9d1f31af50ca3448e822e1bbaeb236679843ce642c027c3499b253c8900ec05b9a5dcba2131383630f7d4b21
-
SSDEEP
3072:y6glyuxE4GsUPnliByocWepzy2Pwa9n69EvVRBtE:y6gDBGpvEByocWe4jat2Evr7
Malware Config
Extracted
C:\Gr5n3QR3r.README.txt
lockbit
http://lockbitapt2yfbt7lchxejug47kmqvqqxvvjpqkmevv4l3azl3gy6pyd.onion
http://lockbitapt5x4zkjbcqmz6frdhecqqgadevyiwqxukksspnlidyvd7qd.onion
http://lockbitapt6vx57t3eeqjofwgcglmutr3a35nygvokja5uuccip4ykyd.onion
http://lockbitapt34kvrip6xojylohhxrwsvpzdffgs5z4pbbsywnzsbdguqd.onion
http://lockbitaptc2iq4atewz2ise62q63wfktyrl4qtwuk5qax262kgtzjqd.onion
http://lockbitaptjpikdqjynvgozhgc6bgetgucdk5xjacozeaawihmoio6yd.onion
http://lockbitaptq7ephv2oigdncfhtwhpqgwmqojnxqdyhprxxfpcllqdxad.onion
http://lockbitaptstzf3er2lz6ku3xuifafq2yh5lmiqj5ncur6rtlmkteiqd.onion
http://lockbitaptoofrpignlz6dt2wqqc5z3a4evjevoa3eqdfcntxad5lmyd.onion
http://lockbitapt.uz
http://lockbitapt2yfbt7lchxejug47kmqvqqxvvjpqkmevv4l3azl3gy6pyd.onion.ly
http://lockbitapt5x4zkjbcqmz6frdhecqqgadevyiwqxukksspnlidyvd7qd.onion.ly
http://lockbitapt6vx57t3eeqjofwgcglmutr3a35nygvokja5uuccip4ykyd.onion.ly
http://lockbitapt34kvrip6xojylohhxrwsvpzdffgs5z4pbbsywnzsbdguqd.onion.ly
http://lockbitaptc2iq4atewz2ise62q63wfktyrl4qtwuk5qax262kgtzjqd.onion.ly
http://lockbitaptjpikdqjynvgozhgc6bgetgucdk5xjacozeaawihmoio6yd.onion.ly
http://lockbitaptq7ephv2oigdncfhtwhpqgwmqojnxqdyhprxxfpcllqdxad.onion.ly
http://lockbitaptstzf3er2lz6ku3xuifafq2yh5lmiqj5ncur6rtlmkteiqd.onion.ly
http://lockbitaptoofrpignlz6dt2wqqc5z3a4evjevoa3eqdfcntxad5lmyd.onion.ly
https://twitter.com/hashtag/lockbit?f=live
Signatures
-
Lockbit
Ransomware family with multiple variants released since late 2019.
-
Lockbit family
-
Renames multiple (627) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
-
Deletes itself 1 IoCs
-
Executes dropped EXE 1 IoCs
-
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Drops desktop.ini file(s) 2 IoCs
-
Indicator Removal: File Deletion 1 TTPs
Adversaries may delete files left behind by the actions of their intrusion activity.
-
Drops file in System32 directory 4 IoCs
-
Sets desktop wallpaper using registry 2 TTPs 2 IoCs
-
Suspicious use of NtSetInformationThreadHideFromDebugger 5 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
-
Enumerates system info in registry 2 TTPs 3 IoCs
-
Modifies Control Panel 2 IoCs
-
Modifies registry class 5 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious behavior: RenamesItself 26 IoCs
-
Suspicious use of AdjustPrivilegeToken 64 IoCs
-
Suspicious use of SetWindowsHookEx 13 IoCs
-
Suspicious use of WriteProcessMemory 11 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-12-31_a8e100a287fad6eb312b6b2c6448aa20_darkside.exe"C:\Users\Admin\AppData\Local\Temp\2024-12-31_a8e100a287fad6eb312b6b2c6448aa20_darkside.exe"1⤵
- Drops desktop.ini file(s)
- Sets desktop wallpaper using registry
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Modifies Control Panel
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\splwow64.exeC:\Windows\splwow64.exe 122882⤵
- Drops file in System32 directory
-
-
C:\ProgramData\A45F.tmp"C:\ProgramData\A45F.tmp"2⤵
- Checks computer location settings
- Deletes itself
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C DEL /F /Q C:\PROGRA~3\A45F.tmp >> NUL3⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k PrintWorkflow -s PrintWorkflowUserSvc1⤵
-
C:\Windows\system32\printfilterpipelinesvc.exeC:\Windows\system32\printfilterpipelinesvc.exe -Embedding1⤵
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Microsoft Office\root\Office16\ONENOTE.EXE/insertdoc "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\{49DA791D-E43B-43AE-A3E8-EAC76A7C66A5}.xps" 1338011440909300002⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious use of SetWindowsHookEx
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
129B
MD5c6758a9a68dcad19815107ae60dd5360
SHA1f276be76cc1d23e6b76a5bf7ecdd481639f9ae85
SHA256b0b8c003bdd56b5ec3a5af29d06e7d0367077b1dc238bd5f2b4b4d3f67cc0955
SHA512d6e7ad6202d91d59eabac9208d3addb417a55a0bd8d49ca41ee82afc23a4368282077e1a82143f13615024e3526b2eec3cd329cb83b51686115848e7e7e7c3ec
-
Filesize
6KB
MD526134478e8ae5872b925399d4a6e54cb
SHA1b359d5800ef86537a335f6af8c4212317191662c
SHA25697770e832762c5bd7283095c4b2d9aaa42add479bd9777dcd9b7fea568c05dec
SHA512bd176ac673643234367bbd0c73ed69a4db63b9048f8edb73cad5cf2d4c55014e75cc2970dc9b3365c67527ac56c79245f5842a0043bd566714da6b8cdc4ff1a2
-
Filesize
14KB
MD5294e9f64cb1642dd89229fff0592856b
SHA197b148c27f3da29ba7b18d6aee8a0db9102f47c9
SHA256917e115cc403e29b4388e0d175cbfac3e7e40ca1742299fbdb353847db2de7c2
SHA512b87d531890bf1577b9b4af41dddb2cdbbfa164cf197bd5987df3a3075983645a3acba443e289b7bfd338422978a104f55298fbfe346872de0895bde44adc89cf
-
Filesize
153KB
MD589a80f6391b768c558d0f112a0addd70
SHA117606651b7fef67783c04a3cff437f53ed824f11
SHA25674d0b44c0a20b252798305ed40dd4c8641e2a65f6939b53a3cd108d56cef2140
SHA512a02943bde083a9062c40312cb02290ab10de2a89f7a7a08f1861dca45b10c928ebc33290ac2ffee629d23a497570a31da3013e283b2176cd5d479da4a1a42cc3
-
Filesize
4KB
MD557eb2f337543e5063f0ca80bd2a5dd53
SHA1ec0b7c2f70476a13676fcbf2a4131eafb3d20407
SHA256ac441ba84bc628ff18d5c3cfeee13ca61ec56fa1d347aa1fed7fb9b4543a9407
SHA512595abdde5e0049d98c2e2078680fdf00121dfd83a8dbcdc1d4d5f1840ab6c631d206504031e91d615e64f5e09b180c60fd461dc8b9bafcf21251aab27c1d90a2
-
Filesize
129B
MD54e81f2769ca006f3735582308ca8cb6b
SHA1e4ec1010adde011366e7760d4014eb63931a4419
SHA2565952dd71edac2935dc9a3a615ebb7e269078cafc2dbb7f569a8a3c4853fab606
SHA512eabdf9ca8516576d20b801b667d225b8fc5aba33578ebbc52a5d901d3d8fe209e333d79935e39622014c4eb88ad662c9ff0fbce7c09991c474c9ef40f4e039c0
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB