Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
119s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
18/01/2025, 10:13
Behavioral task
behavioral1
Sample
2025-01-18_798fd8e7a54051164f47f6667706f16f_darkside.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
2025-01-18_798fd8e7a54051164f47f6667706f16f_darkside.exe
Resource
win10v2004-20241007-en
General
-
Target
2025-01-18_798fd8e7a54051164f47f6667706f16f_darkside.exe
-
Size
153KB
-
MD5
798fd8e7a54051164f47f6667706f16f
-
SHA1
ded9b5a611c87f52ebc90f2b31805258eb27318f
-
SHA256
4c53a8e41c934a3a9abef822a69a7372884978dfcc296b8ec9eab4d6a0fddbc5
-
SHA512
98badd234102c2a81db91540b7b0a97156637a4cc8023260f75f299d3d2716e5d2c498a03c3f9c10ea403314b146396317c1c75b0a5f241d34da61e8acfbee16
-
SSDEEP
3072:RqJogYkcSNm9V7DAgmdtEzmc498zPWeH+pfGFmEHmT:Rq2kc4m9tDSiq7YPjHee
Malware Config
Extracted
C:\zznEXQ5xh.README.txt
lockbit
http://lockbitapt2yfbt7lchxejug47kmqvqqxvvjpqkmevv4l3azl3gy6pyd.onion
http://lockbitapt5x4zkjbcqmz6frdhecqqgadevyiwqxukksspnlidyvd7qd.onion
http://lockbitapt6vx57t3eeqjofwgcglmutr3a35nygvokja5uuccip4ykyd.onion
http://lockbitapt34kvrip6xojylohhxrwsvpzdffgs5z4pbbsywnzsbdguqd.onion
http://lockbitaptc2iq4atewz2ise62q63wfktyrl4qtwuk5qax262kgtzjqd.onion
http://lockbitaptjpikdqjynvgozhgc6bgetgucdk5xjacozeaawihmoio6yd.onion
http://lockbitaptq7ephv2oigdncfhtwhpqgwmqojnxqdyhprxxfpcllqdxad.onion
http://lockbitaptstzf3er2lz6ku3xuifafq2yh5lmiqj5ncur6rtlmkteiqd.onion
http://lockbitaptoofrpignlz6dt2wqqc5z3a4evjevoa3eqdfcntxad5lmyd.onion
http://lockbitapt.uz
http://lockbitapt2yfbt7lchxejug47kmqvqqxvvjpqkmevv4l3azl3gy6pyd.onion.ly
http://lockbitapt5x4zkjbcqmz6frdhecqqgadevyiwqxukksspnlidyvd7qd.onion.ly
http://lockbitapt6vx57t3eeqjofwgcglmutr3a35nygvokja5uuccip4ykyd.onion.ly
http://lockbitapt34kvrip6xojylohhxrwsvpzdffgs5z4pbbsywnzsbdguqd.onion.ly
http://lockbitaptc2iq4atewz2ise62q63wfktyrl4qtwuk5qax262kgtzjqd.onion.ly
http://lockbitaptjpikdqjynvgozhgc6bgetgucdk5xjacozeaawihmoio6yd.onion.ly
http://lockbitaptq7ephv2oigdncfhtwhpqgwmqojnxqdyhprxxfpcllqdxad.onion.ly
http://lockbitaptstzf3er2lz6ku3xuifafq2yh5lmiqj5ncur6rtlmkteiqd.onion.ly
http://lockbitaptoofrpignlz6dt2wqqc5z3a4evjevoa3eqdfcntxad5lmyd.onion.ly
https://twitter.com/hashtag/lockbit?f=live
http://lockbitsupt7nr3fa6e7xyb73lk6bw6rcneqhoyblniiabj4uwvzapqd.onion
http://lockbitsupuhswh4izvoucoxsbnotkmgq6durg7kficg6u33zfvq3oyd.onion
http://lockbitsupn2h6be2cnqpvncyhj4rgmnwn44633hnzzmtxdvjoqlp7yd.onion
http://lockbitsupp.uz
https://tox.chat/download.html
Signatures
-
Lockbit
Ransomware family with multiple variants released since late 2019.
-
Lockbit family
-
Renames multiple (362) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Deletes itself 1 IoCs
pid Process 2460 C745.tmp -
Executes dropped EXE 1 IoCs
pid Process 2460 C745.tmp -
Loads dropped DLL 1 IoCs
pid Process 2996 2025-01-18_798fd8e7a54051164f47f6667706f16f_darkside.exe -
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Drops desktop.ini file(s) 2 IoCs
description ioc Process File opened for modification C:\$Recycle.Bin\S-1-5-21-312935884-697965778-3955649944-1000\desktop.ini 2025-01-18_798fd8e7a54051164f47f6667706f16f_darkside.exe File opened for modification F:\$RECYCLE.BIN\S-1-5-21-312935884-697965778-3955649944-1000\desktop.ini 2025-01-18_798fd8e7a54051164f47f6667706f16f_darkside.exe -
Indicator Removal: File Deletion 1 TTPs
Adversaries may delete files left behind by the actions of their intrusion activity.
-
Sets desktop wallpaper using registry 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Control Panel\Desktop\WallPaper = "C:\\ProgramData\\zznEXQ5xh.bmp" 2025-01-18_798fd8e7a54051164f47f6667706f16f_darkside.exe Set value (str) \REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Control Panel\Desktop\Wallpaper = "C:\\ProgramData\\zznEXQ5xh.bmp" 2025-01-18_798fd8e7a54051164f47f6667706f16f_darkside.exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
pid Process 2460 C745.tmp -
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2025-01-18_798fd8e7a54051164f47f6667706f16f_darkside.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C745.tmp -
Modifies Control Panel 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Control Panel\Desktop 2025-01-18_798fd8e7a54051164f47f6667706f16f_darkside.exe Set value (str) \REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Control Panel\Desktop\WallpaperStyle = "10" 2025-01-18_798fd8e7a54051164f47f6667706f16f_darkside.exe -
Modifies registry class 5 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.zznEXQ5xh 2025-01-18_798fd8e7a54051164f47f6667706f16f_darkside.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.zznEXQ5xh\ = "zznEXQ5xh" 2025-01-18_798fd8e7a54051164f47f6667706f16f_darkside.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\zznEXQ5xh\DefaultIcon 2025-01-18_798fd8e7a54051164f47f6667706f16f_darkside.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\zznEXQ5xh 2025-01-18_798fd8e7a54051164f47f6667706f16f_darkside.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\zznEXQ5xh\DefaultIcon\ = "C:\\ProgramData\\zznEXQ5xh.ico" 2025-01-18_798fd8e7a54051164f47f6667706f16f_darkside.exe -
Suspicious behavior: EnumeratesProcesses 14 IoCs
pid Process 2996 2025-01-18_798fd8e7a54051164f47f6667706f16f_darkside.exe 2996 2025-01-18_798fd8e7a54051164f47f6667706f16f_darkside.exe 2996 2025-01-18_798fd8e7a54051164f47f6667706f16f_darkside.exe 2996 2025-01-18_798fd8e7a54051164f47f6667706f16f_darkside.exe 2996 2025-01-18_798fd8e7a54051164f47f6667706f16f_darkside.exe 2996 2025-01-18_798fd8e7a54051164f47f6667706f16f_darkside.exe 2996 2025-01-18_798fd8e7a54051164f47f6667706f16f_darkside.exe 2996 2025-01-18_798fd8e7a54051164f47f6667706f16f_darkside.exe 2996 2025-01-18_798fd8e7a54051164f47f6667706f16f_darkside.exe 2996 2025-01-18_798fd8e7a54051164f47f6667706f16f_darkside.exe 2996 2025-01-18_798fd8e7a54051164f47f6667706f16f_darkside.exe 2996 2025-01-18_798fd8e7a54051164f47f6667706f16f_darkside.exe 2996 2025-01-18_798fd8e7a54051164f47f6667706f16f_darkside.exe 2996 2025-01-18_798fd8e7a54051164f47f6667706f16f_darkside.exe -
Suspicious behavior: RenamesItself 26 IoCs
pid Process 2460 C745.tmp 2460 C745.tmp 2460 C745.tmp 2460 C745.tmp 2460 C745.tmp 2460 C745.tmp 2460 C745.tmp 2460 C745.tmp 2460 C745.tmp 2460 C745.tmp 2460 C745.tmp 2460 C745.tmp 2460 C745.tmp 2460 C745.tmp 2460 C745.tmp 2460 C745.tmp 2460 C745.tmp 2460 C745.tmp 2460 C745.tmp 2460 C745.tmp 2460 C745.tmp 2460 C745.tmp 2460 C745.tmp 2460 C745.tmp 2460 C745.tmp 2460 C745.tmp -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeAssignPrimaryTokenPrivilege 2996 2025-01-18_798fd8e7a54051164f47f6667706f16f_darkside.exe Token: SeBackupPrivilege 2996 2025-01-18_798fd8e7a54051164f47f6667706f16f_darkside.exe Token: SeDebugPrivilege 2996 2025-01-18_798fd8e7a54051164f47f6667706f16f_darkside.exe Token: 36 2996 2025-01-18_798fd8e7a54051164f47f6667706f16f_darkside.exe Token: SeImpersonatePrivilege 2996 2025-01-18_798fd8e7a54051164f47f6667706f16f_darkside.exe Token: SeIncBasePriorityPrivilege 2996 2025-01-18_798fd8e7a54051164f47f6667706f16f_darkside.exe Token: SeIncreaseQuotaPrivilege 2996 2025-01-18_798fd8e7a54051164f47f6667706f16f_darkside.exe Token: 33 2996 2025-01-18_798fd8e7a54051164f47f6667706f16f_darkside.exe Token: SeManageVolumePrivilege 2996 2025-01-18_798fd8e7a54051164f47f6667706f16f_darkside.exe Token: SeProfSingleProcessPrivilege 2996 2025-01-18_798fd8e7a54051164f47f6667706f16f_darkside.exe Token: SeRestorePrivilege 2996 2025-01-18_798fd8e7a54051164f47f6667706f16f_darkside.exe Token: SeSecurityPrivilege 2996 2025-01-18_798fd8e7a54051164f47f6667706f16f_darkside.exe Token: SeSystemProfilePrivilege 2996 2025-01-18_798fd8e7a54051164f47f6667706f16f_darkside.exe Token: SeTakeOwnershipPrivilege 2996 2025-01-18_798fd8e7a54051164f47f6667706f16f_darkside.exe Token: SeShutdownPrivilege 2996 2025-01-18_798fd8e7a54051164f47f6667706f16f_darkside.exe Token: SeDebugPrivilege 2996 2025-01-18_798fd8e7a54051164f47f6667706f16f_darkside.exe Token: SeBackupPrivilege 2996 2025-01-18_798fd8e7a54051164f47f6667706f16f_darkside.exe Token: SeBackupPrivilege 2996 2025-01-18_798fd8e7a54051164f47f6667706f16f_darkside.exe Token: SeSecurityPrivilege 2996 2025-01-18_798fd8e7a54051164f47f6667706f16f_darkside.exe Token: SeSecurityPrivilege 2996 2025-01-18_798fd8e7a54051164f47f6667706f16f_darkside.exe Token: SeBackupPrivilege 2996 2025-01-18_798fd8e7a54051164f47f6667706f16f_darkside.exe Token: SeBackupPrivilege 2996 2025-01-18_798fd8e7a54051164f47f6667706f16f_darkside.exe Token: SeSecurityPrivilege 2996 2025-01-18_798fd8e7a54051164f47f6667706f16f_darkside.exe Token: SeSecurityPrivilege 2996 2025-01-18_798fd8e7a54051164f47f6667706f16f_darkside.exe Token: SeBackupPrivilege 2996 2025-01-18_798fd8e7a54051164f47f6667706f16f_darkside.exe Token: SeBackupPrivilege 2996 2025-01-18_798fd8e7a54051164f47f6667706f16f_darkside.exe Token: SeSecurityPrivilege 2996 2025-01-18_798fd8e7a54051164f47f6667706f16f_darkside.exe Token: SeSecurityPrivilege 2996 2025-01-18_798fd8e7a54051164f47f6667706f16f_darkside.exe Token: SeBackupPrivilege 2996 2025-01-18_798fd8e7a54051164f47f6667706f16f_darkside.exe Token: SeBackupPrivilege 2996 2025-01-18_798fd8e7a54051164f47f6667706f16f_darkside.exe Token: SeSecurityPrivilege 2996 2025-01-18_798fd8e7a54051164f47f6667706f16f_darkside.exe Token: SeSecurityPrivilege 2996 2025-01-18_798fd8e7a54051164f47f6667706f16f_darkside.exe Token: SeBackupPrivilege 2996 2025-01-18_798fd8e7a54051164f47f6667706f16f_darkside.exe Token: SeBackupPrivilege 2996 2025-01-18_798fd8e7a54051164f47f6667706f16f_darkside.exe Token: SeSecurityPrivilege 2996 2025-01-18_798fd8e7a54051164f47f6667706f16f_darkside.exe Token: SeSecurityPrivilege 2996 2025-01-18_798fd8e7a54051164f47f6667706f16f_darkside.exe Token: SeBackupPrivilege 2996 2025-01-18_798fd8e7a54051164f47f6667706f16f_darkside.exe Token: SeBackupPrivilege 2996 2025-01-18_798fd8e7a54051164f47f6667706f16f_darkside.exe Token: SeSecurityPrivilege 2996 2025-01-18_798fd8e7a54051164f47f6667706f16f_darkside.exe Token: SeSecurityPrivilege 2996 2025-01-18_798fd8e7a54051164f47f6667706f16f_darkside.exe Token: SeBackupPrivilege 2996 2025-01-18_798fd8e7a54051164f47f6667706f16f_darkside.exe Token: SeBackupPrivilege 2996 2025-01-18_798fd8e7a54051164f47f6667706f16f_darkside.exe Token: SeSecurityPrivilege 2996 2025-01-18_798fd8e7a54051164f47f6667706f16f_darkside.exe Token: SeSecurityPrivilege 2996 2025-01-18_798fd8e7a54051164f47f6667706f16f_darkside.exe Token: SeBackupPrivilege 2996 2025-01-18_798fd8e7a54051164f47f6667706f16f_darkside.exe Token: SeBackupPrivilege 2996 2025-01-18_798fd8e7a54051164f47f6667706f16f_darkside.exe Token: SeSecurityPrivilege 2996 2025-01-18_798fd8e7a54051164f47f6667706f16f_darkside.exe Token: SeSecurityPrivilege 2996 2025-01-18_798fd8e7a54051164f47f6667706f16f_darkside.exe Token: SeBackupPrivilege 2996 2025-01-18_798fd8e7a54051164f47f6667706f16f_darkside.exe Token: SeBackupPrivilege 2996 2025-01-18_798fd8e7a54051164f47f6667706f16f_darkside.exe Token: SeSecurityPrivilege 2996 2025-01-18_798fd8e7a54051164f47f6667706f16f_darkside.exe Token: SeSecurityPrivilege 2996 2025-01-18_798fd8e7a54051164f47f6667706f16f_darkside.exe Token: SeBackupPrivilege 2996 2025-01-18_798fd8e7a54051164f47f6667706f16f_darkside.exe Token: SeBackupPrivilege 2996 2025-01-18_798fd8e7a54051164f47f6667706f16f_darkside.exe Token: SeSecurityPrivilege 2996 2025-01-18_798fd8e7a54051164f47f6667706f16f_darkside.exe Token: SeSecurityPrivilege 2996 2025-01-18_798fd8e7a54051164f47f6667706f16f_darkside.exe Token: SeBackupPrivilege 2996 2025-01-18_798fd8e7a54051164f47f6667706f16f_darkside.exe Token: SeBackupPrivilege 2996 2025-01-18_798fd8e7a54051164f47f6667706f16f_darkside.exe Token: SeSecurityPrivilege 2996 2025-01-18_798fd8e7a54051164f47f6667706f16f_darkside.exe Token: SeSecurityPrivilege 2996 2025-01-18_798fd8e7a54051164f47f6667706f16f_darkside.exe Token: SeBackupPrivilege 2996 2025-01-18_798fd8e7a54051164f47f6667706f16f_darkside.exe Token: SeBackupPrivilege 2996 2025-01-18_798fd8e7a54051164f47f6667706f16f_darkside.exe Token: SeSecurityPrivilege 2996 2025-01-18_798fd8e7a54051164f47f6667706f16f_darkside.exe Token: SeSecurityPrivilege 2996 2025-01-18_798fd8e7a54051164f47f6667706f16f_darkside.exe -
Suspicious use of WriteProcessMemory 9 IoCs
description pid Process procid_target PID 2996 wrote to memory of 2460 2996 2025-01-18_798fd8e7a54051164f47f6667706f16f_darkside.exe 32 PID 2996 wrote to memory of 2460 2996 2025-01-18_798fd8e7a54051164f47f6667706f16f_darkside.exe 32 PID 2996 wrote to memory of 2460 2996 2025-01-18_798fd8e7a54051164f47f6667706f16f_darkside.exe 32 PID 2996 wrote to memory of 2460 2996 2025-01-18_798fd8e7a54051164f47f6667706f16f_darkside.exe 32 PID 2996 wrote to memory of 2460 2996 2025-01-18_798fd8e7a54051164f47f6667706f16f_darkside.exe 32 PID 2460 wrote to memory of 896 2460 C745.tmp 33 PID 2460 wrote to memory of 896 2460 C745.tmp 33 PID 2460 wrote to memory of 896 2460 C745.tmp 33 PID 2460 wrote to memory of 896 2460 C745.tmp 33
Processes
-
C:\Users\Admin\AppData\Local\Temp\2025-01-18_798fd8e7a54051164f47f6667706f16f_darkside.exe"C:\Users\Admin\AppData\Local\Temp\2025-01-18_798fd8e7a54051164f47f6667706f16f_darkside.exe"1⤵
- Loads dropped DLL
- Drops desktop.ini file(s)
- Sets desktop wallpaper using registry
- System Location Discovery: System Language Discovery
- Modifies Control Panel
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2996 -
C:\ProgramData\C745.tmp"C:\ProgramData\C745.tmp"2⤵
- Deletes itself
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:2460 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C DEL /F /Q C:\PROGRA~3\C745.tmp >> NUL3⤵
- System Location Discovery: System Language Discovery
PID:896
-
-
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x14c1⤵PID:2744
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
129B
MD56dbe7161b71d1e42625b851c365bbf4f
SHA11fb2433f4df7c1317b5975d84d4c10264bb33486
SHA2560ac2a5ef0bfd813c77a1e50b40c311a1a9537823acc2ed6aa7574e140449918a
SHA5129e15bdff7040c81275c81401100394c65301dcfe21f12312170a23e95e9aedc528deaf7c1a78a97248b0252709872eb198b3214124eae8037e382c4cce98fb85
-
Filesize
153KB
MD509fe7f1b5544d0181871fcc744838ace
SHA1fe1c64385162c9b53639754e788f11f25b2709bb
SHA256c8aa361c55eb413c071cf9605f8ad757a58eafd95845301ec2e04e3dfae00a42
SHA512a43cfe0850ea7149282a3698726721fa407900b059cbda670dcbb75d1afdba0543bcff0ced0446704cfe2477ad8c549787985a8928af44604e7ae0a48f88e889
-
Filesize
6KB
MD5dd746ace17e44ace00885b91400f11d5
SHA14a0302d2dca400598f396e4230fdae71779cbeaa
SHA256b27c3c8a30faf7c76483b7e5d964ae85046a9713caa46508ee7a1e31b7dc6272
SHA5128ac26aa7262fdf1afdc74e604720a79ebde076c75f460d7d5f57ff4d81dedb1ad471eb114ddd428c1934029746f5c222339090680bc77a6ea09ce329e1da3ef1
-
Filesize
129B
MD5c8b7b165805e3f1655ce915ad926a9c8
SHA1b8985b1ffd7e7c11b3059789bdfab0d569e261f4
SHA256b21ce098ad03bebd27e5535c0c46159c1e425ce367c6e993cfff3187f4391158
SHA5128fa6248bf7e6a42a8855dedf9219d7ee025d17cb646737976b18f3d1450a584dfdc71bee3ead8d34b446ab738f310401dd0b97babbaeb9aa3a2a64366366ea37
-
Filesize
14KB
MD5294e9f64cb1642dd89229fff0592856b
SHA197b148c27f3da29ba7b18d6aee8a0db9102f47c9
SHA256917e115cc403e29b4388e0d175cbfac3e7e40ca1742299fbdb353847db2de7c2
SHA512b87d531890bf1577b9b4af41dddb2cdbbfa164cf197bd5987df3a3075983645a3acba443e289b7bfd338422978a104f55298fbfe346872de0895bde44adc89cf