Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

10

Static

static

10

2025-01-21...de.exe

windows7-x64

10

2025-01-21...de.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    121s
  • max time network
    122s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    21/01/2025, 02:06

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    2025-01-21_f57b7799396365cd3c83134e780f992d_darkside.exe

  • Size

    148KB

  • MD5

    f57b7799396365cd3c83134e780f992d

  • SHA1

    28e75c41f4aaf6346bd4c98b033bc16c07a4ba82

  • SHA256

    25b00899c5afd916d3d9d36859dcd92dcc9bfea4753e8ac4a6febf16f050a7db

  • SHA512

    181860f41c407d687dad546fe98011eb7c24874f688495f4e8007fec59ad24329f4a3d72915102d4e9ac6870f6b2fc7b59c7ca2d5153ec2ab8068ffd0496aaed

  • SSDEEP

    3072:46glyuxE4GsUPnliByocWepCnkOry1yC8NwtS:46gDBGpvEByocWeSkOmCD

Score
10/10
defense_evasiondiscoveryransomwarespywarestealer

Malware Config

Extracted

Path

C:\8gduxxdQN.README.txt

Ransom Note
Ni hao! Your data are stolen and encrypted. In case of nonpayment - all information will be sold or made publicly accessible, and we will also continue to attack your servers. Compared to other ransomware we charge a lot less, so don't be stingy!:-) If you pay - we will provide you with decryption software and remove your data from our servers. We will also let you know about the vulnerability in your servers that we used to infiltrate your network. WARNING! Do not delete or modify any files, it can lead to recovery problems! You can contact us using Session messenger without registration and sms https://getsession.org/download My Session ID: 05839c6cce78c3f3043e7a65c27e881cbb9efbda3bab942d273a496876340b254f You also can contact us using Tox messenger without registration and SMS https://tox.chat/download.html My Tox ID: BF2FBB22C4CFD24EF9AFE2CAB694D8C1E3E2340393E846514659C59D8C52F43CBD76209603AE You can send us any 1 file for free decryption. Good luck! 您好！ 您的数据已被窃取并加密。 如果不付款，所有信息将被出售或公开，我们将继续攻击您的服务器。 与其他勒索软件相比，我们的收费要低得多，所以不要小气！ 如果您付款，我们将为您提供解密软件，并从我们的服务器上删除您的数据。 我们还会让你知道我们利用你服务器上的漏洞来渗透你的网络。 警告：请勿删除或修改任何文件，否则可能导致恢复问题！ 您可以使用无需注册的会话信使和短信 https://getsession.org/download 与我们联系。 我的会话 ID: 05839c6cce78c3f3043e7a65c27e881cbb9efbda3bab942d273a496876340b254f 您也可以使用 Tox 使者（无需注册）和 SMS https://tox.chat/download.html 与我们联系。 我的 ID: BF2FBB22C4C4CFD24EF9AF9AFE2CAB694D8C1E3E2340393E846514659C59C59D8C52F43CBD76209603AE 您可以将任意 1 个文件发送给我们进行免费转录。 祝您好运
URLs

https://getsession.org/download

https://tox.chat/download.html

Signatures

  • Renames multiple (8063) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

    ransomware
  • Deletes itself 1 IoCs
  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 5 IoCs
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Drops desktop.ini file(s) 2 IoCs
  • Indicator Removal: File Deletion 1 TTPs

    Adversaries may delete files left behind by the actions of their intrusion activity.

    defense_evasion
  • Sets desktop wallpaper using registry 2 TTPs 2 IoCs
    ransomware
  • Suspicious use of NtSetInformationThreadHideFromDebugger 5 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Modifies Control Panel 2 IoCs
    defense_evasion
  • Modifies registry class 5 IoCs
  • Suspicious behavior: EnumeratesProcesses 54 IoCs
  • Suspicious behavior: RenamesItself 26 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of WriteProcessMemory 9 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2025-01-21_f57b7799396365cd3c83134e780f992d_darkside.exe
    "C:\Users\Admin\AppData\Local\Temp\2025-01-21_f57b7799396365cd3c83134e780f992d_darkside.exe"
    1⤵
    • Loads dropped DLL
    • Drops desktop.ini file(s)
    • Sets desktop wallpaper using registry
    • Suspicious use of NtSetInformationThreadHideFromDebugger
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Modifies Control Panel
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:2972
    • C:\ProgramData\FF46.tmp
      "C:\ProgramData\FF46.tmp"
      2⤵
      • Deletes itself
      • Executes dropped EXE
      • Suspicious use of NtSetInformationThreadHideFromDebugger
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: RenamesItself
      • Suspicious use of WriteProcessMemory
      PID:2724
      • C:\Windows\SysWOW64\cmd.exe
        "C:\Windows\System32\cmd.exe" /C DEL /F /Q C:\PROGRA~3\FF46.tmp >> NUL
        3⤵
        • System Location Discovery: System Language Discovery
        PID:1352
  • C:\Windows\system32\AUDIODG.EXE
    C:\Windows\system32\AUDIODG.EXE 0x14c
    1⤵
      PID:2104

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\$Recycle.Bin\S-1-5-21-312935884-697965778-3955649944-1000\IIIIIIIIIII
      Filesize

      129B

      MD5

      1c0d4fc9980dbb9adffc0cea25a77e07

      SHA1

      0c7c968fccd2594bb7cc91f2fc4e05bf7fffc7f6

      SHA256

      909236795cd6a23699e1e9e5b172648f28c165a808615401245a0030e0c8bb31

      SHA512

      4e8e47fd6c1da82f61fa57d7b21bf80bef88866494046ae69d7e1680f62164672f6bbd7d0c6288039a15f38da6f37c1004e6d4fe296a393681fe1f3d69460799

      Download Submit

    • C:\8gduxxdQN.README.txt
      Filesize

      2KB

      MD5

      d16734b43544f0e05d570563c001e4eb

      SHA1

      73cef7171e473b7ebbec10511baa694ba51d38ae

      SHA256

      a0514422de97e9ebcd6f4fd7e1de1e978a67abe298aa7be582f653fedd4bceff

      SHA512

      f321cb9b4a6df1e3dd3ff1163ac447e87543d2ed77079d07a45a11069b95d98ef4448a1d5f5a971f8ca69ddede80eff17d0ccf3784438a6ccd9e638659d66004

      Download Submit

    • C:\Users\Admin\AppData\Local\Temp\DDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDD
      Filesize

      148KB

      MD5

      72a772893aea9d7808351bab397628f5

      SHA1

      0786e66cb40047964789ba91f579f04346e31ec4

      SHA256

      4b339c169dbaf000bc8ea01259b3b8d39408fe9dfbccafde95ebb7f60512503e

      SHA512

      8f891eb62d5068612e4920f0e57679986d586bf5c484d3679231475542e569cb39adae9bf96897106f65eb201772bb35a3456956fa3cf03cc11b962b9d35d3ec

      Download Submit

    • F:\$RECYCLE.BIN\S-1-5-21-312935884-697965778-3955649944-1000\DDDDDDDDDDD
      Filesize

      129B

      MD5

      c5676f8d081c64e7af9d4b12c2c67000

      SHA1

      2a0f39d1b624a2288962ac5b567936f200a53def

      SHA256

      ad0e4f9ee62a3ebc314acebfc6d3d7162701f62c4f9457adedca3e77d4962d0f

      SHA512

      1f4d0b1fe1bd3bdd313a519330bd414f131706c45beea342d262719c8e41313206b0d799a43e861ed49e0c80477c955a0fd07d189bb171b283389b0630d5a9b9

      Download Submit

    • \Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE
      Filesize

      4.7MB

      MD5

      61bffb5f57ad12f83ab64b7181829b34

      SHA1

      945d94fef51e0db76c2fd95ee22ed2767be0fe0b

      SHA256

      1dd0dd35e4158f95765ee6639f217df03a0a19e624e020dba609268c08a13846

      SHA512

      e569639d3bb81a7b3bd46484ff4b8065d7fd15df416602d825443b2b17d8c0c59500fb6516118e7a65ea9fdd9e4be238f0319577fa44c114eaca18b0334ba521

      Download Submit

    • \ProgramData\FF46.tmp
      Filesize

      14KB

      MD5

      294e9f64cb1642dd89229fff0592856b

      SHA1

      97b148c27f3da29ba7b18d6aee8a0db9102f47c9

      SHA256

      917e115cc403e29b4388e0d175cbfac3e7e40ca1742299fbdb353847db2de7c2

      SHA512

      b87d531890bf1577b9b4af41dddb2cdbbfa164cf197bd5987df3a3075983645a3acba443e289b7bfd338422978a104f55298fbfe346872de0895bde44adc89cf

      Download Submit

    • memory/2724-12021-0x0000000000400000-0x0000000000407000-memory.dmp

      Filesize

      28KB

      Download

    • memory/2724-12019-0x0000000000401000-0x0000000000404000-memory.dmp

      Filesize

      12KB

      Download

    • memory/2972-1-0x0000000000230000-0x0000000000270000-memory.dmp

      Filesize

      256KB

      Download

    • memory/2972-0-0x0000000000230000-0x0000000000270000-memory.dmp

      Filesize

      256KB

      Download