Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    121s
  • max time network
    122s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    27/01/2025, 11:30

General

  • Target

    2025-01-27_475f6e42f0cb53fc60fa80022826489f_darkside.exe

  • Size

    148KB

  • MD5

    475f6e42f0cb53fc60fa80022826489f

  • SHA1

    b1dc8069d4d667af8cc8cbff950dc7a67a129cc8

  • SHA256

    5fee867e93f672a561fedf8bb2d8525ab4a9146a51f922c88d34eb5c2d60561d

  • SHA512

    04663b3c60b26fcde8e1b30c061242ec0356b467d62b17128a4c72608e71425f43f540a41a60ba5c88b8a50f3a78bb5fcdddeea68589ac83806b24e22ecd9335

  • SSDEEP

    3072:pqJogYkcSNm9V7DHjsdAzWxxLaMdg9nW2T:pq2kc4m9tDDsdAzWCMdY

Malware Config

Extracted

Path

C:\utZMwPnzM.README.txt

Ransom Note
███╗ ███╗ █████╗ ███╗ ██╗██╗ █████╗ ██████╗██████╗ ██╗ ██╗██████╗ ████████╗ ████╗ ████║██╔══██╗████╗ ██║██║██╔══██╗██╔════╝██╔══██╗╚██╗ ██╔╝██╔══██╗╚══██╔══╝ ██╔████╔██║███████║██╔██╗ ██║██║███████║██║ ██████╔╝ ╚████╔╝ ██████╔╝ ██║ ██║╚██╔╝██║██╔══██║██║╚██╗██║██║██╔══██║██║ ██╔══██╗ ╚██╔╝ ██╔═══╝ ██║ ██║ ╚═╝ ██║██║ ██║██║ ╚████║██║██║ ██║╚██████╗██║ ██║ ██║ ██║ ██║ ╚═╝ ╚═╝╚═╝ ╚═╝╚═╝ ╚═══╝╚═╝╚═╝ ╚═╝ ╚═════╝╚═╝ ╚═╝ ╚═╝ ╚═╝ ╚═╝ What Happened? All your important files have been stolen and encrypted and only WE can decrypt your files but if you do not pay we will remove your unique decryption software and publish your data to the public. How do i pay? Send 300$ worth of BTC to the following wallet, then contact us on discord using the username: ballets4 we will give you the decryption software after the payment has been confirmed and delete the data we stole. Bitcoin wallet: bc1qgngtzxgt3vcgx7andfl2temn3vt4unf5lmcqkj How can i trust you? Because nobody will trust us if we cheat users and whats the point of not giving you the decryption software. DO NOT try to decrypt your files yourself as this may cause a permanent file corruption. DO NOT rename any file as this may also cause a file corruption. You only have 3 days to pay, if you did not contact us or pay us in these 3 days we will release your data to the public and remove your unique decryption software.

Signatures

  • Renames multiple (327) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

  • Deletes itself 1 IoCs
  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 1 IoCs
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Drops desktop.ini file(s) 2 IoCs
  • Indicator Removal: File Deletion 1 TTPs

    Adversaries may delete files left behind by the actions of their intrusion activity.

  • Sets desktop wallpaper using registry 2 TTPs 2 IoCs
  • Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Modifies Control Panel 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 12 IoCs
  • Suspicious behavior: RenamesItself 26 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of WriteProcessMemory 9 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2025-01-27_475f6e42f0cb53fc60fa80022826489f_darkside.exe
    "C:\Users\Admin\AppData\Local\Temp\2025-01-27_475f6e42f0cb53fc60fa80022826489f_darkside.exe"
    1⤵
    • Loads dropped DLL
    • Drops desktop.ini file(s)
    • Sets desktop wallpaper using registry
    • System Location Discovery: System Language Discovery
    • Modifies Control Panel
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:1316
    • C:\ProgramData\B00D.tmp
      "C:\ProgramData\B00D.tmp"
      2⤵
      • Deletes itself
      • Executes dropped EXE
      • Suspicious use of NtSetInformationThreadHideFromDebugger
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: RenamesItself
      • Suspicious use of WriteProcessMemory
      PID:1816
      • C:\Windows\SysWOW64\cmd.exe
        "C:\Windows\System32\cmd.exe" /C DEL /F /Q C:\PROGRA~3\B00D.tmp >> NUL
        3⤵
        • System Location Discovery: System Language Discovery
        PID:1240
  • C:\Windows\system32\AUDIODG.EXE
    C:\Windows\system32\AUDIODG.EXE 0x14c
    1⤵
      PID:1600

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\$Recycle.Bin\S-1-5-21-3063565911-2056067323-3330884624-1000\desktop.ini

      Filesize

      129B

      MD5

      c2ca9bbc0d7c71e4289bb80fb27bbaf1

      SHA1

      3439b3469c4d5e03bc9525c97a59ad0af8b53886

      SHA256

      4e8a1e588ff5f5843bd0a51b2b5b660fa412e586de94cb9d85fd139ba8905b54

      SHA512

      5afb6d88b5267f071b5c55d1dac59ee8baa16d292fd7c90f8c29cd0d922ec2794e3c031265408b48e646830bd40ae88c0c220f4bc8938cc79406bc1de551cff7

    • C:\Users\Admin\AppData\Local\Temp\DDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDD

      Filesize

      148KB

      MD5

      974f2b5598c074df607beb8379333e22

      SHA1

      e4c5bd6fdcea5e18c3c7c26fc093eb5c7d17472f

      SHA256

      cb15707d7174dd419c5c687c4630eae6227bc0115703db97978b528ccec25089

      SHA512

      bdfcf80c673e788e7c667d461b59bddb067b8f4d31f375d1e9db079037561fc3becb64ebf34dbdb811ef84b6d96c512ff9eb99e35bf57bd160f75287a13a2868

    • C:\utZMwPnzM.README.txt

      Filesize

      2KB

      MD5

      d9e1661bc09300cad8aa8d795b9ce0b3

      SHA1

      1676ba84687a2d7b27f73f3a37500317ba0d30a4

      SHA256

      e2fa3f74d96324cd7dd0d611843e8102e897a8d65beac9d9491e8c42a7ada8bd

      SHA512

      9fdaa9b0f68c19eba772fcb5b2ceaf371a0b78435a296765c3dbcdc5890218523d5844708473a685cf12ec559163fc3c87928b12e46bfda92faf2c5fc2d57f7f

    • F:\$RECYCLE.BIN\S-1-5-21-3063565911-2056067323-3330884624-1000\CCCCCCCCCCC

      Filesize

      129B

      MD5

      cdee457c4b19661384d7de14abaab0b6

      SHA1

      eaf9e0527aa6794c0b7c8150ef7ab6cf74943b86

      SHA256

      a1a80cb235b95da0e1b7a29c98e953d0c9d59fe6c3feaef82d077b1ebc06d16c

      SHA512

      8d646e7473394c5629a6ea9d996c43f5c9571edab7ea980376375992ec625426f371f72ce95a1e750c3fa58b831c66c0353ef20cafff08457d06a2a7329fbade

    • \ProgramData\B00D.tmp

      Filesize

      14KB

      MD5

      294e9f64cb1642dd89229fff0592856b

      SHA1

      97b148c27f3da29ba7b18d6aee8a0db9102f47c9

      SHA256

      917e115cc403e29b4388e0d175cbfac3e7e40ca1742299fbdb353847db2de7c2

      SHA512

      b87d531890bf1577b9b4af41dddb2cdbbfa164cf197bd5987df3a3075983645a3acba443e289b7bfd338422978a104f55298fbfe346872de0895bde44adc89cf

    • memory/1316-0-0x00000000023B0000-0x00000000023F0000-memory.dmp

      Filesize

      256KB

    • memory/1816-859-0x00000000023B0000-0x00000000023F0000-memory.dmp

      Filesize

      256KB

    • memory/1816-862-0x000000007EF20000-0x000000007EF21000-memory.dmp

      Filesize

      4KB

    • memory/1816-861-0x000000007EF80000-0x000000007EF81000-memory.dmp

      Filesize

      4KB

    • memory/1816-860-0x00000000023B0000-0x00000000023F0000-memory.dmp

      Filesize

      256KB

    • memory/1816-857-0x000000007EFA0000-0x000000007EFA1000-memory.dmp

      Filesize

      4KB

    • memory/1816-892-0x000000007EF60000-0x000000007EF61000-memory.dmp

      Filesize

      4KB

    • memory/1816-891-0x000000007EF40000-0x000000007EF41000-memory.dmp

      Filesize

      4KB