Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
137s -
max time network
140s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
03/02/2025, 08:35
Behavioral task
behavioral1
Sample
2025-02-03_fada690889cb0d344030fdce3ca25758_darkside.exe
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
2025-02-03_fada690889cb0d344030fdce3ca25758_darkside.exe
Resource
win10v2004-20241007-en
General
-
Target
2025-02-03_fada690889cb0d344030fdce3ca25758_darkside.exe
-
Size
147KB
-
MD5
fada690889cb0d344030fdce3ca25758
-
SHA1
f64fb65e59a2fdba3ce0f9d8c10e670ffa94f56f
-
SHA256
b838571dbc7905cacd42173f5703f2d6799a35ea6346438ef055476cff7fb3f1
-
SHA512
a41248233cd1d1ce9cff027256ac4f9be7e77b0f00075ad174345cb8ad5cb62a3afb73550ac6064faa08cd80cae60c5445fbb9386ddec8bc52059a3f1701c753
-
SSDEEP
3072:O6glyuxE4GsUPnliByocWepE94iiK2uzAERpM:O6gDBGpvEByocWeFlyM
Malware Config
Extracted
C:\cbNhUvy60.README.txt
Signatures
-
Renames multiple (623) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\Control Panel\International\Geo\Nation DE5A.tmp -
Deletes itself 1 IoCs
pid Process 4340 DE5A.tmp -
Executes dropped EXE 1 IoCs
pid Process 4340 DE5A.tmp -
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Drops desktop.ini file(s) 2 IoCs
description ioc Process File opened for modification C:\$Recycle.Bin\S-1-5-21-3756129449-3121373848-4276368241-1000\desktop.ini 2025-02-03_fada690889cb0d344030fdce3ca25758_darkside.exe File opened for modification F:\$RECYCLE.BIN\S-1-5-21-3756129449-3121373848-4276368241-1000\desktop.ini 2025-02-03_fada690889cb0d344030fdce3ca25758_darkside.exe -
Indicator Removal: File Deletion 1 TTPs
Adversaries may delete files left behind by the actions of their intrusion activity.
-
Suspicious use of NtSetInformationThreadHideFromDebugger 5 IoCs
pid Process 1068 2025-02-03_fada690889cb0d344030fdce3ca25758_darkside.exe 1068 2025-02-03_fada690889cb0d344030fdce3ca25758_darkside.exe 1068 2025-02-03_fada690889cb0d344030fdce3ca25758_darkside.exe 1068 2025-02-03_fada690889cb0d344030fdce3ca25758_darkside.exe 4340 DE5A.tmp -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2025-02-03_fada690889cb0d344030fdce3ca25758_darkside.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DE5A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1068 2025-02-03_fada690889cb0d344030fdce3ca25758_darkside.exe 1068 2025-02-03_fada690889cb0d344030fdce3ca25758_darkside.exe 1068 2025-02-03_fada690889cb0d344030fdce3ca25758_darkside.exe 1068 2025-02-03_fada690889cb0d344030fdce3ca25758_darkside.exe 1068 2025-02-03_fada690889cb0d344030fdce3ca25758_darkside.exe 1068 2025-02-03_fada690889cb0d344030fdce3ca25758_darkside.exe 1068 2025-02-03_fada690889cb0d344030fdce3ca25758_darkside.exe 1068 2025-02-03_fada690889cb0d344030fdce3ca25758_darkside.exe 1068 2025-02-03_fada690889cb0d344030fdce3ca25758_darkside.exe 1068 2025-02-03_fada690889cb0d344030fdce3ca25758_darkside.exe 1068 2025-02-03_fada690889cb0d344030fdce3ca25758_darkside.exe 1068 2025-02-03_fada690889cb0d344030fdce3ca25758_darkside.exe 1068 2025-02-03_fada690889cb0d344030fdce3ca25758_darkside.exe 1068 2025-02-03_fada690889cb0d344030fdce3ca25758_darkside.exe 1068 2025-02-03_fada690889cb0d344030fdce3ca25758_darkside.exe 1068 2025-02-03_fada690889cb0d344030fdce3ca25758_darkside.exe 1068 2025-02-03_fada690889cb0d344030fdce3ca25758_darkside.exe 1068 2025-02-03_fada690889cb0d344030fdce3ca25758_darkside.exe 1068 2025-02-03_fada690889cb0d344030fdce3ca25758_darkside.exe 1068 2025-02-03_fada690889cb0d344030fdce3ca25758_darkside.exe 1068 2025-02-03_fada690889cb0d344030fdce3ca25758_darkside.exe 1068 2025-02-03_fada690889cb0d344030fdce3ca25758_darkside.exe 1068 2025-02-03_fada690889cb0d344030fdce3ca25758_darkside.exe 1068 2025-02-03_fada690889cb0d344030fdce3ca25758_darkside.exe 1068 2025-02-03_fada690889cb0d344030fdce3ca25758_darkside.exe 1068 2025-02-03_fada690889cb0d344030fdce3ca25758_darkside.exe 1068 2025-02-03_fada690889cb0d344030fdce3ca25758_darkside.exe 1068 2025-02-03_fada690889cb0d344030fdce3ca25758_darkside.exe 1068 2025-02-03_fada690889cb0d344030fdce3ca25758_darkside.exe 1068 2025-02-03_fada690889cb0d344030fdce3ca25758_darkside.exe 1068 2025-02-03_fada690889cb0d344030fdce3ca25758_darkside.exe 1068 2025-02-03_fada690889cb0d344030fdce3ca25758_darkside.exe 1068 2025-02-03_fada690889cb0d344030fdce3ca25758_darkside.exe 1068 2025-02-03_fada690889cb0d344030fdce3ca25758_darkside.exe 1068 2025-02-03_fada690889cb0d344030fdce3ca25758_darkside.exe 1068 2025-02-03_fada690889cb0d344030fdce3ca25758_darkside.exe 1068 2025-02-03_fada690889cb0d344030fdce3ca25758_darkside.exe 1068 2025-02-03_fada690889cb0d344030fdce3ca25758_darkside.exe 1068 2025-02-03_fada690889cb0d344030fdce3ca25758_darkside.exe 1068 2025-02-03_fada690889cb0d344030fdce3ca25758_darkside.exe 1068 2025-02-03_fada690889cb0d344030fdce3ca25758_darkside.exe 1068 2025-02-03_fada690889cb0d344030fdce3ca25758_darkside.exe 1068 2025-02-03_fada690889cb0d344030fdce3ca25758_darkside.exe 1068 2025-02-03_fada690889cb0d344030fdce3ca25758_darkside.exe 1068 2025-02-03_fada690889cb0d344030fdce3ca25758_darkside.exe 1068 2025-02-03_fada690889cb0d344030fdce3ca25758_darkside.exe 1068 2025-02-03_fada690889cb0d344030fdce3ca25758_darkside.exe 1068 2025-02-03_fada690889cb0d344030fdce3ca25758_darkside.exe 1068 2025-02-03_fada690889cb0d344030fdce3ca25758_darkside.exe 1068 2025-02-03_fada690889cb0d344030fdce3ca25758_darkside.exe 1068 2025-02-03_fada690889cb0d344030fdce3ca25758_darkside.exe 1068 2025-02-03_fada690889cb0d344030fdce3ca25758_darkside.exe 1068 2025-02-03_fada690889cb0d344030fdce3ca25758_darkside.exe 1068 2025-02-03_fada690889cb0d344030fdce3ca25758_darkside.exe 1068 2025-02-03_fada690889cb0d344030fdce3ca25758_darkside.exe 1068 2025-02-03_fada690889cb0d344030fdce3ca25758_darkside.exe 1068 2025-02-03_fada690889cb0d344030fdce3ca25758_darkside.exe 1068 2025-02-03_fada690889cb0d344030fdce3ca25758_darkside.exe 1068 2025-02-03_fada690889cb0d344030fdce3ca25758_darkside.exe 1068 2025-02-03_fada690889cb0d344030fdce3ca25758_darkside.exe 1068 2025-02-03_fada690889cb0d344030fdce3ca25758_darkside.exe 1068 2025-02-03_fada690889cb0d344030fdce3ca25758_darkside.exe 1068 2025-02-03_fada690889cb0d344030fdce3ca25758_darkside.exe 1068 2025-02-03_fada690889cb0d344030fdce3ca25758_darkside.exe -
Suspicious behavior: RenamesItself 26 IoCs
pid Process 4340 DE5A.tmp 4340 DE5A.tmp 4340 DE5A.tmp 4340 DE5A.tmp 4340 DE5A.tmp 4340 DE5A.tmp 4340 DE5A.tmp 4340 DE5A.tmp 4340 DE5A.tmp 4340 DE5A.tmp 4340 DE5A.tmp 4340 DE5A.tmp 4340 DE5A.tmp 4340 DE5A.tmp 4340 DE5A.tmp 4340 DE5A.tmp 4340 DE5A.tmp 4340 DE5A.tmp 4340 DE5A.tmp 4340 DE5A.tmp 4340 DE5A.tmp 4340 DE5A.tmp 4340 DE5A.tmp 4340 DE5A.tmp 4340 DE5A.tmp 4340 DE5A.tmp -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeAssignPrimaryTokenPrivilege 1068 2025-02-03_fada690889cb0d344030fdce3ca25758_darkside.exe Token: SeBackupPrivilege 1068 2025-02-03_fada690889cb0d344030fdce3ca25758_darkside.exe Token: SeDebugPrivilege 1068 2025-02-03_fada690889cb0d344030fdce3ca25758_darkside.exe Token: 36 1068 2025-02-03_fada690889cb0d344030fdce3ca25758_darkside.exe Token: SeImpersonatePrivilege 1068 2025-02-03_fada690889cb0d344030fdce3ca25758_darkside.exe Token: SeIncBasePriorityPrivilege 1068 2025-02-03_fada690889cb0d344030fdce3ca25758_darkside.exe Token: SeIncreaseQuotaPrivilege 1068 2025-02-03_fada690889cb0d344030fdce3ca25758_darkside.exe Token: 33 1068 2025-02-03_fada690889cb0d344030fdce3ca25758_darkside.exe Token: SeManageVolumePrivilege 1068 2025-02-03_fada690889cb0d344030fdce3ca25758_darkside.exe Token: SeProfSingleProcessPrivilege 1068 2025-02-03_fada690889cb0d344030fdce3ca25758_darkside.exe Token: SeRestorePrivilege 1068 2025-02-03_fada690889cb0d344030fdce3ca25758_darkside.exe Token: SeSecurityPrivilege 1068 2025-02-03_fada690889cb0d344030fdce3ca25758_darkside.exe Token: SeSystemProfilePrivilege 1068 2025-02-03_fada690889cb0d344030fdce3ca25758_darkside.exe Token: SeTakeOwnershipPrivilege 1068 2025-02-03_fada690889cb0d344030fdce3ca25758_darkside.exe Token: SeShutdownPrivilege 1068 2025-02-03_fada690889cb0d344030fdce3ca25758_darkside.exe Token: SeDebugPrivilege 1068 2025-02-03_fada690889cb0d344030fdce3ca25758_darkside.exe Token: SeBackupPrivilege 1068 2025-02-03_fada690889cb0d344030fdce3ca25758_darkside.exe Token: SeBackupPrivilege 1068 2025-02-03_fada690889cb0d344030fdce3ca25758_darkside.exe Token: SeSecurityPrivilege 1068 2025-02-03_fada690889cb0d344030fdce3ca25758_darkside.exe Token: SeSecurityPrivilege 1068 2025-02-03_fada690889cb0d344030fdce3ca25758_darkside.exe Token: SeBackupPrivilege 1068 2025-02-03_fada690889cb0d344030fdce3ca25758_darkside.exe Token: SeBackupPrivilege 1068 2025-02-03_fada690889cb0d344030fdce3ca25758_darkside.exe Token: SeSecurityPrivilege 1068 2025-02-03_fada690889cb0d344030fdce3ca25758_darkside.exe Token: SeSecurityPrivilege 1068 2025-02-03_fada690889cb0d344030fdce3ca25758_darkside.exe Token: SeBackupPrivilege 1068 2025-02-03_fada690889cb0d344030fdce3ca25758_darkside.exe Token: SeBackupPrivilege 1068 2025-02-03_fada690889cb0d344030fdce3ca25758_darkside.exe Token: SeSecurityPrivilege 1068 2025-02-03_fada690889cb0d344030fdce3ca25758_darkside.exe Token: SeSecurityPrivilege 1068 2025-02-03_fada690889cb0d344030fdce3ca25758_darkside.exe Token: SeBackupPrivilege 1068 2025-02-03_fada690889cb0d344030fdce3ca25758_darkside.exe Token: SeBackupPrivilege 1068 2025-02-03_fada690889cb0d344030fdce3ca25758_darkside.exe Token: SeSecurityPrivilege 1068 2025-02-03_fada690889cb0d344030fdce3ca25758_darkside.exe Token: SeSecurityPrivilege 1068 2025-02-03_fada690889cb0d344030fdce3ca25758_darkside.exe Token: SeBackupPrivilege 1068 2025-02-03_fada690889cb0d344030fdce3ca25758_darkside.exe Token: SeBackupPrivilege 1068 2025-02-03_fada690889cb0d344030fdce3ca25758_darkside.exe Token: SeSecurityPrivilege 1068 2025-02-03_fada690889cb0d344030fdce3ca25758_darkside.exe Token: SeSecurityPrivilege 1068 2025-02-03_fada690889cb0d344030fdce3ca25758_darkside.exe Token: SeBackupPrivilege 1068 2025-02-03_fada690889cb0d344030fdce3ca25758_darkside.exe Token: SeBackupPrivilege 1068 2025-02-03_fada690889cb0d344030fdce3ca25758_darkside.exe Token: SeSecurityPrivilege 1068 2025-02-03_fada690889cb0d344030fdce3ca25758_darkside.exe Token: SeSecurityPrivilege 1068 2025-02-03_fada690889cb0d344030fdce3ca25758_darkside.exe Token: SeBackupPrivilege 1068 2025-02-03_fada690889cb0d344030fdce3ca25758_darkside.exe Token: SeBackupPrivilege 1068 2025-02-03_fada690889cb0d344030fdce3ca25758_darkside.exe Token: SeSecurityPrivilege 1068 2025-02-03_fada690889cb0d344030fdce3ca25758_darkside.exe Token: SeSecurityPrivilege 1068 2025-02-03_fada690889cb0d344030fdce3ca25758_darkside.exe Token: SeBackupPrivilege 1068 2025-02-03_fada690889cb0d344030fdce3ca25758_darkside.exe Token: SeBackupPrivilege 1068 2025-02-03_fada690889cb0d344030fdce3ca25758_darkside.exe Token: SeSecurityPrivilege 1068 2025-02-03_fada690889cb0d344030fdce3ca25758_darkside.exe Token: SeSecurityPrivilege 1068 2025-02-03_fada690889cb0d344030fdce3ca25758_darkside.exe Token: SeBackupPrivilege 1068 2025-02-03_fada690889cb0d344030fdce3ca25758_darkside.exe Token: SeBackupPrivilege 1068 2025-02-03_fada690889cb0d344030fdce3ca25758_darkside.exe Token: SeSecurityPrivilege 1068 2025-02-03_fada690889cb0d344030fdce3ca25758_darkside.exe Token: SeSecurityPrivilege 1068 2025-02-03_fada690889cb0d344030fdce3ca25758_darkside.exe Token: SeBackupPrivilege 1068 2025-02-03_fada690889cb0d344030fdce3ca25758_darkside.exe Token: SeBackupPrivilege 1068 2025-02-03_fada690889cb0d344030fdce3ca25758_darkside.exe Token: SeSecurityPrivilege 1068 2025-02-03_fada690889cb0d344030fdce3ca25758_darkside.exe Token: SeSecurityPrivilege 1068 2025-02-03_fada690889cb0d344030fdce3ca25758_darkside.exe Token: SeBackupPrivilege 1068 2025-02-03_fada690889cb0d344030fdce3ca25758_darkside.exe Token: SeBackupPrivilege 1068 2025-02-03_fada690889cb0d344030fdce3ca25758_darkside.exe Token: SeSecurityPrivilege 1068 2025-02-03_fada690889cb0d344030fdce3ca25758_darkside.exe Token: SeSecurityPrivilege 1068 2025-02-03_fada690889cb0d344030fdce3ca25758_darkside.exe Token: SeBackupPrivilege 1068 2025-02-03_fada690889cb0d344030fdce3ca25758_darkside.exe Token: SeBackupPrivilege 1068 2025-02-03_fada690889cb0d344030fdce3ca25758_darkside.exe Token: SeSecurityPrivilege 1068 2025-02-03_fada690889cb0d344030fdce3ca25758_darkside.exe Token: SeSecurityPrivilege 1068 2025-02-03_fada690889cb0d344030fdce3ca25758_darkside.exe -
Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 1068 wrote to memory of 4340 1068 2025-02-03_fada690889cb0d344030fdce3ca25758_darkside.exe 88 PID 1068 wrote to memory of 4340 1068 2025-02-03_fada690889cb0d344030fdce3ca25758_darkside.exe 88 PID 1068 wrote to memory of 4340 1068 2025-02-03_fada690889cb0d344030fdce3ca25758_darkside.exe 88 PID 1068 wrote to memory of 4340 1068 2025-02-03_fada690889cb0d344030fdce3ca25758_darkside.exe 88 PID 4340 wrote to memory of 1416 4340 DE5A.tmp 90 PID 4340 wrote to memory of 1416 4340 DE5A.tmp 90 PID 4340 wrote to memory of 1416 4340 DE5A.tmp 90
Processes
-
C:\Users\Admin\AppData\Local\Temp\2025-02-03_fada690889cb0d344030fdce3ca25758_darkside.exe"C:\Users\Admin\AppData\Local\Temp\2025-02-03_fada690889cb0d344030fdce3ca25758_darkside.exe"1⤵
- Drops desktop.ini file(s)
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1068 -
C:\ProgramData\DE5A.tmp"C:\ProgramData\DE5A.tmp"2⤵
- Checks computer location settings
- Deletes itself
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:4340 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C DEL /F /Q C:\PROGRA~3\DE5A.tmp >> NUL3⤵
- System Location Discovery: System Language Discovery
PID:1416
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
129B
MD57fcbcaaeb59228a618311fa4a47b9622
SHA1cc8f9c018be2b4dea405756f383cc7d2398a6fb9
SHA2567d2d6077b96bfcf15a24cc2e68c84508fd908df0cd6a4a3e7aaac3987bef25e2
SHA5123c952dc40712243fb33ebbf14df0441cf94ff4bee4fd484666ce0938e4b0545c21f4afba40cc0fd703872e76cc8b7057a9cdb4392a5a6b456ae2ca735758c15d
-
Filesize
14KB
MD5294e9f64cb1642dd89229fff0592856b
SHA197b148c27f3da29ba7b18d6aee8a0db9102f47c9
SHA256917e115cc403e29b4388e0d175cbfac3e7e40ca1742299fbdb353847db2de7c2
SHA512b87d531890bf1577b9b4af41dddb2cdbbfa164cf197bd5987df3a3075983645a3acba443e289b7bfd338422978a104f55298fbfe346872de0895bde44adc89cf
-
Filesize
147KB
MD54908ea8e8ad4f5aea07e1ee79c569422
SHA1406ef83da381065b5330c75453f45b3d31238a8e
SHA256d1fbd731b2a6f2cfeed0c0205d88810ba8e7c73baaee411cfc11c0a14a677520
SHA5120ef85ed2e8c5af770713fd016f015edd8ecc77f3592081696bbec721e0ea267c6b7b090e42577b05d7d018ce6c7d5be7c0458407bca97dfc178e0513f1a9f412
-
Filesize
1KB
MD5283c5cd7f49a9e755f1be36919383e6d
SHA1c48cbf31903409c598dbf4008d09751a080fa00a
SHA256e06f6e928e35bd84876d0d7465bc72f67dc9a304f504c3d8ac084653f415ac33
SHA512141193bd3d7a1b2d7c93b67168138f4682d16f40a745754f82a1036d0aa136cc8a94490dd53ae41378b52af513604a46beab866b847cd3ea759ee98d99775165
-
Filesize
129B
MD58b5e0472e88817606edfca6abb8abe09
SHA1d13f406c7dfef006174d094c6776d613a9c48903
SHA25609a345767ddb44ba2d2c2536c64e80ee3734799c0fa83e12f33eb2af8a773ce6
SHA5125c5dd45dfef187f26b749ed11ae7cd5188abaf8d2de16652d5b5b8e73c81690004e12b4bd91434bc15b162d15603ec63b12c51fa2743a05095ddd41782bd7d5c