Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

10

Static

static

10

2025-02-03...de.exe

windows7-x64

10

2025-02-03...de.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    137s
  • max time network
    140s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    03/02/2025, 08:35

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    2025-02-03_fada690889cb0d344030fdce3ca25758_darkside.exe

  • Size

    147KB

  • MD5

    fada690889cb0d344030fdce3ca25758

  • SHA1

    f64fb65e59a2fdba3ce0f9d8c10e670ffa94f56f

  • SHA256

    b838571dbc7905cacd42173f5703f2d6799a35ea6346438ef055476cff7fb3f1

  • SHA512

    a41248233cd1d1ce9cff027256ac4f9be7e77b0f00075ad174345cb8ad5cb62a3afb73550ac6064faa08cd80cae60c5445fbb9386ddec8bc52059a3f1701c753

  • SSDEEP

    3072:O6glyuxE4GsUPnliByocWepE94iiK2uzAERpM:O6gDBGpvEByocWeFlyM

Score
10/10
defense_evasiondiscoveryransomwarespywarestealer

Malware Config

Extracted

Path

C:\cbNhUvy60.README.txt

Ransom Note
YOUR FILES ARE ENCRYPTED Your files, documents, photos, databases and other important files are encrypted. You are not able to decrypt it by yourself! The only method of recovering files is to purchase an unique decryptor. Only we can give you this decryptor and only we can recover your files. To be sure we have the decryptor and it works you can send an email: [email protected] and decrypt one file for free. But this file should be of not valuable! Your personal DECRYPTION ID: 57EF078892B7D9E26C0C583CD9C72D6C Do you really want to restore your files? Write to email: [email protected] Reserved email: [email protected] telegram: @somran2025 Attention! * Do not rename or edit encrypted files and archives containing encrypted files. * Do not try to decrypt your data using third party software, it may cause permanent data loss. * Decryption of your files with the help of third parties may cause increased price (they add their fee to our) or you can become a victim of a scam. * We have been in your network for a long time. We know everything about your company most of your information has already been downloaded to our server. We recommend you to do not waste your time if you dont wont we start 2nd part. * You have 24 hours to contact us. * Otherwise, your data will be sold or made public.

Signatures

  • Renames multiple (623) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

    ransomware
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself 1 IoCs
  • Executes dropped EXE 1 IoCs
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Drops desktop.ini file(s) 2 IoCs
  • Indicator Removal: File Deletion 1 TTPs

    Adversaries may delete files left behind by the actions of their intrusion activity.

    defense_evasion
  • Suspicious use of NtSetInformationThreadHideFromDebugger 5 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: RenamesItself 26 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of WriteProcessMemory 7 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2025-02-03_fada690889cb0d344030fdce3ca25758_darkside.exe
    "C:\Users\Admin\AppData\Local\Temp\2025-02-03_fada690889cb0d344030fdce3ca25758_darkside.exe"
    1⤵
    • Drops desktop.ini file(s)
    • Suspicious use of NtSetInformationThreadHideFromDebugger
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:1068
    • C:\ProgramData\DE5A.tmp
      "C:\ProgramData\DE5A.tmp"
      2⤵
      • Checks computer location settings
      • Deletes itself
      • Executes dropped EXE
      • Suspicious use of NtSetInformationThreadHideFromDebugger
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: RenamesItself
      • Suspicious use of WriteProcessMemory
      PID:4340
      • C:\Windows\SysWOW64\cmd.exe
        "C:\Windows\System32\cmd.exe" /C DEL /F /Q C:\PROGRA~3\DE5A.tmp >> NUL
        3⤵
        • System Location Discovery: System Language Discovery
        PID:1416

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\$Recycle.Bin\S-1-5-21-3756129449-3121373848-4276368241-1000\WWWWWWWWWWW
    Filesize

    129B

    MD5

    7fcbcaaeb59228a618311fa4a47b9622

    SHA1

    cc8f9c018be2b4dea405756f383cc7d2398a6fb9

    SHA256

    7d2d6077b96bfcf15a24cc2e68c84508fd908df0cd6a4a3e7aaac3987bef25e2

    SHA512

    3c952dc40712243fb33ebbf14df0441cf94ff4bee4fd484666ce0938e4b0545c21f4afba40cc0fd703872e76cc8b7057a9cdb4392a5a6b456ae2ca735758c15d

    Download Submit

  • C:\ProgramData\DE5A.tmp
    Filesize

    14KB

    MD5

    294e9f64cb1642dd89229fff0592856b

    SHA1

    97b148c27f3da29ba7b18d6aee8a0db9102f47c9

    SHA256

    917e115cc403e29b4388e0d175cbfac3e7e40ca1742299fbdb353847db2de7c2

    SHA512

    b87d531890bf1577b9b4af41dddb2cdbbfa164cf197bd5987df3a3075983645a3acba443e289b7bfd338422978a104f55298fbfe346872de0895bde44adc89cf

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\DDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDD
    Filesize

    147KB

    MD5

    4908ea8e8ad4f5aea07e1ee79c569422

    SHA1

    406ef83da381065b5330c75453f45b3d31238a8e

    SHA256

    d1fbd731b2a6f2cfeed0c0205d88810ba8e7c73baaee411cfc11c0a14a677520

    SHA512

    0ef85ed2e8c5af770713fd016f015edd8ecc77f3592081696bbec721e0ea267c6b7b090e42577b05d7d018ce6c7d5be7c0458407bca97dfc178e0513f1a9f412

    Download Submit

  • C:\cbNhUvy60.README.txt
    Filesize

    1KB

    MD5

    283c5cd7f49a9e755f1be36919383e6d

    SHA1

    c48cbf31903409c598dbf4008d09751a080fa00a

    SHA256

    e06f6e928e35bd84876d0d7465bc72f67dc9a304f504c3d8ac084653f415ac33

    SHA512

    141193bd3d7a1b2d7c93b67168138f4682d16f40a745754f82a1036d0aa136cc8a94490dd53ae41378b52af513604a46beab866b847cd3ea759ee98d99775165

    Download Submit

  • F:\$RECYCLE.BIN\S-1-5-21-3756129449-3121373848-4276368241-1000\DDDDDDDDDDD
    Filesize

    129B

    MD5

    8b5e0472e88817606edfca6abb8abe09

    SHA1

    d13f406c7dfef006174d094c6776d613a9c48903

    SHA256

    09a345767ddb44ba2d2c2536c64e80ee3734799c0fa83e12f33eb2af8a773ce6

    SHA512

    5c5dd45dfef187f26b749ed11ae7cd5188abaf8d2de16652d5b5b8e73c81690004e12b4bd91434bc15b162d15603ec63b12c51fa2743a05095ddd41782bd7d5c

    Download Submit

  • memory/1068-2832-0x00000000030C0000-0x00000000030D0000-memory.dmp

    Filesize

    64KB

    Download

  • memory/1068-0-0x00000000030C0000-0x00000000030D0000-memory.dmp

    Filesize

    64KB

    Download

  • memory/1068-2-0x00000000030C0000-0x00000000030D0000-memory.dmp

    Filesize

    64KB

    Download

  • memory/1068-2837-0x00000000030C0000-0x00000000030D0000-memory.dmp

    Filesize

    64KB

    Download

  • memory/1068-1-0x00000000030C0000-0x00000000030D0000-memory.dmp

    Filesize

    64KB

    Download

  • memory/4340-2836-0x000000007FDC0000-0x000000007FDC1000-memory.dmp

    Filesize

    4KB

    Download

  • memory/4340-2834-0x00000000027A0000-0x00000000027B0000-memory.dmp

    Filesize

    64KB

    Download

  • memory/4340-2833-0x000000007FE40000-0x000000007FE41000-memory.dmp

    Filesize

    4KB

    Download

  • memory/4340-2835-0x000000007FE20000-0x000000007FE21000-memory.dmp

    Filesize

    4KB

    Download

  • memory/4340-2866-0x000000007FDE0000-0x000000007FDE1000-memory.dmp

    Filesize

    4KB

    Download

  • memory/4340-2867-0x000000007FE00000-0x000000007FE01000-memory.dmp

    Filesize

    4KB

    Download