Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

10

Static

static

10

2025-03-01...de.exe

windows7-x64

10

2025-03-01...de.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    122s
  • max time network
    123s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    01/03/2025, 10:10

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    2025-03-01_e484fdf70971d7884b935f35009b70d9_darkside.exe

  • Size

    147KB

  • MD5

    e484fdf70971d7884b935f35009b70d9

  • SHA1

    9df69d121589be29aaea4a791de68940e5b4560d

  • SHA256

    cc34b0ee0a05ec167f26cf9c0e7617dfe5c93859694d7f86519721e0500ea3e3

  • SHA512

    7af96b6e59288f9f5117cd9b8bce1a404bfadf0b2a74df61c0f6e8e5069a69fc50da802397fa6effc44dbdf2d9a912daff26482143c33f823e5fead7b4dd1bbc

  • SSDEEP

    3072:i6glyuxE4GsUPnliByocWepu1lFSooIjlya2j:i6gDBGpvEByocWe08i14

Score
10/10
braincipherdefense_evasiondiscoveryransomwarespywarestealer

Malware Config

Extracted

Path

C:\P2cK9tagI.README.txt

Family

braincipher

Ransom Note
*** Welcome to Brain Cipher Ransomware! *** Dear managers! If you're reading this, it means your systems have been hacked and encrypted and your data stolen. *** The most proper way to safely recover your data is through our support. We can recover your systems within 4-6 hours. In order for it to be successful, you must follow a few points: 1.Don't go to the police, etc. 2.Do not attempt to recover data on your own. 3.Do not take the help of third-party data recovery companies. In most cases, they are scammers who will pay us a ransom and take a for themselves. *** If you violate any 1 of these points, we will refuse to cooperate with you!!! ATTENTION! If you do not contact us within 48 hours, we will post the record on our website: vkvsgl7lhipjirmz6j5ubp3w3bwvxgcdbpi3fsbqngfynetqtw4w5hyd.onion 3 steps to data recovery: 1. Download and install Tor Browser (https://www.torproject.org/download/) 2. Go to our support page: http://brain4zoadgr6clxecixffvxjsw43cflyprnpfeak72nfh664kqqriyd.onion This page can take up to 30 minutes to load. 3. Enter your encryption ID: YTLPEc1HteenqnmYMoULaQdZbHGeFzy7wpU63FqZxtA+JiOucpFdpfacqk4OKunDNT714KgoOxL5BqpWxD7zdUVUFTSEN6 Email to support: [email protected]
URLs

http://vkvsgl7lhipjirmz6j5ubp3w3bwvxgcdbpi3fsbqngfynetqtw4w5hyd.onion

http://brain4zoadgr6clxecixffvxjsw43cflyprnpfeak72nfh664kqqriyd.onion

Signatures

  • Brain Cipher

    Ransomware family based on Lockbit that was first observed in June 2024.

    ransomwarebraincipher
  • Braincipher family
    braincipher
  • Renames multiple (7742) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

    ransomware
  • Deletes itself 1 IoCs
  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 1 IoCs
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Drops desktop.ini file(s) 2 IoCs
  • Indicator Removal: File Deletion 1 TTPs

    Adversaries may delete files left behind by the actions of their intrusion activity.

    defense_evasion
  • Suspicious use of NtSetInformationThreadHideFromDebugger 5 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Suspicious behavior: EnumeratesProcesses 36 IoCs
  • Suspicious behavior: RenamesItself 26 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of WriteProcessMemory 9 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2025-03-01_e484fdf70971d7884b935f35009b70d9_darkside.exe
    "C:\Users\Admin\AppData\Local\Temp\2025-03-01_e484fdf70971d7884b935f35009b70d9_darkside.exe"
    1⤵
    • Loads dropped DLL
    • Drops desktop.ini file(s)
    • Suspicious use of NtSetInformationThreadHideFromDebugger
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:2420
    • C:\ProgramData\46A1.tmp
      "C:\ProgramData\46A1.tmp"
      2⤵
      • Deletes itself
      • Executes dropped EXE
      • Suspicious use of NtSetInformationThreadHideFromDebugger
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: RenamesItself
      • Suspicious use of WriteProcessMemory
      PID:2340
      • C:\Windows\SysWOW64\cmd.exe
        "C:\Windows\System32\cmd.exe" /C DEL /F /Q C:\PROGRA~3\46A1.tmp >> NUL
        3⤵
        • System Location Discovery: System Language Discovery
        PID:2020
  • C:\Windows\system32\AUDIODG.EXE
    C:\Windows\system32\AUDIODG.EXE 0x14c
    1⤵
      PID:3012

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\$Recycle.Bin\S-1-5-21-3290804112-2823094203-3137964600-1000\desktop.ini
      Filesize

      129B

      MD5

      341b0aa371d98ac17d080d6538529ef5

      SHA1

      41d35d26b4dce10ba6fa66bb7181e757d53c597f

      SHA256

      2679083109fda1dbf32e74e68aa13d231216d1dde2e33471d0f4c223097da2e9

      SHA512

      b6993384d09346d9018f7a179da07e8a8ad6b2d5dd87e07b5a2b684d0a95fbcdb9b6a99b62934b12d0492c6b3aca0690563ed4c47d2d1c302823f54fc74997a9

      Download Submit

    • C:\P2cK9tagI.README.txt
      Filesize

      1KB

      MD5

      8df1bd24362b8a25f7ce7d224a061abc

      SHA1

      c2d82d77a706fd90cdf1f3a13fee1c195bab56d3

      SHA256

      50cf548c89c26f1d0335a4c45c7e66fb0cfe220cf1d6db75e6f43bca1afd9563

      SHA512

      e2c68ab14b8983741a6b0fee4a350f2dc774c5319ddd2e8c47aa60da47b408fed49d255e68500334c05e031eab4f59ab163abc8e206c3d3e5b09db16bbf4f1e7

      Download Submit

    • C:\ProgramData\46A1.tmp
      Filesize

      14KB

      MD5

      294e9f64cb1642dd89229fff0592856b

      SHA1

      97b148c27f3da29ba7b18d6aee8a0db9102f47c9

      SHA256

      917e115cc403e29b4388e0d175cbfac3e7e40ca1742299fbdb353847db2de7c2

      SHA512

      b87d531890bf1577b9b4af41dddb2cdbbfa164cf197bd5987df3a3075983645a3acba443e289b7bfd338422978a104f55298fbfe346872de0895bde44adc89cf

      Download Submit

    • C:\Users\Admin\AppData\Local\Temp\DDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDD
      Filesize

      147KB

      MD5

      079ba8cd1a75273c5683ad8c279246ce

      SHA1

      c3197c8f807cd21854af8ce18353bf1bdf3f6f95

      SHA256

      4398a76c39e02097db38bd5d1b88dccb319d08aa0516a60e01e92f58b8b42537

      SHA512

      ae92c2740fcbd21819d9eda396d92a1abc055d0552c2ecf15d05fb7201011ce69ea151e0231f46485bc31991a5b4fc5c3252a1425ec4cfa1e364d7c4becf7de1

      Download Submit

    • F:\$RECYCLE.BIN\S-1-5-21-3290804112-2823094203-3137964600-1000\DDDDDDDDDDD
      Filesize

      129B

      MD5

      c25260a136157cba062fe1772a17a85b

      SHA1

      be540f57937bc315aa8667829d6972d99ea36ae8

      SHA256

      48d849f9a31392e9d67a6837a291f0ee9e4fe2a91a2b2959aec9c4f36e1f39bc

      SHA512

      5b024dd83ce82df803fc1de8b3d6aeb70f0113f891e98642b30910086013a7aaf026da9f612a83e48dbf3ee0baac72306bf0cad0a58e2f78323b3543b029985b

      Download Submit

    • memory/2340-11577-0x0000000000401000-0x0000000000404000-memory.dmp

      Filesize

      12KB

      Download

    • memory/2340-11579-0x0000000000400000-0x0000000000407000-memory.dmp

      Filesize

      28KB

      Download

    • memory/2420-0-0x0000000000AB0000-0x0000000000AF0000-memory.dmp

      Filesize

      256KB

      Download