Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    114s
  • max time network
    120s
  • platform
    windows7_x64
  • resource
    win7
  • submitted
    30/06/2020, 13:07

General

  • Target

    5cd04805f9753ca08b82e88c27bf5426d1d356bb26b281885573051048911367.exe

  • Size

    1.0MB

  • MD5

    572fea5f025df78f2d316216fbeee52e

  • SHA1

    91b2bf44b1f9282c09f07f16631deaa3ad9d956d

  • SHA256

    5cd04805f9753ca08b82e88c27bf5426d1d356bb26b281885573051048911367

  • SHA512

    eb238272227c5825477ff1e37dc4f7e467665049d4db5649fff59c39d7745e88b06234d6d1218c05c802e33e21577f9d4a533cb9e23ebe6fb09654f97759c187

Malware Config

Extracted

Path

C:\Users\Admin\Desktop\PushSend.aifc.txt

Family

wastedlocker

Ransom Note
RL Hudson YOUR NETWORK IS ENCRYPTED NOW USE [email protected] | [email protected] TO GET THE PRICE FOR YOUR DATA DO NOT GIVE THIS EMAIL TO 3RD PARTIES DO NOT RENAME OR MOVE THE FILE THE FILE IS ENCRYPTED WITH THE FOLLOWING KEY: [begin_key]gwZBEAvEP2FqvUvL47sPJ45/yVBX4Yw3mjqRxsUH0eMigNwvIjy5CGS3jZvjAOCL 4qNHA6uQpH6xp7nlGPojecVwtbE0PQ0AzWqjLF+rhmBximG1pC3sSVp5otVCqnGf wLAA0ArD1ifoCS71IGZr6FKtP7z+pQj862fG9ev4IeRiLvRyjwCTp3ZbebV6i6qp 7Z9ICPUDH+Io9kKf1M+x4DMNFvobtTrDfG4OyvlSflIjOLMIKs7t797AYMPIQBXf IU8n6jN526XpohETzyhEzp/pnSTU7gm3Rewzo4Om6H47yqnpiqvi2dK5TZ46e4Hb geBNBiMp/+f9ym6TIPAHoaZ4v9HyxkyY4Dw2Pwx6zWkWs5A7+LvG3GfAetF1kgf+ 6/dMG7chAu9cfVVOTr2W5rSyncUW9mZiVc96hRIXbFB23DTIMXDU1lnp4b0E2stu mCcASWt4SvEAC6xmDNu4OZFyMJ9Y/hTCOniStc0b+V1zJAgPE0oOl34IX2O2mPxi rDQEp1KbGbjGkaIybaT+aN2i55FQpbxiRsKARv8XXJuQqe5kOuF1Avu+zRSgAEu3 fJPttM5dyIIm7QRUHJSb47GgIoEVbvHepw4RYtQugkWhJSsHg9yrmnugS+ezCWJM 8saesPbsb/xZSNpNI7/keZX0X6ZHCyfax8NvQiqPKo2=[end_key] KEEP IT

Signatures

  • Loads dropped DLL 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 3 IoCs
  • Views/modifies file attributes 1 TTPs 3 IoCs
  • Opens file in notepad (likely ransom note) 1 IoCs
  • Drops file in System32 directory 2 IoCs
  • Suspicious use of WriteProcessMemory 52 IoCs
  • Deletes itself 1 IoCs
  • Deletes shadow copies 2 TTPs

    Ransomware often targets backup files to inhibit system recovery.

  • Interacts with shadow copies 2 TTPs 1 IoCs

    Shadow copies are often targeted by ransomware to inhibit system recovery.

  • Possible privilege escalation attempt 2 IoCs
  • Modifies service 2 TTPs 5 IoCs
  • Modifies file permissions 1 TTPs 2 IoCs
  • Executes dropped EXE 2 IoCs
  • WastedLocker

    Ransomware family seen in the wild since May 2020.

  • NTFS ADS 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\5cd04805f9753ca08b82e88c27bf5426d1d356bb26b281885573051048911367.exe
    "C:\Users\Admin\AppData\Local\Temp\5cd04805f9753ca08b82e88c27bf5426d1d356bb26b281885573051048911367.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious use of WriteProcessMemory
    • NTFS ADS
    PID:1612
    • C:\Users\Admin\AppData\Roaming\Name:bin
      C:\Users\Admin\AppData\Roaming\Name:bin -r
      2⤵
      • Drops file in System32 directory
      • Suspicious use of WriteProcessMemory
      • Executes dropped EXE
      PID:364
      • C:\Windows\system32\vssadmin.exe
        C:\Windows\system32\vssadmin.exe Delete Shadows /All /Quiet
        3⤵
        • Interacts with shadow copies
        PID:1052
      • C:\Windows\SysWOW64\takeown.exe
        C:\Windows\system32\takeown.exe /F C:\Windows\system32\Name.exe
        3⤵
        • Possible privilege escalation attempt
        • Modifies file permissions
        PID:1416
      • C:\Windows\SysWOW64\icacls.exe
        C:\Windows\system32\icacls.exe C:\Windows\system32\Name.exe /reset
        3⤵
        • Possible privilege escalation attempt
        • Modifies file permissions
        PID:1948
      • C:\Windows\SysWOW64\cmd.exe
        cmd /c choice /t 10 /d y & attrib -h "C:\Users\Admin\AppData\Roaming\Name" & del "C:\Users\Admin\AppData\Roaming\Name"
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:1628
        • C:\Windows\SysWOW64\choice.exe
          choice /t 10 /d y
          4⤵
            PID:1632
          • C:\Windows\SysWOW64\attrib.exe
            attrib -h "C:\Users\Admin\AppData\Roaming\Name"
            4⤵
            • Views/modifies file attributes
            PID:1280
      • C:\Windows\SysWOW64\cmd.exe
        cmd /c choice /t 10 /d y & attrib -h "C:\Users\Admin\AppData\Local\Temp\5cd04805f9753ca08b82e88c27bf5426d1d356bb26b281885573051048911367.exe" & del "C:\Users\Admin\AppData\Local\Temp\5cd04805f9753ca08b82e88c27bf5426d1d356bb26b281885573051048911367.exe"
        2⤵
        • Suspicious use of WriteProcessMemory
        • Deletes itself
        PID:1640
        • C:\Windows\SysWOW64\choice.exe
          choice /t 10 /d y
          3⤵
            PID:1128
          • C:\Windows\SysWOW64\attrib.exe
            attrib -h "C:\Users\Admin\AppData\Local\Temp\5cd04805f9753ca08b82e88c27bf5426d1d356bb26b281885573051048911367.exe"
            3⤵
            • Views/modifies file attributes
            PID:1364
      • C:\Windows\system32\vssvc.exe
        C:\Windows\system32\vssvc.exe
        1⤵
        • Suspicious use of AdjustPrivilegeToken
        • Modifies service
        PID:1508
      • C:\Windows\SysWOW64\Name.exe
        C:\Windows\SysWOW64\Name.exe -s
        1⤵
        • Suspicious use of WriteProcessMemory
        • Executes dropped EXE
        PID:1956
        • C:\Windows\SysWOW64\cmd.exe
          cmd /c choice /t 10 /d y & attrib -h "C:\Windows\SysWOW64\Name.exe" & del "C:\Windows\SysWOW64\Name.exe"
          2⤵
          • Suspicious use of WriteProcessMemory
          PID:1828
          • C:\Windows\SysWOW64\choice.exe
            choice /t 10 /d y
            3⤵
              PID:1644
            • C:\Windows\SysWOW64\attrib.exe
              attrib -h "C:\Windows\SysWOW64\Name.exe"
              3⤵
              • Views/modifies file attributes
              • Drops file in System32 directory
              PID:2028
        • C:\Windows\system32\NOTEPAD.EXE
          "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\PushSend.aifc.txt
          1⤵
          • Opens file in notepad (likely ransom note)
          PID:528

        Network

        MITRE ATT&CK Enterprise v6

        Replay Monitor

        Loading Replay Monitor...

        Downloads