Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    151s
  • max time network
    93s
  • platform
    windows7_x64
  • resource
    win7v20201028
  • submitted
    22/01/2021, 07:41

General

  • Target

    invoice_NQ_Supply.xls

  • Size

    83KB

  • MD5

    50fecec126570e4b8fcd531d6711879a

  • SHA1

    9166aee4a6815e4f67e0ae43344d8ca144958d47

  • SHA256

    c7e40628fb6beb52d9d73a3b3afd1dca5d2335713593b698637e1a47b42bfc71

  • SHA512

    5f6d88626024811fd05af98d35a2e54a87ce5c8929d56c8bc49d718417b3370af7aa9a66c46007c600c5ec608a0f91f1e952738ee35cd3aebe28b4db46a2c042

Malware Config

Extracted

Path

C:\Users\Admin\AppData\Local\Temp\RESTORE_FILES_INFO.txt

Ransom Note
Don't worry, you can return all your files! All your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key. The only method of recovering files is to purchase decrypt tool and unique key for you. This software will decrypt all your encrypted files. What guarantees you have? You can send one of your encrypted file from your PC and we decrypt it for free. But we can decrypt only 1 file for free. File must not contain valuable information. We also downloaded your corporate files (databases, tables, accounting information, etc.) and we will have to publish them if you do not agree to cooperation. To get this software you need write on our e-mail: [email protected] Reserve e-mail address to contact us: [email protected] Key Identifier: MrdspKpEvSZKY8uLASEE5yMvxwD7P4ziTOK9r5PffokBqapJBEBgD84xDzSY16f7pDxYlK2w4nSJdL+Lj5mLGG/YBcqY+yN4UBjlWNgX/P4FMpNKXAFwfDn/+oxLntKrr86lkqUpY1geXHigIHd6EHyQZjepy0XmU01FMToV6iBSvP08bXHL63DGRHNFHtwUdCHt5Zo4jFaiWM+FSs8PuJ7SPPmZb9QBcHdrCRkCSqQ0oVnKLX9VtVQsONKPXQIoEjOAHPIuuL+U0oexM3febm7VyohuBQXDFylwK8I5NGPBLncu/IOCShNBz9faoN+q10aliTaOQ3YxtnTU8QAG1WVzOFGWSsiK3J/wIFVxT0XkNrE5HrHXPOghu06YIxH3GNK2G38WVmEJ6KuYHkjkcwgYp89D6L1cRRd5Dl3or3ELyTKt27mpfxyhMWM+aFb19W4/gpFIQB6OxXdY+tPj1KEj3XU1ldXLM+C4q6OzZ9njxZsB3kefIuIpci3KGE17WDfC3wYTgHS03NgPXrcphbtA8UPUUG+deK360Dw49CLRjj8gMy6K5fS8tXY7ZQGVndtM9/2OwhTVCrvfpOaWkm8U7kyAaa2MVnIQ9QMR53OVDswc6sntkL6NnOfHUVWWqby3SmvPWZDpu+jqhsU7ws6RWFS50PgkijJuua+aDbk=

Extracted

Language
xlm4.0
Source
URLs
xlm40.dropper

https://iffusedtrac.xyz/3/bbc.exe

Signatures

  • Modifies Windows Defender Real-time Protection settings 3 TTPs
  • TeslaCrypt, AlphaCrypt

    Ransomware based on CryptoLocker. Shut down by the developers in 2016.

  • Executes dropped EXE 2 IoCs
  • Modifies Windows Firewall 1 TTPs
  • Drops startup file 1 IoCs
  • Loads dropped DLL 2 IoCs
  • Windows security modification 2 TTPs 2 IoCs
  • Launches sc.exe

    Sc.exe is a Windows utlilty to control services on the system.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • NSIS installer 6 IoCs
  • Enumerates system info in registry 2 TTPs 1 IoCs
  • Kills process with taskkill 1 IoCs
  • Modifies Internet Explorer settings 1 TTPs 9 IoCs
  • Modifies registry key 1 TTPs 1 IoCs
  • Runs net.exe
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 3 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SendNotifyMessage 1 IoCs
  • Suspicious use of SetWindowsHookEx 9 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE
    "C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE" /dde C:\Users\Admin\AppData\Local\Temp\invoice_NQ_Supply.xls
    1⤵
    • Loads dropped DLL
    • Enumerates system info in registry
    • Modifies Internet Explorer settings
    • Suspicious behavior: AddClipboardFormatListener
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:1856
    • C:\wCmfmRe\dtwzrQf\GZTJoxx.exe
      "C:\wCmfmRe\dtwzrQf\GZTJoxx.exe"
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Suspicious use of WriteProcessMemory
      PID:1052
      • C:\Users\Admin\AppData\Local\Programs\Temp\wqm58yk7.exe
        "C:\Users\Admin\AppData\Local\Programs\Temp\wqm58yk7.exe"
        3⤵
        • Executes dropped EXE
        • Drops startup file
        • Windows security modification
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SendNotifyMessage
        • Suspicious use of WriteProcessMemory
        PID:560
        • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
          "powershell" Get-MpPreference -verbose
          4⤵
          • Suspicious use of AdjustPrivilegeToken
          PID:1580
        • C:\Windows\SysWOW64\taskkill.exe
          "taskkill" /F /IM RaccineSettings.exe
          4⤵
          • Kills process with taskkill
          • Suspicious use of AdjustPrivilegeToken
          PID:924
        • C:\Windows\SysWOW64\reg.exe
          "reg" delete "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "Raccine Tray" /F
          4⤵
            PID:1156
          • C:\Windows\SysWOW64\reg.exe
            "reg" delete HKCU\Software\Raccine /F
            4⤵
            • Modifies registry key
            PID:1620
          • C:\Windows\SysWOW64\schtasks.exe
            "schtasks" /DELETE /TN "Raccine Rules Updater" /F
            4⤵
              PID:2016
            • C:\Windows\SysWOW64\cmd.exe
              "cmd.exe" /c rd /s /q %SYSTEMDRIVE%\\$Recycle.bin
              4⤵
                PID:2020
              • C:\Windows\SysWOW64\sc.exe
                "sc.exe" config Dnscache start= auto
                4⤵
                  PID:1752
                • C:\Windows\SysWOW64\sc.exe
                  "sc.exe" config SQLTELEMETRY start= disabled
                  4⤵
                    PID:1868
                  • C:\Windows\SysWOW64\sc.exe
                    "sc.exe" config SQLTELEMETRY$ECWDB2 start= disabled
                    4⤵
                      PID:660
                    • C:\Windows\SysWOW64\cmd.exe
                      "cmd.exe" /c rd /s /q D:\\$Recycle.bin
                      4⤵
                        PID:1136
                      • C:\Windows\SysWOW64\sc.exe
                        "sc.exe" config FDResPub start= auto
                        4⤵
                          PID:1356
                        • C:\Windows\SysWOW64\sc.exe
                          "sc.exe" config SstpSvc start= disabled
                          4⤵
                            PID:1552
                          • C:\Windows\SysWOW64\netsh.exe
                            "netsh" advfirewall firewall set rule group=\"Network Discovery\" new enable=Yes
                            4⤵
                              PID:1624
                            • C:\Windows\SysWOW64\sc.exe
                              "sc.exe" config upnphost start= auto
                              4⤵
                                PID:936
                              • C:\Windows\SysWOW64\netsh.exe
                                "netsh" advfirewall firewall set rule group="File and Printer Sharing" new enable=Yes
                                4⤵
                                  PID:1264
                                • C:\Windows\SysWOW64\net.exe
                                  "net.exe" start Dnscache /y
                                  4⤵
                                    PID:1376
                                    • C:\Windows\SysWOW64\net1.exe
                                      C:\Windows\system32\net1 start Dnscache /y
                                      5⤵
                                        PID:2224
                                    • C:\Windows\SysWOW64\sc.exe
                                      "sc.exe" config SQLWriter start= disabled
                                      4⤵
                                        PID:1548
                                      • C:\Windows\SysWOW64\net.exe
                                        "net.exe" start FDResPub /y
                                        4⤵
                                          PID:820
                                          • C:\Windows\SysWOW64\net1.exe
                                            C:\Windows\system32\net1 start FDResPub /y
                                            5⤵
                                              PID:2216
                                          • C:\Windows\SysWOW64\net.exe
                                            "net.exe" start SSDPSRV /y
                                            4⤵
                                              PID:324
                                              • C:\Windows\SysWOW64\net1.exe
                                                C:\Windows\system32\net1 start SSDPSRV /y
                                                5⤵
                                                  PID:2248
                                              • C:\Windows\SysWOW64\net.exe
                                                "net.exe" stop mfewc /y
                                                4⤵
                                                  PID:1664
                                                  • C:\Windows\SysWOW64\net1.exe
                                                    C:\Windows\system32\net1 stop mfewc /y
                                                    5⤵
                                                      PID:2276
                                                  • C:\Windows\SysWOW64\net.exe
                                                    "net.exe" stop McAfeeDLPAgentService /y
                                                    4⤵
                                                      PID:1380
                                                      • C:\Windows\SysWOW64\net1.exe
                                                        C:\Windows\system32\net1 stop McAfeeDLPAgentService /y
                                                        5⤵
                                                          PID:2256
                                                      • C:\Windows\SysWOW64\net.exe
                                                        "net.exe" stop avpsus /y
                                                        4⤵
                                                          PID:2024
                                                          • C:\Windows\SysWOW64\net1.exe
                                                            C:\Windows\system32\net1 stop avpsus /y
                                                            5⤵
                                                              PID:2148
                                                          • C:\Windows\SysWOW64\net.exe
                                                            "net.exe" stop bedbg /y
                                                            4⤵
                                                              PID:1684
                                                              • C:\Windows\SysWOW64\net1.exe
                                                                C:\Windows\system32\net1 stop bedbg /y
                                                                5⤵
                                                                  PID:2240
                                                              • C:\Windows\SysWOW64\sc.exe
                                                                "sc.exe" config SSDPSRV start= auto
                                                                4⤵
                                                                  PID:1044
                                                                • C:\Windows\SysWOW64\net.exe
                                                                  "net.exe" stop MSSQL$SQL_2008 /y
                                                                  4⤵
                                                                    PID:436
                                                                    • C:\Windows\SysWOW64\net1.exe
                                                                      C:\Windows\system32\net1 stop MSSQL$SQL_2008 /y
                                                                      5⤵
                                                                        PID:2208
                                                                    • C:\Windows\SysWOW64\net.exe
                                                                      "net.exe" stop EhttpSrv /y
                                                                      4⤵
                                                                        PID:800
                                                                        • C:\Windows\SysWOW64\net1.exe
                                                                          C:\Windows\system32\net1 stop EhttpSrv /y
                                                                          5⤵
                                                                            PID:2268
                                                                        • C:\Windows\SysWOW64\net.exe
                                                                          "net.exe" stop BMR Boot Service /y
                                                                          4⤵
                                                                            PID:956
                                                                            • C:\Windows\SysWOW64\net1.exe
                                                                              C:\Windows\system32\net1 stop BMR Boot Service /y
                                                                              5⤵
                                                                                PID:2156
                                                                            • C:\Windows\SysWOW64\net.exe
                                                                              "net.exe" start upnphost /y
                                                                              4⤵
                                                                                PID:1900
                                                                                • C:\Windows\SysWOW64\net1.exe
                                                                                  C:\Windows\system32\net1 start upnphost /y
                                                                                  5⤵
                                                                                    PID:2164
                                                                                • C:\Windows\SysWOW64\net.exe
                                                                                  "net.exe" stop ccEvtMgr /y
                                                                                  4⤵
                                                                                    PID:2056
                                                                                    • C:\Windows\SysWOW64\net1.exe
                                                                                      C:\Windows\system32\net1 stop ccEvtMgr /y
                                                                                      5⤵
                                                                                        PID:2184
                                                                                    • C:\Windows\SysWOW64\net.exe
                                                                                      "net.exe" stop ccSetMgr /y
                                                                                      4⤵
                                                                                        PID:2084
                                                                                        • C:\Windows\SysWOW64\net1.exe
                                                                                          C:\Windows\system32\net1 stop ccSetMgr /y
                                                                                          5⤵
                                                                                            PID:2232
                                                                                        • C:\Windows\SysWOW64\net.exe
                                                                                          "net.exe" stop NetBackup BMR MTFTP Service /y
                                                                                          4⤵
                                                                                            PID:2112

                                                                                    Network

                                                                                    MITRE ATT&CK Enterprise v6

                                                                                    Replay Monitor

                                                                                    Loading Replay Monitor...

                                                                                    Downloads

                                                                                    • memory/560-15-0x000000006C110000-0x000000006C7FE000-memory.dmp

                                                                                      Filesize

                                                                                      6.9MB

                                                                                    • memory/560-18-0x0000000004760000-0x0000000004761000-memory.dmp

                                                                                      Filesize

                                                                                      4KB

                                                                                    • memory/560-16-0x0000000001150000-0x0000000001151000-memory.dmp

                                                                                      Filesize

                                                                                      4KB

                                                                                    • memory/1052-9-0x00000000767E1000-0x00000000767E3000-memory.dmp

                                                                                      Filesize

                                                                                      8KB

                                                                                    • memory/1096-5-0x000007FEF7F70000-0x000007FEF81EA000-memory.dmp

                                                                                      Filesize

                                                                                      2.5MB

                                                                                    • memory/1580-23-0x0000000004770000-0x0000000004771000-memory.dmp

                                                                                      Filesize

                                                                                      4KB

                                                                                    • memory/1580-44-0x00000000062A0000-0x00000000062A1000-memory.dmp

                                                                                      Filesize

                                                                                      4KB

                                                                                    • memory/1580-59-0x0000000006320000-0x0000000006321000-memory.dmp

                                                                                      Filesize

                                                                                      4KB

                                                                                    • memory/1580-45-0x00000000055F0000-0x00000000055F1000-memory.dmp

                                                                                      Filesize

                                                                                      4KB

                                                                                    • memory/1580-25-0x0000000002572000-0x0000000002573000-memory.dmp

                                                                                      Filesize

                                                                                      4KB

                                                                                    • memory/1580-60-0x0000000006330000-0x0000000006331000-memory.dmp

                                                                                      Filesize

                                                                                      4KB

                                                                                    • memory/1580-21-0x000000006C110000-0x000000006C7FE000-memory.dmp

                                                                                      Filesize

                                                                                      6.9MB

                                                                                    • memory/1580-22-0x0000000000480000-0x0000000000481000-memory.dmp

                                                                                      Filesize

                                                                                      4KB

                                                                                    • memory/1580-24-0x0000000002570000-0x0000000002571000-memory.dmp

                                                                                      Filesize

                                                                                      4KB

                                                                                    • memory/1580-37-0x0000000006100000-0x0000000006101000-memory.dmp

                                                                                      Filesize

                                                                                      4KB

                                                                                    • memory/1580-36-0x000000007EF30000-0x000000007EF31000-memory.dmp

                                                                                      Filesize

                                                                                      4KB

                                                                                    • memory/1580-35-0x00000000060B0000-0x00000000060B1000-memory.dmp

                                                                                      Filesize

                                                                                      4KB

                                                                                    • memory/1580-30-0x00000000056D0000-0x00000000056D1000-memory.dmp

                                                                                      Filesize

                                                                                      4KB

                                                                                    • memory/1580-27-0x00000000052A0000-0x00000000052A1000-memory.dmp

                                                                                      Filesize

                                                                                      4KB

                                                                                    • memory/1580-26-0x0000000002010000-0x0000000002011000-memory.dmp

                                                                                      Filesize

                                                                                      4KB

                                                                                    • memory/1856-4-0x000000005FFF0000-0x0000000060000000-memory.dmp

                                                                                      Filesize

                                                                                      64KB

                                                                                    • memory/1856-106-0x000000005FFF0000-0x0000000060000000-memory.dmp

                                                                                      Filesize

                                                                                      64KB

                                                                                    • memory/1856-2-0x000000002F621000-0x000000002F624000-memory.dmp

                                                                                      Filesize

                                                                                      12KB

                                                                                    • memory/1856-3-0x00000000719D1000-0x00000000719D3000-memory.dmp

                                                                                      Filesize

                                                                                      8KB