Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
128s -
max time network
9s -
platform
windows7_x64 -
resource
win7v20201028 -
submitted
29/01/2021, 08:59
Static task
static1
Behavioral task
behavioral1
Sample
skynet.exe
Resource
win7v20201028
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
skynet.exe
Resource
win10v20201028
windows10_x64
0 signatures
0 seconds
General
-
Target
skynet.exe
-
Size
678KB
-
MD5
115b22d9cff82d75c28e43f83f55c663
-
SHA1
8c0c54194a88551feec78c5a8416411ed17c4fce
-
SHA256
fbf6c8f0857d888385f6bc0d46523ebcc1634e06d0e96411fc43a8ae4213d1f3
-
SHA512
9f1a50d735fb30ca0464ad8746929c416d5fee3ee14dfb2fab43abb3e7000e0bf478dc337b8e4fe6c2f8ec6fc2ccc17b73c9429df6799bc91faa04710a0051de
Malware Config
Signatures
-
MedusaLocker
Ransomware with several variants first seen in September 2019.
-
MedusaLocker Payload 2 IoCs
resource yara_rule behavioral1/files/0x00040000000130d6-9.dat family_medusalocker behavioral1/files/0x00040000000130d6-11.dat family_medusalocker -
Deletes shadow copies 2 TTPs
Ransomware often targets backup files to inhibit system recovery.
-
Executes dropped EXE 1 IoCs
pid Process 1612 svhost.exe -
Modifies extensions of user files 10 IoCs
Ransomware generally changes the extension on encrypted files.
description ioc Process File renamed C:\Users\Admin\Pictures\SetConvertFrom.raw => C:\Users\Admin\Pictures\SetConvertFrom.raw.skynet skynet.exe File renamed C:\Users\Admin\Pictures\WaitFind.tif => C:\Users\Admin\Pictures\WaitFind.tif.skynet skynet.exe File renamed C:\Users\Admin\Pictures\AddUnlock.tif => C:\Users\Admin\Pictures\AddUnlock.tif.skynet skynet.exe File renamed C:\Users\Admin\Pictures\BackupInvoke.tiff => C:\Users\Admin\Pictures\BackupInvoke.tiff.skynet skynet.exe File renamed C:\Users\Admin\Pictures\CompressStop.tif => C:\Users\Admin\Pictures\CompressStop.tif.skynet skynet.exe File opened for modification C:\Users\Admin\Pictures\RemoveStop.tiff skynet.exe File renamed C:\Users\Admin\Pictures\RemoveStop.tiff => C:\Users\Admin\Pictures\RemoveStop.tiff.skynet skynet.exe File opened for modification C:\Users\Admin\Pictures\BackupInvoke.tiff skynet.exe File renamed C:\Users\Admin\Pictures\PushMount.crw => C:\Users\Admin\Pictures\PushMount.crw.skynet skynet.exe File renamed C:\Users\Admin\Pictures\UninstallReceive.raw => C:\Users\Admin\Pictures\UninstallReceive.raw.skynet skynet.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" skynet.exe -
Drops desktop.ini file(s) 1 IoCs
description ioc Process File opened for modification \??\Z:\$RECYCLE.BIN\S-1-5-21-3825035466-2522850611-591511364-1000\desktop.ini skynet.exe -
Enumerates connected drives 3 TTPs 24 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\H: skynet.exe File opened (read-only) \??\I: skynet.exe File opened (read-only) \??\J: skynet.exe File opened (read-only) \??\P: skynet.exe File opened (read-only) \??\Z: skynet.exe File opened (read-only) \??\M: skynet.exe File opened (read-only) \??\U: skynet.exe File opened (read-only) \??\W: skynet.exe File opened (read-only) \??\X: skynet.exe File opened (read-only) \??\Y: skynet.exe File opened (read-only) \??\L: skynet.exe File opened (read-only) \??\N: skynet.exe File opened (read-only) \??\O: skynet.exe File opened (read-only) \??\Q: skynet.exe File opened (read-only) \??\S: skynet.exe File opened (read-only) \??\K: skynet.exe File opened (read-only) \??\R: skynet.exe File opened (read-only) \??\T: skynet.exe File opened (read-only) \??\A: skynet.exe File opened (read-only) \??\B: skynet.exe File opened (read-only) \??\E: skynet.exe File opened (read-only) \??\F: skynet.exe File opened (read-only) \??\G: skynet.exe File opened (read-only) \??\V: skynet.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Interacts with shadow copies 2 TTPs 3 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
pid Process 916 vssadmin.exe 1664 vssadmin.exe 1900 vssadmin.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2028 skynet.exe 2028 skynet.exe 2028 skynet.exe 2028 skynet.exe 2028 skynet.exe 2028 skynet.exe 2028 skynet.exe 2028 skynet.exe 2028 skynet.exe 2028 skynet.exe 2028 skynet.exe 2028 skynet.exe 2028 skynet.exe 2028 skynet.exe 2028 skynet.exe 2028 skynet.exe 2028 skynet.exe 2028 skynet.exe 2028 skynet.exe 2028 skynet.exe 2028 skynet.exe 2028 skynet.exe 2028 skynet.exe 2028 skynet.exe 2028 skynet.exe 2028 skynet.exe 2028 skynet.exe 2028 skynet.exe 2028 skynet.exe 2028 skynet.exe 2028 skynet.exe 2028 skynet.exe 2028 skynet.exe 2028 skynet.exe 2028 skynet.exe 2028 skynet.exe 2028 skynet.exe 2028 skynet.exe 2028 skynet.exe 2028 skynet.exe 2028 skynet.exe 2028 skynet.exe 2028 skynet.exe 2028 skynet.exe 2028 skynet.exe 2028 skynet.exe 2028 skynet.exe 2028 skynet.exe 2028 skynet.exe 2028 skynet.exe 2028 skynet.exe 2028 skynet.exe 2028 skynet.exe 2028 skynet.exe 2028 skynet.exe 2028 skynet.exe 2028 skynet.exe 2028 skynet.exe 2028 skynet.exe 2028 skynet.exe 2028 skynet.exe 2028 skynet.exe 2028 skynet.exe 2028 skynet.exe -
Suspicious use of AdjustPrivilegeToken 63 IoCs
description pid Process Token: SeBackupPrivilege 1964 vssvc.exe Token: SeRestorePrivilege 1964 vssvc.exe Token: SeAuditPrivilege 1964 vssvc.exe Token: SeIncreaseQuotaPrivilege 1788 wmic.exe Token: SeSecurityPrivilege 1788 wmic.exe Token: SeTakeOwnershipPrivilege 1788 wmic.exe Token: SeLoadDriverPrivilege 1788 wmic.exe Token: SeSystemProfilePrivilege 1788 wmic.exe Token: SeSystemtimePrivilege 1788 wmic.exe Token: SeProfSingleProcessPrivilege 1788 wmic.exe Token: SeIncBasePriorityPrivilege 1788 wmic.exe Token: SeCreatePagefilePrivilege 1788 wmic.exe Token: SeBackupPrivilege 1788 wmic.exe Token: SeRestorePrivilege 1788 wmic.exe Token: SeShutdownPrivilege 1788 wmic.exe Token: SeDebugPrivilege 1788 wmic.exe Token: SeSystemEnvironmentPrivilege 1788 wmic.exe Token: SeRemoteShutdownPrivilege 1788 wmic.exe Token: SeUndockPrivilege 1788 wmic.exe Token: SeManageVolumePrivilege 1788 wmic.exe Token: 33 1788 wmic.exe Token: 34 1788 wmic.exe Token: 35 1788 wmic.exe Token: SeIncreaseQuotaPrivilege 112 wmic.exe Token: SeSecurityPrivilege 112 wmic.exe Token: SeTakeOwnershipPrivilege 112 wmic.exe Token: SeLoadDriverPrivilege 112 wmic.exe Token: SeSystemProfilePrivilege 112 wmic.exe Token: SeSystemtimePrivilege 112 wmic.exe Token: SeProfSingleProcessPrivilege 112 wmic.exe Token: SeIncBasePriorityPrivilege 112 wmic.exe Token: SeCreatePagefilePrivilege 112 wmic.exe Token: SeBackupPrivilege 112 wmic.exe Token: SeRestorePrivilege 112 wmic.exe Token: SeShutdownPrivilege 112 wmic.exe Token: SeDebugPrivilege 112 wmic.exe Token: SeSystemEnvironmentPrivilege 112 wmic.exe Token: SeRemoteShutdownPrivilege 112 wmic.exe Token: SeUndockPrivilege 112 wmic.exe Token: SeManageVolumePrivilege 112 wmic.exe Token: 33 112 wmic.exe Token: 34 112 wmic.exe Token: 35 112 wmic.exe Token: SeIncreaseQuotaPrivilege 1032 wmic.exe Token: SeSecurityPrivilege 1032 wmic.exe Token: SeTakeOwnershipPrivilege 1032 wmic.exe Token: SeLoadDriverPrivilege 1032 wmic.exe Token: SeSystemProfilePrivilege 1032 wmic.exe Token: SeSystemtimePrivilege 1032 wmic.exe Token: SeProfSingleProcessPrivilege 1032 wmic.exe Token: SeIncBasePriorityPrivilege 1032 wmic.exe Token: SeCreatePagefilePrivilege 1032 wmic.exe Token: SeBackupPrivilege 1032 wmic.exe Token: SeRestorePrivilege 1032 wmic.exe Token: SeShutdownPrivilege 1032 wmic.exe Token: SeDebugPrivilege 1032 wmic.exe Token: SeSystemEnvironmentPrivilege 1032 wmic.exe Token: SeRemoteShutdownPrivilege 1032 wmic.exe Token: SeUndockPrivilege 1032 wmic.exe Token: SeManageVolumePrivilege 1032 wmic.exe Token: 33 1032 wmic.exe Token: 34 1032 wmic.exe Token: 35 1032 wmic.exe -
Suspicious use of WriteProcessMemory 28 IoCs
description pid Process procid_target PID 2028 wrote to memory of 916 2028 skynet.exe 26 PID 2028 wrote to memory of 916 2028 skynet.exe 26 PID 2028 wrote to memory of 916 2028 skynet.exe 26 PID 2028 wrote to memory of 916 2028 skynet.exe 26 PID 2028 wrote to memory of 1788 2028 skynet.exe 29 PID 2028 wrote to memory of 1788 2028 skynet.exe 29 PID 2028 wrote to memory of 1788 2028 skynet.exe 29 PID 2028 wrote to memory of 1788 2028 skynet.exe 29 PID 2028 wrote to memory of 1664 2028 skynet.exe 33 PID 2028 wrote to memory of 1664 2028 skynet.exe 33 PID 2028 wrote to memory of 1664 2028 skynet.exe 33 PID 2028 wrote to memory of 1664 2028 skynet.exe 33 PID 2028 wrote to memory of 112 2028 skynet.exe 36 PID 2028 wrote to memory of 112 2028 skynet.exe 36 PID 2028 wrote to memory of 112 2028 skynet.exe 36 PID 2028 wrote to memory of 112 2028 skynet.exe 36 PID 2028 wrote to memory of 1900 2028 skynet.exe 38 PID 2028 wrote to memory of 1900 2028 skynet.exe 38 PID 2028 wrote to memory of 1900 2028 skynet.exe 38 PID 2028 wrote to memory of 1900 2028 skynet.exe 38 PID 2028 wrote to memory of 1032 2028 skynet.exe 40 PID 2028 wrote to memory of 1032 2028 skynet.exe 40 PID 2028 wrote to memory of 1032 2028 skynet.exe 40 PID 2028 wrote to memory of 1032 2028 skynet.exe 40 PID 1892 wrote to memory of 1612 1892 taskeng.exe 45 PID 1892 wrote to memory of 1612 1892 taskeng.exe 45 PID 1892 wrote to memory of 1612 1892 taskeng.exe 45 PID 1892 wrote to memory of 1612 1892 taskeng.exe 45 -
System policy modification 1 TTPs 3 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" skynet.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" skynet.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLinkedConnections = "1" skynet.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\skynet.exe"C:\Users\Admin\AppData\Local\Temp\skynet.exe"1⤵
- Modifies extensions of user files
- Checks whether UAC is enabled
- Drops desktop.ini file(s)
- Enumerates connected drives
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
- System policy modification
PID:2028 -
C:\Windows\SysWOW64\vssadmin.exevssadmin.exe Delete Shadows /All /Quiet2⤵
- Interacts with shadow copies
PID:916
-
-
C:\Windows\SysWOW64\Wbem\wmic.exewmic.exe SHADOWCOPY /nointeractive2⤵
- Suspicious use of AdjustPrivilegeToken
PID:1788
-
-
C:\Windows\SysWOW64\vssadmin.exevssadmin.exe Delete Shadows /All /Quiet2⤵
- Interacts with shadow copies
PID:1664
-
-
C:\Windows\SysWOW64\Wbem\wmic.exewmic.exe SHADOWCOPY /nointeractive2⤵
- Suspicious use of AdjustPrivilegeToken
PID:112
-
-
C:\Windows\SysWOW64\vssadmin.exevssadmin.exe Delete Shadows /All /Quiet2⤵
- Interacts with shadow copies
PID:1900
-
-
C:\Windows\SysWOW64\Wbem\wmic.exewmic.exe SHADOWCOPY /nointeractive2⤵
- Suspicious use of AdjustPrivilegeToken
PID:1032
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1964
-
C:\Windows\system32\taskeng.exetaskeng.exe {026D5D0B-33E3-4B9F-80AD-404817BBF32A} S-1-5-21-3825035466-2522850611-591511364-1000:EIDQHRRL\Admin:Interactive:[1]1⤵
- Suspicious use of WriteProcessMemory
PID:1892 -
C:\Users\Admin\AppData\Roaming\svhost.exeC:\Users\Admin\AppData\Roaming\svhost.exe2⤵
- Executes dropped EXE
PID:1612
-