Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
127s -
max time network
122s -
platform
windows10_x64 -
resource
win10v20201028 -
submitted
29/01/2021, 08:59
Static task
static1
Behavioral task
behavioral1
Sample
skynet.exe
Resource
win7v20201028
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
skynet.exe
Resource
win10v20201028
windows10_x64
0 signatures
0 seconds
General
-
Target
skynet.exe
-
Size
678KB
-
MD5
115b22d9cff82d75c28e43f83f55c663
-
SHA1
8c0c54194a88551feec78c5a8416411ed17c4fce
-
SHA256
fbf6c8f0857d888385f6bc0d46523ebcc1634e06d0e96411fc43a8ae4213d1f3
-
SHA512
9f1a50d735fb30ca0464ad8746929c416d5fee3ee14dfb2fab43abb3e7000e0bf478dc337b8e4fe6c2f8ec6fc2ccc17b73c9429df6799bc91faa04710a0051de
Malware Config
Signatures
-
MedusaLocker
Ransomware with several variants first seen in September 2019.
-
Deletes shadow copies 2 TTPs
Ransomware often targets backup files to inhibit system recovery.
-
Modifies extensions of user files 7 IoCs
Ransomware generally changes the extension on encrypted files.
description ioc Process File renamed C:\Users\Admin\Pictures\ProtectRepair.png => C:\Users\Admin\Pictures\ProtectRepair.png.skynet skynet.exe File renamed C:\Users\Admin\Pictures\ResetPop.crw => C:\Users\Admin\Pictures\ResetPop.crw.skynet skynet.exe File renamed C:\Users\Admin\Pictures\AssertRename.raw => C:\Users\Admin\Pictures\AssertRename.raw.skynet skynet.exe File opened for modification C:\Users\Admin\Pictures\AssertUndo.tiff skynet.exe File renamed C:\Users\Admin\Pictures\AssertUndo.tiff => C:\Users\Admin\Pictures\AssertUndo.tiff.skynet skynet.exe File opened for modification C:\Users\Admin\Pictures\CheckpointImport.tiff skynet.exe File renamed C:\Users\Admin\Pictures\CheckpointImport.tiff => C:\Users\Admin\Pictures\CheckpointImport.tiff.skynet skynet.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" skynet.exe -
Drops desktop.ini file(s) 1 IoCs
description ioc Process File opened for modification \??\Z:\$RECYCLE.BIN\S-1-5-21-3341490333-719741536-2920803124-1000\desktop.ini skynet.exe -
Enumerates connected drives 3 TTPs 24 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\F: skynet.exe File opened (read-only) \??\M: skynet.exe File opened (read-only) \??\Z: skynet.exe File opened (read-only) \??\B: skynet.exe File opened (read-only) \??\J: skynet.exe File opened (read-only) \??\K: skynet.exe File opened (read-only) \??\N: skynet.exe File opened (read-only) \??\O: skynet.exe File opened (read-only) \??\Q: skynet.exe File opened (read-only) \??\A: skynet.exe File opened (read-only) \??\H: skynet.exe File opened (read-only) \??\I: skynet.exe File opened (read-only) \??\L: skynet.exe File opened (read-only) \??\S: skynet.exe File opened (read-only) \??\T: skynet.exe File opened (read-only) \??\U: skynet.exe File opened (read-only) \??\V: skynet.exe File opened (read-only) \??\G: skynet.exe File opened (read-only) \??\P: skynet.exe File opened (read-only) \??\R: skynet.exe File opened (read-only) \??\W: skynet.exe File opened (read-only) \??\X: skynet.exe File opened (read-only) \??\Y: skynet.exe File opened (read-only) \??\E: skynet.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Interacts with shadow copies 2 TTPs 3 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
pid Process 2620 vssadmin.exe 4068 vssadmin.exe 2500 vssadmin.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 3980 skynet.exe 3980 skynet.exe 3980 skynet.exe 3980 skynet.exe 3980 skynet.exe 3980 skynet.exe 3980 skynet.exe 3980 skynet.exe 3980 skynet.exe 3980 skynet.exe 3980 skynet.exe 3980 skynet.exe 3980 skynet.exe 3980 skynet.exe 3980 skynet.exe 3980 skynet.exe 3980 skynet.exe 3980 skynet.exe 3980 skynet.exe 3980 skynet.exe 3980 skynet.exe 3980 skynet.exe 3980 skynet.exe 3980 skynet.exe 3980 skynet.exe 3980 skynet.exe 3980 skynet.exe 3980 skynet.exe 3980 skynet.exe 3980 skynet.exe 3980 skynet.exe 3980 skynet.exe 3980 skynet.exe 3980 skynet.exe 3980 skynet.exe 3980 skynet.exe 3980 skynet.exe 3980 skynet.exe 3980 skynet.exe 3980 skynet.exe 3980 skynet.exe 3980 skynet.exe 3980 skynet.exe 3980 skynet.exe 3980 skynet.exe 3980 skynet.exe 3980 skynet.exe 3980 skynet.exe 3980 skynet.exe 3980 skynet.exe 3980 skynet.exe 3980 skynet.exe 3980 skynet.exe 3980 skynet.exe 3980 skynet.exe 3980 skynet.exe 3980 skynet.exe 3980 skynet.exe 3980 skynet.exe 3980 skynet.exe 3980 skynet.exe 3980 skynet.exe 3980 skynet.exe 3980 skynet.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeBackupPrivilege 204 vssvc.exe Token: SeRestorePrivilege 204 vssvc.exe Token: SeAuditPrivilege 204 vssvc.exe Token: SeIncreaseQuotaPrivilege 2760 wmic.exe Token: SeSecurityPrivilege 2760 wmic.exe Token: SeTakeOwnershipPrivilege 2760 wmic.exe Token: SeLoadDriverPrivilege 2760 wmic.exe Token: SeSystemProfilePrivilege 2760 wmic.exe Token: SeSystemtimePrivilege 2760 wmic.exe Token: SeProfSingleProcessPrivilege 2760 wmic.exe Token: SeIncBasePriorityPrivilege 2760 wmic.exe Token: SeCreatePagefilePrivilege 2760 wmic.exe Token: SeBackupPrivilege 2760 wmic.exe Token: SeRestorePrivilege 2760 wmic.exe Token: SeShutdownPrivilege 2760 wmic.exe Token: SeDebugPrivilege 2760 wmic.exe Token: SeSystemEnvironmentPrivilege 2760 wmic.exe Token: SeRemoteShutdownPrivilege 2760 wmic.exe Token: SeUndockPrivilege 2760 wmic.exe Token: SeManageVolumePrivilege 2760 wmic.exe Token: 33 2760 wmic.exe Token: 34 2760 wmic.exe Token: 35 2760 wmic.exe Token: 36 2760 wmic.exe Token: SeIncreaseQuotaPrivilege 3460 wmic.exe Token: SeSecurityPrivilege 3460 wmic.exe Token: SeTakeOwnershipPrivilege 3460 wmic.exe Token: SeLoadDriverPrivilege 3460 wmic.exe Token: SeSystemProfilePrivilege 3460 wmic.exe Token: SeSystemtimePrivilege 3460 wmic.exe Token: SeProfSingleProcessPrivilege 3460 wmic.exe Token: SeIncBasePriorityPrivilege 3460 wmic.exe Token: SeCreatePagefilePrivilege 3460 wmic.exe Token: SeBackupPrivilege 3460 wmic.exe Token: SeRestorePrivilege 3460 wmic.exe Token: SeShutdownPrivilege 3460 wmic.exe Token: SeDebugPrivilege 3460 wmic.exe Token: SeSystemEnvironmentPrivilege 3460 wmic.exe Token: SeRemoteShutdownPrivilege 3460 wmic.exe Token: SeUndockPrivilege 3460 wmic.exe Token: SeManageVolumePrivilege 3460 wmic.exe Token: 33 3460 wmic.exe Token: 34 3460 wmic.exe Token: 35 3460 wmic.exe Token: 36 3460 wmic.exe Token: SeIncreaseQuotaPrivilege 3492 wmic.exe Token: SeSecurityPrivilege 3492 wmic.exe Token: SeTakeOwnershipPrivilege 3492 wmic.exe Token: SeLoadDriverPrivilege 3492 wmic.exe Token: SeSystemProfilePrivilege 3492 wmic.exe Token: SeSystemtimePrivilege 3492 wmic.exe Token: SeProfSingleProcessPrivilege 3492 wmic.exe Token: SeIncBasePriorityPrivilege 3492 wmic.exe Token: SeCreatePagefilePrivilege 3492 wmic.exe Token: SeBackupPrivilege 3492 wmic.exe Token: SeRestorePrivilege 3492 wmic.exe Token: SeShutdownPrivilege 3492 wmic.exe Token: SeDebugPrivilege 3492 wmic.exe Token: SeSystemEnvironmentPrivilege 3492 wmic.exe Token: SeRemoteShutdownPrivilege 3492 wmic.exe Token: SeUndockPrivilege 3492 wmic.exe Token: SeManageVolumePrivilege 3492 wmic.exe Token: 33 3492 wmic.exe Token: 34 3492 wmic.exe -
Suspicious use of WriteProcessMemory 18 IoCs
description pid Process procid_target PID 3980 wrote to memory of 2620 3980 skynet.exe 76 PID 3980 wrote to memory of 2620 3980 skynet.exe 76 PID 3980 wrote to memory of 2620 3980 skynet.exe 76 PID 3980 wrote to memory of 2760 3980 skynet.exe 80 PID 3980 wrote to memory of 2760 3980 skynet.exe 80 PID 3980 wrote to memory of 2760 3980 skynet.exe 80 PID 3980 wrote to memory of 4068 3980 skynet.exe 82 PID 3980 wrote to memory of 4068 3980 skynet.exe 82 PID 3980 wrote to memory of 4068 3980 skynet.exe 82 PID 3980 wrote to memory of 3460 3980 skynet.exe 84 PID 3980 wrote to memory of 3460 3980 skynet.exe 84 PID 3980 wrote to memory of 3460 3980 skynet.exe 84 PID 3980 wrote to memory of 2500 3980 skynet.exe 86 PID 3980 wrote to memory of 2500 3980 skynet.exe 86 PID 3980 wrote to memory of 2500 3980 skynet.exe 86 PID 3980 wrote to memory of 3492 3980 skynet.exe 88 PID 3980 wrote to memory of 3492 3980 skynet.exe 88 PID 3980 wrote to memory of 3492 3980 skynet.exe 88 -
System policy modification 1 TTPs 3 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" skynet.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" skynet.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLinkedConnections = "1" skynet.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\skynet.exe"C:\Users\Admin\AppData\Local\Temp\skynet.exe"1⤵
- Modifies extensions of user files
- Checks whether UAC is enabled
- Drops desktop.ini file(s)
- Enumerates connected drives
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
- System policy modification
PID:3980 -
C:\Windows\SysWOW64\vssadmin.exevssadmin.exe Delete Shadows /All /Quiet2⤵
- Interacts with shadow copies
PID:2620
-
-
C:\Windows\SysWOW64\Wbem\wmic.exewmic.exe SHADOWCOPY /nointeractive2⤵
- Suspicious use of AdjustPrivilegeToken
PID:2760
-
-
C:\Windows\SysWOW64\vssadmin.exevssadmin.exe Delete Shadows /All /Quiet2⤵
- Interacts with shadow copies
PID:4068
-
-
C:\Windows\SysWOW64\Wbem\wmic.exewmic.exe SHADOWCOPY /nointeractive2⤵
- Suspicious use of AdjustPrivilegeToken
PID:3460
-
-
C:\Windows\SysWOW64\vssadmin.exevssadmin.exe Delete Shadows /All /Quiet2⤵
- Interacts with shadow copies
PID:2500
-
-
C:\Windows\SysWOW64\Wbem\wmic.exewmic.exe SHADOWCOPY /nointeractive2⤵
- Suspicious use of AdjustPrivilegeToken
PID:3492
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
PID:204