Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
148s -
max time network
33s -
platform
windows7_x64 -
resource
win7v20201028 -
submitted
13/03/2021, 15:32
Static task
static1
Behavioral task
behavioral1
Sample
1.exe
Resource
win7v20201028
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
1.exe
Resource
win10v20201028
windows10_x64
0 signatures
0 seconds
General
-
Target
1.exe
-
Size
1.3MB
-
MD5
9f05994819a3d8c1a3769352c7c39d1d
-
SHA1
eb2457196e04dfdd54f70bd32ed02ae854d45bc0
-
SHA256
10bce0ff6597f347c3cca8363b7c81a8bff52d2ff81245cd1e66a6e11aeb25da
-
SHA512
32cac848f47a0096773435c6365fcbd6bdb02115aae2677aec5a86031b6def938033210fdcf0e12f735aa5ceb8cd4be5f7edb5cdc437bbca61f0d79196ec9be8
Score
10/10
Malware Config
Extracted
Path
C:\PROGRAM FILES\WINDOWS SIDEBAR\GADGETS\SLIDESHOW.GADGET\IMAGES\ON_DESKTOP\readme.txt
Family
dearcry
Ransom Note
Your file has been encrypted!
If you want to decrypt, please contact us.
[email protected] or [email protected]
And please send me the following hash!
2133c369fb115ea61eebd7b62768decf
Signatures
-
DearCry
DearCry is a ransomware first seen after the 2021 Microsoft Exchange hacks.
-
Modifies extensions of user files 4 IoCs
Ransomware generally changes the extension on encrypted files.
description ioc Process File created C:\Users\Admin\Pictures\EditStart.tif.CRYPT 1.exe File opened for modification C:\Users\Admin\Pictures\MeasureResolve.tiff 1.exe File created C:\Users\Admin\Pictures\MeasureResolve.tiff.CRYPT 1.exe File created C:\Users\Admin\Pictures\MountFind.tif.CRYPT 1.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Drops desktop.ini file(s) 64 IoCs
description ioc Process File opened for modification C:\Users\Public\Libraries\desktop.ini 1.exe File opened for modification C:\Users\Public\Pictures\Sample Pictures\desktop.ini 1.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\F6QQJELO\desktop.ini 1.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\desktop.ini 1.exe File opened for modification C:\Users\Admin\Saved Games\desktop.ini 1.exe File opened for modification C:\Users\Admin\Searches\desktop.ini 1.exe File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini 1.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\Stationery\Desktop.ini 1.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Feeds Cache\F6O5NPVK\desktop.ini 1.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\NXBH52U7\desktop.ini 1.exe File opened for modification C:\Users\Public\desktop.ini 1.exe File opened for modification C:\Users\Public\Music\desktop.ini 1.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\D08RECS3\desktop.ini 1.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\desktop.ini 1.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\M1AZJ0WQ\desktop.ini 1.exe File opened for modification C:\Users\Admin\Contacts\desktop.ini 1.exe File opened for modification C:\Users\Admin\Links\desktop.ini 1.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Feeds Cache\desktop.ini 1.exe File opened for modification C:\Users\Admin\Desktop\desktop.ini 1.exe File opened for modification C:\Users\Admin\Documents\desktop.ini 1.exe File opened for modification C:\Users\Admin\Favorites\desktop.ini 1.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\Stationery\Desktop.ini 1.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\desktop.ini 1.exe File opened for modification C:\Users\Public\Recorded TV\Sample Media\desktop.ini 1.exe File opened for modification C:\Users\Public\Videos\desktop.ini 1.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Administrative Tools\desktop.ini 1.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini 1.exe File opened for modification C:\Users\Admin\Videos\desktop.ini 1.exe File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini 1.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Feeds Cache\8DDKLDOL\desktop.ini 1.exe File opened for modification C:\Users\Public\Music\Sample Music\desktop.ini 1.exe File opened for modification C:\Users\Public\Pictures\desktop.ini 1.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\Desktop.ini 1.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\Tablet PC\Desktop.ini 1.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\History\History.IE5\desktop.ini 1.exe File opened for modification C:\Users\Admin\Music\desktop.ini 1.exe File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Windows\SendTo\Desktop.ini 1.exe File opened for modification C:\$Recycle.Bin\S-1-5-21-3825035466-2522850611-591511364-1000\desktop.ini 1.exe File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\System Tools\Desktop.ini 1.exe File opened for modification C:\Users\Public\Recorded TV\desktop.ini 1.exe File opened for modification C:\Program Files\desktop.ini 1.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\DataServices\DESKTOP.INI 1.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\System Tools\Desktop.ini 1.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini 1.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\History\desktop.ini 1.exe File opened for modification C:\Users\Public\Documents\desktop.ini 1.exe File opened for modification C:\Users\Public\Downloads\desktop.ini 1.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\desktop.ini 1.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows Mail\Stationery\Desktop.ini 1.exe File opened for modification C:\Users\Admin\Favorites\Links for United States\desktop.ini 1.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\Burn\Burn\desktop.ini 1.exe File opened for modification C:\ProgramData\Microsoft\Windows\Ringtones\desktop.ini 1.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\desktop.ini 1.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Feeds Cache\AT22T7OH\desktop.ini 1.exe File opened for modification C:\Users\Admin\Downloads\desktop.ini 1.exe File opened for modification C:\Users\Public\Videos\Sample Videos\desktop.ini 1.exe File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\Accessibility\Desktop.ini 1.exe File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\Desktop.ini 1.exe File opened for modification C:\Users\Public\Desktop\desktop.ini 1.exe File opened for modification C:\Program Files (x86)\desktop.ini 1.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\Accessibility\Desktop.ini 1.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Feeds Cache\RKGIF8TT\desktop.ini 1.exe File opened for modification C:\Users\Admin\Favorites\Links\desktop.ini 1.exe File opened for modification C:\Users\Admin\Pictures\desktop.ini 1.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\schemagen.exe 1.exe File created C:\Program Files\VideoLAN\VLC\plugins\access\libaccess_mms_plugin.dll.CRYPT 1.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsStyles\BabyBlue.css 1.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\IpsPlugin.dll 1.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\LayeredTitles\layers.png 1.exe File created C:\Program Files\Java\jdk1.7.0_80\include\win32\bridge\AccessBridgeCalls.h.CRYPT 1.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-netbeans-api-annotations-common.xml.CRYPT 1.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\IPIRMV.XML 1.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-netbeans-swing-plaf.xml 1.exe File opened for modification C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\ReachFramework.dll 1.exe File created C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0341634.JPG.CRYPT 1.exe File created C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0387578.JPG.CRYPT 1.exe File created C:\Program Files (x86)\Microsoft Office\Office14\CDLMSO.DLL.CRYPT 1.exe File opened for modification C:\Program Files (x86)\Windows Sidebar\Gadgets\Weather.Gadget\images\docked_black_moon-first-quarter.png 1.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\codec\libaom_plugin.dll 1.exe File opened for modification C:\Program Files (x86)\Windows Sidebar\Gadgets\SlideShow.Gadget\icon.png 1.exe File opened for modification C:\Program Files\7-Zip\Lang\ug.txt 1.exe File created C:\Program Files\Java\jre7\bin\keytool.exe.CRYPT 1.exe File opened for modification C:\Program Files\Java\jre7\bin\splashscreen.dll 1.exe File created C:\Program Files\VideoLAN\VLC\plugins\video_output\libvmem_plugin.dll.CRYPT 1.exe File created C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\AddToViewArrow.jpg.CRYPT 1.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\bin\unpack.dll.CRYPT 1.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\config\Modules\com-sun-tools-visualvm-host.xml.CRYPT 1.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.35.452\goopdateres_tr.dll 1.exe File created C:\Program Files (x86)\Microsoft Office\Office14\OutlookAutoDiscover\YAHOO.CO.IN.XML.CRYPT 1.exe File opened for modification C:\Program Files (x86)\Windows Sidebar\Gadgets\SlideShow.Gadget\en-US\slideShow.html 1.exe File created C:\Program Files\Java\jre7\bin\ssvagent.exe.CRYPT 1.exe File created C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe.CRYPT 1.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\ONPPTAddin.dll 1.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\PAGESIZE\PGMN022.XML 1.exe File created C:\Program Files (x86)\Microsoft Visual Studio 8\Common7\IDE\VSTA\ItemTemplates\VisualBasic\1033\AppConfigurationInternal.zip.CRYPT 1.exe File opened for modification C:\Program Files (x86)\Microsoft Visual Studio 8\Common7\IDE\VSTA\ItemTemplates\VisualBasic\1033\Explorer.zip 1.exe File opened for modification C:\Program Files (x86)\Windows Media Player\Media Renderer\DMR_48.png 1.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Document Themes 14\Theme Fonts\Composite.xml 1.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\CommonData\MessageBoxIconImagesMask.bmp 1.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\bin\decora-sse.dll.CRYPT 1.exe File opened for modification C:\Program Files\VideoLAN\VLC\lua\http\dialogs\equalizer_window.html 1.exe File created C:\Program Files (x86)\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\Oasis.css.CRYPT 1.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveDocumentReview\InactiveTabImage.jpg 1.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\PUBWIZ\DGWEBAD.XML 1.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\com.jrockit.mc.feature.core_5.5.0.165303\feature.xml 1.exe File created C:\Program Files\VideoLAN\VLC\plugins\codec\libspudec_plugin.dll.CRYPT 1.exe File created C:\Program Files (x86)\Microsoft Office\Document Themes 14\Theme Fonts\Office 2.xml.CRYPT 1.exe File created C:\Program Files (x86)\Microsoft Office\Office14\1033\DataServices\DESKTOP.INI.CRYPT 1.exe File created C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms\FieldTypePreview\DATETIME.JPG.CRYPT 1.exe File opened for modification C:\Program Files (x86)\Windows Media Player\Media Renderer\DMR_120.png 1.exe File opened for modification C:\Program Files (x86)\Windows Media Player\wmpenc.exe 1.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\packetizer\libpacketizer_av1_plugin.dll 1.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\OUTLFLTR.DLL 1.exe File opened for modification C:\Program Files\Windows Mail\wab.exe 1.exe File opened for modification C:\Program Files\Windows Media Player\WMPDMCCore.dll 1.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\RADIAL\THMBNAIL.PNG 1.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Document Themes 14\Theme Colors\Flow.xml 1.exe File created C:\Program Files (x86)\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\LightSpirit.css.CRYPT 1.exe File created C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FORM.JS.CRYPT 1.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\SUBMIT.JS 1.exe File opened for modification C:\Program Files\Common Files\SpeechEngines\Microsoft\TTS20\en-US\MSTTSFrontendENU.dll 1.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\Office64.WW\Office64WW.XML 1.exe File created C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0099168.JPG.CRYPT 1.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\demux\libdirectory_demux_plugin.dll 1.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\Circle_SelectionSubpictureB.png 1.exe File created C:\Program Files\Java\jre7\lib\jvm.hprof.txt.CRYPT 1.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\docked-loading.png 1.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\config\Modules\com-sun-tools-visualvm-coredump.xml.CRYPT 1.exe -
Program crash 1 IoCs
pid pid_target Process procid_target 1380 1272 WerFault.exe 7 -
Suspicious behavior: EnumeratesProcesses 5 IoCs
pid Process 1380 WerFault.exe 1380 WerFault.exe 1380 WerFault.exe 1380 WerFault.exe 1380 WerFault.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 1380 WerFault.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 1380 WerFault.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\1.exe"C:\Users\Admin\AppData\Local\Temp\1.exe"1⤵
- Modifies extensions of user files
- Drops desktop.ini file(s)
- Drops file in Program Files directory
PID:780
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 1272 -s 14801⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
PID:1380