Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
148s -
max time network
64s -
platform
windows7_x64 -
resource
win7v20210410 -
submitted
26/07/2021, 12:58
Static task
static1
Behavioral task
behavioral1
Sample
b2b3244147fe99552144847d8561eda14c6751e9afda58fc3039c5d11a4b44af.sample.exe
Resource
win7v20210410
Behavioral task
behavioral2
Sample
b2b3244147fe99552144847d8561eda14c6751e9afda58fc3039c5d11a4b44af.sample.exe
Resource
win10v20210410
General
-
Target
b2b3244147fe99552144847d8561eda14c6751e9afda58fc3039c5d11a4b44af.sample.exe
-
Size
216KB
-
MD5
832814b3212fd82fbced6afd72b4e8dc
-
SHA1
be3b021f3bd5b86a3d126e1b5d7bde4ccdad6ae5
-
SHA256
b2b3244147fe99552144847d8561eda14c6751e9afda58fc3039c5d11a4b44af
-
SHA512
19f8db46f1095516b3300f933c9b4ea7ecc9c671ecb22eae0a6806e18daf7ad19687b610c52822e27144a6b05270e1e333ff74ea0a58175a9b17c85a016b2ff8
Malware Config
Extracted
C:\ProgramData\cryptinfo.txt
1DtyvLb1pDzXVoaVnJLAFzBJN6b4gcJSdR
Signatures
-
DMA Locker
Ransomware family with some advanced features, like encryption of unmapped network shares.
-
Adds Run key to start application 2 TTPs 4 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Windows Firewall = "C:\\ProgramData\\svchosd.exe" b2b3244147fe99552144847d8561eda14c6751e9afda58fc3039c5d11a4b44af.sample.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Windows Update = "notepad C:\\ProgramData\\cryptinfo.txt" b2b3244147fe99552144847d8561eda14c6751e9afda58fc3039c5d11a4b44af.sample.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Windows Firewall = "C:\\ProgramData\\svchosd.exe" svchosd.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Windows Update = "notepad C:\\ProgramData\\cryptinfo.txt" svchosd.exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
pid Process 1856 b2b3244147fe99552144847d8561eda14c6751e9afda58fc3039c5d11a4b44af.sample.exe 1976 svchosd.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\curtains.png svchosd.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\META-INF\ECLIPSE_.SF svchosd.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\America\Danmarkshavn svchosd.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Stacking\NavigationLeft_ButtonGraphic.png svchosd.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.flightrecorder.ui.zh_CN_5.5.0.165303.jar svchosd.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-swing-outline_ja.jar svchosd.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\com-sun-tools-visualvm-sampler.jar svchosd.exe File created C:\Program Files\Windows Sidebar\Gadgets\CPU.Gadget\images\glass_lrg.png svchosd.exe File opened for modification C:\Program Files\Java\jre7\README.txt svchosd.exe File created C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\Images\setting_back.png svchosd.exe File created C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\Images\settings_right_hover.png svchosd.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\Web Server Extensions\14\BIN\1033\FPEXT.MSG svchosd.exe File created C:\Program Files\Common Files\Services\verisign.bmp svchosd.exe File opened for modification C:\Program Files\Google\Chrome\Application\89.0.4389.114\Locales\am.pak svchosd.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-openide-actions.xml svchosd.exe File opened for modification C:\Program Files\VideoLAN\VLC\lua\playlist\anevia_xml.luac svchosd.exe File created C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\images\settings_corner_top_left.png svchosd.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\oskmenu\oskmenubase.xml svchosd.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Memories\button-overlay.png svchosd.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Push\NavigationRight_SelectionSubpicture.png svchosd.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Europe\Bucharest svchosd.exe File created C:\Program Files (x86)\Adobe\Reader 9.0\Resource\ENUtxt.pdf svchosd.exe File created C:\Program Files\Windows Sidebar\Gadgets\RSSFeeds.Gadget\images\16-on-black.gif svchosd.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Travel\button-bullet.png svchosd.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-netbeans-modules-sendopts.xml svchosd.exe File opened for modification C:\Program Files\Microsoft Office\Office14\ONLNTCOMLIB.DLL svchosd.exe File opened for modification C:\Program Files\VideoLAN\VLC\lua\playlist\liveleak.luac svchosd.exe File created C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\Images\timer_down.png svchosd.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\include\win32\bridge\AccessBridgePackages.h svchosd.exe File opened for modification C:\Program Files\Mozilla Firefox\crashreporter.ini svchosd.exe File created C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\Images\timer_up.png svchosd.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\css\e4_default_win7.css svchosd.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Pacific\Fiji svchosd.exe File created C:\Program Files\Windows Media Player\Network Sharing\wmpnss_bw120.jpg svchosd.exe File created C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\LanguageNames2\DisplayLanguageNames.en_US_POSIX.txt svchosd.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\1033\OARPMANR.DLL svchosd.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Sports\NavigationButtonSubpicture.png svchosd.exe File opened for modification C:\Program Files\Google\Chrome\Application\89.0.4389.114\Extensions\external_extensions.json svchosd.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Europe\Chisinau svchosd.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.help_2.0.102.v20141007-2301\epl-v10.html svchosd.exe File created C:\Program Files\Windows Journal\en-US\jnwdui.dll.mui svchosd.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\ko-kr.xml svchosd.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Multimedia\MPP\Real.mpp svchosd.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Spelling.api svchosd.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\com-sun-tools-visualvm-tools.jar svchosd.exe File opened for modification C:\Program Files\Java\jre7\lib\management\snmp.acl.template svchosd.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\SPRING\PREVIEW.GIF svchosd.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\NavigationLeft_ButtonGraphic.png svchosd.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Sports\SportsMainToNotesBackground.wmv svchosd.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Stacking\15x15dot.png svchosd.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Nassau svchosd.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\THIRDPARTYLICENSEREADME-JAVAFX.txt svchosd.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Africa\Algiers svchosd.exe File created C:\Program Files\Windows Sidebar\Gadgets\Calendar.Gadget\icon.png svchosd.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\flower_trans_matte.wmv svchosd.exe File opened for modification C:\Program Files\Google\Chrome\Application\89.0.4389.114\MEIPreload\preloaded_data.pb svchosd.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Metlakatla svchosd.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.equinox.p2.rcp.feature_1.2.0.v20140523-0116\META-INF\MANIFEST.MF svchosd.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\com-sun-tools-visualvm-host-remote.jar svchosd.exe File created C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\reviews_joined.gif svchosd.exe File created C:\Program Files\Common Files\System\Ole DB\en-US\sqloledb.rll.mui svchosd.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Full\NavigationLeft_ButtonGraphic.png svchosd.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.engine_2.3.0.v20140506-1720.jar svchosd.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\com-sun-tools-visualvm-profiler.jar svchosd.exe -
Suspicious behavior: RenamesItself 1 IoCs
pid Process 1856 b2b3244147fe99552144847d8561eda14c6751e9afda58fc3039c5d11a4b44af.sample.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1856 wrote to memory of 1976 1856 b2b3244147fe99552144847d8561eda14c6751e9afda58fc3039c5d11a4b44af.sample.exe 26 PID 1856 wrote to memory of 1976 1856 b2b3244147fe99552144847d8561eda14c6751e9afda58fc3039c5d11a4b44af.sample.exe 26 PID 1856 wrote to memory of 1976 1856 b2b3244147fe99552144847d8561eda14c6751e9afda58fc3039c5d11a4b44af.sample.exe 26 PID 1856 wrote to memory of 1976 1856 b2b3244147fe99552144847d8561eda14c6751e9afda58fc3039c5d11a4b44af.sample.exe 26
Processes
-
C:\Users\Admin\AppData\Local\Temp\b2b3244147fe99552144847d8561eda14c6751e9afda58fc3039c5d11a4b44af.sample.exe"C:\Users\Admin\AppData\Local\Temp\b2b3244147fe99552144847d8561eda14c6751e9afda58fc3039c5d11a4b44af.sample.exe"1⤵
- Adds Run key to start application
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:1856 -
C:\ProgramData\svchosd.exe"C:\ProgramData\svchosd.exe"2⤵
- Adds Run key to start application
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Program Files directory
PID:1976
-