Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
128s -
max time network
41s -
platform
windows7_x64 -
resource
win7v20210410 -
submitted
08/08/2021, 17:00
Static task
static1
Behavioral task
behavioral1
Sample
4f9a833e79092006c06203a66b41fc9250bcebcee148fea404db75d52035131c.bin.exe
Resource
win7v20210410
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
4f9a833e79092006c06203a66b41fc9250bcebcee148fea404db75d52035131c.bin.exe
Resource
win10v20210408
windows10_x64
0 signatures
0 seconds
General
-
Target
4f9a833e79092006c06203a66b41fc9250bcebcee148fea404db75d52035131c.bin.exe
-
Size
669KB
-
MD5
4ef811b784b985769645e03bc0b9cd24
-
SHA1
2e04a37b215dd2a95694b1c18dbe1dd35be5aa9f
-
SHA256
4f9a833e79092006c06203a66b41fc9250bcebcee148fea404db75d52035131c
-
SHA512
34e9a5a015b04ae904b50a0b2e466788db16d7eb43769fec156cab830932032174b3a43a206016332f99eb16571225dc1a0a0042ce2bca67de1821bbc08c039c
Malware Config
Signatures
-
MedusaLocker
Ransomware with several variants first seen in September 2019.
-
MedusaLocker Payload 2 IoCs
resource yara_rule behavioral1/files/0x00040000000130e3-67.dat family_medusalocker behavioral1/files/0x00040000000130e3-69.dat family_medusalocker -
Deletes shadow copies 2 TTPs
Ransomware often targets backup files to inhibit system recovery.
-
Executes dropped EXE 1 IoCs
pid Process 524 svhost.exe -
Modifies extensions of user files 1 IoCs
Ransomware generally changes the extension on encrypted files.
description ioc Process File renamed C:\Users\Admin\Pictures\ConvertToClear.crw => C:\Users\Admin\Pictures\ConvertToClear.crw.L47 4f9a833e79092006c06203a66b41fc9250bcebcee148fea404db75d52035131c.bin.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 4f9a833e79092006c06203a66b41fc9250bcebcee148fea404db75d52035131c.bin.exe -
Drops desktop.ini file(s) 1 IoCs
description ioc Process File opened for modification \??\Z:\$RECYCLE.BIN\S-1-5-21-2513283230-931923277-594887482-1000\desktop.ini 4f9a833e79092006c06203a66b41fc9250bcebcee148fea404db75d52035131c.bin.exe -
Enumerates connected drives 3 TTPs 24 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\X: 4f9a833e79092006c06203a66b41fc9250bcebcee148fea404db75d52035131c.bin.exe File opened (read-only) \??\Z: 4f9a833e79092006c06203a66b41fc9250bcebcee148fea404db75d52035131c.bin.exe File opened (read-only) \??\J: 4f9a833e79092006c06203a66b41fc9250bcebcee148fea404db75d52035131c.bin.exe File opened (read-only) \??\O: 4f9a833e79092006c06203a66b41fc9250bcebcee148fea404db75d52035131c.bin.exe File opened (read-only) \??\S: 4f9a833e79092006c06203a66b41fc9250bcebcee148fea404db75d52035131c.bin.exe File opened (read-only) \??\U: 4f9a833e79092006c06203a66b41fc9250bcebcee148fea404db75d52035131c.bin.exe File opened (read-only) \??\V: 4f9a833e79092006c06203a66b41fc9250bcebcee148fea404db75d52035131c.bin.exe File opened (read-only) \??\A: 4f9a833e79092006c06203a66b41fc9250bcebcee148fea404db75d52035131c.bin.exe File opened (read-only) \??\G: 4f9a833e79092006c06203a66b41fc9250bcebcee148fea404db75d52035131c.bin.exe File opened (read-only) \??\I: 4f9a833e79092006c06203a66b41fc9250bcebcee148fea404db75d52035131c.bin.exe File opened (read-only) \??\Q: 4f9a833e79092006c06203a66b41fc9250bcebcee148fea404db75d52035131c.bin.exe File opened (read-only) \??\Y: 4f9a833e79092006c06203a66b41fc9250bcebcee148fea404db75d52035131c.bin.exe File opened (read-only) \??\R: 4f9a833e79092006c06203a66b41fc9250bcebcee148fea404db75d52035131c.bin.exe File opened (read-only) \??\T: 4f9a833e79092006c06203a66b41fc9250bcebcee148fea404db75d52035131c.bin.exe File opened (read-only) \??\B: 4f9a833e79092006c06203a66b41fc9250bcebcee148fea404db75d52035131c.bin.exe File opened (read-only) \??\E: 4f9a833e79092006c06203a66b41fc9250bcebcee148fea404db75d52035131c.bin.exe File opened (read-only) \??\F: 4f9a833e79092006c06203a66b41fc9250bcebcee148fea404db75d52035131c.bin.exe File opened (read-only) \??\K: 4f9a833e79092006c06203a66b41fc9250bcebcee148fea404db75d52035131c.bin.exe File opened (read-only) \??\N: 4f9a833e79092006c06203a66b41fc9250bcebcee148fea404db75d52035131c.bin.exe File opened (read-only) \??\H: 4f9a833e79092006c06203a66b41fc9250bcebcee148fea404db75d52035131c.bin.exe File opened (read-only) \??\L: 4f9a833e79092006c06203a66b41fc9250bcebcee148fea404db75d52035131c.bin.exe File opened (read-only) \??\M: 4f9a833e79092006c06203a66b41fc9250bcebcee148fea404db75d52035131c.bin.exe File opened (read-only) \??\P: 4f9a833e79092006c06203a66b41fc9250bcebcee148fea404db75d52035131c.bin.exe File opened (read-only) \??\W: 4f9a833e79092006c06203a66b41fc9250bcebcee148fea404db75d52035131c.bin.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Interacts with shadow copies 2 TTPs 3 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
pid Process 996 vssadmin.exe 1628 vssadmin.exe 288 vssadmin.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 736 4f9a833e79092006c06203a66b41fc9250bcebcee148fea404db75d52035131c.bin.exe 736 4f9a833e79092006c06203a66b41fc9250bcebcee148fea404db75d52035131c.bin.exe 736 4f9a833e79092006c06203a66b41fc9250bcebcee148fea404db75d52035131c.bin.exe 736 4f9a833e79092006c06203a66b41fc9250bcebcee148fea404db75d52035131c.bin.exe 736 4f9a833e79092006c06203a66b41fc9250bcebcee148fea404db75d52035131c.bin.exe 736 4f9a833e79092006c06203a66b41fc9250bcebcee148fea404db75d52035131c.bin.exe 736 4f9a833e79092006c06203a66b41fc9250bcebcee148fea404db75d52035131c.bin.exe 736 4f9a833e79092006c06203a66b41fc9250bcebcee148fea404db75d52035131c.bin.exe 736 4f9a833e79092006c06203a66b41fc9250bcebcee148fea404db75d52035131c.bin.exe 736 4f9a833e79092006c06203a66b41fc9250bcebcee148fea404db75d52035131c.bin.exe 736 4f9a833e79092006c06203a66b41fc9250bcebcee148fea404db75d52035131c.bin.exe 736 4f9a833e79092006c06203a66b41fc9250bcebcee148fea404db75d52035131c.bin.exe 736 4f9a833e79092006c06203a66b41fc9250bcebcee148fea404db75d52035131c.bin.exe 736 4f9a833e79092006c06203a66b41fc9250bcebcee148fea404db75d52035131c.bin.exe 736 4f9a833e79092006c06203a66b41fc9250bcebcee148fea404db75d52035131c.bin.exe 736 4f9a833e79092006c06203a66b41fc9250bcebcee148fea404db75d52035131c.bin.exe 736 4f9a833e79092006c06203a66b41fc9250bcebcee148fea404db75d52035131c.bin.exe 736 4f9a833e79092006c06203a66b41fc9250bcebcee148fea404db75d52035131c.bin.exe 736 4f9a833e79092006c06203a66b41fc9250bcebcee148fea404db75d52035131c.bin.exe 736 4f9a833e79092006c06203a66b41fc9250bcebcee148fea404db75d52035131c.bin.exe 736 4f9a833e79092006c06203a66b41fc9250bcebcee148fea404db75d52035131c.bin.exe 736 4f9a833e79092006c06203a66b41fc9250bcebcee148fea404db75d52035131c.bin.exe 736 4f9a833e79092006c06203a66b41fc9250bcebcee148fea404db75d52035131c.bin.exe 736 4f9a833e79092006c06203a66b41fc9250bcebcee148fea404db75d52035131c.bin.exe 736 4f9a833e79092006c06203a66b41fc9250bcebcee148fea404db75d52035131c.bin.exe 736 4f9a833e79092006c06203a66b41fc9250bcebcee148fea404db75d52035131c.bin.exe 736 4f9a833e79092006c06203a66b41fc9250bcebcee148fea404db75d52035131c.bin.exe 736 4f9a833e79092006c06203a66b41fc9250bcebcee148fea404db75d52035131c.bin.exe 736 4f9a833e79092006c06203a66b41fc9250bcebcee148fea404db75d52035131c.bin.exe 736 4f9a833e79092006c06203a66b41fc9250bcebcee148fea404db75d52035131c.bin.exe 736 4f9a833e79092006c06203a66b41fc9250bcebcee148fea404db75d52035131c.bin.exe 736 4f9a833e79092006c06203a66b41fc9250bcebcee148fea404db75d52035131c.bin.exe 736 4f9a833e79092006c06203a66b41fc9250bcebcee148fea404db75d52035131c.bin.exe 736 4f9a833e79092006c06203a66b41fc9250bcebcee148fea404db75d52035131c.bin.exe 736 4f9a833e79092006c06203a66b41fc9250bcebcee148fea404db75d52035131c.bin.exe 736 4f9a833e79092006c06203a66b41fc9250bcebcee148fea404db75d52035131c.bin.exe 736 4f9a833e79092006c06203a66b41fc9250bcebcee148fea404db75d52035131c.bin.exe 736 4f9a833e79092006c06203a66b41fc9250bcebcee148fea404db75d52035131c.bin.exe 736 4f9a833e79092006c06203a66b41fc9250bcebcee148fea404db75d52035131c.bin.exe 736 4f9a833e79092006c06203a66b41fc9250bcebcee148fea404db75d52035131c.bin.exe 736 4f9a833e79092006c06203a66b41fc9250bcebcee148fea404db75d52035131c.bin.exe 736 4f9a833e79092006c06203a66b41fc9250bcebcee148fea404db75d52035131c.bin.exe 736 4f9a833e79092006c06203a66b41fc9250bcebcee148fea404db75d52035131c.bin.exe 736 4f9a833e79092006c06203a66b41fc9250bcebcee148fea404db75d52035131c.bin.exe 736 4f9a833e79092006c06203a66b41fc9250bcebcee148fea404db75d52035131c.bin.exe 736 4f9a833e79092006c06203a66b41fc9250bcebcee148fea404db75d52035131c.bin.exe 736 4f9a833e79092006c06203a66b41fc9250bcebcee148fea404db75d52035131c.bin.exe 736 4f9a833e79092006c06203a66b41fc9250bcebcee148fea404db75d52035131c.bin.exe 736 4f9a833e79092006c06203a66b41fc9250bcebcee148fea404db75d52035131c.bin.exe 736 4f9a833e79092006c06203a66b41fc9250bcebcee148fea404db75d52035131c.bin.exe 736 4f9a833e79092006c06203a66b41fc9250bcebcee148fea404db75d52035131c.bin.exe 736 4f9a833e79092006c06203a66b41fc9250bcebcee148fea404db75d52035131c.bin.exe 736 4f9a833e79092006c06203a66b41fc9250bcebcee148fea404db75d52035131c.bin.exe 736 4f9a833e79092006c06203a66b41fc9250bcebcee148fea404db75d52035131c.bin.exe 736 4f9a833e79092006c06203a66b41fc9250bcebcee148fea404db75d52035131c.bin.exe 736 4f9a833e79092006c06203a66b41fc9250bcebcee148fea404db75d52035131c.bin.exe 736 4f9a833e79092006c06203a66b41fc9250bcebcee148fea404db75d52035131c.bin.exe 736 4f9a833e79092006c06203a66b41fc9250bcebcee148fea404db75d52035131c.bin.exe 736 4f9a833e79092006c06203a66b41fc9250bcebcee148fea404db75d52035131c.bin.exe 736 4f9a833e79092006c06203a66b41fc9250bcebcee148fea404db75d52035131c.bin.exe 736 4f9a833e79092006c06203a66b41fc9250bcebcee148fea404db75d52035131c.bin.exe 736 4f9a833e79092006c06203a66b41fc9250bcebcee148fea404db75d52035131c.bin.exe 736 4f9a833e79092006c06203a66b41fc9250bcebcee148fea404db75d52035131c.bin.exe 736 4f9a833e79092006c06203a66b41fc9250bcebcee148fea404db75d52035131c.bin.exe -
Suspicious use of AdjustPrivilegeToken 63 IoCs
description pid Process Token: SeBackupPrivilege 1428 vssvc.exe Token: SeRestorePrivilege 1428 vssvc.exe Token: SeAuditPrivilege 1428 vssvc.exe Token: SeIncreaseQuotaPrivilege 1552 wmic.exe Token: SeSecurityPrivilege 1552 wmic.exe Token: SeTakeOwnershipPrivilege 1552 wmic.exe Token: SeLoadDriverPrivilege 1552 wmic.exe Token: SeSystemProfilePrivilege 1552 wmic.exe Token: SeSystemtimePrivilege 1552 wmic.exe Token: SeProfSingleProcessPrivilege 1552 wmic.exe Token: SeIncBasePriorityPrivilege 1552 wmic.exe Token: SeCreatePagefilePrivilege 1552 wmic.exe Token: SeBackupPrivilege 1552 wmic.exe Token: SeRestorePrivilege 1552 wmic.exe Token: SeShutdownPrivilege 1552 wmic.exe Token: SeDebugPrivilege 1552 wmic.exe Token: SeSystemEnvironmentPrivilege 1552 wmic.exe Token: SeRemoteShutdownPrivilege 1552 wmic.exe Token: SeUndockPrivilege 1552 wmic.exe Token: SeManageVolumePrivilege 1552 wmic.exe Token: 33 1552 wmic.exe Token: 34 1552 wmic.exe Token: 35 1552 wmic.exe Token: SeIncreaseQuotaPrivilege 1868 wmic.exe Token: SeSecurityPrivilege 1868 wmic.exe Token: SeTakeOwnershipPrivilege 1868 wmic.exe Token: SeLoadDriverPrivilege 1868 wmic.exe Token: SeSystemProfilePrivilege 1868 wmic.exe Token: SeSystemtimePrivilege 1868 wmic.exe Token: SeProfSingleProcessPrivilege 1868 wmic.exe Token: SeIncBasePriorityPrivilege 1868 wmic.exe Token: SeCreatePagefilePrivilege 1868 wmic.exe Token: SeBackupPrivilege 1868 wmic.exe Token: SeRestorePrivilege 1868 wmic.exe Token: SeShutdownPrivilege 1868 wmic.exe Token: SeDebugPrivilege 1868 wmic.exe Token: SeSystemEnvironmentPrivilege 1868 wmic.exe Token: SeRemoteShutdownPrivilege 1868 wmic.exe Token: SeUndockPrivilege 1868 wmic.exe Token: SeManageVolumePrivilege 1868 wmic.exe Token: 33 1868 wmic.exe Token: 34 1868 wmic.exe Token: 35 1868 wmic.exe Token: SeIncreaseQuotaPrivilege 1652 wmic.exe Token: SeSecurityPrivilege 1652 wmic.exe Token: SeTakeOwnershipPrivilege 1652 wmic.exe Token: SeLoadDriverPrivilege 1652 wmic.exe Token: SeSystemProfilePrivilege 1652 wmic.exe Token: SeSystemtimePrivilege 1652 wmic.exe Token: SeProfSingleProcessPrivilege 1652 wmic.exe Token: SeIncBasePriorityPrivilege 1652 wmic.exe Token: SeCreatePagefilePrivilege 1652 wmic.exe Token: SeBackupPrivilege 1652 wmic.exe Token: SeRestorePrivilege 1652 wmic.exe Token: SeShutdownPrivilege 1652 wmic.exe Token: SeDebugPrivilege 1652 wmic.exe Token: SeSystemEnvironmentPrivilege 1652 wmic.exe Token: SeRemoteShutdownPrivilege 1652 wmic.exe Token: SeUndockPrivilege 1652 wmic.exe Token: SeManageVolumePrivilege 1652 wmic.exe Token: 33 1652 wmic.exe Token: 34 1652 wmic.exe Token: 35 1652 wmic.exe -
Suspicious use of WriteProcessMemory 28 IoCs
description pid Process procid_target PID 736 wrote to memory of 1628 736 4f9a833e79092006c06203a66b41fc9250bcebcee148fea404db75d52035131c.bin.exe 29 PID 736 wrote to memory of 1628 736 4f9a833e79092006c06203a66b41fc9250bcebcee148fea404db75d52035131c.bin.exe 29 PID 736 wrote to memory of 1628 736 4f9a833e79092006c06203a66b41fc9250bcebcee148fea404db75d52035131c.bin.exe 29 PID 736 wrote to memory of 1628 736 4f9a833e79092006c06203a66b41fc9250bcebcee148fea404db75d52035131c.bin.exe 29 PID 736 wrote to memory of 1552 736 4f9a833e79092006c06203a66b41fc9250bcebcee148fea404db75d52035131c.bin.exe 32 PID 736 wrote to memory of 1552 736 4f9a833e79092006c06203a66b41fc9250bcebcee148fea404db75d52035131c.bin.exe 32 PID 736 wrote to memory of 1552 736 4f9a833e79092006c06203a66b41fc9250bcebcee148fea404db75d52035131c.bin.exe 32 PID 736 wrote to memory of 1552 736 4f9a833e79092006c06203a66b41fc9250bcebcee148fea404db75d52035131c.bin.exe 32 PID 736 wrote to memory of 288 736 4f9a833e79092006c06203a66b41fc9250bcebcee148fea404db75d52035131c.bin.exe 34 PID 736 wrote to memory of 288 736 4f9a833e79092006c06203a66b41fc9250bcebcee148fea404db75d52035131c.bin.exe 34 PID 736 wrote to memory of 288 736 4f9a833e79092006c06203a66b41fc9250bcebcee148fea404db75d52035131c.bin.exe 34 PID 736 wrote to memory of 288 736 4f9a833e79092006c06203a66b41fc9250bcebcee148fea404db75d52035131c.bin.exe 34 PID 736 wrote to memory of 1868 736 4f9a833e79092006c06203a66b41fc9250bcebcee148fea404db75d52035131c.bin.exe 36 PID 736 wrote to memory of 1868 736 4f9a833e79092006c06203a66b41fc9250bcebcee148fea404db75d52035131c.bin.exe 36 PID 736 wrote to memory of 1868 736 4f9a833e79092006c06203a66b41fc9250bcebcee148fea404db75d52035131c.bin.exe 36 PID 736 wrote to memory of 1868 736 4f9a833e79092006c06203a66b41fc9250bcebcee148fea404db75d52035131c.bin.exe 36 PID 736 wrote to memory of 996 736 4f9a833e79092006c06203a66b41fc9250bcebcee148fea404db75d52035131c.bin.exe 38 PID 736 wrote to memory of 996 736 4f9a833e79092006c06203a66b41fc9250bcebcee148fea404db75d52035131c.bin.exe 38 PID 736 wrote to memory of 996 736 4f9a833e79092006c06203a66b41fc9250bcebcee148fea404db75d52035131c.bin.exe 38 PID 736 wrote to memory of 996 736 4f9a833e79092006c06203a66b41fc9250bcebcee148fea404db75d52035131c.bin.exe 38 PID 736 wrote to memory of 1652 736 4f9a833e79092006c06203a66b41fc9250bcebcee148fea404db75d52035131c.bin.exe 40 PID 736 wrote to memory of 1652 736 4f9a833e79092006c06203a66b41fc9250bcebcee148fea404db75d52035131c.bin.exe 40 PID 736 wrote to memory of 1652 736 4f9a833e79092006c06203a66b41fc9250bcebcee148fea404db75d52035131c.bin.exe 40 PID 736 wrote to memory of 1652 736 4f9a833e79092006c06203a66b41fc9250bcebcee148fea404db75d52035131c.bin.exe 40 PID 752 wrote to memory of 524 752 taskeng.exe 45 PID 752 wrote to memory of 524 752 taskeng.exe 45 PID 752 wrote to memory of 524 752 taskeng.exe 45 PID 752 wrote to memory of 524 752 taskeng.exe 45 -
System policy modification 1 TTPs 3 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 4f9a833e79092006c06203a66b41fc9250bcebcee148fea404db75d52035131c.bin.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" 4f9a833e79092006c06203a66b41fc9250bcebcee148fea404db75d52035131c.bin.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLinkedConnections = "1" 4f9a833e79092006c06203a66b41fc9250bcebcee148fea404db75d52035131c.bin.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\4f9a833e79092006c06203a66b41fc9250bcebcee148fea404db75d52035131c.bin.exe"C:\Users\Admin\AppData\Local\Temp\4f9a833e79092006c06203a66b41fc9250bcebcee148fea404db75d52035131c.bin.exe"1⤵
- Modifies extensions of user files
- Checks whether UAC is enabled
- Drops desktop.ini file(s)
- Enumerates connected drives
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
- System policy modification
PID:736 -
C:\Windows\SysWOW64\vssadmin.exevssadmin.exe Delete Shadows /All /Quiet2⤵
- Interacts with shadow copies
PID:1628
-
-
C:\Windows\SysWOW64\Wbem\wmic.exewmic.exe SHADOWCOPY /nointeractive2⤵
- Suspicious use of AdjustPrivilegeToken
PID:1552
-
-
C:\Windows\SysWOW64\vssadmin.exevssadmin.exe Delete Shadows /All /Quiet2⤵
- Interacts with shadow copies
PID:288
-
-
C:\Windows\SysWOW64\Wbem\wmic.exewmic.exe SHADOWCOPY /nointeractive2⤵
- Suspicious use of AdjustPrivilegeToken
PID:1868
-
-
C:\Windows\SysWOW64\vssadmin.exevssadmin.exe Delete Shadows /All /Quiet2⤵
- Interacts with shadow copies
PID:996
-
-
C:\Windows\SysWOW64\Wbem\wmic.exewmic.exe SHADOWCOPY /nointeractive2⤵
- Suspicious use of AdjustPrivilegeToken
PID:1652
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1428
-
C:\Windows\system32\taskeng.exetaskeng.exe {01D3430D-43B9-404F-B67C-81D885D76F2F} S-1-5-21-2513283230-931923277-594887482-1000:MRBKYMNO\Admin:Interactive:[1]1⤵
- Suspicious use of WriteProcessMemory
PID:752 -
C:\Users\Admin\AppData\Roaming\svhost.exeC:\Users\Admin\AppData\Roaming\svhost.exe2⤵
- Executes dropped EXE
PID:524
-