Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

10

Static

static

software.exe

windows7_x64

10

software.exe

windows10_x64

10

Analysis

  • max time kernel
    131s
  • max time network
    225s
  • platform
    windows7_x64
  • resource
    win7-en-20211014
  • submitted
    08/12/2021, 08:15

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    software.exe

  • Size

    3.2MB

  • MD5

    9bb9bef710583acc0b74b42e9c244209

  • SHA1

    ac0cb5474c2bd21263c3758aaff6420f7380f5b6

  • SHA256

    15fea1662d7a85e4d95fd89e36b4f02dd6657045ea9f20301130a321994504c6

  • SHA512

    aa630dec6a967b9bbbad8425ac8afee443f7e37dbf21fe761fd3a4a27f3b78efdd92b13fd14a3e8931045d803ec52f7b1276f6534bf6b07e8ab1a4e74340ae17

Score
10/10
xmrigevasionminerransomwarespywarestealer

Malware Config

Extracted

Path

C:\Decryption-Guide.txt

Ransom Note
Your Files Are Has Been Locked Your Files Has Been Encrypted with cryptography Algorithm If You Need Your Files And They are Important to You, Dont be shy Send Me an Email Send Test File + The Key File on Your System (File Exist in C:/ProgramData example : RSAKEY-SE-24r6t523 pr RSAKEY.KEY) to Make Sure Your Files Can be Restored Make an Agreement on Price with me and Pay Get Decryption Tool + RSA Key AND Instruction For Decryption Process Attention: 1- Do Not Rename or Modify The Files (You May loose That file) 2- Do Not Try To Use 3rd Party Apps or Recovery Tools ( if You want to do that make an copy from Files and try on them and Waste Your time ) 3-Do not Reinstall Operation System(Windows) You may loose the key File and Loose Your Files 4-Do Not Always Trust to Middle mans and negotiators (some of them are good but some of them agree on 4000usd for example and Asked 10000usd From Client) this Was happened Your Case ID :MJ-VB6702958413 OUR Email :[email protected]

Extracted

Path

C:\Users\Admin\Desktop\Decryption-Guide.HTA

Ransom Note
Your Files Are Has Been Locked Your Files Has Been Encrypted with cryptography Algorithm If You Need Your Files And They are Important to You, Dont be shy Send Me an Email Send Test File + The Key File on Your System (File Exist in C:/ProgramData example : KEY-SE-24r6t523 or RSAKEY.KEY) to Make Sure Your Files Can be Restored Make an Agreement on Price with me and Pay Get Decryption Tool + RSA Key AND Instruction For Decryption Process Attention: 1- Do Not Rename or Modify The Files (You May loose That file) 2- Do Not Try To Use 3rd Party Apps or Recovery Tools ( if You want to do that make an copy from Files and try on them and Waste Your time ) 3-Do not Reinstall Operation System(Windows) You may loose the key File and Loose Your Files 4-Do Not Always Trust to Middle mans and negotiators (some of them are good but some of them agree on 4000usd for example and Asked 10000usd From Client) this Was happened Your Case ID : MJ-VB6702958413 Our Email:[email protected]
Emails

Email:[email protected]

Signatures

  • xmrig

    XMRig is a high performance, open source, cross platform CPU/GPU miner.

    minerxmrig
  • Drops file in Drivers directory 27 IoCs
  • Modifies Windows Firewall 1 TTPs
    evasion
  • Drops startup file 4 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Drops desktop.ini file(s) 64 IoCs
  • Drops autorun.inf file 1 TTPs

    Malware can abuse Windows Autorun to spread further via attached volumes.

  • Drops file in System32 directory 64 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 64 IoCs
  • NTFS ADS 3 IoCs
  • Runs net.exe
  • Suspicious behavior: EnumeratesProcesses 9 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\software.exe
    "C:\Users\Admin\AppData\Local\Temp\software.exe"
    1⤵
    • Drops file in Drivers directory
    • Drops startup file
    • Drops desktop.ini file(s)
    • Drops file in System32 directory
    • Drops file in Program Files directory
    • Drops file in Windows directory
    • NTFS ADS
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:1268
    • C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c net stop MSDTC
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:588
      • C:\Windows\SysWOW64\net.exe
        net stop MSDTC
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:636
        • C:\Windows\SysWOW64\net1.exe
          C:\Windows\system32\net1 stop MSDTC
          4⤵
            PID:560
      • C:\Windows\SysWOW64\cmd.exe
        C:\Windows\system32\cmd.exe /c bcdedit /set {default} bootstatuspolicy ignoreallfailures
        2⤵
          PID:568
        • C:\Windows\SysWOW64\cmd.exe
          C:\Windows\system32\cmd.exe /c bcdedit /set {default} recoveryenabled no
          2⤵
            PID:364
          • C:\Windows\SysWOW64\cmd.exe
            C:\Windows\system32\cmd.exe /c wbadmin delete catalog -quiet
            2⤵
              PID:1052
            • C:\Windows\SysWOW64\cmd.exe
              C:\Windows\system32\cmd.exe /c net stop SQLSERVERAGENT
              2⤵
              • Suspicious use of WriteProcessMemory
              PID:976
              • C:\Windows\SysWOW64\net.exe
                net stop SQLSERVERAGENT
                3⤵
                • Suspicious use of WriteProcessMemory
                PID:1580
                • C:\Windows\SysWOW64\net1.exe
                  C:\Windows\system32\net1 stop SQLSERVERAGENT
                  4⤵
                    PID:1804
              • C:\Windows\SysWOW64\cmd.exe
                C:\Windows\system32\cmd.exe /c net stop MSSQLSERVER
                2⤵
                • Suspicious use of WriteProcessMemory
                PID:1116
                • C:\Windows\SysWOW64\net.exe
                  net stop MSSQLSERVER
                  3⤵
                  • Suspicious use of WriteProcessMemory
                  PID:1088
                  • C:\Windows\SysWOW64\net1.exe
                    C:\Windows\system32\net1 stop MSSQLSERVER
                    4⤵
                      PID:2036
                • C:\Windows\SysWOW64\cmd.exe
                  C:\Windows\system32\cmd.exe /c net stop vds
                  2⤵
                  • Suspicious use of WriteProcessMemory
                  PID:1552
                  • C:\Windows\SysWOW64\net.exe
                    net stop vds
                    3⤵
                    • Suspicious use of WriteProcessMemory
                    PID:1828
                    • C:\Windows\SysWOW64\net1.exe
                      C:\Windows\system32\net1 stop vds
                      4⤵
                        PID:1928
                  • C:\Windows\SysWOW64\cmd.exe
                    C:\Windows\system32\cmd.exe /c netsh advfirewall set currentprofile state off
                    2⤵
                      PID:1760
                      • C:\Windows\SysWOW64\netsh.exe
                        netsh advfirewall set currentprofile state off
                        3⤵
                          PID:1980
                      • C:\Windows\SysWOW64\cmd.exe
                        C:\Windows\system32\cmd.exe /c netsh firewall set opmode mode=disable
                        2⤵
                          PID:476
                          • C:\Windows\SysWOW64\netsh.exe
                            netsh firewall set opmode mode=disable
                            3⤵
                              PID:868
                          • C:\Windows\SysWOW64\cmd.exe
                            C:\Windows\system32\cmd.exe /c net stop SQLWriter
                            2⤵
                              PID:1616
                              • C:\Windows\SysWOW64\net.exe
                                net stop SQLWriter
                                3⤵
                                  PID:1488
                                  • C:\Windows\SysWOW64\net1.exe
                                    C:\Windows\system32\net1 stop SQLWriter
                                    4⤵
                                      PID:1968
                                • C:\Windows\SysWOW64\cmd.exe
                                  C:\Windows\system32\cmd.exe /c net stop SQLBrowser
                                  2⤵
                                    PID:1692
                                    • C:\Windows\SysWOW64\net.exe
                                      net stop SQLBrowser
                                      3⤵
                                        PID:1628
                                        • C:\Windows\SysWOW64\net1.exe
                                          C:\Windows\system32\net1 stop SQLBrowser
                                          4⤵
                                            PID:768
                                      • C:\Windows\SysWOW64\cmd.exe
                                        C:\Windows\system32\cmd.exe /c net stop MSSQLSERVER
                                        2⤵
                                          PID:1216
                                          • C:\Windows\SysWOW64\net.exe
                                            net stop MSSQLSERVER
                                            3⤵
                                              PID:548
                                              • C:\Windows\SysWOW64\net1.exe
                                                C:\Windows\system32\net1 stop MSSQLSERVER
                                                4⤵
                                                  PID:1960
                                            • C:\Windows\SysWOW64\cmd.exe
                                              C:\Windows\system32\cmd.exe /c net stop MSSQL$CONTOSO1
                                              2⤵
                                                PID:568
                                                • C:\Windows\SysWOW64\net.exe
                                                  net stop MSSQL$CONTOSO1
                                                  3⤵
                                                    PID:364
                                                    • C:\Windows\SysWOW64\net1.exe
                                                      C:\Windows\system32\net1 stop MSSQL$CONTOSO1
                                                      4⤵
                                                        PID:432
                                                • C:\Windows\system32\AUDIODG.EXE
                                                  C:\Windows\system32\AUDIODG.EXE 0x580
                                                  1⤵
                                                    PID:1624
                                                  • C:\Windows\system32\NOTEPAD.EXE
                                                    "C:\Windows\system32\NOTEPAD.EXE" C:\Decryption-Guide.txt
                                                    1⤵
                                                      PID:1412
                                                    • C:\Windows\SysWOW64\mshta.exe
                                                      "C:\Windows\SysWOW64\mshta.exe" "C:\Users\Admin\Desktop\Decryption-Guide.HTA"
                                                      1⤵
                                                        PID:1900

                                                      Network

                                                      MITRE ATT&CK Enterprise v6

                                                      Replay Monitor

                                                      Loading Replay Monitor...

                                                      Downloads

                                                      • memory/1412-89-0x000007FEFC061000-0x000007FEFC063000-memory.dmp

                                                        Filesize

                                                        8KB

                                                        Download

                                                      • memory/1980-72-0x0000000076081000-0x0000000076083000-memory.dmp

                                                        Filesize

                                                        8KB

                                                        Download