Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    156s
  • max time network
    131s
  • platform
    windows7_x64
  • resource
    win7-en-20211208
  • submitted
    01/02/2022, 15:21

General

  • Target

    fc29c372042941ac432de2e4cbb2dcdc22c8ffdb8b5281db982d345e73b9c7d6.exe

  • Size

    678KB

  • MD5

    c8d0b3efe09caffc7eb1223dd9125568

  • SHA1

    52e4c3a528b68f9efae8f54191b2e4e088cddfb9

  • SHA256

    fc29c372042941ac432de2e4cbb2dcdc22c8ffdb8b5281db982d345e73b9c7d6

  • SHA512

    8c995b8ba882a67b582714c104a8d2315f56016412708d58e840e43a001446242d6e09831997a2845fa77db02d5f54129565e8908fc24f829bfbac3d8b9d86b3

Malware Config

Extracted

Path

C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Recovery_Instructions.html

Ransom Note
<html> <style type="text/css"> body { background-color: #f5f5f5; } h1, h3{ text-align: center; text-transform: uppercase; font-weight: normal; } /*---*/ .tabs1{ display: block; margin: auto; } .tabs1 .head{ text-align: center; float: top; padding: 0px; text-transform: uppercase; font-weight: normal; display: block; background: #81bef7; color: #DF0101; font-size: 30px; } .tabs1 .identi { font-size: 10px; text-align: center; float: top; padding: 15px; display: block; background: #81bef7; color: #DFDFDF; } .tabs .content { background: #f5f5f5; /*text-align: center;*/ color: #000000; padding: 25px 15px; font-size: 15px; font-weight: 400; line-height: 20px; } .tabs .content a { color: #df0130; font-size: 23px; font-style: italic; text-decoration: none; line-height: 35px; } .tabs .content .text{ padding: 25px; line-height: 1.2; } </style> <body> <div class="tabs1"> <div class="head" ><b>Your personal ID:</b></div> <div class="identi"> <span style="width:1000px; color: #ffffff; font-size: 10px;">B962595484ABB710F033126D1E46F6D11EA35512212A4015303042458EE2BAE65AB3A1CFECE53ABDA2418933D37BD4E3D1483AFE3CCC6D4187F5394DBF0480A3<br>74F0E0DCA04674F1F4C518B1EA83A4B9D7C020ED04A5BBD5FD78664FE758C34A6C87BB82D81E2029E319BE5A58AAD16CC201DC8875F2E1DA7BD34A715418<br>B4B9D57D2BBD58DB18E347813AE5304F6987FCE3DEDB65A8CDF0C8AA63EF189424C85CFD35693D696AA8816FECFEBFFCFBA67DDEC64C1FBD8F25DFB7F726<br>DF74CEAA46F06AC73E29400D3859F20487FA713889641125810B35A1C0DEE81166B1111BEDF3F1EE3549602053E03560516631A2D85E6ADE53578B1B8CE0<br>94A8CEB64EA6E6C55C01C0CE25F481AEAA6624D16C3391D72E4170C06A1157CF238D204A35A8C8B885613F33A45CD6C77EBD8945EBAB7B42B73C77D6D82A<br>08357AEFAC17544B0CAB61278581ECE5C3EA4D6E264DF1BF7CC376F23ABB3A2CE6BADF2DE7EBFFE7409CD332E2D447E4123DB6AF32B2943578F61501368A<br>C249F1EF1C38571535E57BCEF03EE8E3D2297C04FA4F9A2EC5D436BE83A2E33019FF2A30B498EBC19C1BD8A7E6CF9921A66E898B7C827DD688B33849089F<br>4BD6623B4297C864BCFAFCD1FC30E60D2880F01F4336D0CE1718BD38EBE8E1FE7C341A5A6A01838385B8310A9065B1ADCD6F26BFD3A16297B3D2BBC83378<br>8B5A0ABA980A7BFDF3504D0D3416</span> <br> <!-- !!! dont changing this !!! --> </div> </div> <!-- --> <div class="tabs"> <!--tab--> <div class="tab"> <div id="tab-content1" class="content"> <div class="text"> <!--text data --> <b>/!\ YOUR COMPANY NETWORK HAS BEEN PENETRATED /!\</b><br> <b>All your important files have been encrypted!</b><br><br> <hr> Your files are safe! Only modified. (RSA+AES)<br><br> ANY ATTEMPT TO RESTORE YOUR FILES WITH THIRD-PARTY SOFTWARE<br> WILL PERMANENTLY CORRUPT IT.<br> DO NOT MODIFY ENCRYPTED FILES.<br> DO NOT RENAME ENCRYPTED FILES.<br><br> No software available on internet can help you. We are the only ones able to<br> solve your problem.<br><br> We gathered highly confidential/personal data. These data are currently stored on<br> a private server. This server will be immediately destroyed after your payment.<br> If you decide to not pay, we will release your data to public or re-seller.<br> So you can expect your data to be publicly available in the near future..<br><br> We only seek money and our goal is not to damage your reputation or prevent<br> your business from running.<br><br> You will can send us 2-3 non-important files and we will decrypt it for free<br> to prove we are able to give your files back.<br><br> <!--text data --> <hr> <b>Contact us for price and get decryption software.</b><br><br> <a>http://gvlay6u4g53rxdi5.onion/21-E6UQFCEuCn4KvtAh4TonRTpyHqFo6F6L-FOjrhKEytP5KZUoB7F18CAThAESIrU76</a><br> * Note that this server is available via Tor browser only<br><br> Follow the instructions to open the link:<br> 1. Type the addres "https://www.torproject.org" in your Internet browser. It opens the Tor site.<br> 2. Press "Download Tor", then press "Download Tor Browser Bundle", install and run it.<br> 3. Now you have Tor browser. In the Tor Browser open "{{URL}}". <br> 4. Start a chat and follow the further instructions. <br><br> <hr> <b>If you can not use the above link, use the email:</b><br> <a href=" [email protected]">[email protected] </a> <br><a href="[email protected]">[email protected]</a> <br> <b>* To contact us, create a new mail on the site:</b> <a href="https://protonmail.com">protonmail.com<br> <hr> <b>Make contact as soon as possible. Your private key (decryption key) <br> is only stored temporarily.<br><br> IF YOU DON'T CONTACT US WITHIN 72 HOURS, PRICE WILL BE HIGHER.</b><br> </div> </div> </div> <!--tab--> <!--text data --> </div> </div> <!--tab--> </div> </div> </body> </html>

Signatures

  • MedusaLocker

    Ransomware with several variants first seen in September 2019.

  • MedusaLocker Payload 2 IoCs
  • UAC bypass 3 TTPs
  • Deletes shadow copies 2 TTPs

    Ransomware often targets backup files to inhibit system recovery.

  • Executes dropped EXE 1 IoCs
  • Checks whether UAC is enabled 1 TTPs 1 IoCs
  • Drops desktop.ini file(s) 1 IoCs
  • Enumerates connected drives 3 TTPs 24 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Interacts with shadow copies 2 TTPs 3 IoCs

    Shadow copies are often targeted by ransomware to inhibit system recovery.

  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 63 IoCs
  • Suspicious use of WriteProcessMemory 28 IoCs
  • System policy modification 1 TTPs 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\fc29c372042941ac432de2e4cbb2dcdc22c8ffdb8b5281db982d345e73b9c7d6.exe
    "C:\Users\Admin\AppData\Local\Temp\fc29c372042941ac432de2e4cbb2dcdc22c8ffdb8b5281db982d345e73b9c7d6.exe"
    1⤵
    • Checks whether UAC is enabled
    • Drops desktop.ini file(s)
    • Enumerates connected drives
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    • System policy modification
    PID:2028
    • C:\Windows\SysWOW64\vssadmin.exe
      vssadmin.exe Delete Shadows /All /Quiet
      2⤵
      • Interacts with shadow copies
      PID:768
    • C:\Windows\SysWOW64\Wbem\wmic.exe
      wmic.exe SHADOWCOPY /nointeractive
      2⤵
      • Suspicious use of AdjustPrivilegeToken
      PID:896
    • C:\Windows\SysWOW64\vssadmin.exe
      vssadmin.exe Delete Shadows /All /Quiet
      2⤵
      • Interacts with shadow copies
      PID:976
    • C:\Windows\SysWOW64\Wbem\wmic.exe
      wmic.exe SHADOWCOPY /nointeractive
      2⤵
      • Suspicious use of AdjustPrivilegeToken
      PID:1960
    • C:\Windows\SysWOW64\vssadmin.exe
      vssadmin.exe Delete Shadows /All /Quiet
      2⤵
      • Interacts with shadow copies
      PID:2044
    • C:\Windows\SysWOW64\Wbem\wmic.exe
      wmic.exe SHADOWCOPY /nointeractive
      2⤵
      • Suspicious use of AdjustPrivilegeToken
      PID:1152
  • C:\Windows\system32\vssvc.exe
    C:\Windows\system32\vssvc.exe
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    PID:1248
  • C:\Windows\system32\taskeng.exe
    taskeng.exe {DF295130-15D7-4625-901C-8FB0C1A00F45} S-1-5-21-2329389628-4064185017-3901522362-1000:QSKGHMYQ\Admin:Interactive:[1]
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:1500
    • C:\Users\Admin\AppData\Roaming\svhost.exe
      C:\Users\Admin\AppData\Roaming\svhost.exe
      2⤵
      • Executes dropped EXE
      PID:1712

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/2028-55-0x0000000076731000-0x0000000076733000-memory.dmp

    Filesize

    8KB