Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

10

Static

static

Taleb.Ransom.exe

windows7_x64

10

Taleb.Ransom.exe

windows10-2004_x64

10

Resubmissions

25/03/2022, 06:59 UTC

220325-hsddnafgel 10

08/03/2022, 23:12 UTC

220308-263p9abfb4 8

Analysis

  • max time kernel
    4294372s
  • max time network
    318s
  • platform
    windows7_x64
  • resource
    win7-20220311-en
  • submitted
    25/03/2022, 06:59 UTC

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    Taleb.Ransom.exe

  • Size

    10.8MB

  • MD5

    ac09b7550eda13e03a55448fd8367e2d

  • SHA1

    8266a12669a4a3952cb9af86e75ed74c27c71013

  • SHA256

    4b78968928cfa5437ffdd56a39a5ea8c10a7b6dc5d3f342d003260088876b3cf

  • SHA512

    44cace3038bd96fa36a9d3b16251573f625f5e7cb53f0233d87f6e8ab564e731bd8719088feec44f47a460c0a096b964c2c0e77f3f1c371b773e66407aef5d29

Score
10/10
evasionpersistenceransomwarespywarestealer

Malware Config

Extracted

Path

C:\Decryption-Guide.txt

Ransom Note
Your Files Are Has Been Locked Your Files Has Been Encrypted with cryptography Algorithm If You Need Your Files And They are Important to You, Dont be shy Send Me an Email Send Test File + The Key File on Your System (File Exist in C:/ProgramData example : RSAKEY-SE-24r6t523 pr RSAKEY.KEY) to Make Sure Your Files Can be Restored Make an Agreement on Price with me and Pay Get Decryption Tool + RSA Key AND Instruction For Decryption Process Attention: 1- Do Not Rename or Modify The Files (You May loose That file) 2- Do Not Try To Use 3rd Party Apps or Recovery Tools ( if You want to do that make an copy from Files and try on them and Waste Your time ) 3-Do not Reinstall Operation System(Windows) You may loose the key File and Loose Your Files 4-Do Not Always Trust to Middle mans and negotiators (some of them are good but some of them agree on 4000usd for example and Asked 10000usd From Client) this Was happened Your Case ID :MJ-PH7316520894 OUR Email :Folperdock@gmail.com
Emails

Folperdock@gmail.com

Signatures

  • Modifies Installed Components in the registry 2 TTPs
    persistence
  • Modifies Windows Firewall 1 TTPs
    evasion
  • Modifies extensions of user files 2 IoCs

    Ransomware generally changes the extension on encrypted files.

    ransomware
  • Drops startup file 1 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Drops desktop.ini file(s) 64 IoCs
  • Looks up external IP address via web service 2 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Drops autorun.inf file 1 TTPs

    Malware can abuse Windows Autorun to spread further via attached volumes.

  • Drops file in System32 directory 1 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 64 IoCs
  • Modifies Internet Explorer settings 1 TTPs 2 IoCs
    adwarespyware
  • Modifies registry class 11 IoCs
  • Runs net.exe
  • Suspicious behavior: EnumeratesProcesses 9 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 17 IoCs
  • Suspicious use of FindShellTrayWindow 30 IoCs
  • Suspicious use of SendNotifyMessage 53 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\Taleb.Ransom.exe
    "C:\Users\Admin\AppData\Local\Temp\Taleb.Ransom.exe"
    1⤵
    • Modifies extensions of user files
    • Drops startup file
    • Drops desktop.ini file(s)
    • Drops file in System32 directory
    • Drops file in Program Files directory
    • Drops file in Windows directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:1844
    • C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c net stop MSDTC
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:816
      • C:\Windows\SysWOW64\net.exe
        net stop MSDTC
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:1756
        • C:\Windows\SysWOW64\net1.exe
          C:\Windows\system32\net1 stop MSDTC
          4⤵
            PID:556
      • C:\Windows\SysWOW64\cmd.exe
        C:\Windows\system32\cmd.exe /c bcdedit /set {default} bootstatuspolicy ignoreallfailures
        2⤵
          PID:392
        • C:\Windows\SysWOW64\cmd.exe
          C:\Windows\system32\cmd.exe /c bcdedit /set {default} recoveryenabled no
          2⤵
            PID:2000
          • C:\Windows\SysWOW64\cmd.exe
            C:\Windows\system32\cmd.exe /c wbadmin delete catalog -quiet
            2⤵
              PID:2016
            • C:\Windows\SysWOW64\cmd.exe
              C:\Windows\system32\cmd.exe /c net stop SQLSERVERAGENT
              2⤵
              • Suspicious use of WriteProcessMemory
              PID:1824
              • C:\Windows\SysWOW64\net.exe
                net stop SQLSERVERAGENT
                3⤵
                • Suspicious use of WriteProcessMemory
                PID:1656
                • C:\Windows\SysWOW64\net1.exe
                  C:\Windows\system32\net1 stop SQLSERVERAGENT
                  4⤵
                    PID:1344
              • C:\Windows\SysWOW64\cmd.exe
                C:\Windows\system32\cmd.exe /c net stop MSSQLSERVER
                2⤵
                • Suspicious use of WriteProcessMemory
                PID:1996
                • C:\Windows\SysWOW64\net.exe
                  net stop MSSQLSERVER
                  3⤵
                  • Suspicious use of WriteProcessMemory
                  PID:1900
                  • C:\Windows\SysWOW64\net1.exe
                    C:\Windows\system32\net1 stop MSSQLSERVER
                    4⤵
                      PID:316
                • C:\Windows\SysWOW64\cmd.exe
                  C:\Windows\system32\cmd.exe /c net stop vds
                  2⤵
                  • Suspicious use of WriteProcessMemory
                  PID:1784
                  • C:\Windows\SysWOW64\net.exe
                    net stop vds
                    3⤵
                    • Suspicious use of WriteProcessMemory
                    PID:1540
                    • C:\Windows\SysWOW64\net1.exe
                      C:\Windows\system32\net1 stop vds
                      4⤵
                        PID:1556
                  • C:\Windows\SysWOW64\cmd.exe
                    C:\Windows\system32\cmd.exe /c netsh advfirewall set currentprofile state off
                    2⤵
                      PID:840
                      • C:\Windows\SysWOW64\netsh.exe
                        netsh advfirewall set currentprofile state off
                        3⤵
                          PID:2044
                      • C:\Windows\SysWOW64\cmd.exe
                        C:\Windows\system32\cmd.exe /c netsh firewall set opmode mode=disable
                        2⤵
                          PID:1504
                          • C:\Windows\SysWOW64\netsh.exe
                            netsh firewall set opmode mode=disable
                            3⤵
                              PID:832
                          • C:\Windows\SysWOW64\cmd.exe
                            C:\Windows\system32\cmd.exe /c net stop SQLWriter
                            2⤵
                              PID:1684
                              • C:\Windows\SysWOW64\net.exe
                                net stop SQLWriter
                                3⤵
                                  PID:560
                                  • C:\Windows\SysWOW64\net1.exe
                                    C:\Windows\system32\net1 stop SQLWriter
                                    4⤵
                                      PID:844
                                • C:\Windows\SysWOW64\cmd.exe
                                  C:\Windows\system32\cmd.exe /c net stop SQLBrowser
                                  2⤵
                                    PID:1524
                                    • C:\Windows\SysWOW64\net.exe
                                      net stop SQLBrowser
                                      3⤵
                                        PID:1756
                                        • C:\Windows\SysWOW64\net1.exe
                                          C:\Windows\system32\net1 stop SQLBrowser
                                          4⤵
                                            PID:1776
                                      • C:\Windows\SysWOW64\cmd.exe
                                        C:\Windows\system32\cmd.exe /c net stop MSSQLSERVER
                                        2⤵
                                          PID:1976
                                          • C:\Windows\SysWOW64\net.exe
                                            net stop MSSQLSERVER
                                            3⤵
                                              PID:1436
                                              • C:\Windows\SysWOW64\net1.exe
                                                C:\Windows\system32\net1 stop MSSQLSERVER
                                                4⤵
                                                  PID:2000
                                            • C:\Windows\SysWOW64\cmd.exe
                                              C:\Windows\system32\cmd.exe /c net stop MSSQL$CONTOSO1
                                              2⤵
                                                PID:1948
                                                • C:\Windows\SysWOW64\net.exe
                                                  net stop MSSQL$CONTOSO1
                                                  3⤵
                                                    PID:1820
                                                    • C:\Windows\SysWOW64\net1.exe
                                                      C:\Windows\system32\net1 stop MSSQL$CONTOSO1
                                                      4⤵
                                                        PID:308
                                                • C:\Windows\explorer.exe
                                                  "C:\Windows\explorer.exe"
                                                  1⤵
                                                    PID:1596
                                                  • C:\Windows\system32\AUDIODG.EXE
                                                    C:\Windows\system32\AUDIODG.EXE 0x18c
                                                    1⤵
                                                      PID:844
                                                    • C:\Windows\explorer.exe
                                                      explorer.exe
                                                      1⤵
                                                      • Drops desktop.ini file(s)
                                                      • Modifies Internet Explorer settings
                                                      • Modifies registry class
                                                      • Suspicious behavior: GetForegroundWindowSpam
                                                      • Suspicious use of AdjustPrivilegeToken
                                                      • Suspicious use of FindShellTrayWindow
                                                      • Suspicious use of SendNotifyMessage
                                                      • Suspicious use of SetWindowsHookEx
                                                      PID:840

                                                    Network

                                                    • flag-us
                                                      DNS
                                                      api.my-ip.io
                                                      Taleb.Ransom.exe
                                                      Remote address:
                                                      8.8.8.8:53
                                                      Request
                                                      api.my-ip.io
                                                      IN A
                                                      Response
                                                      api.my-ip.io
                                                      IN A
                                                      172.67.193.226
                                                      api.my-ip.io
                                                      IN A
                                                      104.21.68.98
                                                    • flag-us
                                                      GET
                                                      https://api.my-ip.io/ip
                                                      Taleb.Ransom.exe
                                                      Remote address:
                                                      172.67.193.226:443
                                                      Request
                                                      GET /ip HTTP/1.1
                                                      Host: api.my-ip.io
                                                      Accept: */*
                                                      Response
                                                      HTTP/1.1 200 OK
                                                      Date: Fri, 25 Mar 2022 07:00:43 GMT
                                                      Content-Type: text/plain; charset=utf-8
                                                      Content-Length: 12
                                                      Connection: keep-alive
                                                      Cache-Control: no-store,no-cache
                                                      Cache-Control: no-store, no-cache, must-revalidate, proxy-revalidate, max-age=0
                                                      pragma: no-cache
                                                      x-ip-type: IPv4
                                                      last-modified: Friday, 25-Mar-2022 07:00:43 GMT
                                                      CF-Cache-Status: DYNAMIC
                                                      Expect-CT: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
                                                      Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=F5jTRMR1qUYU7gBHWj1iO6ULMyNoWd8%2F9ZRWz2tKoh1bp8R4QnfA5XDbsAxQeAy2n1ISs5otrm3CVhrvMnfgrwPgtvvcyzR8%2FVMC8xiuwE3wdsdfXzQq8ZM8udPDf5U%3D"}],"group":"cf-nel","max_age":604800}
                                                      NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
                                                      Server: cloudflare
                                                      CF-RAY: 6f15c5690acc7276-HAM
                                                    • 127.0.0.1:49194
                                                      Taleb.Ransom.exe
                                                    • 127.0.0.1:49196
                                                      Taleb.Ransom.exe
                                                    • 172.67.193.226:443
                                                      https://api.my-ip.io/ip
                                                      tls, http
                                                      Taleb.Ransom.exe
                                                      681 B
                                                       4.1kB
                                                       7
                                                      8

                                                      HTTP Request

                                                      GET https://api.my-ip.io/ip

                                                      HTTP Response

                                                      200
                                                    • 8.8.8.8:53
                                                      api.my-ip.io
                                                      dns
                                                      Taleb.Ransom.exe
                                                      58 B
                                                       90 B
                                                       1
                                                      1

                                                      DNS Request

                                                      api.my-ip.io

                                                      DNS Response

                                                      172.67.193.226
                                                      104.21.68.98

                                                    MITRE ATT&CK Enterprise v6

                                                    Replay Monitor

                                                    Loading Replay Monitor...

                                                    Downloads

                                                    • memory/1596-87-0x000007FEFB8B1000-0x000007FEFB8B3000-memory.dmp

                                                      Filesize

                                                      8KB

                                                      Download

                                                    • memory/2044-71-0x0000000075611000-0x0000000075613000-memory.dmp

                                                      Filesize

                                                      8KB

                                                      Download

                                                    We care about your privacy.

                                                    This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.