Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    54s
  • max time network
    136s
  • platform
    windows7_x64
  • resource
    win7-20220901-en
  • resource tags

    arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
  • submitted
    24/09/2022, 08:24

General

  • Target

    file.exe

  • Size

    715KB

  • MD5

    a7758558b4b7cc054abceff13adab239

  • SHA1

    971192ff22f27861738bb90255a075c7e7c66d48

  • SHA256

    cca18e1650fa82f0233dbf8a897793d3e5f8d258d4ce76e7915c63cc5efcabb0

  • SHA512

    354a67af02df29e35e6a9547f88dcd8ac82ce9640f6675ba0f0a540de92940f409014cf3095d96b4a3d025479d4d6ce3961134e51e11dbe69b541d8786516070

  • SSDEEP

    12288:q5ld/CHz3WbTMehxSNz1olkgcgAwASHoVpZpSwJEEVPqKXgx2sU01u1r:OdaTiMehxaEcgAzyoVprS1EdqBpU01u

Malware Config

Extracted

Family

djvu

C2

http://winnlinne.com/test3/get.php

Attributes
  • extension

    .ofoq

  • offline_id

    xkNzhkB1wvgoDI7Uo0HPNLY3qCuwoFpP7nlhlut1

  • payload_url

    http://rgyui.top/dl/build2.exe

    http://winnlinne.com/files/1/build3.exe

  • ransomnote

    ATTENTION! Don't worry, you can return all your files! All your files like pictures, databases, documents and other important are encrypted with strongest encryption and unique key. The only method of recovering files is to purchase decrypt tool and unique key for you. This software will decrypt all your encrypted files. What guarantees you have? You can send one of your encrypted file from your PC and we decrypt it for free. But we can decrypt only 1 file for free. File must not contain valuable information. You can get and look video overview decrypt tool: https://we.tl/t-EWKSsSJiVn Price of private key and decrypt software is $980. Discount 50% available if you contact us first 72 hours, that's price for you is $490. Please note that you'll never restore your data without payment. Check your e-mail "Spam" or "Junk" folder if you don't get answer more than 6 hours. To get this software you need write on our e-mail: [email protected] Reserve e-mail address to contact us: [email protected] Your personal ID: 0568Jhyjd

rsa_pubkey.plain

Extracted

Family

vidar

Version

54.6

Botnet

517

C2

https://t.me/huobiinside

https://mas.to/@kyriazhs1975

Attributes
  • profile_id

    517

Signatures

  • Detected Djvu ransomware 10 IoCs
  • Djvu Ransomware

    Ransomware which is a variant of the STOP family.

  • Vidar

    Vidar is an infostealer based on Arkei stealer.

  • Downloads MZ/PE file
  • Executes dropped EXE 4 IoCs
  • Loads dropped DLL 6 IoCs
  • Modifies file permissions 1 TTPs 1 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Accesses 2FA software files, possible credential harvesting 2 TTPs
  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Looks up external IP address via web service 3 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext 3 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Creates scheduled task(s) 1 TTPs 2 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Delays execution with timeout.exe 1 IoCs
  • Kills process with taskkill 1 IoCs
  • Modifies system certificate store 2 TTPs 11 IoCs
  • Suspicious behavior: EnumeratesProcesses 5 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\file.exe
    "C:\Users\Admin\AppData\Local\Temp\file.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious use of WriteProcessMemory
    PID:1268
    • C:\Users\Admin\AppData\Local\Temp\file.exe
      "C:\Users\Admin\AppData\Local\Temp\file.exe"
      2⤵
      • Adds Run key to start application
      • Modifies system certificate store
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of WriteProcessMemory
      PID:824
      • C:\Windows\SysWOW64\icacls.exe
        icacls "C:\Users\Admin\AppData\Local\a72658e2-26ee-4c12-ba05-5b721c111b8e" /deny *S-1-1-0:(OI)(CI)(DE,DC)
        3⤵
        • Modifies file permissions
        PID:1328
      • C:\Users\Admin\AppData\Local\Temp\file.exe
        "C:\Users\Admin\AppData\Local\Temp\file.exe" --Admin IsNotAutoStart IsNotTask
        3⤵
        • Suspicious use of SetThreadContext
        • Suspicious use of WriteProcessMemory
        PID:112
        • C:\Users\Admin\AppData\Local\Temp\file.exe
          "C:\Users\Admin\AppData\Local\Temp\file.exe" --Admin IsNotAutoStart IsNotTask
          4⤵
          • Loads dropped DLL
          • Modifies system certificate store
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of WriteProcessMemory
          PID:1992
          • C:\Users\Admin\AppData\Local\39fe7447-1101-4759-abbc-12cff71ef5fd\build2.exe
            "C:\Users\Admin\AppData\Local\39fe7447-1101-4759-abbc-12cff71ef5fd\build2.exe"
            5⤵
            • Executes dropped EXE
            • Suspicious use of SetThreadContext
            • Suspicious use of WriteProcessMemory
            PID:1688
            • C:\Users\Admin\AppData\Local\39fe7447-1101-4759-abbc-12cff71ef5fd\build2.exe
              "C:\Users\Admin\AppData\Local\39fe7447-1101-4759-abbc-12cff71ef5fd\build2.exe"
              6⤵
              • Executes dropped EXE
              • Loads dropped DLL
              • Checks processor information in registry
              • Modifies system certificate store
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of WriteProcessMemory
              PID:1620
              • C:\Windows\SysWOW64\cmd.exe
                "C:\Windows\System32\cmd.exe" k/c taskkill /im build2.exe /f & timeout /t 6 & del /f /q "C:\Users\Admin\AppData\Local\39fe7447-1101-4759-abbc-12cff71ef5fd\build2.exe" & del C:\PrograData\*.dll & exit
                7⤵
                • Suspicious use of WriteProcessMemory
                PID:1728
                • C:\Windows\SysWOW64\taskkill.exe
                  taskkill /im build2.exe /f
                  8⤵
                  • Kills process with taskkill
                  • Suspicious use of AdjustPrivilegeToken
                  PID:1972
                • C:\Windows\SysWOW64\timeout.exe
                  timeout /t 6
                  8⤵
                  • Delays execution with timeout.exe
                  PID:576
          • C:\Users\Admin\AppData\Local\39fe7447-1101-4759-abbc-12cff71ef5fd\build3.exe
            "C:\Users\Admin\AppData\Local\39fe7447-1101-4759-abbc-12cff71ef5fd\build3.exe"
            5⤵
            • Executes dropped EXE
            • Suspicious use of WriteProcessMemory
            PID:396
            • C:\Windows\SysWOW64\schtasks.exe
              /C /create /F /sc minute /mo 1 /tn "Azure-Update-Task" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe"
              6⤵
              • Creates scheduled task(s)
              PID:992
  • C:\Windows\system32\taskeng.exe
    taskeng.exe {576BF8DB-12AE-4173-B698-1235AECB279E} S-1-5-21-4063495947-34355257-727531523-1000:RYNKSFQE\Admin:Interactive:[1]
    1⤵
      PID:2004
      • C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
        C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
        2⤵
        • Executes dropped EXE
        PID:1472
        • C:\Windows\SysWOW64\schtasks.exe
          /C /create /F /sc minute /mo 1 /tn "Azure-Update-Task" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe"
          3⤵
          • Creates scheduled task(s)
          PID:1700

    Network

    MITRE ATT&CK Enterprise v6

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\07CEF2F654E3ED6050FFC9B6EB844250_3431D4C539FB2CFCB781821E9902850D

      Filesize

      2KB

      MD5

      32958182234a80a5b2589418864f6117

      SHA1

      598276140fd27d8931dbe02625e3378ad9085b8d

      SHA256

      a6f4c0928ecef1052acb557bf148d4d06206afaa0d334d30ef676d8b4b89fdb2

      SHA512

      04157e1f291fb8e11e8134fa321d6473ff7ed55c7848170ac9c6db4dd9e42d8303c40746ce56f4112f26c5ea730703ad00fa52fdf57377c81221473210e49dfa

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B2FAF7692FD9FFBD64EDE317E42334BA_D7393C8F62BDE4D4CB606228BC7A711E

      Filesize

      1KB

      MD5

      0d870ca424457579d4bd345ac1ec6c3c

      SHA1

      fc3d8924e13b4fc5eca7cabd4967eea3d4db1690

      SHA256

      cf9df8d62ec78ca20a50633047af6c913dc2d10f15823795e8d86042c7b05ed0

      SHA512

      a1e731ae03b1a2259f8e1afc86058aabb3b8ce3b0141f08ea18b6c7003c55aeb135d40bba38ebf1f76174eb1ad758fbec10841dee1ed704fb0285e36b2f7d66b

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\07CEF2F654E3ED6050FFC9B6EB844250_3431D4C539FB2CFCB781821E9902850D

      Filesize

      488B

      MD5

      059764c00e8ad1d25c0b66a2a2af14f8

      SHA1

      317cccc639566364cb8bb62f427bdb7201f5d497

      SHA256

      9fbe08cb92dff44a441a264da23590fe7d4f6685330a0ce904025275aa30980b

      SHA512

      2f3f6e2ab48f9a0a22262e3ffbf1cbfd0d93e1db8741e706cec2093509c0c9561022ef607a99575b269845b8620e04b19662ed043d39c1acff38c445d7bcdb1c

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

      Filesize

      344B

      MD5

      efbce9e6dc6fa2bf085b8a33ca9f2f0d

      SHA1

      abb35960cbe3e86d520a8d1e4d18c727144cb2e8

      SHA256

      6985dde009168a79533e7edcd03b12658fbd628078372f712e2d10db53b29cfb

      SHA512

      d2ae673ae13bb4c9c127d8d5cd1bb0d7a9a00e977ea8ec217f1e081ec00e0ee50db3c0304b4d5180e60c3aac931b70e0287b7843484f940eaaf129733b8d710d

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B2FAF7692FD9FFBD64EDE317E42334BA_D7393C8F62BDE4D4CB606228BC7A711E

      Filesize

      482B

      MD5

      19a3e9242b149f8793b59ef4cea5be71

      SHA1

      66786bcdcd7705b3daacc29809fbbe0cc4a3ecbc

      SHA256

      7f8e49f868b906ec8e9affec938a444f530d7069cdf81953c032fb4c66874a2e

      SHA512

      8c5ee29ba6c65d6461170d3f761514692eca17ed899194972091f9a61f39d24f7e58832ce8933e56e2645780ced8f0b7e0d32f40eaa298eb6416bdb10975911a

    • C:\Users\Admin\AppData\Local\39fe7447-1101-4759-abbc-12cff71ef5fd\build2.exe

      Filesize

      246KB

      MD5

      4e08ecaa075b90f30327bf200d23130b

      SHA1

      f7b67a7abbe3815bd758933f7c4712bd4d4ec4b2

      SHA256

      6c11af0bbd346329224255d38a07fb9db5828881d3520ab4623c7a5fc09ecd47

      SHA512

      e7deeafe000b034cd4d71776cd1285e33d295a830f3459506dd7332e8c1c61b43ec2fdc406c22ba5262aa62a795421492f7e54602bfe08102b8b2a000d150bb7

    • C:\Users\Admin\AppData\Local\39fe7447-1101-4759-abbc-12cff71ef5fd\build2.exe

      Filesize

      246KB

      MD5

      4e08ecaa075b90f30327bf200d23130b

      SHA1

      f7b67a7abbe3815bd758933f7c4712bd4d4ec4b2

      SHA256

      6c11af0bbd346329224255d38a07fb9db5828881d3520ab4623c7a5fc09ecd47

      SHA512

      e7deeafe000b034cd4d71776cd1285e33d295a830f3459506dd7332e8c1c61b43ec2fdc406c22ba5262aa62a795421492f7e54602bfe08102b8b2a000d150bb7

    • C:\Users\Admin\AppData\Local\39fe7447-1101-4759-abbc-12cff71ef5fd\build2.exe

      Filesize

      246KB

      MD5

      4e08ecaa075b90f30327bf200d23130b

      SHA1

      f7b67a7abbe3815bd758933f7c4712bd4d4ec4b2

      SHA256

      6c11af0bbd346329224255d38a07fb9db5828881d3520ab4623c7a5fc09ecd47

      SHA512

      e7deeafe000b034cd4d71776cd1285e33d295a830f3459506dd7332e8c1c61b43ec2fdc406c22ba5262aa62a795421492f7e54602bfe08102b8b2a000d150bb7

    • C:\Users\Admin\AppData\Local\39fe7447-1101-4759-abbc-12cff71ef5fd\build3.exe

      Filesize

      9KB

      MD5

      9ead10c08e72ae41921191f8db39bc16

      SHA1

      abe3bce01cd34afc88e2c838173f8c2bd0090ae1

      SHA256

      8d7f0e6b6877bdfb9f4531afafd0451f7d17f0ac24e2f2427e9b4ecc5452b9f0

      SHA512

      aa35dbc59a3589df2763e76a495ce5a9e62196628b4c1d098add38bd7f27c49edf93a66fb8507fb746e37ee32932da2460e440f241abe1a5a279abcc1e5ffe4a

    • C:\Users\Admin\AppData\Local\39fe7447-1101-4759-abbc-12cff71ef5fd\build3.exe

      Filesize

      9KB

      MD5

      9ead10c08e72ae41921191f8db39bc16

      SHA1

      abe3bce01cd34afc88e2c838173f8c2bd0090ae1

      SHA256

      8d7f0e6b6877bdfb9f4531afafd0451f7d17f0ac24e2f2427e9b4ecc5452b9f0

      SHA512

      aa35dbc59a3589df2763e76a495ce5a9e62196628b4c1d098add38bd7f27c49edf93a66fb8507fb746e37ee32932da2460e440f241abe1a5a279abcc1e5ffe4a

    • C:\Users\Admin\AppData\Local\a72658e2-26ee-4c12-ba05-5b721c111b8e\file.exe

      Filesize

      715KB

      MD5

      a7758558b4b7cc054abceff13adab239

      SHA1

      971192ff22f27861738bb90255a075c7e7c66d48

      SHA256

      cca18e1650fa82f0233dbf8a897793d3e5f8d258d4ce76e7915c63cc5efcabb0

      SHA512

      354a67af02df29e35e6a9547f88dcd8ac82ce9640f6675ba0f0a540de92940f409014cf3095d96b4a3d025479d4d6ce3961134e51e11dbe69b541d8786516070

    • C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe

      Filesize

      9KB

      MD5

      9ead10c08e72ae41921191f8db39bc16

      SHA1

      abe3bce01cd34afc88e2c838173f8c2bd0090ae1

      SHA256

      8d7f0e6b6877bdfb9f4531afafd0451f7d17f0ac24e2f2427e9b4ecc5452b9f0

      SHA512

      aa35dbc59a3589df2763e76a495ce5a9e62196628b4c1d098add38bd7f27c49edf93a66fb8507fb746e37ee32932da2460e440f241abe1a5a279abcc1e5ffe4a

    • C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe

      Filesize

      9KB

      MD5

      9ead10c08e72ae41921191f8db39bc16

      SHA1

      abe3bce01cd34afc88e2c838173f8c2bd0090ae1

      SHA256

      8d7f0e6b6877bdfb9f4531afafd0451f7d17f0ac24e2f2427e9b4ecc5452b9f0

      SHA512

      aa35dbc59a3589df2763e76a495ce5a9e62196628b4c1d098add38bd7f27c49edf93a66fb8507fb746e37ee32932da2460e440f241abe1a5a279abcc1e5ffe4a

    • \ProgramData\mozglue.dll

      Filesize

      593KB

      MD5

      c8fd9be83bc728cc04beffafc2907fe9

      SHA1

      95ab9f701e0024cedfbd312bcfe4e726744c4f2e

      SHA256

      ba06a6ee0b15f5be5c4e67782eec8b521e36c107a329093ec400fe0404eb196a

      SHA512

      fbb446f4a27ef510e616caad52945d6c9cc1fd063812c41947e579ec2b54df57c6dc46237ded80fca5847f38cbe1747a6c66a13e2c8c19c664a72be35eb8b040

    • \ProgramData\nss3.dll

      Filesize

      2.0MB

      MD5

      1cc453cdf74f31e4d913ff9c10acdde2

      SHA1

      6e85eae544d6e965f15fa5c39700fa7202f3aafe

      SHA256

      ac5c92fe6c51cfa742e475215b83b3e11a4379820043263bf50d4068686c6fa5

      SHA512

      dd9ff4e06b00dc831439bab11c10e9b2ae864ea6e780d3835ea7468818f35439f352ef137da111efcdf2bb6465f6ca486719451bf6cf32c6a4420a56b1d64571

    • \Users\Admin\AppData\Local\39fe7447-1101-4759-abbc-12cff71ef5fd\build2.exe

      Filesize

      246KB

      MD5

      4e08ecaa075b90f30327bf200d23130b

      SHA1

      f7b67a7abbe3815bd758933f7c4712bd4d4ec4b2

      SHA256

      6c11af0bbd346329224255d38a07fb9db5828881d3520ab4623c7a5fc09ecd47

      SHA512

      e7deeafe000b034cd4d71776cd1285e33d295a830f3459506dd7332e8c1c61b43ec2fdc406c22ba5262aa62a795421492f7e54602bfe08102b8b2a000d150bb7

    • \Users\Admin\AppData\Local\39fe7447-1101-4759-abbc-12cff71ef5fd\build2.exe

      Filesize

      246KB

      MD5

      4e08ecaa075b90f30327bf200d23130b

      SHA1

      f7b67a7abbe3815bd758933f7c4712bd4d4ec4b2

      SHA256

      6c11af0bbd346329224255d38a07fb9db5828881d3520ab4623c7a5fc09ecd47

      SHA512

      e7deeafe000b034cd4d71776cd1285e33d295a830f3459506dd7332e8c1c61b43ec2fdc406c22ba5262aa62a795421492f7e54602bfe08102b8b2a000d150bb7

    • \Users\Admin\AppData\Local\39fe7447-1101-4759-abbc-12cff71ef5fd\build3.exe

      Filesize

      9KB

      MD5

      9ead10c08e72ae41921191f8db39bc16

      SHA1

      abe3bce01cd34afc88e2c838173f8c2bd0090ae1

      SHA256

      8d7f0e6b6877bdfb9f4531afafd0451f7d17f0ac24e2f2427e9b4ecc5452b9f0

      SHA512

      aa35dbc59a3589df2763e76a495ce5a9e62196628b4c1d098add38bd7f27c49edf93a66fb8507fb746e37ee32932da2460e440f241abe1a5a279abcc1e5ffe4a

    • \Users\Admin\AppData\Local\39fe7447-1101-4759-abbc-12cff71ef5fd\build3.exe

      Filesize

      9KB

      MD5

      9ead10c08e72ae41921191f8db39bc16

      SHA1

      abe3bce01cd34afc88e2c838173f8c2bd0090ae1

      SHA256

      8d7f0e6b6877bdfb9f4531afafd0451f7d17f0ac24e2f2427e9b4ecc5452b9f0

      SHA512

      aa35dbc59a3589df2763e76a495ce5a9e62196628b4c1d098add38bd7f27c49edf93a66fb8507fb746e37ee32932da2460e440f241abe1a5a279abcc1e5ffe4a

    • memory/112-71-0x0000000000270000-0x0000000000302000-memory.dmp

      Filesize

      584KB

    • memory/112-67-0x0000000000270000-0x0000000000302000-memory.dmp

      Filesize

      584KB

    • memory/824-60-0x00000000757A1000-0x00000000757A3000-memory.dmp

      Filesize

      8KB

    • memory/824-66-0x0000000000400000-0x0000000000537000-memory.dmp

      Filesize

      1.2MB

    • memory/824-62-0x0000000000400000-0x0000000000537000-memory.dmp

      Filesize

      1.2MB

    • memory/824-61-0x0000000000400000-0x0000000000537000-memory.dmp

      Filesize

      1.2MB

    • memory/824-55-0x0000000000400000-0x0000000000537000-memory.dmp

      Filesize

      1.2MB

    • memory/1268-54-0x0000000000220000-0x00000000002B2000-memory.dmp

      Filesize

      584KB

    • memory/1268-58-0x0000000000220000-0x00000000002B2000-memory.dmp

      Filesize

      584KB

    • memory/1268-59-0x0000000000610000-0x000000000072B000-memory.dmp

      Filesize

      1.1MB

    • memory/1620-92-0x0000000000400000-0x000000000045B000-memory.dmp

      Filesize

      364KB

    • memory/1620-122-0x0000000000400000-0x000000000045B000-memory.dmp

      Filesize

      364KB

    • memory/1620-99-0x0000000000400000-0x000000000045B000-memory.dmp

      Filesize

      364KB

    • memory/1620-100-0x0000000000400000-0x000000000045B000-memory.dmp

      Filesize

      364KB

    • memory/1620-101-0x0000000061E00000-0x0000000061EF3000-memory.dmp

      Filesize

      972KB

    • memory/1688-97-0x0000000000230000-0x0000000000277000-memory.dmp

      Filesize

      284KB

    • memory/1688-95-0x00000000006EB000-0x0000000000715000-memory.dmp

      Filesize

      168KB

    • memory/1992-79-0x0000000000400000-0x0000000000537000-memory.dmp

      Filesize

      1.2MB

    • memory/1992-125-0x0000000000400000-0x0000000000537000-memory.dmp

      Filesize

      1.2MB

    • memory/1992-73-0x0000000000400000-0x0000000000537000-memory.dmp

      Filesize

      1.2MB