Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

10

Static

static

478c116d9b...64.exe

windows7-x64

10

478c116d9b...64.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    143s
  • max time network
    114s
  • platform
    windows7_x64
  • resource
    win7-20220901-en
  • resource tags

    arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
  • submitted
    11/10/2022, 08:06

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    478c116d9bb318b4621c7839c81be36261c38e748a593249f8c9c67789f71064.exe

  • Size

    660KB

  • MD5

    affd7cfdd9720f8a044d5e9410923a78

  • SHA1

    80ac3f86c3a31c4516f9077f8c5e990de2068032

  • SHA256

    478c116d9bb318b4621c7839c81be36261c38e748a593249f8c9c67789f71064

  • SHA512

    5468ae683c5d5cf41ae8b961d40a02e827a226a2aa5845c74d20ef0f556145d737d3d8932b0dbae4ff69736c388a931f72a5f33a2775b1a9ac8717ce160b43de

  • SSDEEP

    12288:1kr/10xl0PFS4jwbIsO/arlTT6zncVUJ7vndkrh:+r/10xl04EOIH/cTT6DNGrh

Score
10/10
evasionransomwaretrojan

Malware Config

Extracted

Path

C:\Users\Admin\AppData\Local\Temp\info.hta

Ransom Note
All your files have been encrypted by Loki locker! All your files have been encrypted due to a security problem with your PC. If you want to restore them, please send an email [email protected] You have to pay for decryption in Bitcoin. The price depends on how fast you contact us. After payment we will send you the decryption tool. You have to 48 hours(2 Days) To contact or paying us After that, you have to Pay Double . In case of no answer in 24 hours (1 Day) write to this email [email protected] Your unique ID is : 1C64CDBA You only have LIMITED time to get back your files! If timer runs out and you dont pay us , all of files will be DELETED and you hard disk will be seriously DAMAGED. You will lose some of your data on day 2 in the timer. You can buy more time for pay. Just email us. THIS IS NOT A JOKE! you can wait for the timer to run out ,and watch deletion of your files :) What is our decryption guarantee? Before paying you can send us up to for free decryption. The total size of files must be less than 2Mb (non archived), and files should not contain valuable information. (databases,backups, large excel sheets, etc.) Attention! DO NOT pay any money before decrypting the test files. DO NOT trust any intermediary. they wont help you and you may be victim of scam. just email us , we help you in any steps. DO NOT reply to other emails. ONLY this two emails can help you. Do not rename encrypted files. Do not try to decrypt your data using third party software, it may cause permanent data loss. Decryption of your files with the help of third parties may cause increased price (they add their fee to our) or you can become a victim of a scam.

Signatures

  • Modifies Windows Defender Real-time Protection settings 3 TTPs 5 IoCs
    evasiontrojan
  • Deletes shadow copies 2 TTPs

    Ransomware often targets backup files to inhibit system recovery.

    ransomware
  • Disables Task Manager via registry modification
    evasion
  • Modifies Windows Firewall 1 TTPs 2 IoCs
    evasion
  • Drops startup file 3 IoCs
  • Drops desktop.ini file(s) 38 IoCs
  • Enumerates connected drives 3 TTPs 1 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Looks up external IP address via web service 1 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Sets desktop wallpaper using registry 2 TTPs 1 IoCs
    ransomware
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Creates scheduled task(s) 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistence
  • Interacts with shadow copies 2 TTPs 1 IoCs

    Shadow copies are often targeted by ransomware to inhibit system recovery.

    ransomware
  • Modifies Control Panel 2 IoCs
    evasion
  • Modifies Internet Explorer settings 1 TTPs 5 IoCs
    adwarespyware
  • Modifies registry class 7 IoCs
  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious use of AdjustPrivilegeToken 45 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • System policy modification 1 TTPs 2 IoCs
    evasion

Processes

  • C:\Users\Admin\AppData\Local\Temp\478c116d9bb318b4621c7839c81be36261c38e748a593249f8c9c67789f71064.exe
    "C:\Users\Admin\AppData\Local\Temp\478c116d9bb318b4621c7839c81be36261c38e748a593249f8c9c67789f71064.exe"
    1⤵
    • Modifies Windows Defender Real-time Protection settings
    • Drops startup file
    • Drops desktop.ini file(s)
    • Enumerates connected drives
    • Sets desktop wallpaper using registry
    • Drops file in Program Files directory
    • Drops file in Windows directory
    • Modifies Control Panel
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    • System policy modification
    PID:1696
    • C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /C schtasks /CREATE /SC ONLOGON /TN Loki /TR C:\Users\Admin\AppData\Roaming\winlogon.exe /RU SYSTEM /RL HIGHEST /F
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:1680
      • C:\Windows\SysWOW64\schtasks.exe
        schtasks /CREATE /SC ONLOGON /TN Loki /TR C:\Users\Admin\AppData\Roaming\winlogon.exe /RU SYSTEM /RL HIGHEST /F
        3⤵
        • Creates scheduled task(s)
        PID:1732
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\izh41bvl\izh41bvl.cmdline"
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:1352
      • C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES1FA2.tmp" "c:\ProgramData\CSCCC1C899C40E24C1DA44BF9DF4F7E3E1F.TMP"
        3⤵
          PID:568
      • C:\Windows\SysWOW64\cmd.exe
        "C:\Windows\System32\cmd.exe" /C vssadmin delete shadows /all /quiet
        2⤵
        • Suspicious use of WriteProcessMemory
        PID:1752
        • C:\Windows\SysWOW64\vssadmin.exe
          vssadmin delete shadows /all /quiet
          3⤵
          • Interacts with shadow copies
          PID:596
      • C:\Windows\SysWOW64\cmd.exe
        "C:\Windows\System32\cmd.exe" /C wbadmin DELETE SYSTEMSTATEBACKUP
        2⤵
          PID:1448
        • C:\Windows\SysWOW64\cmd.exe
          "C:\Windows\System32\cmd.exe" /C wmic shadowcopy delete
          2⤵
          • Suspicious use of WriteProcessMemory
          PID:2044
          • C:\Windows\SysWOW64\Wbem\WMIC.exe
            wmic shadowcopy delete
            3⤵
            • Suspicious use of AdjustPrivilegeToken
            PID:2000
        • C:\Windows\SysWOW64\cmd.exe
          "C:\Windows\System32\cmd.exe" /C bcdedit /set {default} bootstatuspolicy ignoreallfailures
          2⤵
            PID:1476
          • C:\Windows\SysWOW64\cmd.exe
            "C:\Windows\System32\cmd.exe" /C wbadmin delete catalog -quiet
            2⤵
              PID:1144
            • C:\Windows\SysWOW64\cmd.exe
              "C:\Windows\System32\cmd.exe" /C netsh firewall set opmode mode=disable
              2⤵
              • Suspicious use of WriteProcessMemory
              PID:1924
              • C:\Windows\SysWOW64\netsh.exe
                netsh firewall set opmode mode=disable
                3⤵
                • Modifies Windows Firewall
                PID:744
            • C:\Windows\SysWOW64\cmd.exe
              "C:\Windows\System32\cmd.exe" /C netsh advfirewall set currentprofile state off
              2⤵
              • Suspicious use of WriteProcessMemory
              PID:1996
              • C:\Windows\SysWOW64\netsh.exe
                netsh advfirewall set currentprofile state off
                3⤵
                • Modifies Windows Firewall
                PID:1512
            • C:\Windows\SysWOW64\cmd.exe
              "C:\Windows\System32\cmd.exe" /C bcdedit /set {default} recoveryenabled no
              2⤵
                PID:1536
              • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Command "Get-ADComputer -filter * -Searchbase '%s' | foreach{ Invoke-GPUpdate -computer $_.name -force -RandomDelayInMinutes 0}"
                2⤵
                • Suspicious behavior: EnumeratesProcesses
                • Suspicious use of AdjustPrivilegeToken
                PID:2000
              • C:\Windows\SysWOW64\mshta.exe
                "C:\Windows\SysWOW64\mshta.exe" "C:\Users\Admin\AppData\Local\Temp\info.hta"
                2⤵
                • Modifies Internet Explorer settings
                PID:2944
              • C:\Windows\SysWOW64\mshta.exe
                "C:\Windows\SysWOW64\mshta.exe" "C:\Users\Admin\AppData\Local\Temp\info.hta"
                2⤵
                • Modifies Internet Explorer settings
                PID:2960
              • C:\Windows\SysWOW64\mshta.exe
                "C:\Windows\SysWOW64\mshta.exe" "C:\Users\Admin\AppData\Local\Temp\info.hta"
                2⤵
                • Modifies Internet Explorer settings
                PID:2976
              • C:\Windows\SysWOW64\mshta.exe
                "C:\Windows\SysWOW64\mshta.exe" "C:\Users\Admin\AppData\Local\Temp\info.hta"
                2⤵
                • Modifies Internet Explorer settings
                PID:2992
              • C:\Windows\SysWOW64\mshta.exe
                "C:\Windows\SysWOW64\mshta.exe" "C:\Users\Admin\AppData\Local\Temp\info.hta"
                2⤵
                • Modifies Internet Explorer settings
                PID:3008
              • C:\Windows\SysWOW64\cmd.exe
                "C:\Windows\System32\cmd.exe" /C defrag /C /H
                2⤵
                  PID:3020
              • C:\Windows\system32\vssvc.exe
                C:\Windows\system32\vssvc.exe
                1⤵
                • Suspicious use of AdjustPrivilegeToken
                PID:432

              Network

              MITRE ATT&CK Enterprise v6

              Replay Monitor

              Loading Replay Monitor...

              Downloads

              • C:\ProgramData\atvswilc.exe
                Filesize

                28KB

                MD5

                e744671af571c55ea42ce9b6cf7adfca

                SHA1

                6fb7293b09d34d2c4df9cdba2b42611ed3fa7bc0

                SHA256

                6669ab0d4ad7648a50ed3c95e6f9a4f770f978c3d3003d0a436ca3126fd551c1

                SHA512

                9ecb0183c79f1d7dc112dc122c3afe38a323a4bec7a7374c3c7200573208e713dcbdc816bf9f49014b0c9fcf4a2dfe1c7b9596fb05db2c2a853e86e131cf03fb

                Download Submit

              • C:\Users\Admin\AppData\Local\Temp\RES1FA2.tmp
                Filesize

                25KB

                MD5

                bb08722d65c7fa30404b68bfad981492

                SHA1

                bcc7fa089168f0dc16f0c7512fe0993ba8376ec4

                SHA256

                315755aa2ea016daf5605adf7608aa4db36223b5897cb48061764c5c06bf41f4

                SHA512

                def1cccc64c247dedb268b594baa2e6f79804195997d27135533cdfb05e9050b4c62aff8cc9caff33a7e25b0b222a99a5e3e034237b266aa3d907d6daeb89089

                Download Submit

              • C:\Users\Admin\AppData\Local\Temp\info.hta
                Filesize

                6KB

                MD5

                45363e9bfe49f94b46fe12910038abee

                SHA1

                609118687551a3ab085283d4ed3fcce78d387bb1

                SHA256

                53f1746f45c873afa8635acc75be01fda8b293ec9adcb6117237cdd97e2ad97d

                SHA512

                a97ef0f22891e5da942678496df8fd061c4ee2399a1fe748d774bc5626e785438706dad8afcec24a1a7bccc67d3092ea10e76fbae5307b430cbaf288e79fe180

                Download Submit

              • \??\c:\ProgramData\CSCCC1C899C40E24C1DA44BF9DF4F7E3E1F.TMP
                Filesize

                24KB

                MD5

                a163a95dceddfc429903a7d93d75f8a3

                SHA1

                2d3b5b400f3d0aafd46bcd5cc8ca87c11f50640e

                SHA256

                cef7fb3ba3768478c0cd355c81d5c203744681720408b54a1c8e86bbb5ca1d6d

                SHA512

                0f3902ad1a51adacd51b4b896d4abab871d32f80f63dc9236be7e25fb95414e7dfc5af69e84440349196ec986b115244c53e078ee01cdb76b2ff5089596b0645

                Download Submit

              • \??\c:\Users\Admin\AppData\Local\Temp\1gn3xddo.ico
                Filesize

                23KB

                MD5

                8c9a5448905c6ad6f5a15ad8f102fa56

                SHA1

                185575a9708fe9ff122423e459eeed7098ad11d4

                SHA256

                fc65491d373c30593f9ef53d83959625dc384bc42d551aa77a666d4e9b538104

                SHA512

                2032d1f19ac0734339626531cd77ce0509dbba93260c87505d20998ab66aa3dceee4c94e10d8620cdcc62eacf9e63bbe5357afa2a09abdaa51ca0fde8b9aed50

                Download Submit

              • \??\c:\Users\Admin\AppData\Local\Temp\izh41bvl\izh41bvl.0.cs
                Filesize

                1KB

                MD5

                5b6f82c2d959a2537f9bd0f3ed20aa0c

                SHA1

                05ea352ae5ee942f3c7d031b019ed41eba392d6c

                SHA256

                754d3a014bc3368cbd9fd933d02ed5542771252cb9be35e5be4ed800c110decf

                SHA512

                45ce82ac3ffe9b01a92614bea8911767b356d3dfd8b21e85effedd94e26843539eba54c608c7a13f140ab03a7e8352c4f8fe97ded022e9e0817894fc15245e7e

                Download Submit

              • \??\c:\Users\Admin\AppData\Local\Temp\izh41bvl\izh41bvl.cmdline
                Filesize

                236B

                MD5

                298bbea758e6e5a9813b0a944339ff1b

                SHA1

                7de28052ef83269837628f06e84f885389a0c460

                SHA256

                097dfa66c86230ebfe978dd595bcdd33b6797afd45ffa2ad7e05a5105db2e996

                SHA512

                ac558226e5416648a967d24c7f16c1a6f484bbefd6556e6f096073eea30414eb16ac92cfd8ae460561af83cd0282b9c0cc3ddc13e7122d4ea600be7dff2fad30

                Download Submit

              • memory/1696-55-0x00000000766D1000-0x00000000766D3000-memory.dmp

                Filesize

                8KB

                Download

              • memory/1696-66-0x0000000000B90000-0x0000000000BAA000-memory.dmp

                Filesize

                104KB

                Download

              • memory/1696-54-0x0000000001000000-0x00000000010A6000-memory.dmp

                Filesize

                664KB

                Download

              • memory/2000-83-0x000000006E190000-0x000000006E73B000-memory.dmp

                Filesize

                5.7MB

                Download

              • memory/2000-84-0x000000006E190000-0x000000006E73B000-memory.dmp

                Filesize

                5.7MB

                Download