Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

10

Static

static

8

Trojan-Ran...er.exe

windows7-x64

10

Trojan-Ran...er.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    148s
  • max time network
    154s
  • platform
    windows7_x64
  • resource
    win7-20220901-en
  • resource tags

    arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
  • submitted
    07/11/2022, 04:01

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    Trojan-Ransom.Win32.Blocker.exe

  • Size

    715KB

  • MD5

    9922bb2013d45d0131cc27ab65dde265

  • SHA1

    c8a0a3179794a2d444e4417a747029ad2acd9aba

  • SHA256

    b6e528d6ee93b9ddf32c5b9cb460f9e45b2a1870524579a128f9409541cf35b4

  • SHA512

    d3c1707deb82d11806c3dc9cb81673bbeace140407a67f532136d6059dab7965a01a67a2d2165a8d52a3385c8afbe206eea402bca1c63bac2fe14a78e55240e8

  • SSDEEP

    1536:+EfFNvtgmAl7z5dKY6yuJPW8K43w9NXOM1aRl/i6JWT0S9yXnBibnouy8gHn2JX:+YLmGO4W849NXO9RlK6gOxiDouto2N

Score
10/10
evasionpersistencespywarestealertrojanupx

Malware Config

Signatures

  • Modifies firewall policy service 2 TTPs 14 IoCs
    evasion
  • Modifies security service 2 TTPs 1 IoCs
    evasion
  • Modifies visibility of file extensions in Explorer 2 TTPs 1 IoCs
    evasion
  • Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs
    evasion
  • UAC bypass 3 TTPs 3 IoCs
    evasiontrojan
  • Windows security bypass 2 TTPs 4 IoCs
    evasiontrojan
  • Disables RegEdit via registry modification 1 IoCs
    evasion
  • Disables Task Manager via registry modification
    evasion
  • Drops file in Drivers directory 1 IoCs
  • Executes dropped EXE 2 IoCs
  • Sets file execution options in registry 2 TTPs 64 IoCs
    persistence
  • UPX packed file 11 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Loads dropped DLL 2 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Windows security modification 2 TTPs 15 IoCs
    evasiontrojan
  • Checks whether UAC is enabled 1 TTPs 1 IoCs
    evasiontrojan
  • Suspicious use of SetThreadContext 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Modifies Control Panel 2 IoCs
    evasion
  • Modifies Internet Explorer settings 1 TTPs 61 IoCs
    adwarespyware
  • Modifies Internet Explorer start page 1 TTPs 2 IoCs
    stealer
  • Modifies registry class 24 IoCs
  • Modifies system certificate store 2 TTPs 5 IoCs
    evasionspywaretrojan
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SetWindowsHookEx 7 IoCs
  • Suspicious use of WriteProcessMemory 17 IoCs
  • System policy modification 1 TTPs 4 IoCs
    evasion

Processes

  • C:\Users\Admin\AppData\Local\Temp\Trojan-Ransom.Win32.Blocker.exe
    "C:\Users\Admin\AppData\Local\Temp\Trojan-Ransom.Win32.Blocker.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:2016
    • C:\Users\Admin\E696D64614\winlogon.exe
      "C:\Users\Admin\E696D64614\winlogon.exe"
      2⤵
      • Executes dropped EXE
      • Suspicious use of SetThreadContext
      • Modifies system certificate store
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:828
      • C:\Users\Admin\E696D64614\winlogon.exe
        "C:\Users\Admin\E696D64614\winlogon.exe"
        3⤵
        • Modifies firewall policy service
        • Modifies security service
        • Modifies visibility of file extensions in Explorer
        • Modifies visiblity of hidden/system files in Explorer
        • UAC bypass
        • Windows security bypass
        • Disables RegEdit via registry modification
        • Drops file in Drivers directory
        • Executes dropped EXE
        • Sets file execution options in registry
        • Windows security modification
        • Checks whether UAC is enabled
        • Modifies Control Panel
        • Modifies Internet Explorer settings
        • Modifies Internet Explorer start page
        • Modifies registry class
        • Modifies system certificate store
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of SetWindowsHookEx
        • System policy modification
        PID:1788
  • C:\Program Files\Internet Explorer\iexplore.exe
    "C:\Program Files\Internet Explorer\iexplore.exe" -Embedding
    1⤵
    • Modifies Internet Explorer settings
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:308
    • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
      "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:308 CREDAT:275457 /prefetch:2
      2⤵
      • Modifies Internet Explorer settings
      • Suspicious use of SetWindowsHookEx
      PID:592

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\07CEF2F654E3ED6050FFC9B6EB844250_3431D4C539FB2CFCB781821E9902850D
    Filesize

    2KB

    MD5

    0774dce1dca53ce5c4f06846dc34a01a

    SHA1

    b66a92ae7ae2abc81921ed83fea0886c908b14b3

    SHA256

    653df1e7ee6eb78011d131d41eebad55a6b11e14073ac204587960c404d2300f

    SHA512

    43582562e20238142d801d97dee6efff1213d38506dc8e21001517d799e52c5157a0ce814e29045fb267200878e964f04d05bb209ac738d510b48ebd689b82e2

    Download Submit

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015
    Filesize

    61KB

    MD5

    3dcf580a93972319e82cafbc047d34d5

    SHA1

    8528d2a1363e5de77dc3b1142850e51ead0f4b6b

    SHA256

    40810e31f1b69075c727e6d557f9614d5880112895ff6f4df1767e87ae5640d1

    SHA512

    98384be7218340f95dae88d1cb865f23a0b4e12855beb6e74a3752274c9b4c601e493864db777bca677a370d0a9dbffd68d94898a82014537f3a801cce839c42

    Download Submit

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B2FAF7692FD9FFBD64EDE317E42334BA_D7393C8F62BDE4D4CB606228BC7A711E
    Filesize

    1KB

    MD5

    be2b5211e42eb9225d21358e7eb3f78f

    SHA1

    35b1ab3adde0a5f3cad8862897f1ea7a86946349

    SHA256

    3185aa19aba785efc822b72e3f2959e07343c1935f8f2b46a4438060763c9111

    SHA512

    9b20c8dceb160aad20de302c2589b86fae64f7842b370812fd8baba3e8154a357c0a1c282ea95fbc5406ab093593637929edaf83c42e19c7b6a011d286b06b6a

    Download Submit

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\C67047FE238D580B731A13BEA5F7481F
    Filesize

    472B

    MD5

    348f6c5d513404b3c3c6c27f3de2dfdf

    SHA1

    acb18df838bf8ddb2667e944a82b2930bdecfad8

    SHA256

    a46606d9bc72c7330fff6849e1caa6c773c79d66236549408380362d28d892a1

    SHA512

    79dd389bc9a05312290bf69386faa56fd5a6515a0efd7685249831732f6a7c948ac41f288e038a65929e1b56f8fc615db12b7d3955a5e3279ebc8895fd150cab

    Download Submit

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\07CEF2F654E3ED6050FFC9B6EB844250_3431D4C539FB2CFCB781821E9902850D
    Filesize

    488B

    MD5

    d09c3bb7e38074b85a7181eaf95cc4b7

    SHA1

    57fa49d1f23c50c9b74df9c9c6c3a3eae3af8b18

    SHA256

    702a07c39b5b043b2e8fbe8e5e119d329b7ae241b29304405caf476810449f8e

    SHA512

    49daea482dbeb3234ec0bc6b0115bb800d168e060c3e55c2c26112aeb52e7d146760c3fdd11316e5838ed68cfe40bc29875377a953641eb35bab1c41e109c287

    Download Submit

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\07CEF2F654E3ED6050FFC9B6EB844250_3431D4C539FB2CFCB781821E9902850D
    Filesize

    488B

    MD5

    6262452e362a49ee20dc7ea07d7485b3

    SHA1

    6cb6fb4d6fbb8d62a94055af20b606bfecd75f9c

    SHA256

    8ba53f5f77e4aeb6d19a8298a9b565326439d27d7ee86972f6ed8247d7400cf1

    SHA512

    fa13a6b7d5c4f20b100000dd3ac879a168afcf48343499e1e7e8ecca1bf9b3129a8227f4b485a22a92b85522d41db0075aa7e565cb96a3e75938f61d38c12c5a

    Download Submit

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
    Filesize

    342B

    MD5

    74be834d95313ebc7c0bf5c7ce4c1c78

    SHA1

    0efcd6d4018a24e802fc6352a9040dbe3668441a

    SHA256

    d160c29e4b63b8c347f5ffa549a65f19fc07b3b2414774563195e5c61a84f4c5

    SHA512

    0b8336dce22921eca1d30b2b159671551787f23028a610b4f4542e30fb9d20c59397e6b89a77afa96751ab80bd5e213c22eb4ae46a0c2baf78b8ed01e43d197f

    Download Submit

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B2FAF7692FD9FFBD64EDE317E42334BA_D7393C8F62BDE4D4CB606228BC7A711E
    Filesize

    482B

    MD5

    ff2e230434fa6f8e7597581df0c7a8af

    SHA1

    d6d6918ba41f8196f0a4aec3c463f944d34df891

    SHA256

    f11b38203604330cf935307f5fdc13ecf31398105857a184401efb6863d9049a

    SHA512

    542ac7072469134795687a498dfba13da5740201deda426f6264a6dfb3d752d63b5c40b3526655e11d231f0e4ba79c3c2394c7152d79e163a56d702e9e980bc6

    Download Submit

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\C67047FE238D580B731A13BEA5F7481F
    Filesize

    480B

    MD5

    53bb18b674bd58c505d86edd5c95c1cc

    SHA1

    b905e3c12b4624985caf84096383b7bbc53f9804

    SHA256

    7fda34635f0ebe9b034232ad2966b6d0b3a4c0888ac006a7a3b98d0e41bfda8b

    SHA512

    8b525dd4a80a6cda4f6e2a3104bc14aca2db5048f9d683c180c70fb0d8c493d114715f77c4ed6626d9a7889ff86d28a50c835026b4dba39395011e9a5defe588

    Download Submit

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\230YXW7T.txt
    Filesize

    97B

    MD5

    0c8e67b86a6effebe72de9ecf06238a8

    SHA1

    a7e61af11bb4fbf1d02fec3b3f9abd577f12cb03

    SHA256

    2d91fd1998aed969387183a45f949a75a6742f113d7f09999ce5b3926744951f

    SHA512

    c1c4e7bfe9c6ae0ac85abdfe899f6b38a12d3ec9b5a43e18ec18b14382443224907a9d4f2e4bf31cc538b6345c3c51672627e6ecd9a5d6b3f25df9c29ba1d227

    Download Submit

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\L9T215LY.txt
    Filesize

    118B

    MD5

    82e6553f727396c09da7e858650a3f53

    SHA1

    382e1b170e607cda1118e33308c5588cc1b3e1f0

    SHA256

    f357c06b0b189bc16542b1d57982d42f29cde22136c6a99cd31f4909bc95010b

    SHA512

    16c0b09eb1b8a36a6cff4e876ac7f936631691e3d7ef876acc38e3d83c9d2c61865a981475952048479740806600ec9ecab2aa63dad2ca96ffad42639df55621

    Download Submit

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\ZNGF24MW.txt
    Filesize

    608B

    MD5

    83a3baafec03a5250a2754ea237b017f

    SHA1

    c85ee28e6ef1ede066c49832924c918230f2cdf0

    SHA256

    2777af8262700314c2d065d7853af7c70533efb26d83a12f1a1dd5178b652ab1

    SHA512

    9c4f8b69b95b733c16e92b90ee6b6fdb489ae4c7ef3d0fe3064aa5d00fd824bddc536a41142f4718f0e102e7f2d1b8a21accec4925c1868129e00ea08d934874

    Download Submit

  • C:\Users\Admin\E696D64614\winlogon.exe
    Filesize

    715KB

    MD5

    9922bb2013d45d0131cc27ab65dde265

    SHA1

    c8a0a3179794a2d444e4417a747029ad2acd9aba

    SHA256

    b6e528d6ee93b9ddf32c5b9cb460f9e45b2a1870524579a128f9409541cf35b4

    SHA512

    d3c1707deb82d11806c3dc9cb81673bbeace140407a67f532136d6059dab7965a01a67a2d2165a8d52a3385c8afbe206eea402bca1c63bac2fe14a78e55240e8

    Download Submit

  • C:\Users\Admin\E696D64614\winlogon.exe
    Filesize

    715KB

    MD5

    9922bb2013d45d0131cc27ab65dde265

    SHA1

    c8a0a3179794a2d444e4417a747029ad2acd9aba

    SHA256

    b6e528d6ee93b9ddf32c5b9cb460f9e45b2a1870524579a128f9409541cf35b4

    SHA512

    d3c1707deb82d11806c3dc9cb81673bbeace140407a67f532136d6059dab7965a01a67a2d2165a8d52a3385c8afbe206eea402bca1c63bac2fe14a78e55240e8

    Download Submit

  • C:\Users\Admin\E696D64614\winlogon.exe
    Filesize

    715KB

    MD5

    9922bb2013d45d0131cc27ab65dde265

    SHA1

    c8a0a3179794a2d444e4417a747029ad2acd9aba

    SHA256

    b6e528d6ee93b9ddf32c5b9cb460f9e45b2a1870524579a128f9409541cf35b4

    SHA512

    d3c1707deb82d11806c3dc9cb81673bbeace140407a67f532136d6059dab7965a01a67a2d2165a8d52a3385c8afbe206eea402bca1c63bac2fe14a78e55240e8

    Download Submit

  • \Users\Admin\E696D64614\winlogon.exe
    Filesize

    715KB

    MD5

    9922bb2013d45d0131cc27ab65dde265

    SHA1

    c8a0a3179794a2d444e4417a747029ad2acd9aba

    SHA256

    b6e528d6ee93b9ddf32c5b9cb460f9e45b2a1870524579a128f9409541cf35b4

    SHA512

    d3c1707deb82d11806c3dc9cb81673bbeace140407a67f532136d6059dab7965a01a67a2d2165a8d52a3385c8afbe206eea402bca1c63bac2fe14a78e55240e8

    Download Submit

  • \Users\Admin\E696D64614\winlogon.exe
    Filesize

    715KB

    MD5

    9922bb2013d45d0131cc27ab65dde265

    SHA1

    c8a0a3179794a2d444e4417a747029ad2acd9aba

    SHA256

    b6e528d6ee93b9ddf32c5b9cb460f9e45b2a1870524579a128f9409541cf35b4

    SHA512

    d3c1707deb82d11806c3dc9cb81673bbeace140407a67f532136d6059dab7965a01a67a2d2165a8d52a3385c8afbe206eea402bca1c63bac2fe14a78e55240e8

    Download Submit

  • memory/828-66-0x0000000000400000-0x0000000000447000-memory.dmp

    Filesize

    284KB

    Download

  • memory/1788-77-0x0000000000400000-0x000000000043F000-memory.dmp

    Filesize

    252KB

    Download

  • memory/1788-72-0x0000000000400000-0x000000000043F000-memory.dmp

    Filesize

    252KB

    Download

  • memory/1788-71-0x0000000000400000-0x000000000043F000-memory.dmp

    Filesize

    252KB

    Download

  • memory/1788-67-0x0000000000400000-0x000000000043F000-memory.dmp

    Filesize

    252KB

    Download

  • memory/2016-56-0x0000000075A71000-0x0000000075A73000-memory.dmp

    Filesize

    8KB

    Download

  • memory/2016-61-0x0000000000400000-0x0000000000447000-memory.dmp

    Filesize

    284KB

    Download