Analysis

  • max time kernel
    232s
  • max time network
    201s
  • platform
    windows10-1703_x64
  • resource
    win10-20220901-en
  • resource tags

    arch:x64arch:x86image:win10-20220901-enlocale:en-usos:windows10-1703-x64system
  • submitted
    24-11-2022 21:44

General

  • Target

    7z21.03-zstd-x64.exe

  • Size

    2.7MB

  • MD5

    f755b434e5648f9f2c42102a04da6d3b

  • SHA1

    e4fd50ded0f6cbaa4f1f035c95ec6daea13b93b8

  • SHA256

    531b20dfb03d8f30f61ae56a181610bbb6f3cf7cc71dac1d8f95511289de76f3

  • SHA512

    8aedcbc1076efe73ef43c4f33bc971c93fbb2d9d733232e4ec16ab90082e9dd77360c880fbe67f60e50c24faf6263458491cae4dd99038fbddbcf919d9a18e7c

  • SSDEEP

    49152:c3/Vrv2V0ghd8New+nGeiUDtnTjEuaTfOyeIkHhzKcRWSJHMsIBC7pgvxlX7Sauk:a1vm8MTn/TTjEr7OyeIkpKcRxJsFHlt5

Malware Config

Extracted

Path

C:\Program Files\7-Zip-Zstandard\History.txt

Ransom Note
HISTORY of the 7-Zip -------------------- 21.03 beta 2021-07-20 ------------------------- - The maximum dictionary size for LZMA/LZMA2 compressing was increased to 4 GB (3840 MiB). - Minor speed optimizations in LZMA/LZMA2 compressing. 21.02 alpha 2021-05-06 ------------------------- - 7-Zip now writes additional field for filename in UTF-8 encoding to zip archives. It allows to extract correct file name from zip archives on different systems. - The command line version of 7-Zip for macOS was released. - The speed for LZMA and LZMA2 decompression in arm64 versions for macOS and Linux was increased by 20%-60%. - Some changes and improvements in ZIP, TAR and NSIS code. 21.01 alpha 2021-03-09 ------------------------- - The command line version of 7-Zip for Linux was released. - The improvements for speed of ARM64 version using hardware CPU instructions for AES, CRC-32, SHA-1 and SHA-256. - The bug in versions 18.02 - 21.00 was fixed: 7-Zip could not correctly extract some ZIP archives created with xz compression method. - Some bugs were fixed. 21.00 alpha 2021-01-19 ------------------------- - Some internal changes in code. - Some bugs were fixed. - New localizations: Tajik, Uzbek (Cyrillic) 20.02 alpha 2020-08-08 ------------------------- - The default number of LZMA2 chunks per solid block in 7z archive was increased to 64. It allows to increase the compression speed for big 7z archives, if there is a big number of CPU cores and threads. - The speed of PPMd compressing/decompressing was increased for 7z/ZIP/RAR archives. - The new -ssp switch. If the switch -ssp is specified, 7-Zip doesn't allow the system to modify "Last Access Time" property of source files for archiving and hashing operations. - Some bugs were fixed. - New localization: Swahili. 20.00 alpha 2020-02-06 ------------------------- - 7-Zip now supports new optional match finders for LZMA/LZMA2 compression: bt5 and hc5, that can work faster than bt4 and hc4 match finders for the data with big redundancy. - The compression ratio was improved for Fast and Fastest compression levels with the following default settings: - Fastest level (-mx1) : hc5 match finder with 256 KB dictionary. - Fast level (-mx3) : hc5 match finder with 4 MB dictionary. - Minor speed optimizations in multithreaded LZMA/LZMA2 compression for Normal/Maximum/Ultra compression levels. - bzip2 decoding code was updated to support bzip2 archives, created by lbzip2 program. - Some bugs were fixed. - New localization: Turkmen. 19.02 alpha 2019-09-05 ------------------------- - 7-Zip now can unpack files encoded with Base64 encoding (b64 filename extension). - 7-Zip now can use new x86/x64 hardware instructions for SHA-1 and SHA-256, supported by AMD Ryzen and latest Intel CPUs: Ice Lake and Goldmont. It increases - the speed of SHA-1/SHA-256 hash value calculation, - the speed of encryption/decryption in zip AES, - the speed of key derivation for encryption/decryption in 7z/zip/rar archives. - The speed of zip AES encryption and 7z/zip/rar AES decryption was increased with the following improvements: - 7-Zip now can use new x86/x64 VAES (AVX Vector AES) instructions, supported by Intel Ice Lake CPU. - The existing code of x86/x64 AES-NI was improved also. - There is 2% speed optimization in 7-Zip benchmark's decompression. - Some bugs were fixed. 19.00 2019-02-21 ------------------------- - Encryption strength for 7z archives was increased: the size of random initialization vector was increased from 64-bit to 128-bit, and the pseudo-random number generator was improved. - Some bugs were fixed. 18.06 2018-12-30 ------------------------- - The speed for LZMA/LZMA2 compressing was increased by 3-10%, and there are minor changes in compression ratio. - Some bugs were fixed. - The bug in 7-Zip 18.02-18.05 was fixed: there was memory leak in xz decoder. - 7-Zip 18.02-18.05 used only one CPU thread for bz2 archive creation. 18.05 2018-04-30 ------------------------- - The speed for LZMA/LZMA2 compressing was increased by 8% for fastest/fast compression levels and by 3% for normal/maximum compression levels. - 7-Zip now shows Properties (Info) window and CRC/SHA results window as "list view" window instead of "message box" window. - Some improvements in zip, hfs and dmg code. - Previous versions of 7-Zip could work incorrectly in "Large memory pages" mode in Windows 10 because of some BUG with "Large Pages" in Windows 10. Now 7-Zip doesn't use "Large Pages" on Windows 10 up to revision 1709 (16299). - The vulnerability in RAR unpacking code was fixed (CVE-2018-10115). - Some bugs were fixed. 18.03 beta 2018-03-04 ------------------------- - The speed for single-thread LZMA/LZMA2 decoding was increased by 30% in x64 version and by 3% in x86 version. - 7-Zip now can use multi-threading for 7z/LZMA2 decoding, if there are multiple independent data chunks in LZMA2 stream. - 7-Zip now can use multi-threading for xz decoding, if there are multiple blocks in xz stream. - New localization: Kabyle. - Some bugs were fixed. 18.01 2018-01-28 ------------------------- - 7-Zip now can unpack DMG archives that use LZFSE compression method. - 7-Zip now doesn't allow update operation for archives that have read-only attribute. - The BUG was fixed: extracting from tar with -si switch didn't set timestamps for directories. - Some bugs were fixed. 18.00 beta 2018-01-10 ------------------------- - 7-Zip now can unpack OBJ/COFF files. - new -sse switch to stop archive creating, if 7-Zip can't open some input file. - Some bugs were fixed. 17.01 beta 2017-08-28 ------------------------- - Minor speed optimization for LZMA2 (xz and 7z) multi-threading compression. 7-Zip now uses additional memory buffers for multi-block LZMA2 compression. CPU utilization was slightly improved. - 7-zip now creates multi-block xz archives by default. Block size can be specified with -ms[Size]{m|g} switch. - xz decoder now can unpack random block from multi-block xz archives. 7-Zip File Manager now can open nested multi-block xz archives (for example, image.iso.xz) without full unpacking of xz archive. - 7-Zip now can create zip archives from stdin to stdout. - 7-Zip command line: @listfile now doesn't work after -- switch. Use -i@listfile before -- switch instead. - The BUGs were fixed: 7-Zip could add unrequired alternate file streams to WIM archives, for commands that contain filename wildcards and -sns switch. 7-Zip 17.00 beta crashed for commands that write anti-item to 7z archive. 7-Zip 17.00 beta ignored "Use large memory pages" option. 17.00 beta 2017-04-29 ------------------------- - ZIP unpacking code was improved. - 7-Zip now reserves file space before writing to file (for extraction from archive). It can reduce file fragmentation. - Some bugs were fixed. 7-Zip could crash in some cases. - Internal changes in code. 16.04 2016-10-04 ------------------------- - The bug was fixed: 7-Zip 16.03 exe installer under Vista didn't create links in Start / Programs menu. - Some bugs were fixed in RAR code. 16.03 2016-09-28 ------------------------- - Installer and SFX modules now use some protection against DLL preloading attack. - Some bugs were fixed in 7z, NSIS, SquashFS, RAR5 and another code. 16.02 2016-05-21 ------------------------- - 7-Zip now can extract multivolume ZIP archives (z01, z02, ... , zip). - Some bugs were fixed. 15.14 2015-12-31 ------------------------- - 7-Zip File Manager: - The code for "Open file from archive" operation was improved. - The code for "Tools/Options" window was improved. - The BUG was fixed: there was incorrect mouse cursor capture for drag-and-drop operations from open archive to Explorer window. - Some bugs were fixed. - New localization: Yoruba. 15.12 2015-11-19 ------------------------- - The release version. 15.11 beta 2015-11-14 ------------------------- - Some bugs were fixed. 15.10 beta 2015-11-01 ------------------------- - The BUG in 9.21 - 15.09 was fixed: 7-Zip could ignore some parameters, specified for archive creation operation for gzip and bzip2 formats in "Add to Archive" window and in command line version (-m switch). - Some bugs were fixed. 15.09 beta 2015-10-16 ------------------------- - 7-Zip now can extract ext2 and multivolume VMDK images. - Some bugs were fixed. 15.08 beta 2015-10-01 ------------------------- - 7-Zip now can extract ext3 and ext4 (Linux file system) images. - Some bugs were fixed. 15.07 beta 2015-09-17 ------------------------- - 7-Zip now can extract GPT images and single file QCOW2, VMDK, VDI images. - 7-Zip now can extract solid WIM archives with LZMS compression. - Some bugs were fixed. 15.06 beta 2015-08-09 ------------------------- - 7-Zip now can extract RAR5 archives. - 7-Zip now doesn't sort files by type while adding to solid 7z archive. - new -mqs switch to sort files by type while adding to solid 7z archive. - The BUG in 7-Zip File Manager was fixed: The "Move" operation to open 7z archive didn't delete empty files. - The BUG in 15.05 was fixed: console version added some text to the end of stdout stream, is -so switch was used. - The BUG in 9.30 - 15.05 was fixed: 7-Zip could not open multivolume sfx RAR archive. - Some bugs were fixed. 15.05 beta 2015-06-14 ------------------------- - 7-Zip now uses new installer. - 7-Zip now can create 7z, xz and zip archives with 1536 MB dictionary for LZMA/LZMA2. - 7-Zip File Manager now can operate with alternate file streams at NTFS volumes via "File / Alternate Streams" menu command. - 7-Zip now can extract .zipx (WinZip) archives that use xz compression. - new optional "section size" parameter for BCJ2 filter for compression ratio improving. Example: -mf=BCJ2:d9M, if largest executable section in files is smaller than 9 MB. - Speed optimizations for BCJ2 filter and SHA-1 and SHA-256 calculation. - Console version now uses stderr stream for error messages. - Console version now shows names of processed files only in progress line by default. - new -bb[0-3] switch to set output log level. -bb1 shows names of processed files in log. - new -bs[o|e|p][0|1|2] switch to set stream for output messages; o: output, e: error, p: progress line; 0: disable, 1: stdout, 2: stderr. - new -bt switch to show execution time statistics. - new -myx[0-9] switch to set level of file analysis. - new -mmtf- switch to set single thread mode for filters. - The BUG was fixed: 7-Zip didn't restore NTFS permissions for folders during extracting from WIM archives. - The BUG was fixed: The command line version: if the command "rn" (Rename) was called with more than one pair of paths, 7-Zip used only first rename pair. - The BUG was fixed: 7-Zip crashed for ZIP/LZMA/AES/AES-NI. - The BUG in 15.01-15.02 was fixed: 7-Zip created incorrect ZIP archives, if ZipCrypto encryption was used. 7-Zip 9.20 can extract such incorrect ZIP archives. - Some bugs were fixed. 9.38 beta 2015-01-03 ------------------------- - Some bugs were fixed. 9.36 beta 2014-12-26 ------------------------- - The BUG in command line version was fixed: 7-Zip created temporary archive in current folder during update archive operation, if -w{Path} switch was not specified. The fixed 7-Zip creates temporary archive in folder that contains updated archive. - The BUG in 9.33-9.35 was fixed: 7-Zip silently ignored file reading errors during 7z or gz archive creation, and the created archive contained only part of file that was read before error. The fixed 7-Zip stops archive creation and it reports about error. - Some bugs were fixed. 9.35 beta 2014-12-07 ------------------------- - The BUG was fixed: 7-Zip crashed during ZIP archive creation, if the number of CPU threads was more than 64. - The BUG in 9.31-9.34 was fixed: 7-Zip could not correctly extract ISO archives that are larger than 4 GiB. - The BUG in 9.33-9.34 was fixed: The option "Compress shared files" and -ssw switch didn't work. - The BUG in 9.26-9.34 was fixed: 7-Zip File Manager could crash for some archives open in "Flat View" mode. - Some bugs were fixed. 9.34 alpha 2014-06-22 ------------------------- - The BUG in 9.33 was fixed: Command line version of 7-Zip could work incorrectly, if there is relative path in exclude filename optiton (-x) and absolute path as include filename. - The BUG in 9.26-9.33 was fixed: 7-Zip could not open some unusual 7z archives that were created by another software (not by 7-Zip). - The BUG in 9.31-9.33 was fixed: 7-Zip could crash with switch -tcab. 9.33 alpha 2014-06-15 ------------------------- - 7-Zip now can show icons for 7-Zip items in Explorer's context menu. - "Add to archive" dialog box: - new options in "Path Mode" - new option "Delete files after compression" - new "NTFS" options for WIM and TAR formats: - Store symbolic links - Store hard links - Store alternate data streams - Store file security - "Extract" dialog box: - new optional field to set output folder name - new option "Eliminate duplication of root folder" - new option "Absolute pathnames" in "Path Mode". - new option "Restore file security" (that works for WIM archives only) - 7-Zip File Manager: - new "File / Link" dialog box in to create symbolic links and hard links. - Command line version: - new -spd switch to Disable wildcard matching for file names - new -spe switch to Eliminate duplication of root folder for extract archive command - new -snh switch to store hard links as links (WIM and TAR formats only) - new -snl switch to store symbolic links as links (WIM and TAR formats only) - NSIS support was improved. - The problem was fixed: The command "extract to \*" with multiple archives could use same output folder, if archives are placed inside PE (EXE) file. - The BUG of 9.31-9.32 was fixed: Command line version for test and extract commands returned the value 0 as exit code, if it couldn't open archive. - The BUG was fixed: 7-Zip could not create archives with anti-items for any archive type, except of 7z type - Some bugs were fixed. - New localization: Mongolian (script). 9.32 alpha 2013-12-01 ------------------------- - 7-Zip now can create multivolume SFX archives in 7z format. Standalone sfx module now can unpack external 7z archive with name that is matched to name of sfx module. For example, sfx module renamed to archive.exe can unpack archive.7z or archive.7z.001 . - ZIP, NSIS, HFS, AR support was improved. - 7-Zip now supports files larger than 4 GiB in ISO archives. - Improved compression ratio in 7z format with maximum or ultra level for executable files (EXE and DLL) that are larger than 16 MB (improved BCJ2 filter). - Improved support for file pathnames longer than 260 characters. - CRC and SHA checksum calculation for files can be called via Explorer's context menu. - 7-Zip File Manager now also takes into account the numbers in filenames for sorting order. - 7-Zip File Manager now can use RAM buffers instead of temp files to open nested archives, if temp file is smaller than 1/4 of RAM size. - 7-Zip File Manager can open files in "Parser" mode via "Open Archive > #" context menu command. It shows the list of archives inside file. - Command line version: - new -t# switch to open file in "Parser" mode and show the list of archives inside file. - new -stx{Type} switch to exclude archive type from using. - -scs switch now supports UTF-16 encoding. - now it shows time and memory usage statistics at the end of execution. - The BUGs were fixed: - 7-Zip 9.30 and early versions created ZIP archives wit

Signatures

  • Executes dropped EXE 2 IoCs
  • Registers COM server for autorun 1 TTPs 3 IoCs
  • Loads dropped DLL 3 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Drops file in Program Files directory 64 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Modifies registry class 20 IoCs
  • Suspicious use of AdjustPrivilegeToken 14 IoCs
  • Suspicious use of FindShellTrayWindow 3 IoCs
  • Suspicious use of WriteProcessMemory 2 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\7z21.03-zstd-x64.exe
    "C:\Users\Admin\AppData\Local\Temp\7z21.03-zstd-x64.exe"
    1⤵
    • Registers COM server for autorun
    • Drops file in Program Files directory
    • Modifies registry class
    PID:4580
  • C:\Program Files\7-Zip\7zG.exe
    "C:\Program Files\7-Zip\7zG.exe" a -i#7zMap9907:636:7zEvent29543 -ad -saa -- "C:\Users\Admin\Desktop\Desktop"
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    PID:3564
  • C:\Program Files\7-Zip-Zstandard\7zG.exe
    "C:\Program Files\7-Zip-Zstandard\7zG.exe" a -i#7zMap13635:636:7zEvent17613 -ad -saa -- "C:\Users\Admin\Desktop\Desktop"
    1⤵
    • Executes dropped EXE
    • Loads dropped DLL
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    PID:4996
  • \??\c:\windows\system32\svchost.exe
    c:\windows\system32\svchost.exe -k localsystemnetworkrestricted -s DeviceAssociationService
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:4120
    • C:\Windows\system32\dashost.exe
      dashost.exe {c88ca3a7-52c9-4e1d-abba3a8bcbf46c85}
      2⤵
        PID:2880
    • C:\Program Files\7-Zip-Zstandard\7zG.exe
      "C:\Program Files\7-Zip-Zstandard\7zG.exe" a -i#7zMap28379:2046:7zEvent23329 -ad -saa -- "C:\Users\Admin\Desktop\Desktop"
      1⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of FindShellTrayWindow
      PID:4412

    Network

    MITRE ATT&CK Matrix ATT&CK v6

    Persistence

    Registry Run Keys / Startup Folder

    1
    T1060

    Discovery

    Query Registry

    1
    T1012

    System Information Discovery

    1
    T1082

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Program Files\7-Zip-Zstandard\7z.dll
      Filesize

      4.0MB

      MD5

      5c27dfa0870cbc7734fa981c876a5898

      SHA1

      47e532a2ff3c0228f07191ef3280e1342151e9ce

      SHA256

      931046f66e5dd876122f9cb1951c1d2cdbf7bde69af7e87cfd63319ac0689c17

      SHA512

      93228f6fb67883aa7d37d7164dfb643d7d178868061741dcaffa0af97b978ebfb9c2cba8ab1eed5ccf0fb466e38ac06a063316a6b5fc802b1dabde5b06b351cb

    • C:\Program Files\7-Zip-Zstandard\7zG.exe
      Filesize

      533KB

      MD5

      4de6b2b720b471f07dc1aeabadadecc6

      SHA1

      f2d28dec305a9b3001835e7582b492d90c7c0f18

      SHA256

      48ee1445739d2687b78c9e315edfe4b795460646496c60356e2c251f7ccf4f47

      SHA512

      0de3258d8a798d0439af95f08b74af0868e8c135ce81935e446fa7ef2acaa26c39c0f1c2f88e1b3ab74fdfdd3f23e0509eb12b5342b4334d871aeb5916672f43

    • C:\Program Files\7-Zip-Zstandard\7zG.exe
      Filesize

      533KB

      MD5

      4de6b2b720b471f07dc1aeabadadecc6

      SHA1

      f2d28dec305a9b3001835e7582b492d90c7c0f18

      SHA256

      48ee1445739d2687b78c9e315edfe4b795460646496c60356e2c251f7ccf4f47

      SHA512

      0de3258d8a798d0439af95f08b74af0868e8c135ce81935e446fa7ef2acaa26c39c0f1c2f88e1b3ab74fdfdd3f23e0509eb12b5342b4334d871aeb5916672f43

    • C:\Users\Admin\Desktop\Desktop.7z
      Filesize

      5.9MB

      MD5

      0502b722ccde2897dded38eee8d4d0ca

      SHA1

      635b59827b5222d5cb2140a80464ad8233f2ba29

      SHA256

      274c741aa15077f52155da4b470e6355795caeaaf5e063dbe248b87fc562c33e

      SHA512

      593cb7081f14017ef41f1fe5d58bda056bc2632a262fb4a74421a4f9764c3691432a4874ab8f736360ea9ca1e705533b5adbbc60053e1d13465625bd983d5077

    • C:\Users\Admin\Desktop\Desktop.zip
      Filesize

      5.8MB

      MD5

      8e205f5b44236afd99e41664c6aa56a7

      SHA1

      90db3905c8e0d9d8792276791ed6da56d0442149

      SHA256

      e4389628a6b771e9f3f71101b134a65607ea619f3d87fa9099a68ce582bf0b42

      SHA512

      9b48ab294a5d416475527a2cc747984d6630d4ee6e00e6babb900fde27ddbed970a2da61d70aa3cf7dc783c00cf8bfe03c5fd42d9d0920714941f8ba4d6f24c5

    • \Program Files\7-Zip-Zstandard\7-zip.dll
      Filesize

      160KB

      MD5

      e251bcc7602ade13aa4c8c0f6e0c0baa

      SHA1

      ecb66acf271c99a951f40f48e8655b52522ee9f6

      SHA256

      a2907f7ad8067d0f3b419e1fd3639c825f82339a3ec17e40e159dfe66f63c90c

      SHA512

      a19b28a02a654625a5e176cb4884fea48ebcb922f1dab7bc1f95795fa60436e46f9fe086504fa382acb42d25cbbef7e684d1b6ecc3bddea4682297de08b56ea4

    • \Program Files\7-Zip-Zstandard\7z.dll
      Filesize

      4.0MB

      MD5

      5c27dfa0870cbc7734fa981c876a5898

      SHA1

      47e532a2ff3c0228f07191ef3280e1342151e9ce

      SHA256

      931046f66e5dd876122f9cb1951c1d2cdbf7bde69af7e87cfd63319ac0689c17

      SHA512

      93228f6fb67883aa7d37d7164dfb643d7d178868061741dcaffa0af97b978ebfb9c2cba8ab1eed5ccf0fb466e38ac06a063316a6b5fc802b1dabde5b06b351cb

    • \Program Files\7-Zip-Zstandard\7z.dll
      Filesize

      4.0MB

      MD5

      5c27dfa0870cbc7734fa981c876a5898

      SHA1

      47e532a2ff3c0228f07191ef3280e1342151e9ce

      SHA256

      931046f66e5dd876122f9cb1951c1d2cdbf7bde69af7e87cfd63319ac0689c17

      SHA512

      93228f6fb67883aa7d37d7164dfb643d7d178868061741dcaffa0af97b978ebfb9c2cba8ab1eed5ccf0fb466e38ac06a063316a6b5fc802b1dabde5b06b351cb

    • memory/2880-123-0x0000000000000000-mapping.dmp