Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
35s -
platform
windows7_x64 -
resource
win7-20230220-en -
resource tags
arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system -
submitted
06/04/2023, 17:59 UTC
Behavioral task
behavioral1
Sample
mkp_nowin.bin.exe
Resource
win7-20230220-en
windows7-x64
9 signatures
150 seconds
Behavioral task
behavioral2
Sample
mkp_nowin.bin.exe
Resource
win10v2004-20230220-en
windows10-2004-x64
15 signatures
150 seconds
General
-
Target
mkp_nowin.bin.exe
-
Size
42KB
-
MD5
abb04a0418be9cc4618f393d7fc9d76b
-
SHA1
dbe3b07ab1383e4d693bb6cab17ad8a7c1c5cd7b
-
SHA256
56f7b48f3877743c44aef0f3e990b3387dd6185f1c40a7477f5b6bad64960659
-
SHA512
f7bce71f01ffae675a8b8a23a8f2e4d162ccefc349beadb84ffcca890dc68ed636acf4f7d694145c779125078f6634f30aed5f5651ee6c12dc4768f7c0a0f47b
-
SSDEEP
768:QO1oR/8VS1RzK4wbs+D/SIJX+ZZ1SQQwZuIOPzDsHw67ZY23IWSjNV:QgS1FKnDtkuImsHw6V73ejNV
Score
10/10
Malware Config
Extracted
Path
C:\MSOCache\All Users\{90140000-0018-0409-0000-0000000FF1CE}-C\+README-WARNING+.txt
Ransom Note
::: Greetings :::
Little FAQ:
.1.
Q: Whats Happen?
A: Your files have been encrypted. The file structure was not damaged, we did everything possible so that this could not happen.
.2.
Q: How to recover files?
A: If you wish to decrypt your files you will need to pay us.
.3.
Q: What about guarantees?
A: Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will cooperate with us. Its not in our interests.
To check the ability of returning files, you can send to us any 2 files with SIMPLE extensions(jpg,xls,doc, etc... not databases!) and low sizes(max 1 mb), we will decrypt them and send back to you. That is our guarantee.
.4.
Q: How to contact with you?
A: You can write us to our mailbox: ardellchadwick275@msgsafe.io
.5.
Q: How will the decryption process proceed after payment?
A: After payment we will send to you our scanner-decoder program and detailed instructions for use. With this program you will be able to decrypt all your encrypted files.
.6.
Q: If I don�t want to pay bad people like you?
A: If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause only we have the private key. In practice - time is much more valuable than money.
:::BEWARE:::
DON'T try to change encrypted files by yourself!
If you will try to use any third party software for restoring your data or antivirus solutions - please make a backup for all encrypted files!
Any changes in encrypted files may entail damage of the private key and, as result, the loss all data.
Emails
ardellchadwick275@msgsafe.io
Signatures
-
Deletes shadow copies 2 TTPs
Ransomware often targets backup files to inhibit system recovery.
-
pid Process 1148 wbadmin.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\ja-JP\tabskb.dll.mui mkp_nowin.bin.exe File opened for modification C:\Program Files\7-Zip\Lang\be.txt mkp_nowin.bin.exe File opened for modification C:\Program Files\7-Zip\Lang\ext.txt mkp_nowin.bin.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\FlickAnimation.avi mkp_nowin.bin.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\base_heb.xml mkp_nowin.bin.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\ja-JP\InkObj.dll.mui mkp_nowin.bin.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\ja-JP\rtscom.dll.mui mkp_nowin.bin.exe File opened for modification C:\Program Files\7-Zip\Lang\ar.txt mkp_nowin.bin.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\bg-BG\tipresx.dll.mui mkp_nowin.bin.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\cs-CZ\tipresx.dll.mui mkp_nowin.bin.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\zh-phonetic.xml mkp_nowin.bin.exe File opened for modification C:\Program Files\7-Zip\Lang\nl.txt mkp_nowin.bin.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\en-US\InkObj.dll.mui mkp_nowin.bin.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\es-ES\rtscom.dll.mui mkp_nowin.bin.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\baseAltGr_rtl.xml mkp_nowin.bin.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\MSInfo\es-ES\msinfo32.exe.mui mkp_nowin.bin.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\MSInfo\fr-FR\msinfo32.exe.mui mkp_nowin.bin.exe File opened for modification C:\Program Files\7-Zip\History.txt mkp_nowin.bin.exe File opened for modification C:\Program Files\7-Zip\Lang\de.txt mkp_nowin.bin.exe File opened for modification C:\Program Files\7-Zip\Lang\is.txt mkp_nowin.bin.exe File opened for modification C:\Program Files\7-Zip\Lang\lv.txt mkp_nowin.bin.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\it-IT\mshwLatin.dll.mui mkp_nowin.bin.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\ipsen.xml mkp_nowin.bin.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\sl-SI\tipresx.dll.mui mkp_nowin.bin.exe File opened for modification C:\Program Files\7-Zip\Lang\ka.txt mkp_nowin.bin.exe File opened for modification C:\Program Files\7-Zip\Lang\mk.txt mkp_nowin.bin.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\de-DE\mip.exe.mui mkp_nowin.bin.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\fr-FR\tipresx.dll.mui mkp_nowin.bin.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\ko-kr.xml mkp_nowin.bin.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\hwresmlm.dat mkp_nowin.bin.exe File opened for modification C:\Program Files\7-Zip\Lang\ga.txt mkp_nowin.bin.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\zh-dayi.xml mkp_nowin.bin.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\numbers.xml mkp_nowin.bin.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\hwrcatlm.dat mkp_nowin.bin.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\MSInfo\ja-JP\msinfo32.exe.mui mkp_nowin.bin.exe File opened for modification C:\Program Files\7-Zip\Lang\ky.txt mkp_nowin.bin.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\de-DE\micaut.dll.mui mkp_nowin.bin.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\en-US\InkWatson.exe.mui mkp_nowin.bin.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\base.xml mkp_nowin.bin.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\oskmenu\oskmenubase.xml mkp_nowin.bin.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\it-IT\TipBand.dll.mui mkp_nowin.bin.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\fr-FR\InputPersonalization.exe.mui mkp_nowin.bin.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\it-IT\InkWatson.exe.mui mkp_nowin.bin.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\ro-RO\tipresx.dll.mui mkp_nowin.bin.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\zh-TW\tipresx.dll.mui mkp_nowin.bin.exe File opened for modification C:\Program Files\7-Zip\Lang\lij.txt mkp_nowin.bin.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\en-US\micaut.dll.mui mkp_nowin.bin.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\es-ES\InkWatson.exe.mui mkp_nowin.bin.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\keypad\ea.xml mkp_nowin.bin.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\hu-HU\tipresx.dll.mui mkp_nowin.bin.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\ipsesp.xml mkp_nowin.bin.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\de-DE\rtscom.dll.mui mkp_nowin.bin.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\it-IT\tipresx.dll.mui mkp_nowin.bin.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\ipsdeu.xml mkp_nowin.bin.exe File opened for modification C:\Program Files\7-Zip\Lang\bg.txt mkp_nowin.bin.exe File opened for modification C:\Program Files\7-Zip\Lang\tt.txt mkp_nowin.bin.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\en-US\IPSEventLogMsg.dll.mui mkp_nowin.bin.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\es-ES\ShapeCollector.exe.mui mkp_nowin.bin.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\fr-FR\InkObj.dll.mui mkp_nowin.bin.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\hwritalm.dat mkp_nowin.bin.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\it-IT\TipTsf.dll.mui mkp_nowin.bin.exe File opened for modification C:\Program Files\7-Zip\Lang\br.txt mkp_nowin.bin.exe File opened for modification C:\Program Files\7-Zip\Lang\es.txt mkp_nowin.bin.exe File opened for modification C:\Program Files\7-Zip\Lang\et.txt mkp_nowin.bin.exe -
Interacts with shadow copies 2 TTPs 1 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
pid Process 1712 vssadmin.exe -
Suspicious behavior: EnumeratesProcesses 1 IoCs
pid Process 1048 mkp_nowin.bin.exe -
Suspicious use of AdjustPrivilegeToken 46 IoCs
description pid Process Token: SeBackupPrivilege 876 vssvc.exe Token: SeRestorePrivilege 876 vssvc.exe Token: SeAuditPrivilege 876 vssvc.exe Token: SeBackupPrivilege 1684 wbengine.exe Token: SeRestorePrivilege 1684 wbengine.exe Token: SeSecurityPrivilege 1684 wbengine.exe Token: SeIncreaseQuotaPrivilege 748 WMIC.exe Token: SeSecurityPrivilege 748 WMIC.exe Token: SeTakeOwnershipPrivilege 748 WMIC.exe Token: SeLoadDriverPrivilege 748 WMIC.exe Token: SeSystemProfilePrivilege 748 WMIC.exe Token: SeSystemtimePrivilege 748 WMIC.exe Token: SeProfSingleProcessPrivilege 748 WMIC.exe Token: SeIncBasePriorityPrivilege 748 WMIC.exe Token: SeCreatePagefilePrivilege 748 WMIC.exe Token: SeBackupPrivilege 748 WMIC.exe Token: SeRestorePrivilege 748 WMIC.exe Token: SeShutdownPrivilege 748 WMIC.exe Token: SeDebugPrivilege 748 WMIC.exe Token: SeSystemEnvironmentPrivilege 748 WMIC.exe Token: SeRemoteShutdownPrivilege 748 WMIC.exe Token: SeUndockPrivilege 748 WMIC.exe Token: SeManageVolumePrivilege 748 WMIC.exe Token: 33 748 WMIC.exe Token: 34 748 WMIC.exe Token: 35 748 WMIC.exe Token: SeIncreaseQuotaPrivilege 748 WMIC.exe Token: SeSecurityPrivilege 748 WMIC.exe Token: SeTakeOwnershipPrivilege 748 WMIC.exe Token: SeLoadDriverPrivilege 748 WMIC.exe Token: SeSystemProfilePrivilege 748 WMIC.exe Token: SeSystemtimePrivilege 748 WMIC.exe Token: SeProfSingleProcessPrivilege 748 WMIC.exe Token: SeIncBasePriorityPrivilege 748 WMIC.exe Token: SeCreatePagefilePrivilege 748 WMIC.exe Token: SeBackupPrivilege 748 WMIC.exe Token: SeRestorePrivilege 748 WMIC.exe Token: SeShutdownPrivilege 748 WMIC.exe Token: SeDebugPrivilege 748 WMIC.exe Token: SeSystemEnvironmentPrivilege 748 WMIC.exe Token: SeRemoteShutdownPrivilege 748 WMIC.exe Token: SeUndockPrivilege 748 WMIC.exe Token: SeManageVolumePrivilege 748 WMIC.exe Token: 33 748 WMIC.exe Token: 34 748 WMIC.exe Token: 35 748 WMIC.exe -
Suspicious use of WriteProcessMemory 13 IoCs
description pid Process procid_target PID 1048 wrote to memory of 1072 1048 mkp_nowin.bin.exe 27 PID 1048 wrote to memory of 1072 1048 mkp_nowin.bin.exe 27 PID 1048 wrote to memory of 1072 1048 mkp_nowin.bin.exe 27 PID 1048 wrote to memory of 1072 1048 mkp_nowin.bin.exe 27 PID 1072 wrote to memory of 1712 1072 cmd.exe 29 PID 1072 wrote to memory of 1712 1072 cmd.exe 29 PID 1072 wrote to memory of 1712 1072 cmd.exe 29 PID 1072 wrote to memory of 1148 1072 cmd.exe 32 PID 1072 wrote to memory of 1148 1072 cmd.exe 32 PID 1072 wrote to memory of 1148 1072 cmd.exe 32 PID 1072 wrote to memory of 748 1072 cmd.exe 36 PID 1072 wrote to memory of 748 1072 cmd.exe 36 PID 1072 wrote to memory of 748 1072 cmd.exe 36 -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
-
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\mkp_nowin.bin.exe"C:\Users\Admin\AppData\Local\Temp\mkp_nowin.bin.exe"1⤵
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1048 -
C:\Users\Admin\AppData\Local\Temp\mkp_nowin.bin.exe"C:\Users\Admin\AppData\Local\Temp\mkp_nowin.bin.exe" n10482⤵PID:2004
-
-
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:1072 -
C:\Windows\system32\vssadmin.exevssadmin delete shadows /all /quiet3⤵
- Interacts with shadow copies
PID:1712
-
-
C:\Windows\system32\wbadmin.exewbadmin delete catalog -quiet3⤵
- Deletes backup catalog
PID:1148
-
-
C:\Windows\System32\Wbem\WMIC.exewmic shadowcopy delete3⤵
- Suspicious use of AdjustPrivilegeToken
PID:748
-
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
PID:876
-
C:\Windows\system32\wbengine.exe"C:\Windows\system32\wbengine.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1684
-
C:\Windows\System32\vdsldr.exeC:\Windows\System32\vdsldr.exe -Embedding1⤵PID:1012
-
C:\Windows\System32\vds.exeC:\Windows\System32\vds.exe1⤵PID:1936
-
C:\Windows\system32\Dwm.exe"C:\Windows\system32\Dwm.exe"1⤵PID:432
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD529abe2cf61968275a38bcf735c875d5d
SHA14386674a153df8a4a1dc81bcf976ffae29299b2f
SHA256463c885a5b5cf4b8447e11fddf5b2028c8adf0974f6bb3178454bf26bb3082e6
SHA512261193ffe16866ed90f20ef293876c619393ce7e29a75cfba87badd2f34f2bed8338728a0a0ce505b6817adab04e9e22826cdd42f7917b434c1b978f07dc5871