Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
94s -
max time network
98s -
platform
windows7_x64 -
resource
win7-20230220-en -
resource tags
arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system -
submitted
15/04/2023, 03:12
Behavioral task
behavioral1
Sample
2023-04-14_d8ad1664371e35d12035f530252ec8c4_.exe
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
2023-04-14_d8ad1664371e35d12035f530252ec8c4_.exe
Resource
win10v2004-20230220-en
General
-
Target
2023-04-14_d8ad1664371e35d12035f530252ec8c4_.exe
-
Size
41KB
-
MD5
d8ad1664371e35d12035f530252ec8c4
-
SHA1
41f9275d57ff644c8224034de3032cb73990c2ec
-
SHA256
008e4c327875110b96deef1dd8ef65cefa201fef60ca1cbb9ab51b5304e66fe1
-
SHA512
6cf8ce589c0a0331278e758174139196fae33a9b1c3bb8dab578b6f9be1c30cadf5da16163f53ad7f43d8a47e54cd4d0b1434bd09c872c28d08ab36e07d91f6e
-
SSDEEP
768:RL+ntTLPgnsCI1uGukUcjI2Hp9xG6e7j6oERZVvrd7SRBl+Lkl+XkvDyYD+DAfqp:RwtTLE/I1RUcdJ861s0cy4SAyDJbpI
Malware Config
Extracted
C:\Users\Admin\Desktop\readme-warning.txt
makop
Signatures
-
Makop
Ransomware family discovered by @VK_Intel in early 2020.
-
Deletes shadow copies 2 TTPs
Ransomware often targets backup files to inhibit system recovery.
-
pid Process 1512 wbadmin.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Legitimate hosting services abused for malware hosting/C2 1 TTPs
-
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.views_3.7.0.v20140408-0703.jar 2023-04-14_d8ad1664371e35d12035f530252ec8c4_.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\hy\LC_MESSAGES\vlc.mo 2023-04-14_d8ad1664371e35d12035f530252ec8c4_.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\NA00391_.WMF 2023-04-14_d8ad1664371e35d12035f530252ec8c4_.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\PUBSPAPR\PDIR22F.GIF 2023-04-14_d8ad1664371e35d12035f530252ec8c4_.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\db\lib\derbyLocale_ko_KR.jar 2023-04-14_d8ad1664371e35d12035f530252ec8c4_.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Pacific\Guam 2023-04-14_d8ad1664371e35d12035f530252ec8c4_.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Document Themes 14\Equity.thmx 2023-04-14_d8ad1664371e35d12035f530252ec8c4_.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\ms\LC_MESSAGES\vlc.mo 2023-04-14_d8ad1664371e35d12035f530252ec8c4_.exe File opened for modification C:\Program Files (x86)\Windows Sidebar\Gadgets\Clock.Gadget\ja-JP\clock.html 2023-04-14_d8ad1664371e35d12035f530252ec8c4_.exe File opened for modification C:\Program Files (x86)\Windows Sidebar\Gadgets\Weather.Gadget\en-US\weather.html 2023-04-14_d8ad1664371e35d12035f530252ec8c4_.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.browser.ja_5.5.0.165303.jar 2023-04-14_d8ad1664371e35d12035f530252ec8c4_.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\ED00019_.WMF 2023-04-14_d8ad1664371e35d12035f530252ec8c4_.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\SO02025_.WMF 2023-04-14_d8ad1664371e35d12035f530252ec8c4_.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AMT\AUMProduct.cer 2023-04-14_d8ad1664371e35d12035f530252ec8c4_.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.apache.jasper.glassfish_2.2.2.v201205150955.jar 2023-04-14_d8ad1664371e35d12035f530252ec8c4_.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\locale\com-sun-tools-visualvm-attach_zh_CN.jar 2023-04-14_d8ad1664371e35d12035f530252ec8c4_.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\de-DE\settings.html 2023-04-14_d8ad1664371e35d12035f530252ec8c4_.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\EN00006_.WMF 2023-04-14_d8ad1664371e35d12035f530252ec8c4_.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0237228.WMF 2023-04-14_d8ad1664371e35d12035f530252ec8c4_.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\PUBFTSCM\SCHEME10.CSS 2023-04-14_d8ad1664371e35d12035f530252ec8c4_.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\images\cursors\win32_CopyDrop32x32.gif 2023-04-14_d8ad1664371e35d12035f530252ec8c4_.exe File opened for modification C:\Program Files\Windows Media Player\en-US\setup_wm.exe.mui 2023-04-14_d8ad1664371e35d12035f530252ec8c4_.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.reconciler.dropins_1.1.200.v20131119-0908.jar 2023-04-14_d8ad1664371e35d12035f530252ec8c4_.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-openide-io.xml 2023-04-14_d8ad1664371e35d12035f530252ec8c4_.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Europe\Luxembourg 2023-04-14_d8ad1664371e35d12035f530252ec8c4_.exe File opened for modification C:\Program Files\Microsoft Games\Multiplayer\Checkers\ja-JP\ChkrRes.dll.mui 2023-04-14_d8ad1664371e35d12035f530252ec8c4_.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\BL00148_.WMF 2023-04-14_d8ad1664371e35d12035f530252ec8c4_.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\SplashScreen.bmp 2023-04-14_d8ad1664371e35d12035f530252ec8c4_.exe File opened for modification C:\Program Files (x86)\Windows Sidebar\Gadgets\Weather.Gadget\images\23.png 2023-04-14_d8ad1664371e35d12035f530252ec8c4_.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Etc\GMT+9 2023-04-14_d8ad1664371e35d12035f530252ec8c4_.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-api-search_ja.jar 2023-04-14_d8ad1664371e35d12035f530252ec8c4_.exe File opened for modification C:\Program Files\Windows Journal\de-DE\jnwmon.dll.mui 2023-04-14_d8ad1664371e35d12035f530252ec8c4_.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\AG00160_.GIF 2023-04-14_d8ad1664371e35d12035f530252ec8c4_.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\Publisher\Backgrounds\WB02198_.GIF 2023-04-14_d8ad1664371e35d12035f530252ec8c4_.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Document Themes 14\Urban.thmx 2023-04-14_d8ad1664371e35d12035f530252ec8c4_.exe File opened for modification C:\Program Files (x86)\Windows Sidebar\Gadgets\Clock.Gadget\it-IT\js\timeZones.js 2023-04-14_d8ad1664371e35d12035f530252ec8c4_.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\content-foreground.png 2023-04-14_d8ad1664371e35d12035f530252ec8c4_.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\vi\LC_MESSAGES\vlc.mo 2023-04-14_d8ad1664371e35d12035f530252ec8c4_.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\icon.png 2023-04-14_d8ad1664371e35d12035f530252ec8c4_.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\SL00452_.WMF 2023-04-14_d8ad1664371e35d12035f530252ec8c4_.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\SO02228_.WMF 2023-04-14_d8ad1664371e35d12035f530252ec8c4_.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\PUBFTSCM\SCHEME12.CSS 2023-04-14_d8ad1664371e35d12035f530252ec8c4_.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveProjectToolset\ProjectTool\Project Report Type\Fancy\PLUS.GIF 2023-04-14_d8ad1664371e35d12035f530252ec8c4_.exe File opened for modification C:\Program Files (x86)\Windows Sidebar\Gadgets\SlideShow.Gadget\ja-JP\css\settings.css 2023-04-14_d8ad1664371e35d12035f530252ec8c4_.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\an\LC_MESSAGES\vlc.mo 2023-04-14_d8ad1664371e35d12035f530252ec8c4_.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\core\core.jar 2023-04-14_d8ad1664371e35d12035f530252ec8c4_.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\undocked_black_moon-waxing-crescent_partly-cloudy.png 2023-04-14_d8ad1664371e35d12035f530252ec8c4_.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0186360.WMF 2023-04-14_d8ad1664371e35d12035f530252ec8c4_.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Grand_Turk 2023-04-14_d8ad1664371e35d12035f530252ec8c4_.exe File opened for modification C:\Program Files\NewResolve.xht 2023-04-14_d8ad1664371e35d12035f530252ec8c4_.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\images\flower_m.png 2023-04-14_d8ad1664371e35d12035f530252ec8c4_.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\images\system.png 2023-04-14_d8ad1664371e35d12035f530252ec8c4_.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0182898.WMF 2023-04-14_d8ad1664371e35d12035f530252ec8c4_.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Indiana\Marengo 2023-04-14_d8ad1664371e35d12035f530252ec8c4_.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\config\Modules\com-sun-tools-visualvm-coredump.xml 2023-04-14_d8ad1664371e35d12035f530252ec8c4_.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms\button_left.gif 2023-04-14_d8ad1664371e35d12035f530252ec8c4_.exe File opened for modification C:\Program Files\7-Zip\Lang\ne.txt 2023-04-14_d8ad1664371e35d12035f530252ec8c4_.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\ResizingPanels\bandwidth.png 2023-04-14_d8ad1664371e35d12035f530252ec8c4_.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\ResizingPanels\NavigationUp_ButtonGraphic.png 2023-04-14_d8ad1664371e35d12035f530252ec8c4_.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.feature_3.9.0.v20140827-1444\about.html 2023-04-14_d8ad1664371e35d12035f530252ec8c4_.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\p2\org.eclipse.equinox.p2.engine\profileRegistry\JMC.profile\1423861261279.profile.gz 2023-04-14_d8ad1664371e35d12035f530252ec8c4_.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0152704.WMF 2023-04-14_d8ad1664371e35d12035f530252ec8c4_.exe File opened for modification C:\Program Files (x86)\Windows Sidebar\Gadgets\Calendar.Gadget\es-ES\js\calendar.js 2023-04-14_d8ad1664371e35d12035f530252ec8c4_.exe File opened for modification C:\Program Files (x86)\Windows Sidebar\Gadgets\SlideShow.Gadget\es-ES\css\slideShow.css 2023-04-14_d8ad1664371e35d12035f530252ec8c4_.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Interacts with shadow copies 2 TTPs 1 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
pid Process 1724 vssadmin.exe -
Suspicious behavior: EnumeratesProcesses 1 IoCs
pid Process 2024 2023-04-14_d8ad1664371e35d12035f530252ec8c4_.exe -
Suspicious use of AdjustPrivilegeToken 46 IoCs
description pid Process Token: SeBackupPrivilege 568 vssvc.exe Token: SeRestorePrivilege 568 vssvc.exe Token: SeAuditPrivilege 568 vssvc.exe Token: SeBackupPrivilege 296 wbengine.exe Token: SeRestorePrivilege 296 wbengine.exe Token: SeSecurityPrivilege 296 wbengine.exe Token: SeIncreaseQuotaPrivilege 2012 WMIC.exe Token: SeSecurityPrivilege 2012 WMIC.exe Token: SeTakeOwnershipPrivilege 2012 WMIC.exe Token: SeLoadDriverPrivilege 2012 WMIC.exe Token: SeSystemProfilePrivilege 2012 WMIC.exe Token: SeSystemtimePrivilege 2012 WMIC.exe Token: SeProfSingleProcessPrivilege 2012 WMIC.exe Token: SeIncBasePriorityPrivilege 2012 WMIC.exe Token: SeCreatePagefilePrivilege 2012 WMIC.exe Token: SeBackupPrivilege 2012 WMIC.exe Token: SeRestorePrivilege 2012 WMIC.exe Token: SeShutdownPrivilege 2012 WMIC.exe Token: SeDebugPrivilege 2012 WMIC.exe Token: SeSystemEnvironmentPrivilege 2012 WMIC.exe Token: SeRemoteShutdownPrivilege 2012 WMIC.exe Token: SeUndockPrivilege 2012 WMIC.exe Token: SeManageVolumePrivilege 2012 WMIC.exe Token: 33 2012 WMIC.exe Token: 34 2012 WMIC.exe Token: 35 2012 WMIC.exe Token: SeIncreaseQuotaPrivilege 2012 WMIC.exe Token: SeSecurityPrivilege 2012 WMIC.exe Token: SeTakeOwnershipPrivilege 2012 WMIC.exe Token: SeLoadDriverPrivilege 2012 WMIC.exe Token: SeSystemProfilePrivilege 2012 WMIC.exe Token: SeSystemtimePrivilege 2012 WMIC.exe Token: SeProfSingleProcessPrivilege 2012 WMIC.exe Token: SeIncBasePriorityPrivilege 2012 WMIC.exe Token: SeCreatePagefilePrivilege 2012 WMIC.exe Token: SeBackupPrivilege 2012 WMIC.exe Token: SeRestorePrivilege 2012 WMIC.exe Token: SeShutdownPrivilege 2012 WMIC.exe Token: SeDebugPrivilege 2012 WMIC.exe Token: SeSystemEnvironmentPrivilege 2012 WMIC.exe Token: SeRemoteShutdownPrivilege 2012 WMIC.exe Token: SeUndockPrivilege 2012 WMIC.exe Token: SeManageVolumePrivilege 2012 WMIC.exe Token: 33 2012 WMIC.exe Token: 34 2012 WMIC.exe Token: 35 2012 WMIC.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2024 2023-04-14_d8ad1664371e35d12035f530252ec8c4_.exe -
Suspicious use of WriteProcessMemory 17 IoCs
description pid Process procid_target PID 2024 wrote to memory of 1128 2024 2023-04-14_d8ad1664371e35d12035f530252ec8c4_.exe 27 PID 2024 wrote to memory of 1128 2024 2023-04-14_d8ad1664371e35d12035f530252ec8c4_.exe 27 PID 2024 wrote to memory of 1128 2024 2023-04-14_d8ad1664371e35d12035f530252ec8c4_.exe 27 PID 2024 wrote to memory of 1128 2024 2023-04-14_d8ad1664371e35d12035f530252ec8c4_.exe 27 PID 1128 wrote to memory of 1724 1128 cmd.exe 29 PID 1128 wrote to memory of 1724 1128 cmd.exe 29 PID 1128 wrote to memory of 1724 1128 cmd.exe 29 PID 1128 wrote to memory of 1512 1128 cmd.exe 32 PID 1128 wrote to memory of 1512 1128 cmd.exe 32 PID 1128 wrote to memory of 1512 1128 cmd.exe 32 PID 1128 wrote to memory of 2012 1128 cmd.exe 36 PID 1128 wrote to memory of 2012 1128 cmd.exe 36 PID 1128 wrote to memory of 2012 1128 cmd.exe 36 PID 2024 wrote to memory of 1128 2024 2023-04-14_d8ad1664371e35d12035f530252ec8c4_.exe 40 PID 2024 wrote to memory of 1128 2024 2023-04-14_d8ad1664371e35d12035f530252ec8c4_.exe 40 PID 2024 wrote to memory of 1128 2024 2023-04-14_d8ad1664371e35d12035f530252ec8c4_.exe 40 PID 2024 wrote to memory of 1128 2024 2023-04-14_d8ad1664371e35d12035f530252ec8c4_.exe 40 -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
-
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\2023-04-14_d8ad1664371e35d12035f530252ec8c4_.exe"C:\Users\Admin\AppData\Local\Temp\2023-04-14_d8ad1664371e35d12035f530252ec8c4_.exe"1⤵
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:2024 -
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:1128 -
C:\Windows\system32\vssadmin.exevssadmin delete shadows /all /quiet3⤵
- Interacts with shadow copies
PID:1724
-
-
C:\Windows\system32\wbadmin.exewbadmin delete catalog -quiet3⤵
- Deletes backup catalog
PID:1512
-
-
C:\Windows\System32\Wbem\WMIC.exewmic shadowcopy delete3⤵
- Suspicious use of AdjustPrivilegeToken
PID:2012
-
-
-
C:\Windows\SysWOW64\NOTEPAD.EXE"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\readme-warning.txt2⤵PID:1128
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
PID:568
-
C:\Windows\system32\wbengine.exe"C:\Windows\system32\wbengine.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
PID:296
-
C:\Windows\System32\vdsldr.exeC:\Windows\System32\vdsldr.exe -Embedding1⤵PID:1108
-
C:\Windows\System32\vds.exeC:\Windows\System32\vds.exe1⤵PID:1836
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD53d308673ef659059bafce43f80efc8f8
SHA1c35dee28a24a15e8a26d587b07222214db3e26c8
SHA256a21763a7d65af3c5a70f83f125fb9fd30a22e23873f64a68592c7b166d3352d2
SHA5127677fb22d6f4b2fc51288fe0e7cae329df6e368995fc204767bbaf04d18f7fb5b490588d838d8c2002ed86d9f5f4be571217d48fea7e57093efc1a5c6523f8dd