Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Overview
overview
10Static
static
3cerber.exe
windows7-x64
10cerber.exe
windows10-2004-x64
10Locky.exe
windows7-x64
10Locky.exe
windows10-2004-x64
1026b4699a7b...39.exe
windows7-x64
626b4699a7b...39.exe
windows10-2004-x64
64c1dc73791...5c.exe
windows7-x64
64c1dc73791...5c.exe
windows10-2004-x64
6683a09da21...96.exe
windows7-x64
10683a09da21...96.exe
windows10-2004-x64
5unpacked.exe
windows7-x64
10unpacked.exe
windows10-2004-x64
10Resubmissions
14/05/2023, 19:15
230514-xydc6sdc98 10Analysis
-
max time kernel
133s -
max time network
139s -
platform
windows7_x64 -
resource
win7-20230220-en -
resource tags
arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system -
submitted
14/05/2023, 19:15
Static task
static1
Behavioral task
behavioral1
Sample
cerber.exe
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
cerber.exe
Resource
win10v2004-20230220-en
Behavioral task
behavioral3
Sample
Locky.exe
Resource
win7-20230220-en
Behavioral task
behavioral4
Sample
Locky.exe
Resource
win10v2004-20230220-en
Behavioral task
behavioral5
Sample
26b4699a7b9eeb16e76305d843d4ab05e94d43f3201436927e13b3ebafa90739.exe
Resource
win7-20230220-en
Behavioral task
behavioral6
Sample
26b4699a7b9eeb16e76305d843d4ab05e94d43f3201436927e13b3ebafa90739.exe
Resource
win10v2004-20230220-en
Behavioral task
behavioral7
Sample
4c1dc737915d76b7ce579abddaba74ead6fdb5b519a1ea45308b8c49b950655c.exe
Resource
win7-20230220-en
Behavioral task
behavioral8
Sample
4c1dc737915d76b7ce579abddaba74ead6fdb5b519a1ea45308b8c49b950655c.exe
Resource
win10v2004-20230220-en
Behavioral task
behavioral9
Sample
683a09da219918258c58a7f61f7dc4161a3a7a377cf82a31b840baabfb9a4a96.exe
Resource
win7-20230220-en
Behavioral task
behavioral10
Sample
683a09da219918258c58a7f61f7dc4161a3a7a377cf82a31b840baabfb9a4a96.exe
Resource
win10v2004-20230221-en
Behavioral task
behavioral11
Sample
unpacked.exe
Resource
win7-20230220-en
Behavioral task
behavioral12
Sample
unpacked.exe
Resource
win10v2004-20230220-en
General
-
Target
unpacked.exe
-
Size
72KB
-
MD5
108756f41d114eb93e136ba2feb838d0
-
SHA1
8c6b51923ee7da2f4642c7717db95fbb77d96164
-
SHA256
b38b4c1dcf6d6ecd1bbfc236b43c37c18044c2f42f11e5088384f4bd0751929c
-
SHA512
d13183e8ba4689475b0cb3f5cc7acbfba34a1ba661eb5988984647c2bd3e561cfa03f6267f60ae9fb2ca0783f26c105cdbcfc89def598c48968febef23c21aaa
-
SSDEEP
768:F9NJK3qZRhxXHIQBsLL16BKc+bBQZ/UMc2:rXzXol6cc+lQZMMc2
Malware Config
Extracted
C:\Users\Admin\AppData\Local\Temp\!satana!.txt
Signatures
-
Satana
Ransomware family which also encrypts the system's Master Boot Record (MBR).
-
Deletes shadow copies 2 TTPs
Ransomware often targets backup files to inhibit system recovery.
-
Deletes itself 1 IoCs
pid Process 1316 juoaobqe.exe -
Executes dropped EXE 1 IoCs
pid Process 1316 juoaobqe.exe -
Loads dropped DLL 5 IoCs
pid Process 840 unpacked.exe 840 unpacked.exe 840 unpacked.exe 840 unpacked.exe 1316 juoaobqe.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2961826002-3968192592-354541192-1000\Software\Microsoft\Windows\CurrentVersion\Run\rczb = "C:\\Users\\Admin\\AppData\\Local\\Temp\\!satana!.txt" unpacked.exe Key created \REGISTRY\USER\S-1-5-21-2961826002-3968192592-354541192-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run unpacked.exe -
Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
description ioc Process File opened for modification \??\PHYSICALDRIVE0 juoaobqe.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files (x86)\Common Files\microsoft shared\Help\2052\!satana!.txt juoaobqe.exe File opened for modification C:\Program Files (x86)\Microsoft Visual Studio 8\Common7\IDE\VSTA\ItemTemplates\CSharp\1033\ResourceInternal.zip juoaobqe.exe File created C:\Program Files\Common Files\Microsoft Shared\MSInfo\de-DE\!satana!.txt juoaobqe.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.rjmx_5.5.0.165303\META-INF\!satana!.txt juoaobqe.exe File created C:\Program Files\Microsoft Games\Solitaire\fr-FR\!satana!.txt juoaobqe.exe File opened for modification C:\Program Files (x86)\Windows Sidebar\Gadgets\Calendar.Gadget\icon.png juoaobqe.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\zh-dayi.xml juoaobqe.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\oskmenu\!satana!.txt juoaobqe.exe File opened for modification C:\Program Files\Google\Chrome\Application\106.0.5249.119\VisualElements\SmallLogoDev.png juoaobqe.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsViewAttachmentIcons.jpg juoaobqe.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\org-netbeans-spi-quicksearch.xml juoaobqe.exe File created C:\Program Files\Microsoft Games\Solitaire\!satana!.txt juoaobqe.exe File created C:\Program Files\VideoLAN\VLC\locale\nn\LC_MESSAGES\!satana!.txt juoaobqe.exe File opened for modification C:\Program Files (x86)\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\Images\hint_over.png juoaobqe.exe File created C:\Program Files (x86)\Windows Sidebar\Gadgets\Weather.Gadget\fr-FR\!satana!.txt juoaobqe.exe File created C:\Program Files (x86)\Common Files\System\Ole DB\!satana!.txt juoaobqe.exe File opened for modification C:\Program Files (x86)\Windows Sidebar\Gadgets\Clock.Gadget\images\settings_box_left.png juoaobqe.exe File created C:\Program Files (x86)\Windows Sidebar\Gadgets\Currency.Gadget\fr-FR\js\!satana!.txt juoaobqe.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\RSSFeeds.Gadget\drag.png juoaobqe.exe File created C:\Program Files (x86)\Windows Sidebar\Gadgets\Calendar.Gadget\de-DE\css\!satana!.txt juoaobqe.exe File opened for modification C:\Program Files\7-Zip\Lang\hi.txt juoaobqe.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\!satana!.txt juoaobqe.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\lib\deployed\jdk16\windows-amd64\!satana!.txt juoaobqe.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\ipsnld.xml juoaobqe.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\update_tracking\org-netbeans-modules-profiler-attach.xml juoaobqe.exe File created C:\Program Files\Java\jre7\bin\dtplugin\!satana!.txt juoaobqe.exe File created C:\Program Files (x86)\Common Files\microsoft shared\TRANSLAT\FRAR\!satana!.txt juoaobqe.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveProjectToolset\ZoomIcons.jpg juoaobqe.exe File created C:\Program Files (x86)\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\es-ES\!satana!.txt juoaobqe.exe File created C:\Program Files\Common Files\System\Ole DB\es-ES\!satana!.txt juoaobqe.exe File opened for modification C:\Program Files\Internet Explorer\Timeline.cpu.xml juoaobqe.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\undocked_black_moon-new.png juoaobqe.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Document Themes 14\Theme Colors\Essential.xml juoaobqe.exe File created C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\BrightOrange\!satana!.txt juoaobqe.exe File created C:\Program Files\VideoLAN\VLC\locale\oc\!satana!.txt juoaobqe.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\Images\8.png juoaobqe.exe File created C:\Program Files (x86)\Internet Explorer\ja-JP\!satana!.txt juoaobqe.exe File opened for modification C:\Program Files (x86)\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\Images\timer_up.png juoaobqe.exe File created C:\Program Files (x86)\Windows Sidebar\Gadgets\RSSFeeds.Gadget\es-ES\css\!satana!.txt juoaobqe.exe File opened for modification C:\Program Files (x86)\Windows Sidebar\Gadgets\Weather.Gadget\images\docked_blue_snow.png juoaobqe.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\content-foreground.png juoaobqe.exe File created C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\LAYERS\!satana!.txt juoaobqe.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\STS2\background.gif juoaobqe.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main.xml juoaobqe.exe File opened for modification C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.0\SubsetList\Client.xml juoaobqe.exe File opened for modification C:\Program Files (x86)\Windows Sidebar\Gadgets\Clock.Gadget\images\settings_left_disabled.png juoaobqe.exe File created C:\Program Files (x86)\Common Files\microsoft shared\Triedit\fr-FR\!satana!.txt juoaobqe.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormToolImages.jpg juoaobqe.exe File opened for modification C:\Program Files (x86)\Windows Sidebar\Gadgets\SlideShow.Gadget\images\prev_hov.png juoaobqe.exe File created C:\Program Files\Common Files\System\msadc\en-US\!satana!.txt juoaobqe.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\SpecialOccasion\whitevignette1047.png juoaobqe.exe File created C:\Program Files\VideoLAN\VLC\locale\sq\!satana!.txt juoaobqe.exe File created C:\Program Files\DVD Maker\fr-FR\!satana!.txt juoaobqe.exe File created C:\Program Files\Windows NT\TableTextService\!satana!.txt juoaobqe.exe File opened for modification C:\Program Files (x86)\Windows Sidebar\Gadgets\Weather.Gadget\images\docked_black_moon-waning-crescent.png juoaobqe.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\22.png juoaobqe.exe File opened for modification C:\Program Files (x86)\Windows Sidebar\Gadgets\Currency.Gadget\en-US\gadget.xml juoaobqe.exe File created C:\Program Files (x86)\Windows Sidebar\Gadgets\Currency.Gadget\fr-FR\css\!satana!.txt juoaobqe.exe File opened for modification C:\Program Files\7-Zip\Lang\da.txt juoaobqe.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\org-netbeans-modules-editor-mimelookup.xml juoaobqe.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\config\Modules\!satana!.txt juoaobqe.exe File created C:\Program Files\VideoLAN\VLC\locale\be\!satana!.txt juoaobqe.exe File opened for modification C:\Program Files\Windows NT\TableTextService\TableTextServiceDaYi.txt juoaobqe.exe File created C:\Program Files\Windows Sidebar\Gadgets\CPU.Gadget\it-IT\!satana!.txt juoaobqe.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Interacts with shadow copies 2 TTPs 1 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
pid Process 552 VSSADMIN.EXE -
Suspicious use of AdjustPrivilegeToken 4 IoCs
description pid Process Token: SeIncBasePriorityPrivilege 1316 juoaobqe.exe Token: SeBackupPrivilege 436 vssvc.exe Token: SeRestorePrivilege 436 vssvc.exe Token: SeAuditPrivilege 436 vssvc.exe -
Suspicious use of WriteProcessMemory 8 IoCs
description pid Process procid_target PID 840 wrote to memory of 1316 840 unpacked.exe 28 PID 840 wrote to memory of 1316 840 unpacked.exe 28 PID 840 wrote to memory of 1316 840 unpacked.exe 28 PID 840 wrote to memory of 1316 840 unpacked.exe 28 PID 1316 wrote to memory of 552 1316 juoaobqe.exe 29 PID 1316 wrote to memory of 552 1316 juoaobqe.exe 29 PID 1316 wrote to memory of 552 1316 juoaobqe.exe 29 PID 1316 wrote to memory of 552 1316 juoaobqe.exe 29 -
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\unpacked.exe"C:\Users\Admin\AppData\Local\Temp\unpacked.exe"1⤵
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:840 -
C:\Users\Admin\AppData\Local\Temp\juoaobqe.exe"C:\Users\Admin\AppData\Local\Temp\juoaobqe.exe" {846ee340-7039-11de-9d20-806e6f6e6963} "C:\Users\Admin\AppData\Local\Temp\unpacked.exe"2⤵
- Deletes itself
- Executes dropped EXE
- Loads dropped DLL
- Writes to the Master Boot Record (MBR)
- Drops file in Program Files directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1316 -
C:\Windows\SysWOW64\VSSADMIN.EXE"C:\Windows\system32\VSSADMIN.EXE" Delete Shadows /All /Quiet3⤵
- Interacts with shadow copies
PID:552
-
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
PID:436
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD518fa5c0d22442a65b3dc9ed5f4775cfa
SHA1f916f7bec0b2247e8e20fe3b7f6c49f850435a93
SHA2563ef35a0d3262337defb54714c4e37d3dd51cd39bdbe45f164608965ae0e27c25
SHA512d3ab035ca66b06e0afe4d0357ef43acaddc3d7b1adc5eaab6109c0c1478e200334ba069ca93a970efd9a42795df14509c04ef4c63a7d099c6e881f08e6257afa
-
Filesize
1KB
MD518fa5c0d22442a65b3dc9ed5f4775cfa
SHA1f916f7bec0b2247e8e20fe3b7f6c49f850435a93
SHA2563ef35a0d3262337defb54714c4e37d3dd51cd39bdbe45f164608965ae0e27c25
SHA512d3ab035ca66b06e0afe4d0357ef43acaddc3d7b1adc5eaab6109c0c1478e200334ba069ca93a970efd9a42795df14509c04ef4c63a7d099c6e881f08e6257afa
-
Filesize
72KB
MD5108756f41d114eb93e136ba2feb838d0
SHA18c6b51923ee7da2f4642c7717db95fbb77d96164
SHA256b38b4c1dcf6d6ecd1bbfc236b43c37c18044c2f42f11e5088384f4bd0751929c
SHA512d13183e8ba4689475b0cb3f5cc7acbfba34a1ba661eb5988984647c2bd3e561cfa03f6267f60ae9fb2ca0783f26c105cdbcfc89def598c48968febef23c21aaa
-
Filesize
72KB
MD5108756f41d114eb93e136ba2feb838d0
SHA18c6b51923ee7da2f4642c7717db95fbb77d96164
SHA256b38b4c1dcf6d6ecd1bbfc236b43c37c18044c2f42f11e5088384f4bd0751929c
SHA512d13183e8ba4689475b0cb3f5cc7acbfba34a1ba661eb5988984647c2bd3e561cfa03f6267f60ae9fb2ca0783f26c105cdbcfc89def598c48968febef23c21aaa
-
Filesize
72KB
MD5108756f41d114eb93e136ba2feb838d0
SHA18c6b51923ee7da2f4642c7717db95fbb77d96164
SHA256b38b4c1dcf6d6ecd1bbfc236b43c37c18044c2f42f11e5088384f4bd0751929c
SHA512d13183e8ba4689475b0cb3f5cc7acbfba34a1ba661eb5988984647c2bd3e561cfa03f6267f60ae9fb2ca0783f26c105cdbcfc89def598c48968febef23c21aaa
-
Filesize
72KB
MD5108756f41d114eb93e136ba2feb838d0
SHA18c6b51923ee7da2f4642c7717db95fbb77d96164
SHA256b38b4c1dcf6d6ecd1bbfc236b43c37c18044c2f42f11e5088384f4bd0751929c
SHA512d13183e8ba4689475b0cb3f5cc7acbfba34a1ba661eb5988984647c2bd3e561cfa03f6267f60ae9fb2ca0783f26c105cdbcfc89def598c48968febef23c21aaa
-
Filesize
72KB
MD5108756f41d114eb93e136ba2feb838d0
SHA18c6b51923ee7da2f4642c7717db95fbb77d96164
SHA256b38b4c1dcf6d6ecd1bbfc236b43c37c18044c2f42f11e5088384f4bd0751929c
SHA512d13183e8ba4689475b0cb3f5cc7acbfba34a1ba661eb5988984647c2bd3e561cfa03f6267f60ae9fb2ca0783f26c105cdbcfc89def598c48968febef23c21aaa
-
Filesize
72KB
MD5108756f41d114eb93e136ba2feb838d0
SHA18c6b51923ee7da2f4642c7717db95fbb77d96164
SHA256b38b4c1dcf6d6ecd1bbfc236b43c37c18044c2f42f11e5088384f4bd0751929c
SHA512d13183e8ba4689475b0cb3f5cc7acbfba34a1ba661eb5988984647c2bd3e561cfa03f6267f60ae9fb2ca0783f26c105cdbcfc89def598c48968febef23c21aaa
-
Filesize
72KB
MD5108756f41d114eb93e136ba2feb838d0
SHA18c6b51923ee7da2f4642c7717db95fbb77d96164
SHA256b38b4c1dcf6d6ecd1bbfc236b43c37c18044c2f42f11e5088384f4bd0751929c
SHA512d13183e8ba4689475b0cb3f5cc7acbfba34a1ba661eb5988984647c2bd3e561cfa03f6267f60ae9fb2ca0783f26c105cdbcfc89def598c48968febef23c21aaa
-
Filesize
72KB
MD5108756f41d114eb93e136ba2feb838d0
SHA18c6b51923ee7da2f4642c7717db95fbb77d96164
SHA256b38b4c1dcf6d6ecd1bbfc236b43c37c18044c2f42f11e5088384f4bd0751929c
SHA512d13183e8ba4689475b0cb3f5cc7acbfba34a1ba661eb5988984647c2bd3e561cfa03f6267f60ae9fb2ca0783f26c105cdbcfc89def598c48968febef23c21aaa