Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    117s
  • max time network
    120s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230220-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
  • submitted
    23/05/2023, 05:29

General

  • Target

    Automatic_converter_rff_to_mp4.exe

  • Size

    322KB

  • MD5

    1b4f89bdb12a349de92ca7f1261e67a0

  • SHA1

    f368916850332757d7ed2f0ee335c16b9c9fc95b

  • SHA256

    d4c83205cf6f3098ab6a757312525f4d14a57a819306eeea5c0d022b00b38cf3

  • SHA512

    f2f7985fbf462bc35e099b58308ddef91320d3d81040f77e7c1c0a3cfc3a4da50c849efd0f063c839848a80927398cc24bc8368d5b0b92014abe2ea7bdc2ddeb

  • SSDEEP

    6144:iibVlHNEHBpDDf2vfQ21NV0zUiCqWjH6YPON9q:igtCpPfGfZSWPf

Malware Config

Signatures

  • Modifies WinLogon for persistence 2 TTPs 1 IoCs
  • Disables Task Manager via registry modification
  • Possible privilege escalation attempt 2 IoCs
  • Checks computer location settings 2 TTPs 2 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 1 IoCs
  • Modifies file permissions 1 TTPs 2 IoCs
  • Drops file in System32 directory 6 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Modifies registry class 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 4 IoCs
  • Suspicious use of WriteProcessMemory 10 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\Automatic_converter_rff_to_mp4.exe
    "C:\Users\Admin\AppData\Local\Temp\Automatic_converter_rff_to_mp4.exe"
    1⤵
    • Checks computer location settings
    • Drops file in System32 directory
    • Suspicious use of WriteProcessMemory
    PID:1220
    • C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe" /k takeown /f C:\Windows\System32 && icacls C:\Windows\System32 /grant "%username%:F"
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:2124
      • C:\Windows\system32\takeown.exe
        takeown /f C:\Windows\System32
        3⤵
        • Possible privilege escalation attempt
        • Modifies file permissions
        • Suspicious use of AdjustPrivilegeToken
        PID:2628
      • C:\Windows\system32\icacls.exe
        icacls C:\Windows\System32 /grant "Admin:F"
        3⤵
        • Possible privilege escalation attempt
        • Modifies file permissions
        PID:1484
    • C:\Windows\System32\WormLocker2.0.exe
      "C:\Windows\System32\WormLocker2.0.exe"
      2⤵
      • Modifies WinLogon for persistence
      • Checks computer location settings
      • Executes dropped EXE
      • Modifies registry class
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:1720
      • C:\Windows\System32\WScript.exe
        "C:\Windows\System32\WScript.exe" "C:\Windows\System32\ransom_voice.vbs"
        3⤵
          PID:384
    • C:\Windows\system32\AUDIODG.EXE
      C:\Windows\system32\AUDIODG.EXE 0x440 0x2f8
      1⤵
      • Suspicious use of AdjustPrivilegeToken
      PID:4452

    Network

    MITRE ATT&CK Enterprise v6

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Roaming\Microsoft\Speech\Files\UserLexicons\SP_6CCA938CF0E94F99BD45D1A826208B9A.dat

      Filesize

      940B

      MD5

      2cf7241566e2c9da80ed5ebceae6ed29

      SHA1

      812988494fc394190ac99b18e53145543d6672c4

      SHA256

      b9493cc46823f22b4ea7222040035fdf834d860166532e55a110e3ee51b284ed

      SHA512

      c424a4a44e58a71b7204f75e9c211f57260e6067aa4c537648533329855e1359939243cd4266ad3f78a6dcc1c8cd68bc2aa448d9c5775559f22f2eeabb3c4019

    • C:\Windows\System32\WormLocker2.0.exe

      Filesize

      116KB

      MD5

      041aa5e99ae545dac5f9306bb20d869e

      SHA1

      88ea126645bfd418abba44cca4a16adf12084d2f

      SHA256

      830c271c8aca775457a090a51c93ad08f9665361eeeaa3fda3f9ae032202ad73

      SHA512

      4b8007dddd519c77bb596f6d17f270da62b236894b6fd7f1c528e553b1aac3a7f9c0df4bb40b678461f70bde3c5a8ac4b5e97e5372dd127a8184862c7f6f4c7c

    • C:\Windows\System32\WormLocker2.0.exe

      Filesize

      116KB

      MD5

      041aa5e99ae545dac5f9306bb20d869e

      SHA1

      88ea126645bfd418abba44cca4a16adf12084d2f

      SHA256

      830c271c8aca775457a090a51c93ad08f9665361eeeaa3fda3f9ae032202ad73

      SHA512

      4b8007dddd519c77bb596f6d17f270da62b236894b6fd7f1c528e553b1aac3a7f9c0df4bb40b678461f70bde3c5a8ac4b5e97e5372dd127a8184862c7f6f4c7c

    • C:\Windows\System32\WormLocker2.0.exe

      Filesize

      116KB

      MD5

      041aa5e99ae545dac5f9306bb20d869e

      SHA1

      88ea126645bfd418abba44cca4a16adf12084d2f

      SHA256

      830c271c8aca775457a090a51c93ad08f9665361eeeaa3fda3f9ae032202ad73

      SHA512

      4b8007dddd519c77bb596f6d17f270da62b236894b6fd7f1c528e553b1aac3a7f9c0df4bb40b678461f70bde3c5a8ac4b5e97e5372dd127a8184862c7f6f4c7c

    • C:\Windows\System32\ransom_voice.vbs

      Filesize

      397B

      MD5

      c1f9613622f740c2f00c2fa8881ba7ba

      SHA1

      bf3271720634bebb3c41ef2b33af525b62f931bc

      SHA256

      d200a1e942b8cfdcd8190d1ad59f92e27e39b919ba230f2dd88d70c3df428c7b

      SHA512

      49e00bb3c76f7e69818a889f045f3d3c43badf2116facccbbf69c61de19f91a42aee891b9a5b72a256453e2fc5c637adac1e354cf88e6782679afa886ad1c615

    • memory/1220-134-0x0000000001680000-0x0000000001690000-memory.dmp

      Filesize

      64KB

    • memory/1220-142-0x0000000001680000-0x0000000001690000-memory.dmp

      Filesize

      64KB

    • memory/1220-133-0x0000000000D80000-0x0000000000DD6000-memory.dmp

      Filesize

      344KB

    • memory/1720-154-0x0000000000340000-0x0000000000362000-memory.dmp

      Filesize

      136KB

    • memory/1720-227-0x000000001AF90000-0x000000001AFA0000-memory.dmp

      Filesize

      64KB

    • memory/1720-160-0x000000001AF90000-0x000000001AFA0000-memory.dmp

      Filesize

      64KB

    • memory/1720-223-0x000000001AF90000-0x000000001AFA0000-memory.dmp

      Filesize

      64KB

    • memory/1720-224-0x000000001AF90000-0x000000001AFA0000-memory.dmp

      Filesize

      64KB

    • memory/1720-158-0x000000001AF90000-0x000000001AFA0000-memory.dmp

      Filesize

      64KB

    • memory/1720-225-0x000000001AF90000-0x000000001AFA0000-memory.dmp

      Filesize

      64KB

    • memory/1720-159-0x000000001AF90000-0x000000001AFA0000-memory.dmp

      Filesize

      64KB

    • memory/1720-231-0x000000001AF90000-0x000000001AFA0000-memory.dmp

      Filesize

      64KB

    • memory/1720-232-0x000000001AF90000-0x000000001AFA0000-memory.dmp

      Filesize

      64KB

    • memory/1720-155-0x000000001AF90000-0x000000001AFA0000-memory.dmp

      Filesize

      64KB

    • memory/1720-235-0x000000001AF90000-0x000000001AFA0000-memory.dmp

      Filesize

      64KB

    • memory/1720-236-0x000000001AF90000-0x000000001AFA0000-memory.dmp

      Filesize

      64KB

    • memory/1720-239-0x000000001AC80000-0x000000001AD80000-memory.dmp

      Filesize

      1024KB

    • memory/1720-242-0x000000001AC80000-0x000000001AD80000-memory.dmp

      Filesize

      1024KB

    • memory/1720-243-0x000000001AC80000-0x000000001AD80000-memory.dmp

      Filesize

      1024KB