Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
152s -
max time network
128s -
platform
windows7_x64 -
resource
win7-20230712-en -
resource tags
-
submitted
02/08/2023, 18:13
General
-
Target
Vicebghcfggghc4_browsingExe.exe
-
Size
149KB
-
MD5
7328af3a365df9561a55e86421fb81c0
-
SHA1
6cfb5b4a68100678d95270e3d188572a30abd568
-
SHA256
4dabb914b8a29506e1eced1d0467c34107767f10fdefa08c40112b2e6fc32e41
-
SHA512
d36bc6ff51047aecacbafd92af6581e766d9b38720c5d9443f96a58e213c33a50291d578b18dc77f9b6977eaae712764aa0b49da82c0a9e3fb264e93b0033369
-
SSDEEP
3072:kudyVkuftDR6PhpKHxf09vLOn8LlB9MJ:kyVzpKHxfkv1l
Score
10/10
Malware Config
Extracted
Path
C:\Read Me.Hta
Ransom Note
<!DOCTYPE HTML PUBLIC '-//W3C//DTD HTML 4.01//EN' 'http://www.w3.org/TR/html4/strict.dtd'>
<html>
<head>
<meta charset='windows-1251'>
<title>[email protected]</title>
<HTA:APPLICATION
ICON='msiexec.exe'
SINGLEINSTANCE='yes'
SysMenu="no">
<script language="JScript">
window.moveTo(50, 50);
window.resizeTo(screen.width - 100, screen.height - 100);
</script>
<style type="text/css">
body {
font: 15px Tahoma, sans-serif;
margin: 10px;
line-height: 25px;
background: #EDEDED;
}
img {
display:inline-block;
}
.bold {
font-weight: bold;
}
.mark {
background: #D0D0E8;
padding: 2px 5px;
}
.header {
text-align: center;
font-size: 30px;
line-height: 50px;
font-weight: bold;
margin-bottom:20px;
}
.info {
background: #D0D0E8;
border-left: 10px solid #00008B;
}
.alert {
background: #FFE4E4;
border-left: 10px solid #FF0000;
}
.private {
border: 1px dashed #000;
background: #FFFFEF;
}
.note {
height: auto;
padding-bottom: 1px;
margin: 15px 0;
}
.note .title {
font-weight: bold;
text-indent: 10px;
height: 30px;
line-height: 30px;
padding-top: 10px;
}
.note .mark {
background: #A2A2B5;
}
.note ul {
margin-top: 0;
}
.note pre {
margin-left: 15px;
line-height: 13px;
font-size: 13px;
}
.footer {
position:fixed;
bottom:0;
right:0;
text-align: right;
}
</style>
</hta:application></p>
<div class="header"><img src="data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAAEAAAABACAQAAAAAYLlVAAAABGdBTUEAALGPC/xhBQAAACBjSFJNAAB6JQAAgIMAAPn/AACA6QAAdTAAAOpgAAA6mAAAF2+SX8VGAAAAAmJLR0QA/4ePzL8AAAAJcEhZcwAACxMAAAsTAQCanBgAAAAHdElNRQfjAwwMJwSFwIn8AAADNklEQVRo3u2ZTUhUURTHfzozmprmZ1pYEmkfJNEmiwwkSEyFECIQpEUboYhqFYHQXlcti9rUKldWBEUiuQpbtDDNzD5G8qM0HRXLRtO5LdJx3puPd++8+xyIztm88zgf/3veufeee18SdimDI1RxnL0U4gbAzxhDdPGCfpZs+49JWTTyFB8iAq8wTju1pDgXvopOliIGX+d57rHPieBuLvLNIvgaD1KvP/x1FiTDCwQTNOkFcJVfCuEFgq+c0he+minF8AJBH2WRnCUph8/nIZVhb2d5w1smEbjYSTn7SQ/TucsFlnWkPxBW6Xc4RkbIoHKooSNshsxRbT98Eb0mtyM04oqgmR6hUNvtrwrnWDa4nOVMVF0XLfw2aPuosBfezQPTmNpiVtFmnpj0W+wBKMFrcPeJ3RYWNfwwWHSSZgdAHX6Du5uWFpl0myqm1KiQrASgnNQQaZFOS4t5nhvkAnbZAbDHIE0wIGHzmsUQKdXkQwlACtsN8ijfJay8zBjkovgBbCLPlAG/hNUcswa5IH4Ayasdzxr5pBbWRRYMstGHYg04QAkH4FbQFSwTCKbdI7mzWVipbMceKtiCCFqO0OeY1caRbAaKOcgOCpQ+WWTyM8EwvfjkTfJoYZDFONqwaPyTHs7LbktlPNMYep2XuE22dfhsHjkS/i+3Wn/SK2EdoE72UeuyGH8rxbbLLjqlkRlb4TAzDo5fIJiOvRTnR+ju9VJuwveC/wASDsD+2h5KUyyQTVZiALzjFt3MsY16mtmqx2mt9BbUw4EQuzpGpVcCLQB8nDBZXmJFDoCeInzFS9ObxwzLmeoBMGA4/QBM4t1IAOHXDi7Zqwg9ACrCWotS8xnQWQCHOGsafzOFOhzLT8NxmoI3RZncULjG1ARA8DHYupxUucbUtxd4ghnw4JI30wdARHneMABx0j8FYD3xCkdefQByKFl9KsOjy6nKNBR0cZRCTjOk1JhrBCCY5r3pZtSS9bZkueSqmljVgPoPDa0Algk4HD8QG8AXph0G8Dk2AC89DgPosFKodvR83G/dtiRzTevtUChP0SCTpBQuM+bI6Bvk51gl96X/FFvzCh9oW0v+H2zO2tYtz/EgAAAAJXRFWHRkYXRlOmNyZWF0ZQAyMDE5LTAzLTEyVDEyOjM5OjA0KzAwOjAwG6lIYwAAACV0RVh0ZGF0ZTptb2RpZnkAMjAxOS0wMy0xMlQxMjozOTowNCswMDowMGr08N8AAAAASUVORK5CYII=" />
<h2><span style="text-decoration: underline; color: #000000;"><strong><em>All your files have been encrypted!</em></strong></span></h2>
</div>
<div class="bold">All your files have been encrypted due to a security problem with your PC.</div>
<div class="bold">If you want to restore them, write us to the e-mails: <span style="color: #800000;"><a style="color: #800000;" href="mailto:[email protected]">[email protected]</a></span> and <span style="color: #ff0000;"><a style="color: #0000ff;" href="mailto:[email protected]">[email protected] </a></span> and <span style="color: #800000;"><a style="color: #006400;" href="mailto:[email protected]">[email protected]</a></span><span style="text-decoration: underline;"></span></div>
<p>(for the fastest possible response, write to all 3 mails at once!)</p>
<h4 class="bold"><span style="text-decoration: underline;"><em><strong>Write this ID at the beginning of your message:</strong></em></span></h4>
<p><span style="text-decoration: underline; color: #0000ff;"><em><strong>EA7E7C796874D6646296F7CB270F2DA7FA1F6201174C228E6A0EFA207A3DCF
196366D0F65D34E71897C332D4C05FE10738A00C89689CE2F8F4978DF7C48C
978C1A794E3437CB188595F2CD3E65E088D91F6B0B0522F1C92F56A3AE8549
11044D81D7976AA77FA70B60BF66A0764EDB8F9B991CB0687C5671C1D6FE87
B353CDC70D5366D18958D4BB4FEB32C3B72C4D336AAE1652D57E571A8710F3
180A766CF0092EB1519CD8108BF3711364550A4CB70C090704529FA6A8F0CB
ECEE14D494774AB283AF55E68B425A09280FA03A6F9BDA6E75725D2018112A
6B3AC49B97CEDA2EF91BAC27ED07C03C1E43483610BEE4ACEA2B95AF5A2F7E
BF4B44FBD150F64FBAD756FEA15A2832B26914EAC91F579D4238EF661963A6
AFA0F39E19FA73B39B94AA436F5524F838AFDF0A07389F9242CD90266CAD8A
18E08FEDFF918A17C741F5156C7A9720B2E15B1E10317DA205989BB0E81740
E800D03BCD0C1D8C4AF6BC088B566E6F7577C8D3B15D54A746606A3785348F
C5AF14DD078B2964F3FC1E4ABBBD7ACE01FCDC4D660D2E1067AE59B9D9EF7D
2232E53B9713F0ED7DC256713C47B130A7F9A23737E5E4B09B81B4120F0A7A
8394003CCC56F8518AD0672387CD8F1D0967162606B3FD096055CEE07F323C
A9AE29826706777F7B60BE6542EB6562607EC94B94BAB91DFEAC1A902FF941
A5C0257F86961F47DBE79F6CDFC87BA45F33EBB2AC0A0629F1C1502845D0B3
40AF1AD194F1F87B3971066AE97E49D09939F44C549B22E344A2A4E62FCE72
001F2B656479CA2A5703D53C9414B02716554F2CCF26CEB2F4614FB967ECB2
A01DADA643901ED5341C6608038771807BF0BE58D40486E19EEAD56752E0A5
03F3E5C2E9304F836F3E7EC15FCB4A663354F171FF1B7D242FE6FCA39FE7D1
F39CB1924B54EC3A97AF1550957752D5AAED4F780AACFE0CD27598203788A6
6F192ADF5C7759893AAAC00AFFF4FF2BF3D150B5C1E7250E816112E6FCCAAE
74145351B923643C0FC69D388339DC2F0331225F9864F5453B5D5230D1D422
E5208C56B52E672B2E56B3A181955668B5B90218A79606A461C4ECB17622E5
EC75485F1AE2B6907315A404518DDD6931452051399A5D2CA8522E0E20A799
9D01
</strong></em></span></p>
<div>
You have to pay for decryption in Bitcoins. The price depends on how fast you write to us. After payment we will send you the tool that will decrypt all your files.
</div>
<div class='note info'>
<div class='title'>Free decryption as guarantee</div>
<ul>Before paying you can send us up to 3 files for free decryption. The total size of files must be less than 5Mb (non archived), and files should not contain valuable information. (databases,backups, large excel sheets, etc.) </ul>
</div>
<div class='note info'>
<div class='title'>How to obtain Bitcoins</div>
<ul>
The easiest way to buy bitcoins is LocalBitcoins site. You have to register, click 'Buy bitcoins', and select the seller by payment method and price.
<br><a href='https://localbitcoins.com/buy_bitcoins'>https://localbitcoins.com/buy_bitcoins</a>
<br> Also you can find other places to buy Bitcoins and beginners guide here:
<br><a href='http://www.coindesk.com/information/how-can-i-buy-bitcoins/'>http://www.coindesk.com/information/how-can-i-buy-bitcoins/</a>
</ul>
</div>
<div class='note alert'>
<div class='title'>Attention!</div>
<ul>
<li>Do not rename encrypted files.</li>
<li>Do not try to decrypt your data using third party software, it may cause permanent data loss.</li>
<li>Decryption of your files with the help of third parties may cause increased price (they add their fee to our) or you can become a victim of a scam.</li>
</ul>
</div>
</body>
</html>
Emails
<title>[email protected]</title>
href="mailto:[email protected]">[email protected]</a></span> and <span
href="mailto:[email protected]">[email protected]
href="mailto:[email protected]">[email protected]</a></span><span
URLs
http://www.w3.org/TR/html4/strict.dtd'>
Signatures
-
Deletes shadow copies 2 TTPs
Ransomware often targets backup files to inhibit system recovery.
-
Renames multiple (5322) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Drops desktop.ini file(s) 29 IoCs
-
Enumerates connected drives 3 TTPs 1 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
-
Drops file in Program Files directory 64 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Interacts with shadow copies 2 TTPs 1 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
-
Suspicious use of AdjustPrivilegeToken 3 IoCs
-
Suspicious use of WriteProcessMemory 6 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\Vicebghcfggghc4_browsingExe.exe"C:\Users\Admin\AppData\Local\Temp\Vicebghcfggghc4_browsingExe.exe"1⤵
- Drops desktop.ini file(s)
- Enumerates connected drives
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe" /c vssadmin.exe Delete Shadows /All /Quiet reg delete "HKEY_CURRENT_USER\Software\Microsoft\Terminal Server Client\Default" /va /f reg delete "HKEY_CURRENT_USER\Software\Microsoft\Terminal Server Client\Servers" /f reg add "HKEY_CURRENT_USER\Software\Microsoft\Terminal Server Client\Servers" cd %userprofile%\documents\ attrib Default.rdp -s -h del Default.rdp for /F "tokens=*" %1 in ('wevtutil.exe el') DO wevtutil.exe cl "%1"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\vssadmin.exevssadmin.exe Delete Shadows /All /Quiet3⤵
- Interacts with shadow copies
-
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
7KB
MD575cf742261829323778ad3634be8722b
SHA1f5ab8ed41913856efbcbb77ade775b5512b82aed
SHA256ff627207d56697179462c43bd936ccb43f6c7892854c7c781798b4b2c1eeb5dd
SHA51241d93e2b74509bb9c2f9928dc972f1660554b1a7e0fe1b96f0548b49811730618bd6405064ff8fe4040652124c85a35364a84979ec7eddcddca46b471c75ffd2
-
Filesize
184KB
-
Filesize
184KB
-
Filesize
184KB
-
Filesize
184KB
-
Filesize
184KB
-
Filesize
184KB
-
Filesize
184KB
-
Filesize
184KB
-
Filesize
184KB
-
Filesize
184KB
-
Filesize
184KB
-
Filesize
184KB
-
Filesize
184KB