Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
119s -
max time network
127s -
platform
windows7_x64 -
resource
win7-20230831-en -
resource tags
arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system -
submitted
12/10/2023, 14:54
Behavioral task
behavioral1
Sample
Sapphire2.exe
Resource
win7-20230831-en
Behavioral task
behavioral2
Sample
Sapphire2.exe
Resource
win10v2004-20230915-en
General
-
Target
Sapphire2.exe
-
Size
46KB
-
MD5
6f0c4424cc7e35b379e69a6e6d553baf
-
SHA1
bf35bbf6c015b3a9d5498e6998e5269a6c129629
-
SHA256
e97941f812323e05ba4e83b138e8bb794b88efcd56980d07313b5acc965b2661
-
SHA512
8dcddb5a2de347344141797adcf46dff3b880e716130a8c23b5b626f14f16afb85d752071ee9a2fd3fee04007a99849866fd84c2cb61ab21dcf097cd7a943507
-
SSDEEP
768:oDFYuu3i50AOO0jhTlg4dPyLjavI7BnVI3ZTLZhoEI6b8WPmyc5:oDdMikjgaPyLjaw7I35Nb8smyc5
Malware Config
Extracted
sapphire
https://api.telegram.org/bot6228811625:AAHLiy2oFkwv-27FAk5KqltothFkPnNRSL8/sendMessage?chat_id=
-
payload_url
https://cdn.discordapp.com/attachments/1023018120211869706/1082072513267380274/DotNetZip.dll
Signatures
-
Sapphire Ransomware
French-language ransomware and stealer identified in May 2020 written in C#.
-
Program crash 1 IoCs
pid pid_target Process procid_target 1692 3068 WerFault.exe 17 -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 3068 Sapphire2.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 3068 wrote to memory of 1692 3068 Sapphire2.exe 28 PID 3068 wrote to memory of 1692 3068 Sapphire2.exe 28 PID 3068 wrote to memory of 1692 3068 Sapphire2.exe 28 PID 3068 wrote to memory of 1692 3068 Sapphire2.exe 28
Processes
-
C:\Users\Admin\AppData\Local\Temp\Sapphire2.exe"C:\Users\Admin\AppData\Local\Temp\Sapphire2.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3068 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3068 -s 10922⤵
- Program crash
PID:1692
-