Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Resubmissions

24/12/2023, 18:24

231224-w112ksffdr 10

24/12/2023, 18:21

231224-wzcycsfchm 10

07/11/2023, 17:16

231107-vs31jadh73 10

Analysis

  • max time kernel
    147s
  • max time network
    118s
  • platform
    windows7_x64
  • resource
    win7-20231215-en
  • resource tags

    arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
  • submitted
    24/12/2023, 18:21

General

  • Target

    95e9cb14d98addba28afd394f68a90d4500fa5396a6b27fdbe5024bd17f972b4.exe

  • Size

    765KB

  • MD5

    52f22c2a5b2c339e75f176bf5bfcb3f3

  • SHA1

    0a3b96aa59d5eda04c731bfb9c2ba7fef997d1b9

  • SHA256

    95e9cb14d98addba28afd394f68a90d4500fa5396a6b27fdbe5024bd17f972b4

  • SHA512

    ec5f24367c46ff558110022ad8e1106fe5d1d9b9f94cf423b0cd1e1cd7d5ee3111e16cc12ccf3d6e65c5a5d5358691726172e33fb6338e1b7291be9566766da8

  • SSDEEP

    12288:mokzmesNcOJCG4jm2E2SLZJsiXlg8XGB2P3yo1jaUPC4t56ha6DJof5:izk/QDo2SVJsylBXjVNPyvu

Malware Config

Extracted

Family

djvu

C2

http://zexeq.com/test1/get.php

Attributes
  • extension

    .jzeq

  • offline_id

    4FMaMDK6uqPZOxJj64677pqiSGF54A1Dam9zfUt1

  • payload_url

    http://colisumy.com/dl/build2.exe

    http://zexeq.com/files/1/build3.exe

  • ransomnote

    ATTENTION! Don't worry, you can return all your files! All your files like pictures, databases, documents and other important are encrypted with strongest encryption and unique key. The only method of recovering files is to purchase decrypt tool and unique key for you. This software will decrypt all your encrypted files. What guarantees you have? You can send one of your encrypted file from your PC and we decrypt it for free. But we can decrypt only 1 file for free. File must not contain valuable information. You can get and look video overview decrypt tool: https://we.tl/t-TAbs6oTGSU Price of private key and decrypt software is $980. Discount 50% available if you contact us first 72 hours, that's price for you is $490. Please note that you'll never restore your data without payment. Check your e-mail "Spam" or "Junk" folder if you don't get answer more than 6 hours. To get this software you need write on our e-mail: [email protected] Reserve e-mail address to contact us: [email protected] Your personal ID: 0821ASdw

rsa_pubkey.plain

Signatures

  • Detected Djvu ransomware 14 IoCs
  • Djvu Ransomware

    Ransomware which is a variant of the STOP family.

  • Downloads MZ/PE file
  • Executes dropped EXE 6 IoCs
  • Loads dropped DLL 2 IoCs
  • Modifies file permissions 1 TTPs 1 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • Looks up external IP address via web service 3 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext 5 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Creates scheduled task(s) 1 TTPs 2 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Suspicious behavior: EnumeratesProcesses 3 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\95e9cb14d98addba28afd394f68a90d4500fa5396a6b27fdbe5024bd17f972b4.exe
    "C:\Users\Admin\AppData\Local\Temp\95e9cb14d98addba28afd394f68a90d4500fa5396a6b27fdbe5024bd17f972b4.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious use of WriteProcessMemory
    PID:1572
    • C:\Users\Admin\AppData\Local\Temp\95e9cb14d98addba28afd394f68a90d4500fa5396a6b27fdbe5024bd17f972b4.exe
      "C:\Users\Admin\AppData\Local\Temp\95e9cb14d98addba28afd394f68a90d4500fa5396a6b27fdbe5024bd17f972b4.exe"
      2⤵
      • Adds Run key to start application
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of WriteProcessMemory
      PID:1664
      • C:\Windows\SysWOW64\icacls.exe
        icacls "C:\Users\Admin\AppData\Local\1f2f931c-0057-4f9c-b52b-e79970f4150b" /deny *S-1-1-0:(OI)(CI)(DE,DC)
        3⤵
        • Modifies file permissions
        PID:2648
      • C:\Users\Admin\AppData\Local\Temp\95e9cb14d98addba28afd394f68a90d4500fa5396a6b27fdbe5024bd17f972b4.exe
        "C:\Users\Admin\AppData\Local\Temp\95e9cb14d98addba28afd394f68a90d4500fa5396a6b27fdbe5024bd17f972b4.exe" --Admin IsNotAutoStart IsNotTask
        3⤵
        • Suspicious use of SetThreadContext
        • Suspicious use of WriteProcessMemory
        PID:2568
        • C:\Users\Admin\AppData\Local\Temp\95e9cb14d98addba28afd394f68a90d4500fa5396a6b27fdbe5024bd17f972b4.exe
          "C:\Users\Admin\AppData\Local\Temp\95e9cb14d98addba28afd394f68a90d4500fa5396a6b27fdbe5024bd17f972b4.exe" --Admin IsNotAutoStart IsNotTask
          4⤵
          • Loads dropped DLL
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of WriteProcessMemory
          PID:2668
          • C:\Users\Admin\AppData\Local\b15bd37f-9427-4ad4-9348-7f9a9b4a71dd\build3.exe
            "C:\Users\Admin\AppData\Local\b15bd37f-9427-4ad4-9348-7f9a9b4a71dd\build3.exe"
            5⤵
            • Executes dropped EXE
            • Suspicious use of SetThreadContext
            • Suspicious use of WriteProcessMemory
            PID:848
            • C:\Users\Admin\AppData\Local\b15bd37f-9427-4ad4-9348-7f9a9b4a71dd\build3.exe
              "C:\Users\Admin\AppData\Local\b15bd37f-9427-4ad4-9348-7f9a9b4a71dd\build3.exe"
              6⤵
              • Executes dropped EXE
              • Suspicious use of WriteProcessMemory
              PID:2712
  • C:\Windows\SysWOW64\schtasks.exe
    /C /create /F /sc minute /mo 1 /tn "Azure-Update-Task" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe"
    1⤵
    • Creates scheduled task(s)
    PID:2504
  • C:\Windows\system32\taskeng.exe
    taskeng.exe {69F7EA45-4A8E-4F06-AA6C-B15168E4C472} S-1-5-21-3818056530-936619650-3554021955-1000:SFVRQGEO\Admin:Interactive:[1]
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:2876
    • C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
      C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
      2⤵
      • Executes dropped EXE
      • Suspicious use of SetThreadContext
      • Suspicious use of WriteProcessMemory
      PID:348
      • C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
        C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
        3⤵
        • Executes dropped EXE
        • Suspicious use of WriteProcessMemory
        PID:852
    • C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
      C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
      2⤵
      • Executes dropped EXE
      • Suspicious use of SetThreadContext
      PID:1988
      • C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
        C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
        3⤵
        • Executes dropped EXE
        PID:580
  • C:\Windows\SysWOW64\schtasks.exe
    /C /create /F /sc minute /mo 1 /tn "Azure-Update-Task" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe"
    1⤵
    • Creates scheduled task(s)
    PID:2044

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA

    Filesize

    1KB

    MD5

    ad1b831e6b39763c118dd6bf34d8641a

    SHA1

    43e23a3d91315736f59751521ade3224f45ece86

    SHA256

    fe673f5da906667a2f5b08f086d292da711c854fce0268f8e4ed7d4d6e62d58a

    SHA512

    cabe0d43a8bc792b9725af5bdb918a7edfe4e7542771cceb57d8686fab0c2c1a5201346f8e960ee31cfa46c1c291d59bcee04b867ff43dfea2520066c8da3fc1

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\CAF4703619713E3F18D8A9D5D88D6288_F2DAF19C1F776537105D08FC8D978464

    Filesize

    724B

    MD5

    8202a1cd02e7d69597995cabbe881a12

    SHA1

    8858d9d934b7aa9330ee73de6c476acf19929ff6

    SHA256

    58f381c3a0a0ace6321da22e40bd44a597bd98b9c9390ab9258426b5cf75a7a5

    SHA512

    97ba9fceab995d4bef706f8deef99e06862999734ebe6a05832c710104479c6337cbf0a76e1c1e0f91566a61334dc100d837dfd049e20da765fe49def684f9c9

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA

    Filesize

    410B

    MD5

    3046b466de23a56e12235012ca00caee

    SHA1

    98ef6e6de2effb29c1c8fc55f5a6750329b81d4d

    SHA256

    0977f7eb7ffa33856be780a2c03cb13d484f62ddfea451e334822b65098e69b6

    SHA512

    2542702a3a2410f01ec33fccec2416be647a343170c7c687d32341c51563a36780e751ed5cdd1c8dea3c7ecba07a4f90822df3c35f5be4b4e377b4cc44a23c70

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    344B

    MD5

    f08f7db66f709e8e0cab64e9ed575478

    SHA1

    5ac03322aca3db5adf9bf26d6bb2861d0b93f15c

    SHA256

    757b04b2fc65445d3efe0a8e97c6071ab5be42b9e58a6809e7962a92a4a9e829

    SHA512

    4f149ca48740077c5f421b3bef38dce5a4e398ce85336de95b33cf0ca612a2aebb5711559f3117ff5b5e2476cc46cdae6032db16526d7150f98916ee4a6f9dbb

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\CAF4703619713E3F18D8A9D5D88D6288_F2DAF19C1F776537105D08FC8D978464

    Filesize

    392B

    MD5

    3476b4c6d6f8fa50ef36fc0e86c47dde

    SHA1

    c5d2a4d52a224e396e311b1b2d4200a0ff06614f

    SHA256

    54c52aacb156fde91890eadb7a5fadbbc58ae626d771ab4a9fe58c51a4263960

    SHA512

    ddbd0587f1038ee65de2561f3e0e78ffec24eaa18569271d20f9bc1e102c3d5571787a2adc0496560edfee7df423abfa31359a43a54454a8918944a368784536

  • C:\Users\Admin\AppData\Local\1f2f931c-0057-4f9c-b52b-e79970f4150b\95e9cb14d98addba28afd394f68a90d4500fa5396a6b27fdbe5024bd17f972b4.exe

    Filesize

    113KB

    MD5

    344b2c215e9b3bf61a7047a44dd5a933

    SHA1

    7c111b055614aaeea2ab353846e497a830b86b55

    SHA256

    bc01fdf556fc9ee8143b280c86e420afbe919208c830a635f68d057c9c43d842

    SHA512

    ccbb784f2c2fd4cf1ab0b4f558d53e5e5d5b73c72701a4eb9ac63cb6eed1f1f70c05c3822e704e74371e6ecc02b9800584f71a58f73d261414d25e5d23b970f1

  • C:\Users\Admin\AppData\Local\Temp\Cab4F29.tmp

    Filesize

    45KB

    MD5

    dc38d629e51926a750b443772d7c8c65

    SHA1

    2868765523e76b2e6706f18ecb665f4631a00d00

    SHA256

    21a98ea45d4ca76fc03cd769b01345da379395b41295e1506644149d0a378883

    SHA512

    beb8198332e8771a0475a925a4b31a8a80df9a04dc889442d1a4e024b1b66709acc3e347d50af1868d5d0c351d489cd454fc2523f752ea9dec56b9a9d6048ef4

  • C:\Users\Admin\AppData\Local\b15bd37f-9427-4ad4-9348-7f9a9b4a71dd\build3.exe

    Filesize

    25KB

    MD5

    6a6b819914b8d32573534e764afd75e8

    SHA1

    9b28d0eb9810049c64fecf2729e801598d8c4bcd

    SHA256

    684e844dcd909165d81df03a4c5d5746a28acee128734e0dc243b8e579126acc

    SHA512

    2152ed48762c752256188de5d1bcfb6276f6e295fc44b8b43c958792bc8ae0b5c5d66b946d069ba93222cac043886999105a57842924644ae5811a39a886993b

  • C:\Users\Admin\AppData\Local\b15bd37f-9427-4ad4-9348-7f9a9b4a71dd\build3.exe

    Filesize

    59KB

    MD5

    dd6f6ac4cd9743d427bd35d17bff63d0

    SHA1

    ca46abe92326cdfbafb288512d08880a1cc57603

    SHA256

    cc3ab67101021e019251a05ee0558d7733a18c893aacafb2d675f25af1569324

    SHA512

    bb5d83326b7ea508b7f1379c56173b5cf28249f86761f8fd3920b9b283ae461a52981f6c13686280ccb8fc1ed2dd7d7b2fce8dc12491d3c856bab99fcccc8a71

  • C:\Users\Admin\AppData\Local\b15bd37f-9427-4ad4-9348-7f9a9b4a71dd\build3.exe

    Filesize

    91KB

    MD5

    bc90cc3455964b06aa0bc96e3d293c76

    SHA1

    3c701e2e23a498928101d7b8ba80397047d13ac1

    SHA256

    729ddbd5e36ab2eae293e4d8f3dc82777c4564ef29e75a0d184bb831f4f736a7

    SHA512

    3d73786b2d40cad354173298610bfe2754c1534738494b8fcc5df6e02c242391ed1bfcbbfca283c1e55c0087f6bcf413dabf73619bc00cef5ce2abe24884c3b0

  • C:\Users\Admin\AppData\Local\b15bd37f-9427-4ad4-9348-7f9a9b4a71dd\build3.exe

    Filesize

    90KB

    MD5

    5c529c0aba49b9bedb7c7508788b83e0

    SHA1

    115ebd45975b10032b775eb53ef7cc32d56ed3f3

    SHA256

    688e0e5683641c64d800a4a309e6221df81c77efad078f2e539b1ac7f608492d

    SHA512

    1bf7ea3c94bd6acddd46a9f3cb9e5cf1b29b5f973370698f998df5ed0f9cf862d12484b5e6d07c88ebbdaa7329349923a3543aca2734ce9d455bc3270343fbd0

  • C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe

    Filesize

    226KB

    MD5

    ced69ef951dae1ed5d276749d61cd523

    SHA1

    302cbbf1c2a719bd026e26f96bbb5dc162667b10

    SHA256

    cfc1163d9d5ab70c63608e685f6f53c6eab23f58a3412f3a4af5fdf309ac0991

    SHA512

    08789467128f64ca16c58eded91925cd86b990ec80919bbafbf67e35a4c4077768213099e427bbacb47e9b05f7e2c673099164cb45ba52503514f6cdaa4e4451

  • C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe

    Filesize

    247KB

    MD5

    b927957fd5395711be898e746706cfdd

    SHA1

    4a8999a009ea851a4f21ff3a719bf411f626b2c7

    SHA256

    565e379f81af7325a3578daab1c57004234b3c62f0f93a8145c861465e298acc

    SHA512

    759714824bda144aa111579f44b9d740cd6ff93d99210a35576f4e8249178be7f06ec4c0d7b070be016473616743b66d18ea8dfea8ab77b9c5138fd7dac960e3

  • C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe

    Filesize

    280KB

    MD5

    a71f7e470960e9b879fce5e04efa4c2b

    SHA1

    5ebf6c88cdcbb01510f0abc3f62da7bf138a51e6

    SHA256

    dcd1f803dcb5e159a4001eecb48a5f7c0866f2a001f8ee90626b27a5f721f0fd

    SHA512

    d0f897e8ef73e7259d5860650b9e925039063cd48a90e4d8f989e72424efcdc80efb5a29799fe16d8127c7de8d65478196aebf324988da866c0ce1ada64d782c

  • C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe

    Filesize

    299KB

    MD5

    41b883a061c95e9b9cb17d4ca50de770

    SHA1

    1daf96ec21d53d9a4699cea9b4db08cda6fbb5ad

    SHA256

    fef2c8ca07c500e416fd7700a381c39899ee26ce1119f62e7c65cf922ce8b408

    SHA512

    cdd1bb3a36182575cd715a52815765161eeaa3849e72c1c2a9a4e84cc43af9f8ec4997e642702bb3de41f162d2e8fd8717f6f8302bba5306821ee4d155626319

  • \Users\Admin\AppData\Local\b15bd37f-9427-4ad4-9348-7f9a9b4a71dd\build3.exe

    Filesize

    51KB

    MD5

    6ff02950a81821b0318fce81c48f1e52

    SHA1

    fa7f05f4665fd01abc691b9e0d7e4a5a0f31e7f6

    SHA256

    b5f35debf509df45fd372a78bb00905b45eb0980ee8cd5b78dd560b5c4d46dd2

    SHA512

    281f6c19178b8db80a87e889be8bb7eace5be2c789e42b861f75ea60ee9c73aebc50d5c922e6a5a6c43d657b35b7d7a1a8818c7f79f312e3b1b50fc81f2156cc

  • \Users\Admin\AppData\Local\b15bd37f-9427-4ad4-9348-7f9a9b4a71dd\build3.exe

    Filesize

    27KB

    MD5

    4d61c524665fcf42f5f6b42978e6b21a

    SHA1

    45d4e46615029b7312bf1d4a4c55c66b25c5b451

    SHA256

    55f392e55aa5017349b5ef6f78620200b167f3909ff3d1a981f70fa457e772b7

    SHA512

    f5768b2698e015bc96256e8993a81a9db9bd5634b591d01af6e002d954309b487b01e31438c82e716e6d8a2bc018c61a330dc53e040f85818acfe1eb57865a4d

  • memory/348-93-0x0000000000C92000-0x0000000000CA2000-memory.dmp

    Filesize

    64KB

  • memory/848-76-0x0000000000912000-0x0000000000923000-memory.dmp

    Filesize

    68KB

  • memory/848-95-0x0000000000230000-0x0000000000234000-memory.dmp

    Filesize

    16KB

  • memory/848-78-0x0000000000230000-0x0000000000234000-memory.dmp

    Filesize

    16KB

  • memory/1572-0-0x0000000000230000-0x00000000002C2000-memory.dmp

    Filesize

    584KB

  • memory/1572-4-0x0000000002080000-0x000000000219B000-memory.dmp

    Filesize

    1.1MB

  • memory/1572-2-0x0000000000230000-0x00000000002C2000-memory.dmp

    Filesize

    584KB

  • memory/1664-5-0x0000000000400000-0x0000000000537000-memory.dmp

    Filesize

    1.2MB

  • memory/1664-8-0x0000000000400000-0x0000000000537000-memory.dmp

    Filesize

    1.2MB

  • memory/1664-7-0x0000000000400000-0x0000000000537000-memory.dmp

    Filesize

    1.2MB

  • memory/1664-1-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

    Filesize

    4KB

  • memory/1664-26-0x0000000000400000-0x0000000000537000-memory.dmp

    Filesize

    1.2MB

  • memory/1988-117-0x0000000000930000-0x0000000000A30000-memory.dmp

    Filesize

    1024KB

  • memory/2568-29-0x0000000000220000-0x00000000002B2000-memory.dmp

    Filesize

    584KB

  • memory/2568-27-0x0000000000220000-0x00000000002B2000-memory.dmp

    Filesize

    584KB

  • memory/2668-55-0x0000000000400000-0x0000000000537000-memory.dmp

    Filesize

    1.2MB

  • memory/2668-68-0x0000000000400000-0x0000000000537000-memory.dmp

    Filesize

    1.2MB

  • memory/2668-57-0x0000000000400000-0x0000000000537000-memory.dmp

    Filesize

    1.2MB

  • memory/2668-53-0x0000000000400000-0x0000000000537000-memory.dmp

    Filesize

    1.2MB

  • memory/2668-56-0x0000000000400000-0x0000000000537000-memory.dmp

    Filesize

    1.2MB

  • memory/2668-48-0x0000000000400000-0x0000000000537000-memory.dmp

    Filesize

    1.2MB

  • memory/2668-49-0x0000000000400000-0x0000000000537000-memory.dmp

    Filesize

    1.2MB

  • memory/2668-34-0x0000000000400000-0x0000000000537000-memory.dmp

    Filesize

    1.2MB

  • memory/2668-35-0x0000000000400000-0x0000000000537000-memory.dmp

    Filesize

    1.2MB

  • memory/2712-80-0x0000000000400000-0x0000000000406000-memory.dmp

    Filesize

    24KB

  • memory/2712-82-0x0000000000400000-0x0000000000406000-memory.dmp

    Filesize

    24KB

  • memory/2712-72-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

    Filesize

    4KB

  • memory/2712-74-0x0000000000400000-0x0000000000406000-memory.dmp

    Filesize

    24KB