Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
119s -
max time network
147s -
platform
windows7_x64 -
resource
win7-20231129-en -
resource tags
-
submitted
09/01/2024, 18:29
General
-
Target
2159739a68fa270eb94caddbb7f5d132b1175716efab3b3f25f86dc57c4c0db4exe.exe
-
Size
400KB
-
MD5
9476b5f481090ea650cfc65e017dc41c
-
SHA1
0fa937125a55c299a48d3e1485fee16646555087
-
SHA256
2159739a68fa270eb94caddbb7f5d132b1175716efab3b3f25f86dc57c4c0db4
-
SHA512
f97c6bf23101bf357d8e4a4ae47421ecfe8f12c821c036e09a4768a8f0dd9e12ba128cf5f10a0f5d4767ac6a3b7f3497f95ffc07d18ac2b9b4a14c9a2c9c9b6d
-
SSDEEP
12288:/4sAED7kDhOztcOTx00ll7Qbnck6i+JQnlopoMaJU:iEXkDQztfe0szc3nCloy7
Malware Config
Extracted
C:\MSOCache\All Users\{90140000-0016-0409-0000-0000000FF1CE}-C\howto_recover_file_ddpdn.txt
http://fg347djvb.poin84mdgu9e.com/59DA59EF51E586
http://hfy28djd6dh.rg7hdts4d2sjfy.com/59DA59EF51E586
https://3st7uyjfocyourll.onion.to/59DA59EF51E586
http://3st7uyjfocyourll.onion/59DA59EF51E586
Signatures
-
Deletes shadow copies 2 TTPs
Ransomware often targets backup files to inhibit system recovery.
-
Renames multiple (408) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Deletes itself 1 IoCs
-
Drops startup file 2 IoCs
-
Executes dropped EXE 2 IoCs
-
Loads dropped DLL 3 IoCs
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 2 IoCs
-
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Suspicious use of SetThreadContext 2 IoCs
-
Drops file in Program Files directory 64 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Interacts with shadow copies 2 TTPs 2 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
-
Modifies Internet Explorer settings 1 TTPs 38 IoCs
-
Modifies system certificate store 2 TTPs 6 IoCs
-
Opens file in notepad (likely ransom note) 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of AdjustPrivilegeToken 7 IoCs
-
Suspicious use of FindShellTrayWindow 2 IoCs
-
Suspicious use of SetWindowsHookEx 4 IoCs
-
Suspicious use of WriteProcessMemory 54 IoCs
-
System policy modification 1 TTPs 2 IoCs
-
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\2159739a68fa270eb94caddbb7f5d132b1175716efab3b3f25f86dc57c4c0db4exe.exe"C:\Users\Admin\AppData\Local\Temp\2159739a68fa270eb94caddbb7f5d132b1175716efab3b3f25f86dc57c4c0db4exe.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\2159739a68fa270eb94caddbb7f5d132b1175716efab3b3f25f86dc57c4c0db4exe.exe"C:\Users\Admin\AppData\Local\Temp\2159739a68fa270eb94caddbb7f5d132b1175716efab3b3f25f86dc57c4c0db4exe.exe"2⤵
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c DEL C:\Users\Admin\AppData\Local\Temp\215973~1.EXE3⤵
- Deletes itself
-
-
C:\Users\Admin\AppData\Roaming\lowlc-a.exeC:\Users\Admin\AppData\Roaming\lowlc-a.exe3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\lowlc-a.exeC:\Users\Admin\AppData\Roaming\lowlc-a.exe4⤵
- Drops startup file
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Program Files directory
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
-
C:\Windows\System32\vssadmin.exe"C:\Windows\System32\vssadmin.exe" delete shadows /all /Quiet5⤵
- Interacts with shadow copies
-
-
C:\Windows\SysWOW64\NOTEPAD.EXE"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\HOWTO_RESTORE_FILES.txt5⤵
- Opens file in notepad (likely ransom note)
-
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\Desktop\HOWTO_RESTORE_FILES.htm5⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
-
C:\Windows\System32\vssadmin.exe"C:\Windows\System32\vssadmin.exe" delete shadows /all /Quiet5⤵
- Interacts with shadow copies
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c DEL C:\Users\Admin\AppData\Roaming\lowlc-a.exe5⤵
-
-
-
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2100 CREDAT:275457 /prefetch:21⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\DllHost.exeC:\Windows\SysWOW64\DllHost.exe /Processid:{76D0CB12-7604-4048-B83C-1005C7DDC503}1⤵
- Suspicious use of FindShellTrayWindow
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
6KB
MD57ac0e96cf463fe5498172b481558e6b9
SHA1ae9575b0c3a588b0dfea622f90102e9cc3b4283e
SHA256e899843e8b36302eb1b0babdcd163213c9164d57cb0658d6a871d14f6608aae3
SHA51219c2e86d9ef5a122f68293d50a98bc24fbb55bc210c2449c62a6bec1051f52bb7f8c7db81e207b4f592b93685a604cab57348ce612b2f60c7c171441033bc65e
-
Filesize
2KB
MD5b504419e4037af65060117f35dee1be9
SHA125f9783c6a81684ca686d8773819685a799ee362
SHA25627516892ba010a5635d325a5a3d96a09f0b23c6fbc21392dd08e2eabf65f3bd0
SHA51293870a37aebab7da53e753816fa340dd5b9583dffcfc096d38088cdb41d86ec2ee22e61f5a75824a8c52feab04adfd38278be07650f79d826188d39143de926c
-
Filesize
914B
MD5e4a68ac854ac5242460afd72481b2a44
SHA1df3c24f9bfd666761b268073fe06d1cc8d4f82a4
SHA256cb3ccbb76031e5e0138f8dd39a23f9de47ffc35e43c1144cea27d46a5ab1cb5f
SHA5125622207e1ba285f172756f6019af92ac808ed63286e24dfecc1e79873fb5d140f1ceb7133f2476e89a5f75f711f9813a9fbb8fd5287f64adfdcc53b864f9bdc5
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
1KB
MD5a266bb7dcc38a562631361bbf61dd11b
SHA13b1efd3a66ea28b16697394703a72ca340a05bd5
SHA256df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e
SHA5120da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc
-
Filesize
252B
MD5fcce58bbd95c0fcad7ad3e1139a494f0
SHA1d052636778e70512a80de69d40315134ab4b6f55
SHA25631d8028fead6310fff20eb769d4a72f76f088a2898b5be8a00fb63d5d7241b39
SHA5125ebc5918de507cdfd40ee2fc9e44f54b6d1296f4b9c8a4b3c6e3854c0125d838fa0a472bff3d148629630fd7615d204cb4517b0382dbe813d7771a1009111307
-
Filesize
344B
MD585e17d109934b3b72c064621803d85fe
SHA1bec75c261793b03d83575d22df24085e8e96ad03
SHA256bdcae84d56a25f58ffe92ecf4319113a79bf0d4f5c1a88fe476db170c28a4b68
SHA512f49545a1689e87b9839790b356f17809015898f4c3b2b02d7450bfdcd7f6a99b6da0e377b632a01866d2aedc6487973dc69de244968c0bf06e36ad1d8c5a64e3
-
Filesize
344B
MD5695d689f80854b1f1de514b90de08175
SHA1e58985ea3ad5590f9538dddf0012da87d442091e
SHA256c95b6352f8f1e30cec5128bfa361445627ad4bbd750604a93c1f74641483c188
SHA512b4c83817d290408345d3ed1f6f71c880f0a8f3782c5327d8a8d764c3578518f8924f2e314b3f71e9e52b89232537953ec14b1fe7280a8d60bd4a32eeb71a88ca
-
Filesize
344B
MD54c1be163e25dbf49d20085bc5c8670dd
SHA17f4f6decc45671c0f839948dfdc59764136d9cca
SHA25616980a3dd977ad6a21cebc767d885ad714af0b4c54865d9797f50e35ecc63df1
SHA5120b0c944896d6649b11a3719ec209152e8ce4dcbcdbda27933bf3f381c8a40dba8ef754575ffbbde074d6e6a847066c3b723f2365b26d7952b9efa1dfb8797bc6
-
Filesize
344B
MD5fa82d6af9a26256c87c7535da8d56a1e
SHA115f332f995002603c3ef10e38f6e57d9f334c415
SHA256f8e60a8fa0f62701c024538f4d8efe2a1a9a574d5855a3f29e16f3c14e84c3db
SHA512b4292f4e7fd37d04a211571e5fef0482f0d26bdeb595e1d18b0aa691d71944d43663780246ceaedc475811a00286d236b18537b2687dc742a38fbce49c845312
-
Filesize
344B
MD535bcc53dbb5f67c8e6752c8ea2694718
SHA12f6941a0a0a78af8b31e15af3387ac87f3dfb09d
SHA2564eb198eb6669a543564f74ceec812c6c93c54e51b6c0fd2b4593a9aa21291832
SHA512b06bd4f0a231b396c12107177abb4e3d28bec190a8720e37b900ad2e3c5344479e91673084d8977ef31912372708f7d67bf650f3d67d2482e17f835821c0aa89
-
Filesize
344B
MD5f2b0917bd605e83abb8c87c9f03a867b
SHA1ba899dbc4360499bbe735b6fa7a2267f4e290f33
SHA2564955276aeab9a45468295863ea638def346900a784584acd088d3415138e0922
SHA512bfd6cc88a24987e1b1156c1c67c10e1775ac5ca6f4de4425ed8200db69bdbce81c0c12667f716837537774eeb51183477f54b0fee0dca721b0e98e1e66b75c1f
-
Filesize
344B
MD5419c2ce81e1481900d5250be06d2ea4b
SHA12932e79a02c26569a3e02917807a5d6ebb16a272
SHA25663154391d388c1da883df6c7ef9b117b582d857c30abf005f2ccd4177549240a
SHA512de1ab4a58220cd8255c445ad4bfd0f623b883794df53fca9c5235b83c4be6b1dfdb2ef6ed074d9e39e418a610f8a63311e8da7f1abb4a5d7a0f6a433bc410858
-
Filesize
344B
MD5064c6b65278276bd3113c5213066ec78
SHA112031d5b74b39e59c1268761480aa69fd932de9f
SHA2569d84bb8d5692de6979b1660f9c497e7f1eafaead4c7689a75ca79a1b203f091b
SHA512d07a02fd4eb62ed598a4c820e5a2770fb105e8362d9ec76886c28dba465ff3a716750b5aac4627b0ea232bd0b579dc63159757a755808b4f59c327e5238b14bc
-
Filesize
344B
MD501f86d8881a31af26beb3d1c8a2bbef5
SHA1d6f0de5559857d3014c6a3c25c5010239793014d
SHA2565dffe0ad1c883a2851ebfc795f59eda85a09b3fe51129cd45894eb86be1a1d62
SHA512e1658160b137513b662ec5621eda796bc7e2442a84e4f03cc7e264957dda30b3dd0babbb56f0534a06ecf6d9adf5ab7c12f7e98f4e9e3c2eb34d7828e2f0d40c
-
Filesize
344B
MD5f6574ed30860064d397b5a63dced0c69
SHA1ada6fbb61c0cf74bde022d24e2f8d7771a29fff6
SHA2565561934bbadfb1f6ef167beab4276589cf37132ed19940e8389505739e57ae5f
SHA51276523f4a4a93b092b7d3d80424f194c68834ce7e52cf4ffa1270211086f3be3e482fd36c02e7fbb1b7f886d4c2472404fb63934e51f5d52b521bb7ac3c444cea
-
Filesize
344B
MD557bcc0716d8a6d094ab4ea2a180beb7c
SHA12af77cf7a4eda607ab4dff7f014619156110ee56
SHA256f4f3a46f51c1cf8dd6dcf66fe81e410690d71a554d57cae998a3a9f341dc7289
SHA5120e204ead3414a800bfa9768c96cf24dd89c5f7854a9fd36007bb8ec4eff4a6d7a0cfadf9abc4b6f8ebc40647aeeca4cd22de3e0a567929001b1b349ac4ad16ce
-
Filesize
344B
MD51b0e62f2f02c39cc584dec2d7344725b
SHA1425143628ba8eb1c3b5316719f8efca1180d3c5d
SHA25619a72f91fd864bffd461238c0e91b476d66884f82da339eb80564e15837b4b3d
SHA512f19297ad4a019dc3c429146647f46ec18dd4ff44c8ac03f8dd5bf6573bd2244e8dac580679e934829cd9a31c52c6785ddcab893aca9c6ff52055f1057b6126ba
-
Filesize
344B
MD54b28db732a52852e46cfa8e619810329
SHA102b62843447f982a029b3dbce53d5ac3d5981196
SHA256967e2f66288a2fc7a73da8550c3755db70aa114fcbbde6de373e42a62f91d58f
SHA5124a1d40b3f9e038f2cbf85d5a049b998600953727d8b1b396a73060e444f7d02f61f5ba4761486c36abf5287c7d577ca87b3a2075647f80802aa4e3b20ca3f938
-
Filesize
242B
MD5f074168b63c8904f0560094a0ecea6ed
SHA13163bf73492fb549a19c38c1eaa737d198d3d36d
SHA256bfb28486700c8371f22d639841f2bca0a140eee6d1ab60d946a5887e2625967b
SHA512e9b0dd0b8ba0d9a0f238da61745c23183183ff8162604fd8dbc4c70540a8e10fb36374bce3f2b738b773f992bfaf4e5ae641660323354357ed0964cc94d3e27d
-
Filesize
242B
MD5179380611bce79432e64b24737142ef7
SHA1722fdc094dd1b1f4dc41406b4304137992b68c93
SHA25659b94dcb6a7056a424478e8de3a512c76e971dca759bd059940f160b8c882862
SHA512bae4fd17bbe2232a99091fa0239a3af889285cf5d9ef49f58f913b3331dea196b7d27c8410bbb397541b222d68c2c5e2667a24670b80a8fa8850f0e562c06131
-
Filesize
4KB
MD5da597791be3b6e732f0bc8b20e38ee62
SHA11125c45d285c360542027d7554a5c442288974de
SHA2565b2c34b3c4e8dd898b664dba6c3786e2ff9869eff55d673aa48361f11325ed07
SHA512d8dc8358727590a1ed74dc70356aedc0499552c2dc0cd4f7a01853dd85ceb3aead5fbdc7c75d7da36db6af2448ce5abdff64cebdca3533ecad953c061a9b338e
-
Filesize
93KB
MD5891cefe5912bdd526dc1886895094520
SHA14a02bda8820b2cb1ac541250997d13c372ad8f94
SHA25674bb946899d937d18bfcbc72ea7368617d7b03f3793cdb66b14cb68de0bc4b0c
SHA512fe7cddf31af1c1508a38423b65d862a4fe2b7771b1e942cb2801093eb1a4c34b1de79cd0c893472f2e180884336f9ccd9c825e3dea7e433132291d452328a140
-
Filesize
92KB
MD57d0004e7846975096a5234afbcda0d86
SHA128d414fdf7d2a96bece4ddba28cdbfa1d66c09a0
SHA25662646ed84957329ff0dbc405acd8ee393326b44d380dfa96f4985e5c23074082
SHA512aa63cf15cac38998499ca0b07a8e2ab584aef22217fcb54c3115e034482ce4f8caf1d8a4121596257fab88e42a67531d27f01035c422a802b1c4ba52ed66f736
-
Filesize
1.6MB
MD5a5401d7dbf97ab90c01490f3815c9dbb
SHA1c7b012eed66371e64d56ef7e1fa2c62404519fda
SHA2564d742a40d03192ba54a21ce3b4b9d1a798815a70251431d44567245e7d073fc8
SHA51251093d810ff0099d475148f2251573d5857e0b9e250c8e6dbf572653026c80413ae5cfe42b8b4b645ab1491c5762193455c126d166dfdc90a6f6d22db2512de9
-
Filesize
512KB
-
Filesize
512KB
-
Filesize
512KB
-
Filesize
512KB
-
Filesize
512KB
-
Filesize
512KB
-
Filesize
4KB
-
Filesize
512KB
-
Filesize
512KB
-
Filesize
512KB
-
Filesize
512KB
-
Filesize
12KB
-
Filesize
100KB
-
Filesize
12KB
-
Filesize
8KB
-
Filesize
512KB
-
Filesize
512KB
-
Filesize
512KB
-
Filesize
512KB
-
Filesize
512KB
-
Filesize
512KB
-
Filesize
512KB
-
Filesize
512KB
-
Filesize
512KB
-
Filesize
512KB
-
Filesize
512KB
-
Filesize
512KB
-
Filesize
512KB
-
Filesize
512KB
-
Filesize
512KB
-
Filesize
100KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
8KB
