Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
121s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
28/01/2024, 22:09
Behavioral task
behavioral1
Sample
127974ae306f0e0434bc6bcdff0b141907fbe11447eb60748dbd43ae87c43c06.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
127974ae306f0e0434bc6bcdff0b141907fbe11447eb60748dbd43ae87c43c06.exe
Resource
win10v2004-20231215-en
General
-
Target
127974ae306f0e0434bc6bcdff0b141907fbe11447eb60748dbd43ae87c43c06.exe
-
Size
99KB
-
MD5
fc0cd8c09e1bf0954c69148ce27d6763
-
SHA1
b1876fdbde6da1f79c9dae609a05ac5abb46b3f5
-
SHA256
8dde13bc5834ca881bbe14707b2ce81b776783150c4a7a8e49b772fb6d610b83
-
SHA512
4141cf923e1c492fd9fe7219b0ca99fd1dcecc81621c6d2781037cf1fc8e58d5e13434932110f3dd2f23a245cb8e42d53ba3bb3401c72c6ab82a40497989cb43
-
SSDEEP
3072:/oiJSuICoVLop3pYTGGcBtkowoxxnNycSi7LTl:tguYq2GGEkowCFpZfT
Malware Config
Signatures
-
Deletes shadow copies 2 TTPs
Ransomware often targets backup files to inhibit system recovery.
-
Detects command variations typically used by ransomware 1 IoCs
resource yara_rule behavioral1/memory/2440-539-0x000000013FCC0000-0x000000013FD02000-memory.dmp INDICATOR_SUSPICIOUS_GENRansomware -
Detects executables containing many references to VEEAM. Observed in ransomware 1 IoCs
resource yara_rule behavioral1/memory/2440-539-0x000000013FCC0000-0x000000013FD02000-memory.dmp INDICATOR_SUSPICOUS_EXE_References_VEEAM -
Detects executables referencing many IR and analysis tools 1 IoCs
resource yara_rule behavioral1/memory/2440-539-0x000000013FCC0000-0x000000013FD02000-memory.dmp INDICATOR_SUSPICIOUS_References_SecTools -
Renames multiple (308) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
UPX dump on OEP (original entry point) 2 IoCs
resource yara_rule behavioral1/memory/2440-0-0x000000013FCC0000-0x000000013FD02000-memory.dmp UPX behavioral1/memory/2440-539-0x000000013FCC0000-0x000000013FD02000-memory.dmp UPX -
resource yara_rule behavioral1/memory/2440-0-0x000000013FCC0000-0x000000013FD02000-memory.dmp upx behavioral1/memory/2440-539-0x000000013FCC0000-0x000000013FD02000-memory.dmp upx -
Drops desktop.ini file(s) 1 IoCs
description ioc Process File opened for modification \??\M:\$RECYCLE.BIN\S-1-5-21-3601492379-692465709-652514833-1000\desktop.ini 127974ae306f0e0434bc6bcdff0b141907fbe11447eb60748dbd43ae87c43c06.exe -
Enumerates connected drives 3 TTPs 23 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\Q: 127974ae306f0e0434bc6bcdff0b141907fbe11447eb60748dbd43ae87c43c06.exe File opened (read-only) \??\W: 127974ae306f0e0434bc6bcdff0b141907fbe11447eb60748dbd43ae87c43c06.exe File opened (read-only) \??\Y: 127974ae306f0e0434bc6bcdff0b141907fbe11447eb60748dbd43ae87c43c06.exe File opened (read-only) \??\O: 127974ae306f0e0434bc6bcdff0b141907fbe11447eb60748dbd43ae87c43c06.exe File opened (read-only) \??\U: 127974ae306f0e0434bc6bcdff0b141907fbe11447eb60748dbd43ae87c43c06.exe File opened (read-only) \??\S: 127974ae306f0e0434bc6bcdff0b141907fbe11447eb60748dbd43ae87c43c06.exe File opened (read-only) \??\L: 127974ae306f0e0434bc6bcdff0b141907fbe11447eb60748dbd43ae87c43c06.exe File opened (read-only) \??\X: 127974ae306f0e0434bc6bcdff0b141907fbe11447eb60748dbd43ae87c43c06.exe File opened (read-only) \??\Z: 127974ae306f0e0434bc6bcdff0b141907fbe11447eb60748dbd43ae87c43c06.exe File opened (read-only) \??\V: 127974ae306f0e0434bc6bcdff0b141907fbe11447eb60748dbd43ae87c43c06.exe File opened (read-only) \??\N: 127974ae306f0e0434bc6bcdff0b141907fbe11447eb60748dbd43ae87c43c06.exe File opened (read-only) \??\P: 127974ae306f0e0434bc6bcdff0b141907fbe11447eb60748dbd43ae87c43c06.exe File opened (read-only) \??\H: 127974ae306f0e0434bc6bcdff0b141907fbe11447eb60748dbd43ae87c43c06.exe File opened (read-only) \??\J: 127974ae306f0e0434bc6bcdff0b141907fbe11447eb60748dbd43ae87c43c06.exe File opened (read-only) \??\K: 127974ae306f0e0434bc6bcdff0b141907fbe11447eb60748dbd43ae87c43c06.exe File opened (read-only) \??\A: 127974ae306f0e0434bc6bcdff0b141907fbe11447eb60748dbd43ae87c43c06.exe File opened (read-only) \??\G: 127974ae306f0e0434bc6bcdff0b141907fbe11447eb60748dbd43ae87c43c06.exe File opened (read-only) \??\B: 127974ae306f0e0434bc6bcdff0b141907fbe11447eb60748dbd43ae87c43c06.exe File opened (read-only) \??\M: 127974ae306f0e0434bc6bcdff0b141907fbe11447eb60748dbd43ae87c43c06.exe File opened (read-only) \??\E: 127974ae306f0e0434bc6bcdff0b141907fbe11447eb60748dbd43ae87c43c06.exe File opened (read-only) \??\R: 127974ae306f0e0434bc6bcdff0b141907fbe11447eb60748dbd43ae87c43c06.exe File opened (read-only) \??\T: 127974ae306f0e0434bc6bcdff0b141907fbe11447eb60748dbd43ae87c43c06.exe File opened (read-only) \??\I: 127974ae306f0e0434bc6bcdff0b141907fbe11447eb60748dbd43ae87c43c06.exe -
Modifies boot configuration data using bcdedit 4 IoCs
pid Process 1660 bcdedit.exe 2292 bcdedit.exe 3008 bcdedit.exe 3004 bcdedit.exe -
Sets desktop wallpaper using registry 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Local\\Temp\\readme.bmp" 127974ae306f0e0434bc6bcdff0b141907fbe11447eb60748dbd43ae87c43c06.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Interacts with shadow copies 2 TTPs 2 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
pid Process 2756 vssadmin.exe 1532 vssadmin.exe -
Modifies Control Panel 2 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Control Panel\Desktop\WallpaperStyle = "0" 127974ae306f0e0434bc6bcdff0b141907fbe11447eb60748dbd43ae87c43c06.exe Set value (str) \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Control Panel\Desktop\TileWallpaper = "0" 127974ae306f0e0434bc6bcdff0b141907fbe11447eb60748dbd43ae87c43c06.exe -
Suspicious behavior: EnumeratesProcesses 19 IoCs
pid Process 2440 127974ae306f0e0434bc6bcdff0b141907fbe11447eb60748dbd43ae87c43c06.exe 2440 127974ae306f0e0434bc6bcdff0b141907fbe11447eb60748dbd43ae87c43c06.exe 2440 127974ae306f0e0434bc6bcdff0b141907fbe11447eb60748dbd43ae87c43c06.exe 2440 127974ae306f0e0434bc6bcdff0b141907fbe11447eb60748dbd43ae87c43c06.exe 2440 127974ae306f0e0434bc6bcdff0b141907fbe11447eb60748dbd43ae87c43c06.exe 2440 127974ae306f0e0434bc6bcdff0b141907fbe11447eb60748dbd43ae87c43c06.exe 2440 127974ae306f0e0434bc6bcdff0b141907fbe11447eb60748dbd43ae87c43c06.exe 2440 127974ae306f0e0434bc6bcdff0b141907fbe11447eb60748dbd43ae87c43c06.exe 2440 127974ae306f0e0434bc6bcdff0b141907fbe11447eb60748dbd43ae87c43c06.exe 2440 127974ae306f0e0434bc6bcdff0b141907fbe11447eb60748dbd43ae87c43c06.exe 2440 127974ae306f0e0434bc6bcdff0b141907fbe11447eb60748dbd43ae87c43c06.exe 2440 127974ae306f0e0434bc6bcdff0b141907fbe11447eb60748dbd43ae87c43c06.exe 2440 127974ae306f0e0434bc6bcdff0b141907fbe11447eb60748dbd43ae87c43c06.exe 2440 127974ae306f0e0434bc6bcdff0b141907fbe11447eb60748dbd43ae87c43c06.exe 2440 127974ae306f0e0434bc6bcdff0b141907fbe11447eb60748dbd43ae87c43c06.exe 2440 127974ae306f0e0434bc6bcdff0b141907fbe11447eb60748dbd43ae87c43c06.exe 2440 127974ae306f0e0434bc6bcdff0b141907fbe11447eb60748dbd43ae87c43c06.exe 2440 127974ae306f0e0434bc6bcdff0b141907fbe11447eb60748dbd43ae87c43c06.exe 2440 127974ae306f0e0434bc6bcdff0b141907fbe11447eb60748dbd43ae87c43c06.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeIncreaseQuotaPrivilege 2600 WMIC.exe Token: SeSecurityPrivilege 2600 WMIC.exe Token: SeTakeOwnershipPrivilege 2600 WMIC.exe Token: SeLoadDriverPrivilege 2600 WMIC.exe Token: SeSystemProfilePrivilege 2600 WMIC.exe Token: SeSystemtimePrivilege 2600 WMIC.exe Token: SeProfSingleProcessPrivilege 2600 WMIC.exe Token: SeIncBasePriorityPrivilege 2600 WMIC.exe Token: SeCreatePagefilePrivilege 2600 WMIC.exe Token: SeBackupPrivilege 2600 WMIC.exe Token: SeRestorePrivilege 2600 WMIC.exe Token: SeShutdownPrivilege 2600 WMIC.exe Token: SeDebugPrivilege 2600 WMIC.exe Token: SeSystemEnvironmentPrivilege 2600 WMIC.exe Token: SeRemoteShutdownPrivilege 2600 WMIC.exe Token: SeUndockPrivilege 2600 WMIC.exe Token: SeManageVolumePrivilege 2600 WMIC.exe Token: 33 2600 WMIC.exe Token: 34 2600 WMIC.exe Token: 35 2600 WMIC.exe Token: SeIncreaseQuotaPrivilege 2600 WMIC.exe Token: SeSecurityPrivilege 2600 WMIC.exe Token: SeTakeOwnershipPrivilege 2600 WMIC.exe Token: SeLoadDriverPrivilege 2600 WMIC.exe Token: SeSystemProfilePrivilege 2600 WMIC.exe Token: SeSystemtimePrivilege 2600 WMIC.exe Token: SeProfSingleProcessPrivilege 2600 WMIC.exe Token: SeIncBasePriorityPrivilege 2600 WMIC.exe Token: SeCreatePagefilePrivilege 2600 WMIC.exe Token: SeBackupPrivilege 2600 WMIC.exe Token: SeRestorePrivilege 2600 WMIC.exe Token: SeShutdownPrivilege 2600 WMIC.exe Token: SeDebugPrivilege 2600 WMIC.exe Token: SeSystemEnvironmentPrivilege 2600 WMIC.exe Token: SeRemoteShutdownPrivilege 2600 WMIC.exe Token: SeUndockPrivilege 2600 WMIC.exe Token: SeManageVolumePrivilege 2600 WMIC.exe Token: 33 2600 WMIC.exe Token: 34 2600 WMIC.exe Token: 35 2600 WMIC.exe Token: SeBackupPrivilege 1572 vssvc.exe Token: SeRestorePrivilege 1572 vssvc.exe Token: SeAuditPrivilege 1572 vssvc.exe Token: SeIncreaseQuotaPrivilege 2548 WMIC.exe Token: SeSecurityPrivilege 2548 WMIC.exe Token: SeTakeOwnershipPrivilege 2548 WMIC.exe Token: SeLoadDriverPrivilege 2548 WMIC.exe Token: SeSystemProfilePrivilege 2548 WMIC.exe Token: SeSystemtimePrivilege 2548 WMIC.exe Token: SeProfSingleProcessPrivilege 2548 WMIC.exe Token: SeIncBasePriorityPrivilege 2548 WMIC.exe Token: SeCreatePagefilePrivilege 2548 WMIC.exe Token: SeBackupPrivilege 2548 WMIC.exe Token: SeRestorePrivilege 2548 WMIC.exe Token: SeShutdownPrivilege 2548 WMIC.exe Token: SeDebugPrivilege 2548 WMIC.exe Token: SeSystemEnvironmentPrivilege 2548 WMIC.exe Token: SeRemoteShutdownPrivilege 2548 WMIC.exe Token: SeUndockPrivilege 2548 WMIC.exe Token: SeManageVolumePrivilege 2548 WMIC.exe Token: 33 2548 WMIC.exe Token: 34 2548 WMIC.exe Token: 35 2548 WMIC.exe Token: SeIncreaseQuotaPrivilege 2548 WMIC.exe -
Suspicious use of WriteProcessMemory 48 IoCs
description pid Process procid_target PID 2440 wrote to memory of 1628 2440 127974ae306f0e0434bc6bcdff0b141907fbe11447eb60748dbd43ae87c43c06.exe 29 PID 2440 wrote to memory of 1628 2440 127974ae306f0e0434bc6bcdff0b141907fbe11447eb60748dbd43ae87c43c06.exe 29 PID 2440 wrote to memory of 1628 2440 127974ae306f0e0434bc6bcdff0b141907fbe11447eb60748dbd43ae87c43c06.exe 29 PID 2440 wrote to memory of 2484 2440 127974ae306f0e0434bc6bcdff0b141907fbe11447eb60748dbd43ae87c43c06.exe 31 PID 2440 wrote to memory of 2484 2440 127974ae306f0e0434bc6bcdff0b141907fbe11447eb60748dbd43ae87c43c06.exe 31 PID 2440 wrote to memory of 2484 2440 127974ae306f0e0434bc6bcdff0b141907fbe11447eb60748dbd43ae87c43c06.exe 31 PID 2440 wrote to memory of 2708 2440 127974ae306f0e0434bc6bcdff0b141907fbe11447eb60748dbd43ae87c43c06.exe 33 PID 2440 wrote to memory of 2708 2440 127974ae306f0e0434bc6bcdff0b141907fbe11447eb60748dbd43ae87c43c06.exe 33 PID 2440 wrote to memory of 2708 2440 127974ae306f0e0434bc6bcdff0b141907fbe11447eb60748dbd43ae87c43c06.exe 33 PID 1628 wrote to memory of 2756 1628 cmd.exe 35 PID 1628 wrote to memory of 2756 1628 cmd.exe 35 PID 1628 wrote to memory of 2756 1628 cmd.exe 35 PID 2440 wrote to memory of 2764 2440 127974ae306f0e0434bc6bcdff0b141907fbe11447eb60748dbd43ae87c43c06.exe 36 PID 2440 wrote to memory of 2764 2440 127974ae306f0e0434bc6bcdff0b141907fbe11447eb60748dbd43ae87c43c06.exe 36 PID 2440 wrote to memory of 2764 2440 127974ae306f0e0434bc6bcdff0b141907fbe11447eb60748dbd43ae87c43c06.exe 36 PID 2484 wrote to memory of 2600 2484 cmd.exe 40 PID 2484 wrote to memory of 2600 2484 cmd.exe 40 PID 2484 wrote to memory of 2600 2484 cmd.exe 40 PID 2708 wrote to memory of 2292 2708 cmd.exe 39 PID 2708 wrote to memory of 2292 2708 cmd.exe 39 PID 2708 wrote to memory of 2292 2708 cmd.exe 39 PID 2764 wrote to memory of 1660 2764 cmd.exe 38 PID 2764 wrote to memory of 1660 2764 cmd.exe 38 PID 2764 wrote to memory of 1660 2764 cmd.exe 38 PID 2440 wrote to memory of 3044 2440 127974ae306f0e0434bc6bcdff0b141907fbe11447eb60748dbd43ae87c43c06.exe 47 PID 2440 wrote to memory of 3044 2440 127974ae306f0e0434bc6bcdff0b141907fbe11447eb60748dbd43ae87c43c06.exe 47 PID 2440 wrote to memory of 3044 2440 127974ae306f0e0434bc6bcdff0b141907fbe11447eb60748dbd43ae87c43c06.exe 47 PID 2440 wrote to memory of 1436 2440 127974ae306f0e0434bc6bcdff0b141907fbe11447eb60748dbd43ae87c43c06.exe 46 PID 2440 wrote to memory of 1436 2440 127974ae306f0e0434bc6bcdff0b141907fbe11447eb60748dbd43ae87c43c06.exe 46 PID 2440 wrote to memory of 1436 2440 127974ae306f0e0434bc6bcdff0b141907fbe11447eb60748dbd43ae87c43c06.exe 46 PID 2440 wrote to memory of 2972 2440 127974ae306f0e0434bc6bcdff0b141907fbe11447eb60748dbd43ae87c43c06.exe 50 PID 2440 wrote to memory of 2972 2440 127974ae306f0e0434bc6bcdff0b141907fbe11447eb60748dbd43ae87c43c06.exe 50 PID 2440 wrote to memory of 2972 2440 127974ae306f0e0434bc6bcdff0b141907fbe11447eb60748dbd43ae87c43c06.exe 50 PID 2440 wrote to memory of 1524 2440 127974ae306f0e0434bc6bcdff0b141907fbe11447eb60748dbd43ae87c43c06.exe 48 PID 2440 wrote to memory of 1524 2440 127974ae306f0e0434bc6bcdff0b141907fbe11447eb60748dbd43ae87c43c06.exe 48 PID 2440 wrote to memory of 1524 2440 127974ae306f0e0434bc6bcdff0b141907fbe11447eb60748dbd43ae87c43c06.exe 48 PID 3044 wrote to memory of 1532 3044 cmd.exe 52 PID 3044 wrote to memory of 1532 3044 cmd.exe 52 PID 3044 wrote to memory of 1532 3044 cmd.exe 52 PID 1436 wrote to memory of 2548 1436 cmd.exe 54 PID 1436 wrote to memory of 2548 1436 cmd.exe 54 PID 1436 wrote to memory of 2548 1436 cmd.exe 54 PID 2972 wrote to memory of 3004 2972 cmd.exe 56 PID 2972 wrote to memory of 3004 2972 cmd.exe 56 PID 2972 wrote to memory of 3004 2972 cmd.exe 56 PID 1524 wrote to memory of 3008 1524 cmd.exe 55 PID 1524 wrote to memory of 3008 1524 cmd.exe 55 PID 1524 wrote to memory of 3008 1524 cmd.exe 55 -
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\127974ae306f0e0434bc6bcdff0b141907fbe11447eb60748dbd43ae87c43c06.exe"C:\Users\Admin\AppData\Local\Temp\127974ae306f0e0434bc6bcdff0b141907fbe11447eb60748dbd43ae87c43c06.exe"1⤵
- Drops desktop.ini file(s)
- Enumerates connected drives
- Sets desktop wallpaper using registry
- Modifies Control Panel
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2440 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c vssadmin.exe delete shadows /all /quiet2⤵
- Suspicious use of WriteProcessMemory
PID:1628 -
C:\Windows\system32\vssadmin.exevssadmin.exe delete shadows /all /quiet3⤵
- Interacts with shadow copies
PID:2756
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c wmic SHADOWCOPY DELETE2⤵
- Suspicious use of WriteProcessMemory
PID:2484 -
C:\Windows\System32\Wbem\WMIC.exewmic SHADOWCOPY DELETE3⤵
- Suspicious use of AdjustPrivilegeToken
PID:2600
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c bcdedit / set{ default } recoveryenabled No2⤵
- Suspicious use of WriteProcessMemory
PID:2708 -
C:\Windows\system32\bcdedit.exebcdedit / set{ default } recoveryenabled No3⤵
- Modifies boot configuration data using bcdedit
PID:2292
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c bcdedit / set{ default } bootstatuspolicy ignoreallfailures2⤵
- Suspicious use of WriteProcessMemory
PID:2764 -
C:\Windows\system32\bcdedit.exebcdedit / set{ default } bootstatuspolicy ignoreallfailures3⤵
- Modifies boot configuration data using bcdedit
PID:1660
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c wmic SHADOWCOPY DELETE2⤵
- Suspicious use of WriteProcessMemory
PID:1436 -
C:\Windows\System32\Wbem\WMIC.exewmic SHADOWCOPY DELETE3⤵
- Suspicious use of AdjustPrivilegeToken
PID:2548
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c vssadmin.exe delete shadows /all /quiet2⤵
- Suspicious use of WriteProcessMemory
PID:3044 -
C:\Windows\system32\vssadmin.exevssadmin.exe delete shadows /all /quiet3⤵
- Interacts with shadow copies
PID:1532
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c bcdedit / set{ default } bootstatuspolicy ignoreallfailures2⤵
- Suspicious use of WriteProcessMemory
PID:1524 -
C:\Windows\system32\bcdedit.exebcdedit / set{ default } bootstatuspolicy ignoreallfailures3⤵
- Modifies boot configuration data using bcdedit
PID:3008
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c bcdedit / set{ default } recoveryenabled No2⤵
- Suspicious use of WriteProcessMemory
PID:2972 -
C:\Windows\system32\bcdedit.exebcdedit / set{ default } recoveryenabled No3⤵
- Modifies boot configuration data using bcdedit
PID:3004
-
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1572
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD5b05e32b7e78e82f01f6f0c7d1411ee67
SHA12e1dda46f8561858b378d19a24b839062f794274
SHA256f058bc2a88431119f286f2708751f25449dc1d58e1c87de3bb38aff764c814a8
SHA5126cb7c842a48b9f982ac87280ded95e206e2b9055f9f51ea84f6060470a61a35decbb688650c0d6b7c318df018078af0c0a1afe0ce65db1b460d75ae7800e2d3c