Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

10

Static

static

10

1f24461803...c1.exe

windows7-x64

9

1f24461803...c1.exe

windows10-2004-x64

9

Analysis

  • max time kernel
    142s
  • max time network
    152s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231215-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
  • submitted
    28/01/2024, 22:19

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    1f244618036218fe5bad01282f41a97a32ba879d4a8dd171ba698e98401859c1.exe

  • Size

    216KB

  • MD5

    d0e6827c65a12b12a2694faf686c7a2f

  • SHA1

    7c7bf8661237efbd03e40bc03eb204bf605a6878

  • SHA256

    9babc90e51e36cf84d14ae6e8003412e4ef154cb886e685ef6737bd3c1bcb37a

  • SHA512

    7eef8d9a14a7ac253f1dcff5cf613f22b6eb7285d517bf6d3d23dabb1b4b2baf72226db1721690a30f291d544dd0ff310d7a8114e530b3fbc3f7bea7cf9b8ab1

  • SSDEEP

    3072:m17DaAz38w3v47F6PFwgBZTGFKQ+avVe+gGooSlFC2OLKKZAFEMpo4Iv1k:Gb8xF6Pf2KQ+aVB2fJqh4Id

Score
9/10
ransomware

Malware Config

Signatures

  • Deletes shadow copies 2 TTPs

    Ransomware often targets backup files to inhibit system recovery.

    ransomware
  • Renames multiple (616) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

    ransomware
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Drops desktop.ini file(s) 1 IoCs
  • Enumerates connected drives 3 TTPs 23 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Modifies boot configuration data using bcdedit 4 IoCs
  • Sets desktop wallpaper using registry 2 TTPs 1 IoCs
    ransomware
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Interacts with shadow copies 2 TTPs 2 IoCs

    Shadow copies are often targeted by ransomware to inhibit system recovery.

    ransomware
  • Modifies Control Panel 2 IoCs
    evasion
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of WriteProcessMemory 32 IoCs
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware

Processes

  • C:\Users\Admin\AppData\Local\Temp\1f244618036218fe5bad01282f41a97a32ba879d4a8dd171ba698e98401859c1.exe
    "C:\Users\Admin\AppData\Local\Temp\1f244618036218fe5bad01282f41a97a32ba879d4a8dd171ba698e98401859c1.exe"
    1⤵
    • Checks computer location settings
    • Drops desktop.ini file(s)
    • Enumerates connected drives
    • Sets desktop wallpaper using registry
    • Modifies Control Panel
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:3060
    • C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe" /c vssadmin.exe delete shadows /all /quiet
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:3924
      • C:\Windows\system32\vssadmin.exe
        vssadmin.exe delete shadows /all /quiet
        3⤵
        • Interacts with shadow copies
        PID:3200
    • C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe" /c wmic SHADOWCOPY DELETE
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:4460
      • C:\Windows\System32\Wbem\WMIC.exe
        wmic SHADOWCOPY DELETE
        3⤵
        • Suspicious use of AdjustPrivilegeToken
        PID:4036
    • C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe" /c bcdedit / set{ default } recoveryenabled No
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:3848
      • C:\Windows\system32\bcdedit.exe
        bcdedit / set{ default } recoveryenabled No
        3⤵
        • Modifies boot configuration data using bcdedit
        PID:3592
    • C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe" /c bcdedit / set{ default } bootstatuspolicy ignoreallfailures
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:2808
      • C:\Windows\system32\bcdedit.exe
        bcdedit / set{ default } bootstatuspolicy ignoreallfailures
        3⤵
        • Modifies boot configuration data using bcdedit
        PID:2304
    • C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe" /c vssadmin.exe delete shadows /all /quiet
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:1984
      • C:\Windows\system32\vssadmin.exe
        vssadmin.exe delete shadows /all /quiet
        3⤵
        • Interacts with shadow copies
        PID:228
    • C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe" /c wmic SHADOWCOPY DELETE
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:3980
      • C:\Windows\System32\Wbem\WMIC.exe
        wmic SHADOWCOPY DELETE
        3⤵
        • Suspicious use of AdjustPrivilegeToken
        PID:4888
    • C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe" /c bcdedit / set{ default } recoveryenabled No
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:752
      • C:\Windows\system32\bcdedit.exe
        bcdedit / set{ default } recoveryenabled No
        3⤵
        • Modifies boot configuration data using bcdedit
        PID:1576
    • C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe" /c bcdedit / set{ default } bootstatuspolicy ignoreallfailures
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:672
      • C:\Windows\system32\bcdedit.exe
        bcdedit / set{ default } bootstatuspolicy ignoreallfailures
        3⤵
        • Modifies boot configuration data using bcdedit
        PID:392
  • C:\Windows\system32\vssvc.exe
    C:\Windows\system32\vssvc.exe
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    PID:2176
  • C:\Windows\system32\svchost.exe
    C:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc
    1⤵
      PID:3468

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\ProgramData\Adobe\Setup\WhatHappened.txt
      Filesize

      1KB

      MD5

      b05e32b7e78e82f01f6f0c7d1411ee67

      SHA1

      2e1dda46f8561858b378d19a24b839062f794274

      SHA256

      f058bc2a88431119f286f2708751f25449dc1d58e1c87de3bb38aff764c814a8

      SHA512

      6cb7c842a48b9f982ac87280ded95e206e2b9055f9f51ea84f6060470a61a35decbb688650c0d6b7c318df018078af0c0a1afe0ce65db1b460d75ae7800e2d3c

      Download Submit