Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
119s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
28/01/2024, 23:04
Static task
static1
Behavioral task
behavioral1
Sample
4a11b257b2c12a77e16e5d2ba735d24a3092ba52773be43520b1fecb253ad764.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
4a11b257b2c12a77e16e5d2ba735d24a3092ba52773be43520b1fecb253ad764.exe
Resource
win10v2004-20231222-en
General
-
Target
4a11b257b2c12a77e16e5d2ba735d24a3092ba52773be43520b1fecb253ad764.exe
-
Size
216KB
-
MD5
89bd7a775337d96d0aca2a87107ebd93
-
SHA1
5e1d95de8db5d25ecc91bf92add8dc7cc908e984
-
SHA256
fbf217ab8daaecf8825f65ba068b39fc031c859a69c1a619ee464dba27631db0
-
SHA512
270bb3b08e28016f7f18f35334287ffd87bdb11ab71774e2f11130bc2c211a3784c57e6629d8c4d5aa687f161fdee59016fc7155df4bdb7e80ab955f4f091011
-
SSDEEP
3072:m17DaAz38w3vl7F6PFwgBZTGFKQ+avVe+gGooSlFC2OLKKZAFEMpo4Iv1k:Gb8EF6Pf2KQ+aVB2fJqh4Id
Malware Config
Signatures
-
Deletes shadow copies 2 TTPs
Ransomware often targets backup files to inhibit system recovery.
-
Renames multiple (307) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Drops desktop.ini file(s) 1 IoCs
description ioc Process File opened for modification \??\M:\$RECYCLE.BIN\S-1-5-21-3601492379-692465709-652514833-1000\desktop.ini 4a11b257b2c12a77e16e5d2ba735d24a3092ba52773be43520b1fecb253ad764.exe -
Enumerates connected drives 3 TTPs 23 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\W: 4a11b257b2c12a77e16e5d2ba735d24a3092ba52773be43520b1fecb253ad764.exe File opened (read-only) \??\P: 4a11b257b2c12a77e16e5d2ba735d24a3092ba52773be43520b1fecb253ad764.exe File opened (read-only) \??\L: 4a11b257b2c12a77e16e5d2ba735d24a3092ba52773be43520b1fecb253ad764.exe File opened (read-only) \??\V: 4a11b257b2c12a77e16e5d2ba735d24a3092ba52773be43520b1fecb253ad764.exe File opened (read-only) \??\N: 4a11b257b2c12a77e16e5d2ba735d24a3092ba52773be43520b1fecb253ad764.exe File opened (read-only) \??\E: 4a11b257b2c12a77e16e5d2ba735d24a3092ba52773be43520b1fecb253ad764.exe File opened (read-only) \??\A: 4a11b257b2c12a77e16e5d2ba735d24a3092ba52773be43520b1fecb253ad764.exe File opened (read-only) \??\H: 4a11b257b2c12a77e16e5d2ba735d24a3092ba52773be43520b1fecb253ad764.exe File opened (read-only) \??\Z: 4a11b257b2c12a77e16e5d2ba735d24a3092ba52773be43520b1fecb253ad764.exe File opened (read-only) \??\B: 4a11b257b2c12a77e16e5d2ba735d24a3092ba52773be43520b1fecb253ad764.exe File opened (read-only) \??\J: 4a11b257b2c12a77e16e5d2ba735d24a3092ba52773be43520b1fecb253ad764.exe File opened (read-only) \??\Q: 4a11b257b2c12a77e16e5d2ba735d24a3092ba52773be43520b1fecb253ad764.exe File opened (read-only) \??\R: 4a11b257b2c12a77e16e5d2ba735d24a3092ba52773be43520b1fecb253ad764.exe File opened (read-only) \??\Y: 4a11b257b2c12a77e16e5d2ba735d24a3092ba52773be43520b1fecb253ad764.exe File opened (read-only) \??\U: 4a11b257b2c12a77e16e5d2ba735d24a3092ba52773be43520b1fecb253ad764.exe File opened (read-only) \??\I: 4a11b257b2c12a77e16e5d2ba735d24a3092ba52773be43520b1fecb253ad764.exe File opened (read-only) \??\O: 4a11b257b2c12a77e16e5d2ba735d24a3092ba52773be43520b1fecb253ad764.exe File opened (read-only) \??\S: 4a11b257b2c12a77e16e5d2ba735d24a3092ba52773be43520b1fecb253ad764.exe File opened (read-only) \??\K: 4a11b257b2c12a77e16e5d2ba735d24a3092ba52773be43520b1fecb253ad764.exe File opened (read-only) \??\M: 4a11b257b2c12a77e16e5d2ba735d24a3092ba52773be43520b1fecb253ad764.exe File opened (read-only) \??\T: 4a11b257b2c12a77e16e5d2ba735d24a3092ba52773be43520b1fecb253ad764.exe File opened (read-only) \??\G: 4a11b257b2c12a77e16e5d2ba735d24a3092ba52773be43520b1fecb253ad764.exe File opened (read-only) \??\X: 4a11b257b2c12a77e16e5d2ba735d24a3092ba52773be43520b1fecb253ad764.exe -
Modifies boot configuration data using bcdedit 4 IoCs
pid Process 3068 bcdedit.exe 3036 bcdedit.exe 2672 bcdedit.exe 2564 bcdedit.exe -
Sets desktop wallpaper using registry 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Local\\Temp\\readme.bmp" 4a11b257b2c12a77e16e5d2ba735d24a3092ba52773be43520b1fecb253ad764.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Interacts with shadow copies 2 TTPs 2 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
pid Process 2760 vssadmin.exe 2052 vssadmin.exe -
Modifies Control Panel 2 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Control Panel\Desktop\WallpaperStyle = "0" 4a11b257b2c12a77e16e5d2ba735d24a3092ba52773be43520b1fecb253ad764.exe Set value (str) \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Control Panel\Desktop\TileWallpaper = "0" 4a11b257b2c12a77e16e5d2ba735d24a3092ba52773be43520b1fecb253ad764.exe -
Suspicious behavior: EnumeratesProcesses 19 IoCs
pid Process 2236 4a11b257b2c12a77e16e5d2ba735d24a3092ba52773be43520b1fecb253ad764.exe 2236 4a11b257b2c12a77e16e5d2ba735d24a3092ba52773be43520b1fecb253ad764.exe 2236 4a11b257b2c12a77e16e5d2ba735d24a3092ba52773be43520b1fecb253ad764.exe 2236 4a11b257b2c12a77e16e5d2ba735d24a3092ba52773be43520b1fecb253ad764.exe 2236 4a11b257b2c12a77e16e5d2ba735d24a3092ba52773be43520b1fecb253ad764.exe 2236 4a11b257b2c12a77e16e5d2ba735d24a3092ba52773be43520b1fecb253ad764.exe 2236 4a11b257b2c12a77e16e5d2ba735d24a3092ba52773be43520b1fecb253ad764.exe 2236 4a11b257b2c12a77e16e5d2ba735d24a3092ba52773be43520b1fecb253ad764.exe 2236 4a11b257b2c12a77e16e5d2ba735d24a3092ba52773be43520b1fecb253ad764.exe 2236 4a11b257b2c12a77e16e5d2ba735d24a3092ba52773be43520b1fecb253ad764.exe 2236 4a11b257b2c12a77e16e5d2ba735d24a3092ba52773be43520b1fecb253ad764.exe 2236 4a11b257b2c12a77e16e5d2ba735d24a3092ba52773be43520b1fecb253ad764.exe 2236 4a11b257b2c12a77e16e5d2ba735d24a3092ba52773be43520b1fecb253ad764.exe 2236 4a11b257b2c12a77e16e5d2ba735d24a3092ba52773be43520b1fecb253ad764.exe 2236 4a11b257b2c12a77e16e5d2ba735d24a3092ba52773be43520b1fecb253ad764.exe 2236 4a11b257b2c12a77e16e5d2ba735d24a3092ba52773be43520b1fecb253ad764.exe 2236 4a11b257b2c12a77e16e5d2ba735d24a3092ba52773be43520b1fecb253ad764.exe 2236 4a11b257b2c12a77e16e5d2ba735d24a3092ba52773be43520b1fecb253ad764.exe 2236 4a11b257b2c12a77e16e5d2ba735d24a3092ba52773be43520b1fecb253ad764.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeIncreaseQuotaPrivilege 2796 WMIC.exe Token: SeSecurityPrivilege 2796 WMIC.exe Token: SeTakeOwnershipPrivilege 2796 WMIC.exe Token: SeLoadDriverPrivilege 2796 WMIC.exe Token: SeSystemProfilePrivilege 2796 WMIC.exe Token: SeSystemtimePrivilege 2796 WMIC.exe Token: SeProfSingleProcessPrivilege 2796 WMIC.exe Token: SeIncBasePriorityPrivilege 2796 WMIC.exe Token: SeCreatePagefilePrivilege 2796 WMIC.exe Token: SeBackupPrivilege 2796 WMIC.exe Token: SeRestorePrivilege 2796 WMIC.exe Token: SeShutdownPrivilege 2796 WMIC.exe Token: SeDebugPrivilege 2796 WMIC.exe Token: SeSystemEnvironmentPrivilege 2796 WMIC.exe Token: SeRemoteShutdownPrivilege 2796 WMIC.exe Token: SeUndockPrivilege 2796 WMIC.exe Token: SeManageVolumePrivilege 2796 WMIC.exe Token: 33 2796 WMIC.exe Token: 34 2796 WMIC.exe Token: 35 2796 WMIC.exe Token: SeIncreaseQuotaPrivilege 2796 WMIC.exe Token: SeSecurityPrivilege 2796 WMIC.exe Token: SeTakeOwnershipPrivilege 2796 WMIC.exe Token: SeLoadDriverPrivilege 2796 WMIC.exe Token: SeSystemProfilePrivilege 2796 WMIC.exe Token: SeSystemtimePrivilege 2796 WMIC.exe Token: SeProfSingleProcessPrivilege 2796 WMIC.exe Token: SeIncBasePriorityPrivilege 2796 WMIC.exe Token: SeCreatePagefilePrivilege 2796 WMIC.exe Token: SeBackupPrivilege 2796 WMIC.exe Token: SeRestorePrivilege 2796 WMIC.exe Token: SeShutdownPrivilege 2796 WMIC.exe Token: SeDebugPrivilege 2796 WMIC.exe Token: SeSystemEnvironmentPrivilege 2796 WMIC.exe Token: SeRemoteShutdownPrivilege 2796 WMIC.exe Token: SeUndockPrivilege 2796 WMIC.exe Token: SeManageVolumePrivilege 2796 WMIC.exe Token: 33 2796 WMIC.exe Token: 34 2796 WMIC.exe Token: 35 2796 WMIC.exe Token: SeBackupPrivilege 2676 vssvc.exe Token: SeRestorePrivilege 2676 vssvc.exe Token: SeAuditPrivilege 2676 vssvc.exe Token: SeIncreaseQuotaPrivilege 2204 WMIC.exe Token: SeSecurityPrivilege 2204 WMIC.exe Token: SeTakeOwnershipPrivilege 2204 WMIC.exe Token: SeLoadDriverPrivilege 2204 WMIC.exe Token: SeSystemProfilePrivilege 2204 WMIC.exe Token: SeSystemtimePrivilege 2204 WMIC.exe Token: SeProfSingleProcessPrivilege 2204 WMIC.exe Token: SeIncBasePriorityPrivilege 2204 WMIC.exe Token: SeCreatePagefilePrivilege 2204 WMIC.exe Token: SeBackupPrivilege 2204 WMIC.exe Token: SeRestorePrivilege 2204 WMIC.exe Token: SeShutdownPrivilege 2204 WMIC.exe Token: SeDebugPrivilege 2204 WMIC.exe Token: SeSystemEnvironmentPrivilege 2204 WMIC.exe Token: SeRemoteShutdownPrivilege 2204 WMIC.exe Token: SeUndockPrivilege 2204 WMIC.exe Token: SeManageVolumePrivilege 2204 WMIC.exe Token: 33 2204 WMIC.exe Token: 34 2204 WMIC.exe Token: 35 2204 WMIC.exe Token: SeIncreaseQuotaPrivilege 2204 WMIC.exe -
Suspicious use of WriteProcessMemory 48 IoCs
description pid Process procid_target PID 2236 wrote to memory of 2520 2236 4a11b257b2c12a77e16e5d2ba735d24a3092ba52773be43520b1fecb253ad764.exe 25 PID 2236 wrote to memory of 2520 2236 4a11b257b2c12a77e16e5d2ba735d24a3092ba52773be43520b1fecb253ad764.exe 25 PID 2236 wrote to memory of 2520 2236 4a11b257b2c12a77e16e5d2ba735d24a3092ba52773be43520b1fecb253ad764.exe 25 PID 2236 wrote to memory of 2828 2236 4a11b257b2c12a77e16e5d2ba735d24a3092ba52773be43520b1fecb253ad764.exe 23 PID 2236 wrote to memory of 2828 2236 4a11b257b2c12a77e16e5d2ba735d24a3092ba52773be43520b1fecb253ad764.exe 23 PID 2236 wrote to memory of 2828 2236 4a11b257b2c12a77e16e5d2ba735d24a3092ba52773be43520b1fecb253ad764.exe 23 PID 2236 wrote to memory of 2276 2236 4a11b257b2c12a77e16e5d2ba735d24a3092ba52773be43520b1fecb253ad764.exe 18 PID 2236 wrote to memory of 2276 2236 4a11b257b2c12a77e16e5d2ba735d24a3092ba52773be43520b1fecb253ad764.exe 18 PID 2236 wrote to memory of 2276 2236 4a11b257b2c12a77e16e5d2ba735d24a3092ba52773be43520b1fecb253ad764.exe 18 PID 2236 wrote to memory of 2460 2236 4a11b257b2c12a77e16e5d2ba735d24a3092ba52773be43520b1fecb253ad764.exe 20 PID 2236 wrote to memory of 2460 2236 4a11b257b2c12a77e16e5d2ba735d24a3092ba52773be43520b1fecb253ad764.exe 20 PID 2236 wrote to memory of 2460 2236 4a11b257b2c12a77e16e5d2ba735d24a3092ba52773be43520b1fecb253ad764.exe 20 PID 2520 wrote to memory of 2760 2520 cmd.exe 21 PID 2520 wrote to memory of 2760 2520 cmd.exe 21 PID 2520 wrote to memory of 2760 2520 cmd.exe 21 PID 2460 wrote to memory of 3036 2460 cmd.exe 40 PID 2460 wrote to memory of 3036 2460 cmd.exe 40 PID 2460 wrote to memory of 3036 2460 cmd.exe 40 PID 2828 wrote to memory of 2796 2828 cmd.exe 41 PID 2828 wrote to memory of 2796 2828 cmd.exe 41 PID 2828 wrote to memory of 2796 2828 cmd.exe 41 PID 2276 wrote to memory of 3068 2276 cmd.exe 39 PID 2276 wrote to memory of 3068 2276 cmd.exe 39 PID 2276 wrote to memory of 3068 2276 cmd.exe 39 PID 2236 wrote to memory of 2952 2236 4a11b257b2c12a77e16e5d2ba735d24a3092ba52773be43520b1fecb253ad764.exe 45 PID 2236 wrote to memory of 2952 2236 4a11b257b2c12a77e16e5d2ba735d24a3092ba52773be43520b1fecb253ad764.exe 45 PID 2236 wrote to memory of 2952 2236 4a11b257b2c12a77e16e5d2ba735d24a3092ba52773be43520b1fecb253ad764.exe 45 PID 2236 wrote to memory of 1880 2236 4a11b257b2c12a77e16e5d2ba735d24a3092ba52773be43520b1fecb253ad764.exe 48 PID 2236 wrote to memory of 1880 2236 4a11b257b2c12a77e16e5d2ba735d24a3092ba52773be43520b1fecb253ad764.exe 48 PID 2236 wrote to memory of 1880 2236 4a11b257b2c12a77e16e5d2ba735d24a3092ba52773be43520b1fecb253ad764.exe 48 PID 2236 wrote to memory of 2232 2236 4a11b257b2c12a77e16e5d2ba735d24a3092ba52773be43520b1fecb253ad764.exe 52 PID 2236 wrote to memory of 2232 2236 4a11b257b2c12a77e16e5d2ba735d24a3092ba52773be43520b1fecb253ad764.exe 52 PID 2236 wrote to memory of 2232 2236 4a11b257b2c12a77e16e5d2ba735d24a3092ba52773be43520b1fecb253ad764.exe 52 PID 2236 wrote to memory of 2784 2236 4a11b257b2c12a77e16e5d2ba735d24a3092ba52773be43520b1fecb253ad764.exe 49 PID 2236 wrote to memory of 2784 2236 4a11b257b2c12a77e16e5d2ba735d24a3092ba52773be43520b1fecb253ad764.exe 49 PID 2236 wrote to memory of 2784 2236 4a11b257b2c12a77e16e5d2ba735d24a3092ba52773be43520b1fecb253ad764.exe 49 PID 1880 wrote to memory of 2204 1880 cmd.exe 56 PID 1880 wrote to memory of 2204 1880 cmd.exe 56 PID 1880 wrote to memory of 2204 1880 cmd.exe 56 PID 2232 wrote to memory of 2672 2232 cmd.exe 53 PID 2232 wrote to memory of 2672 2232 cmd.exe 53 PID 2232 wrote to memory of 2672 2232 cmd.exe 53 PID 2784 wrote to memory of 2564 2784 cmd.exe 55 PID 2784 wrote to memory of 2564 2784 cmd.exe 55 PID 2784 wrote to memory of 2564 2784 cmd.exe 55 PID 2952 wrote to memory of 2052 2952 cmd.exe 54 PID 2952 wrote to memory of 2052 2952 cmd.exe 54 PID 2952 wrote to memory of 2052 2952 cmd.exe 54 -
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\4a11b257b2c12a77e16e5d2ba735d24a3092ba52773be43520b1fecb253ad764.exe"C:\Users\Admin\AppData\Local\Temp\4a11b257b2c12a77e16e5d2ba735d24a3092ba52773be43520b1fecb253ad764.exe"1⤵
- Drops desktop.ini file(s)
- Enumerates connected drives
- Sets desktop wallpaper using registry
- Modifies Control Panel
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2236 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c bcdedit / set{ default } recoveryenabled No2⤵
- Suspicious use of WriteProcessMemory
PID:2276 -
C:\Windows\system32\bcdedit.exebcdedit / set{ default } recoveryenabled No3⤵
- Modifies boot configuration data using bcdedit
PID:3068
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c bcdedit / set{ default } bootstatuspolicy ignoreallfailures2⤵
- Suspicious use of WriteProcessMemory
PID:2460 -
C:\Windows\system32\bcdedit.exebcdedit / set{ default } bootstatuspolicy ignoreallfailures3⤵
- Modifies boot configuration data using bcdedit
PID:3036
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c wmic SHADOWCOPY DELETE2⤵
- Suspicious use of WriteProcessMemory
PID:2828 -
C:\Windows\System32\Wbem\WMIC.exewmic SHADOWCOPY DELETE3⤵
- Suspicious use of AdjustPrivilegeToken
PID:2796
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c vssadmin.exe delete shadows /all /quiet2⤵
- Suspicious use of WriteProcessMemory
PID:2520
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c vssadmin.exe delete shadows /all /quiet2⤵
- Suspicious use of WriteProcessMemory
PID:2952 -
C:\Windows\system32\vssadmin.exevssadmin.exe delete shadows /all /quiet3⤵
- Interacts with shadow copies
PID:2052
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c wmic SHADOWCOPY DELETE2⤵
- Suspicious use of WriteProcessMemory
PID:1880 -
C:\Windows\System32\Wbem\WMIC.exewmic SHADOWCOPY DELETE3⤵
- Suspicious use of AdjustPrivilegeToken
PID:2204
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c bcdedit / set{ default } bootstatuspolicy ignoreallfailures2⤵
- Suspicious use of WriteProcessMemory
PID:2784 -
C:\Windows\system32\bcdedit.exebcdedit / set{ default } bootstatuspolicy ignoreallfailures3⤵
- Modifies boot configuration data using bcdedit
PID:2564
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c bcdedit / set{ default } recoveryenabled No2⤵
- Suspicious use of WriteProcessMemory
PID:2232 -
C:\Windows\system32\bcdedit.exebcdedit / set{ default } recoveryenabled No3⤵
- Modifies boot configuration data using bcdedit
PID:2672
-
-
-
C:\Windows\system32\vssadmin.exevssadmin.exe delete shadows /all /quiet1⤵
- Interacts with shadow copies
PID:2760
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2676
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD5b05e32b7e78e82f01f6f0c7d1411ee67
SHA12e1dda46f8561858b378d19a24b839062f794274
SHA256f058bc2a88431119f286f2708751f25449dc1d58e1c87de3bb38aff764c814a8
SHA5126cb7c842a48b9f982ac87280ded95e206e2b9055f9f51ea84f6060470a61a35decbb688650c0d6b7c318df018078af0c0a1afe0ce65db1b460d75ae7800e2d3c