Overview
overview
10Static
static
3Ransomware.7ev3n.exe
windows7-x64
Ransomware.7ev3n.exe
windows10-2004-x64
Ransomware...it.exe
windows7-x64
10Ransomware...it.exe
windows10-2004-x64
10Ransomware...us.exe
windows7-x64
10Ransomware...us.exe
windows10-2004-x64
10Ransomware...er.exe
windows7-x64
10Ransomware...er.exe
windows10-2004-x64
10MalwareCol...om.zip
windows7-x64
1MalwareCol...om.zip
windows10-2004-x64
1MalwareCol...v1.zip
windows7-x64
1MalwareCol...v1.zip
windows10-2004-x64
1MalwareCol...00.zip
windows7-x64
1MalwareCol...00.zip
windows10-2004-x64
1MalwareCol....0.zip
windows7-x64
1MalwareCol....0.zip
windows10-2004-x64
1MalwareCol....A.zip
windows7-x64
1MalwareCol....A.zip
windows10-2004-x64
1Analysis
-
max time kernel
26s -
max time network
28s -
platform
windows10-2004_x64 -
resource
win10v2004-20240221-en -
resource tags
arch:x64arch:x86image:win10v2004-20240221-enlocale:en-usos:windows10-2004-x64system -
submitted
24-02-2024 11:28
Static task
static1
Behavioral task
behavioral1
Sample
Ransomware.7ev3n.exe
Resource
win7-20240215-en
Behavioral task
behavioral2
Sample
Ransomware.7ev3n.exe
Resource
win10v2004-20240221-en
Behavioral task
behavioral3
Sample
Ransomware.BadRabbit.exe
Resource
win7-20240221-en
Behavioral task
behavioral4
Sample
Ransomware.BadRabbit.exe
Resource
win10v2004-20240221-en
Behavioral task
behavioral5
Sample
Ransomware.CoronaVirus.exe
Resource
win7-20240221-en
Behavioral task
behavioral6
Sample
Ransomware.CoronaVirus.exe
Resource
win10v2004-20240221-en
Behavioral task
behavioral7
Sample
Ransomware.CryptoLocker.exe
Resource
win7-20240221-en
Behavioral task
behavioral8
Sample
Ransomware.CryptoLocker.exe
Resource
win10v2004-20240221-en
Behavioral task
behavioral9
Sample
MalwareCollection-master/Ransomware/Ransomware.NoMoreRansom.zip
Resource
win7-20240220-en
Behavioral task
behavioral10
Sample
MalwareCollection-master/Ransomware/Ransomware.NoMoreRansom.zip
Resource
win10v2004-20240221-en
Behavioral task
behavioral11
Sample
MalwareCollection-master/Ransomware/Ransomware.WannaCrypt0r.v1.zip
Resource
win7-20240221-en
Behavioral task
behavioral12
Sample
MalwareCollection-master/Ransomware/Ransomware.WannaCrypt0r.v1.zip
Resource
win10v2004-20240221-en
Behavioral task
behavioral13
Sample
MalwareCollection-master/Trojan/Trojan.000.zip
Resource
win7-20240221-en
Behavioral task
behavioral14
Sample
MalwareCollection-master/Trojan/Trojan.000.zip
Resource
win10v2004-20240221-en
Behavioral task
behavioral15
Sample
MalwareCollection-master/Trojan/Trojan.MEMZ-4.0.zip
Resource
win7-20240221-en
Behavioral task
behavioral16
Sample
MalwareCollection-master/Trojan/Trojan.MEMZ-4.0.zip
Resource
win10v2004-20240221-en
Behavioral task
behavioral17
Sample
MalwareCollection-master/Worm/Email-Worm/Email-Worm.Mylife.A.zip
Resource
win7-20240221-en
Behavioral task
behavioral18
Sample
MalwareCollection-master/Worm/Email-Worm/Email-Worm.Mylife.A.zip
Resource
win10v2004-20240221-en
Errors
General
-
Target
Ransomware.7ev3n.exe
-
Size
315KB
-
MD5
9f8bc96c96d43ecb69f883388d228754
-
SHA1
61ed25a706afa2f6684bb4d64f69c5fb29d20953
-
SHA256
7d373ccb96d1dbb1856ef31afa87c2112a0c1795a796ab01cb154700288afec5
-
SHA512
550a891c1059f58aa983138caf65a7ea9c326cb1b94c15f3e7594128f6e9f1295b9c2dbc0925637dba7c94e938083fffc6a63dc7c2e5b1e247679931cce505c6
-
SSDEEP
6144:BswDdb2MemnBVlz0SoVbO4A6OA4Trl28TyT6llY1/I8cWJWlfTXv:BswRSslz0P1OdFXJlJ8buXv
Malware Config
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "C:\\Users\\Admin\\AppData\\Local\\system.exe" reg.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe -
Executes dropped EXE 1 IoCs
pid Process 1212 system.exe -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\System = "C:\\Users\\Admin\\AppData\\Local\\system.exe" reg.exe -
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 1752 SCHTASKS.exe -
Modifies data under HKEY_USERS 15 IoCs
description ioc Process Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\EnableWindowColorization = "57" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationGlassAttribute = "1" LogonUI.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentColorMenu = "4292311040" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColor = "3288365271" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationBlurBalance = "1" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History\AutoColor = "0" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\StartColorMenu = "4288567808" LogonUI.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\AccentColor = "4292311040" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglow = "3288365271" LogonUI.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent LogonUI.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentPalette = a6d8ff0076b9ed00429ce3000078d700005a9e000042750000264200f7630c00 LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColorBalance = "89" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglowBalance = "10" LogonUI.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeShutdownPrivilege 1360 shutdown.exe Token: SeRemoteShutdownPrivilege 1360 shutdown.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 4200 LogonUI.exe -
Suspicious use of WriteProcessMemory 57 IoCs
description pid Process procid_target PID 1612 wrote to memory of 1212 1612 Ransomware.7ev3n.exe 92 PID 1612 wrote to memory of 1212 1612 Ransomware.7ev3n.exe 92 PID 1612 wrote to memory of 1212 1612 Ransomware.7ev3n.exe 92 PID 1212 wrote to memory of 4620 1212 system.exe 93 PID 1212 wrote to memory of 4620 1212 system.exe 93 PID 1212 wrote to memory of 4620 1212 system.exe 93 PID 1212 wrote to memory of 1752 1212 system.exe 94 PID 1212 wrote to memory of 1752 1212 system.exe 94 PID 1212 wrote to memory of 1752 1212 system.exe 94 PID 1212 wrote to memory of 2964 1212 system.exe 97 PID 1212 wrote to memory of 2964 1212 system.exe 97 PID 1212 wrote to memory of 2964 1212 system.exe 97 PID 1212 wrote to memory of 3260 1212 system.exe 105 PID 1212 wrote to memory of 3260 1212 system.exe 105 PID 1212 wrote to memory of 3260 1212 system.exe 105 PID 1212 wrote to memory of 1548 1212 system.exe 104 PID 1212 wrote to memory of 1548 1212 system.exe 104 PID 1212 wrote to memory of 1548 1212 system.exe 104 PID 1212 wrote to memory of 3648 1212 system.exe 102 PID 1212 wrote to memory of 3648 1212 system.exe 102 PID 1212 wrote to memory of 3648 1212 system.exe 102 PID 1212 wrote to memory of 2228 1212 system.exe 98 PID 1212 wrote to memory of 2228 1212 system.exe 98 PID 1212 wrote to memory of 2228 1212 system.exe 98 PID 1212 wrote to memory of 1716 1212 system.exe 101 PID 1212 wrote to memory of 1716 1212 system.exe 101 PID 1212 wrote to memory of 1716 1212 system.exe 101 PID 2964 wrote to memory of 1060 2964 cmd.exe 109 PID 2964 wrote to memory of 1060 2964 cmd.exe 109 PID 2964 wrote to memory of 1060 2964 cmd.exe 109 PID 2228 wrote to memory of 4944 2228 cmd.exe 111 PID 2228 wrote to memory of 4944 2228 cmd.exe 111 PID 2228 wrote to memory of 4944 2228 cmd.exe 111 PID 3260 wrote to memory of 4344 3260 cmd.exe 110 PID 3260 wrote to memory of 4344 3260 cmd.exe 110 PID 3260 wrote to memory of 4344 3260 cmd.exe 110 PID 3648 wrote to memory of 448 3648 cmd.exe 113 PID 3648 wrote to memory of 448 3648 cmd.exe 113 PID 3648 wrote to memory of 448 3648 cmd.exe 113 PID 1716 wrote to memory of 2932 1716 cmd.exe 112 PID 1716 wrote to memory of 2932 1716 cmd.exe 112 PID 1716 wrote to memory of 2932 1716 cmd.exe 112 PID 1548 wrote to memory of 2692 1548 cmd.exe 114 PID 1548 wrote to memory of 2692 1548 cmd.exe 114 PID 1548 wrote to memory of 2692 1548 cmd.exe 114 PID 1212 wrote to memory of 4788 1212 system.exe 118 PID 1212 wrote to memory of 4788 1212 system.exe 118 PID 1212 wrote to memory of 4788 1212 system.exe 118 PID 4788 wrote to memory of 4612 4788 cmd.exe 120 PID 4788 wrote to memory of 4612 4788 cmd.exe 120 PID 4788 wrote to memory of 4612 4788 cmd.exe 120 PID 1212 wrote to memory of 2380 1212 system.exe 121 PID 1212 wrote to memory of 2380 1212 system.exe 121 PID 1212 wrote to memory of 2380 1212 system.exe 121 PID 2380 wrote to memory of 1360 2380 cmd.exe 123 PID 2380 wrote to memory of 1360 2380 cmd.exe 123 PID 2380 wrote to memory of 1360 2380 cmd.exe 123
Processes
-
C:\Users\Admin\AppData\Local\Temp\Ransomware.7ev3n.exe"C:\Users\Admin\AppData\Local\Temp\Ransomware.7ev3n.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1612 -
C:\Users\Admin\AppData\Local\system.exe"C:\Users\Admin\AppData\Local\system.exe"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1212 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\del.bat3⤵PID:4620
-
-
C:\Windows\SysWOW64\SCHTASKS.exeC:\Windows\System32\SCHTASKS.exe /create /SC ONLOGON /TN uac /TR "C:\Users\Admin\AppData\Local\bcd.bat" /RL HIGHEST /f3⤵
- Creates scheduled task(s)
PID:1752
-
-
C:\windows\SysWOW64\cmd.exeC:\windows\system32\cmd.exe /c REG ADD "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon" /v "Shell" /t REG_SZ /d "C:\Users\Admin\AppData\Local\system.exe" /f /reg:643⤵
- Suspicious use of WriteProcessMemory
PID:2964 -
C:\Windows\SysWOW64\reg.exeREG ADD "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon" /v "Shell" /t REG_SZ /d "C:\Users\Admin\AppData\Local\system.exe" /f /reg:644⤵
- Modifies WinLogon for persistence
PID:1060
-
-
-
C:\windows\SysWOW64\cmd.exeC:\windows\system32\cmd.exe /c REG ADD "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion" /v "rgd_bcd_condition" /t REG_SZ /d 1 /f /reg:643⤵
- Suspicious use of WriteProcessMemory
PID:2228 -
C:\Windows\SysWOW64\reg.exeREG ADD "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion" /v "rgd_bcd_condition" /t REG_SZ /d 1 /f /reg:644⤵PID:4944
-
-
-
C:\windows\SysWOW64\cmd.exeC:\windows\system32\cmd.exe /c REG ADD "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v "EnableLUA" /t REG_DWORD /d 0 /f /reg:643⤵
- Suspicious use of WriteProcessMemory
PID:1716 -
C:\Windows\SysWOW64\reg.exeREG ADD "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v "EnableLUA" /t REG_DWORD /d 0 /f /reg:644⤵
- UAC bypass
PID:2932
-
-
-
C:\windows\SysWOW64\cmd.exeC:\windows\system32\cmd.exe /c REG ADD "HKEY_CURRENT_USER\Control Panel\Accessibility\StickyKeys" /v "Flags" /t REG_SZ /d 506 /f /reg:643⤵
- Suspicious use of WriteProcessMemory
PID:3648 -
C:\Windows\SysWOW64\reg.exeREG ADD "HKEY_CURRENT_USER\Control Panel\Accessibility\StickyKeys" /v "Flags" /t REG_SZ /d 506 /f /reg:644⤵PID:448
-
-
-
C:\windows\SysWOW64\cmd.exeC:\windows\system32\cmd.exe /c REG ADD "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Keyboard Layout" /v "Scancode Map" /t REG_BINARY /d "00000000000000001700000000003800000038e000005be000005ce00000360000001d0000001de000000f000000010000001c0000003e0000003b00000044000000450000003d0000005de000000000" /f /reg:643⤵
- Suspicious use of WriteProcessMemory
PID:1548 -
C:\Windows\SysWOW64\reg.exeREG ADD "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Keyboard Layout" /v "Scancode Map" /t REG_BINARY /d "00000000000000001700000000003800000038e000005be000005ce00000360000001d0000001de000000f000000010000001c0000003e0000003b00000044000000450000003d0000005de000000000" /f /reg:644⤵PID:2692
-
-
-
C:\windows\SysWOW64\cmd.exeC:\windows\system32\cmd.exe /c REG ADD "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "System" /t REG_SZ /d "C:\Users\Admin\AppData\Local\system.exe" /f /reg:643⤵
- Suspicious use of WriteProcessMemory
PID:3260 -
C:\Windows\SysWOW64\reg.exeREG ADD "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "System" /t REG_SZ /d "C:\Users\Admin\AppData\Local\system.exe" /f /reg:644⤵
- Adds Run key to start application
PID:4344
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c REG ADD "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion" /v "crypted" /t REG_SZ /d 1 /f /reg:643⤵
- Suspicious use of WriteProcessMemory
PID:4788 -
C:\Windows\SysWOW64\reg.exeREG ADD "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion" /v "crypted" /t REG_SZ /d 1 /f /reg:644⤵PID:4612
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c shutdown -r -t 10 -f3⤵
- Suspicious use of WriteProcessMemory
PID:2380 -
C:\Windows\SysWOW64\shutdown.exeshutdown -r -t 10 -f4⤵
- Suspicious use of AdjustPrivilegeToken
PID:1360
-
-
-
-
C:\Windows\system32\LogonUI.exe"LogonUI.exe" /flags:0x4 /state0:0xa394b055 /state1:0x41c64e6d1⤵
- Modifies data under HKEY_USERS
- Suspicious use of SetWindowsHookEx
PID:4200
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Scheduled Task/Job
1Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Scheduled Task/Job
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
76B
MD5bd6cd262cc5cccb49b23151fd6ac9d83
SHA1cbb450016597875cd6616e62ec8f9a1acd4abb9a
SHA2567f35dc86053a85c2ffe7ef385ace63105cdff5fd1960be4169a72b66dcb9c2cb
SHA5126bfbb77e4050c65a74c97aefebd80bab1b61e9cad3332aa5dbe42ea8bd2c171012a9426e98e1b85e3f9ab0f48ef6501d44ef1b9318def2c994f4f26433b3ad09
-
Filesize
315KB
MD5c98e0d7e5d0c9882fe18a3d99161d82d
SHA12ecf293bd53af605c1cfd4a153271b53f3aec74c
SHA256996ae93da2c2b6b8a47f2e31084972fcbefad0fc9a7123ae3ee4f486bd91afe5
SHA51201e8352864eaf8901c58c106be8ad00dc137063e6f61425a01113743b5d617ab3e03610ab4aec197cb71a2b0805085f947824428cf0540045f2618744bf5ee75