Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
118s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
07/03/2024, 21:50
Static task
static1
Behavioral task
behavioral1
Sample
Ransom.bat
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
Ransom.bat
Resource
win10v2004-20240226-en
General
-
Target
Ransom.bat
-
Size
772B
-
MD5
65fa17810ee502541074b1cf56381270
-
SHA1
ed6358e7d3e5e1aa48af83f30d296ed5919418c4
-
SHA256
458356522cd7f251a4e86b87fbcdf375f81a9ddc9af7f9c6e2a166c1a1d4c1f9
-
SHA512
8ef0778c77e6bf68ad8a085d74434fb4fe7d39c091b23f6515bf22a55e600750e06a83ebc3c9655f8e2ba4036a4ce76fcfa4f28df27dbbd6d8f949da082bc54a
Malware Config
Signatures
-
Delays execution with timeout.exe 1 IoCs
pid Process 2484 timeout.exe -
Suspicious use of WriteProcessMemory 57 IoCs
description pid Process procid_target PID 2992 wrote to memory of 3024 2992 cmd.exe 29 PID 2992 wrote to memory of 3024 2992 cmd.exe 29 PID 2992 wrote to memory of 3024 2992 cmd.exe 29 PID 2992 wrote to memory of 1956 2992 cmd.exe 30 PID 2992 wrote to memory of 1956 2992 cmd.exe 30 PID 2992 wrote to memory of 1956 2992 cmd.exe 30 PID 2992 wrote to memory of 3040 2992 cmd.exe 31 PID 2992 wrote to memory of 3040 2992 cmd.exe 31 PID 2992 wrote to memory of 3040 2992 cmd.exe 31 PID 2992 wrote to memory of 2000 2992 cmd.exe 32 PID 2992 wrote to memory of 2000 2992 cmd.exe 32 PID 2992 wrote to memory of 2000 2992 cmd.exe 32 PID 2992 wrote to memory of 2516 2992 cmd.exe 33 PID 2992 wrote to memory of 2516 2992 cmd.exe 33 PID 2992 wrote to memory of 2516 2992 cmd.exe 33 PID 2992 wrote to memory of 2604 2992 cmd.exe 34 PID 2992 wrote to memory of 2604 2992 cmd.exe 34 PID 2992 wrote to memory of 2604 2992 cmd.exe 34 PID 2992 wrote to memory of 2708 2992 cmd.exe 35 PID 2992 wrote to memory of 2708 2992 cmd.exe 35 PID 2992 wrote to memory of 2708 2992 cmd.exe 35 PID 2992 wrote to memory of 2564 2992 cmd.exe 36 PID 2992 wrote to memory of 2564 2992 cmd.exe 36 PID 2992 wrote to memory of 2564 2992 cmd.exe 36 PID 2992 wrote to memory of 2824 2992 cmd.exe 37 PID 2992 wrote to memory of 2824 2992 cmd.exe 37 PID 2992 wrote to memory of 2824 2992 cmd.exe 37 PID 2992 wrote to memory of 3044 2992 cmd.exe 38 PID 2992 wrote to memory of 3044 2992 cmd.exe 38 PID 2992 wrote to memory of 3044 2992 cmd.exe 38 PID 2992 wrote to memory of 2572 2992 cmd.exe 39 PID 2992 wrote to memory of 2572 2992 cmd.exe 39 PID 2992 wrote to memory of 2572 2992 cmd.exe 39 PID 2992 wrote to memory of 1964 2992 cmd.exe 40 PID 2992 wrote to memory of 1964 2992 cmd.exe 40 PID 2992 wrote to memory of 1964 2992 cmd.exe 40 PID 2992 wrote to memory of 2732 2992 cmd.exe 41 PID 2992 wrote to memory of 2732 2992 cmd.exe 41 PID 2992 wrote to memory of 2732 2992 cmd.exe 41 PID 2992 wrote to memory of 2432 2992 cmd.exe 42 PID 2992 wrote to memory of 2432 2992 cmd.exe 42 PID 2992 wrote to memory of 2432 2992 cmd.exe 42 PID 2992 wrote to memory of 2180 2992 cmd.exe 43 PID 2992 wrote to memory of 2180 2992 cmd.exe 43 PID 2992 wrote to memory of 2180 2992 cmd.exe 43 PID 2992 wrote to memory of 2472 2992 cmd.exe 44 PID 2992 wrote to memory of 2472 2992 cmd.exe 44 PID 2992 wrote to memory of 2472 2992 cmd.exe 44 PID 2992 wrote to memory of 2408 2992 cmd.exe 45 PID 2992 wrote to memory of 2408 2992 cmd.exe 45 PID 2992 wrote to memory of 2408 2992 cmd.exe 45 PID 2992 wrote to memory of 2428 2992 cmd.exe 46 PID 2992 wrote to memory of 2428 2992 cmd.exe 46 PID 2992 wrote to memory of 2428 2992 cmd.exe 46 PID 2992 wrote to memory of 2484 2992 cmd.exe 47 PID 2992 wrote to memory of 2484 2992 cmd.exe 47 PID 2992 wrote to memory of 2484 2992 cmd.exe 47
Processes
-
C:\Windows\system32\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\Ransom.bat"1⤵
- Suspicious use of WriteProcessMemory
PID:2992 -
C:\Windows\system32\certutil.execertutil -encode "C:\vcredist2010_x64.log-MSI_vc_red.msi.txt" "C:\Users\Admin\AppData\Local\Temp\vcredist2010_x64.log-MSI_vc_red.msi.txt.enc"2⤵PID:3024
-
-
C:\Windows\system32\certutil.execertutil -encode "C:\vcredist2010_x64.log.html" "C:\Users\Admin\AppData\Local\Temp\vcredist2010_x64.log.html.enc"2⤵PID:1956
-
-
C:\Windows\system32\certutil.execertutil -encode "C:\vcredist2010_x86.log-MSI_vc_red.msi.txt" "C:\Users\Admin\AppData\Local\Temp\vcredist2010_x86.log-MSI_vc_red.msi.txt.enc"2⤵PID:3040
-
-
C:\Windows\system32\certutil.execertutil -encode "C:\vcredist2010_x86.log.html" "C:\Users\Admin\AppData\Local\Temp\vcredist2010_x86.log.html.enc"2⤵PID:2000
-
-
C:\Windows\system32\certutil.execertutil -encode "C:\vcredist2012_x64_0_vcRuntimeMinimum_x64.log" "C:\Users\Admin\AppData\Local\Temp\vcredist2012_x64_0_vcRuntimeMinimum_x64.log.enc"2⤵PID:2516
-
-
C:\Windows\system32\certutil.execertutil -encode "C:\vcredist2012_x64_1_vcRuntimeAdditional_x64.log" "C:\Users\Admin\AppData\Local\Temp\vcredist2012_x64_1_vcRuntimeAdditional_x64.log.enc"2⤵PID:2604
-
-
C:\Windows\system32\certutil.execertutil -encode "C:\vcredist2012_x86.log" "C:\Users\Admin\AppData\Local\Temp\vcredist2012_x86.log.enc"2⤵PID:2708
-
-
C:\Windows\system32\certutil.execertutil -encode "C:\vcredist2012_x86_0_vcRuntimeMinimum_x86.log" "C:\Users\Admin\AppData\Local\Temp\vcredist2012_x86_0_vcRuntimeMinimum_x86.log.enc"2⤵PID:2564
-
-
C:\Windows\system32\certutil.execertutil -encode "C:\vcredist2012_x86_1_vcRuntimeAdditional_x86.log" "C:\Users\Admin\AppData\Local\Temp\vcredist2012_x86_1_vcRuntimeAdditional_x86.log.enc"2⤵PID:2824
-
-
C:\Windows\system32\certutil.execertutil -encode "C:\vcredist2013_x64_000_vcRuntimeMinimum_x64.log" "C:\Users\Admin\AppData\Local\Temp\vcredist2013_x64_000_vcRuntimeMinimum_x64.log.enc"2⤵PID:3044
-
-
C:\Windows\system32\certutil.execertutil -encode "C:\vcredist2013_x64_001_vcRuntimeAdditional_x64.log" "C:\Users\Admin\AppData\Local\Temp\vcredist2013_x64_001_vcRuntimeAdditional_x64.log.enc"2⤵PID:2572
-
-
C:\Windows\system32\certutil.execertutil -encode "C:\vcredist2013_x86_000_vcRuntimeMinimum_x86.log" "C:\Users\Admin\AppData\Local\Temp\vcredist2013_x86_000_vcRuntimeMinimum_x86.log.enc"2⤵PID:1964
-
-
C:\Windows\system32\certutil.execertutil -encode "C:\vcredist2013_x86_001_vcRuntimeAdditional_x86.log" "C:\Users\Admin\AppData\Local\Temp\vcredist2013_x86_001_vcRuntimeAdditional_x86.log.enc"2⤵PID:2732
-
-
C:\Windows\system32\certutil.execertutil -encode "C:\vcredist2022_x64_000_vcRuntimeMinimum_x64.log" "C:\Users\Admin\AppData\Local\Temp\vcredist2022_x64_000_vcRuntimeMinimum_x64.log.enc"2⤵PID:2432
-
-
C:\Windows\system32\certutil.execertutil -encode "C:\vcredist2022_x64_001_vcRuntimeAdditional_x64.log" "C:\Users\Admin\AppData\Local\Temp\vcredist2022_x64_001_vcRuntimeAdditional_x64.log.enc"2⤵PID:2180
-
-
C:\Windows\system32\certutil.execertutil -encode "C:\vcredist2022_x86_001_vcRuntimeMinimum_x86.log" "C:\Users\Admin\AppData\Local\Temp\vcredist2022_x86_001_vcRuntimeMinimum_x86.log.enc"2⤵PID:2472
-
-
C:\Windows\system32\certutil.execertutil -encode "C:\vcredist2022_x86_002_vcRuntimeAdditional_x86.log" "C:\Users\Admin\AppData\Local\Temp\vcredist2022_x86_002_vcRuntimeAdditional_x86.log.enc"2⤵PID:2408
-
-
C:\Windows\system32\msg.exemsg * Your files have been encrypted Send $30 worth of Bitcoin to bc1q7ze0jx5ktwn8vyfw8cs2yzpcyks274fmh3ny2d to get the decryption key.2⤵PID:2428
-
-
C:\Windows\system32\timeout.exetimeout /t 1800 /nobreak2⤵
- Delays execution with timeout.exe
PID:2484
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
500KB
MD58a515ea865af904ebbc045d18c7cfd89
SHA18c8e86b95a1ad25ea01b3166dfa7e01248f1cdd1
SHA2568a3aee3477d9498a87ccfbccde3e8bdb1ac04da3754aceead860eb06231f2a22
SHA512860ad00ec0f9b581518f4a9be265a3fee175ff42deb5330c6533e7e0191ce3e6b4cba8e74d904aadd4195c3339099aa5edb998612cb636d0940c1bf27a7e09e0
-
Filesize
118KB
MD5c7f58769c485348a99f8fcc98299656b
SHA1d9ba8d5a338d51f47b2cfa4d49961ab8eda8758b
SHA256b48fd9e9d60efe616ca6dea1d48764761b3ded13fe8ee757ce423f1b08f3d7aa
SHA512bbab349ec2b47578e6f0ac214a1cd8aeaebc027914d60ac2f97bd8d40d1de58c099aacea7584d05c7d97baea70baad334f1325b8033b6fb32a1dd2e9081ae660
-
Filesize
521KB
MD5a8440f83df9ad13a8b4fa39017d1cbd9
SHA151fa8649497f0271b58bd01d84e80b39594f325e
SHA2561405e8fb4fe718d6f5f73d6f3637cd615da753443584df9546651b9f4fd486af
SHA51217d3ce93d81b8b521ce62d145b17a4cb22773ca36f934e59b879586a19217b90a2e0bb108c96a50bfc15f2705203b6b6bdd1fdcf505a9e6eb005edff0ec2b16c
-
Filesize
112KB
MD583a9d74e3e6f4bfe3cdf6d0e6759ad3a
SHA197da8caa36345a116a3cec96972249db0e2a95a7
SHA25616ac46286efd69bc3d0eb0526231f32a8badc17df0babc785908b690d90cbc24
SHA512ea7a4de5ae49681fd877a23cd96471978460432fac3472eeca0bb1f53dd91dd10668eb7b45580ba42d9ff5218d7f511af5d64ff61179ec29fe1ad2f15541a0d1
-
Filesize
227KB
MD537012fd75a58eb686c03e2d96346fa65
SHA1ab772c9a7db6f25c84fc6fd5bf8217a0bfe3359b
SHA256bd1bedaba7519049d0e04eb9f5926277a852388c3b5b85579e0b4d9c36c7689c
SHA51291eea41128b88a389d4832009ef3876709d4ca26330d9b822bd65a708894daf98002267f477c6d9fc9c1bc9895592cb4e9201f36f1e97a57570a4796aeedc919
-
Filesize
265KB
MD516abaf8141384715c1e3ca559fd6e615
SHA19ef55e90415afb1f3286438f7affc9330b2598a8
SHA2562f9bc60e83ff0bb12214fea7b733f892dea4f670e5395d35a0788e0554a4ed8d
SHA512fe7063c215de8de879fa4c17f1aa0133e958124e99e02cf984362ec4b31df94112f50e17a792ad40d2eb3fc8d9ac71f70ba217f37c7b9baa5ca3cd1cee17a837
-
Filesize
11KB
MD5a0c151ff3b3ca3bb6dbe4f0f2befc15e
SHA15dcc927ab09c37324ede056574fa9de56a92079c
SHA2561379041c5a979d753b0b27f23c7a93a214036e645545f1592cde3b8f467647a3
SHA5120bd074374cd83e34664acccb09dae66b7042d735b74b9596b31aecd15d5e6034613cdd9be7f7dfe4832f4abe1db3651832c7a69b4100efb74388ef59924b1106
-
Filesize
232KB
MD5d78d8ab98a5059cdfb2cf765dccf7b24
SHA1c2ec3a7d3d5a9ac4959a427a037652916d89f2fd
SHA256a58e40ae67e262d92daf781018da1f89417ee8045b4e8b2dc8bf35ce2b364b37
SHA51267861557101a604412c311f8638510aa5e6963a8f98f7f2fa28f34cf4e0656eef492aa6f074ccc9503eaf1ce79fad93819a340b53525d0f071852a88c956060b
-
Filesize
283KB
MD5773d117a50a26c13d894bf3366e9f6bd
SHA1cee761df3ae063fa4cabaeb0c7e3fc83f4bf7b67
SHA256531a689c5798008cd9349be04eb7c91c3aa400381d4365d7906de44c9075d399
SHA5129b926bff37438835c42fb3c97cef4abc0f1e15f382401c3a8690d5bdd30de48a0d9aafcf7ca1da0475189af2e5b0bb98c131a3b2f5ba8f6b86d4552cec644e63
-
Filesize
230KB
MD5a6d2d3d5721365f19e21e687ae982b00
SHA185108550e0075e0251f6e3ae67d89f804c9936f2
SHA256f752ff974ac3f2d1f6b5d17f2b1b4323f53b5e634326e5bd14a80552125a3755
SHA512159a15506712e42935c07a1b37a448791e69a567325de85291cefbf53bdb04e070490d5b5c2705f3b8bf2a5d34a709ed55f0d97d333b4501090f05cc6df4828c
-
Filesize
259KB
MD5da5429de7407550d6966e634f729ff27
SHA1de39eb07e2a2d5071af0038680307c71560202eb
SHA2568f10cea838159e0ccf32190363699de9e079ee79158d3dd01e289813232666fd
SHA512b3d740ba4d9f57a0160e6de39645de5be26052e9bd341b075fff4b85a826317734bd848d4bc83fca084e1e88b3f47c19bd7116c5666bce56a18a2a1392aa4e37
-
Filesize
231KB
MD503a9cb95a3f832f8c06338c6096fe266
SHA1336797d3365eb75b7be6d71238a2049c098f18d9
SHA25677e3f9765e072449ab7c18d66ced801319674707ff3f9c5ec1e2981b8c613fb4
SHA51270d3ae92d84a362233638c748156a00d40ee7d30780696bd26dd639106e44a954c72c3c56037bae95e384c9523b4b129cbdbcee9c9334f4fb3c5043b11909b4e
-
Filesize
270KB
MD5743bc0b32072191b8f84c4390b608313
SHA11056043a895aed280de6fe144dccac6c5e52c391
SHA2565b9c250c04558eccb307e79176962fda89ded39f7e1a351ebca6b607e9aea1e7
SHA51299e4dfe7b2d334fbde34d8c15ead24f90cee6688b3fa787c4d0f6df9554c0f99060c1db0aed737c3f533b7e9f80bd13534d26dcdf297cfa3ed9930407f612336
-
Filesize
166KB
MD524c8e85f48991cc1a4f348b998b5f7c5
SHA1c6d721c8c090b72389fa98dd5b5a8e9258523e7f
SHA2566800c30a21f35e9371545ff848836068d4bd158b8af093937126279dce6bf64a
SHA51295806e6060821c20758248f63214292e128ae3154570f7b832e569f24797bd7f5eb99f210fcedef37b6bd5fa383efe1a4f011a8ba63330d1a417daa4c4ca9740
-
Filesize
175KB
MD575ec11619fbd9721c59e90da78f21bd6
SHA128d6e997b0f9912c78f11fffaa2c71384f4478f4
SHA25651e84f040c69d329af266baa217e5841416967541b2d04b61e7fb27904337331
SHA51252babe236ea73b6c2a5196640d40bfc27d7feb767dbd22832ce0ff55acab176ef1a0841c9bdda99461087cf101f238281f103d0b41346f10d505d189b02b01d6
-
Filesize
166KB
MD5438700651599331d92049041792d74ef
SHA1fb2bed554a51e31ee9a666d2c7575ae1d28a1c2d
SHA25694119b77be3a327f8538af419e27b6ea75958e97580ceb70e34ada9e2b28ac8b
SHA512859b9823ed7bc0773c3dd88e82834c37e65b905600fae5f102325d7b6955d9cd3cf02d90437b23a4924911b15383684fe03b33fb679f191f7d7d6777ff44cab7
-
Filesize
183KB
MD5906190c27d1b5e421d04016c7c9f5822
SHA15bf65af2ae14f0b32ea005be700d4930e16d6203
SHA25690edaf65c7cb061774a3dc6e527c80c96d6555aaae7d453afb9249bbcc7e1536
SHA5125bf31ca2b88809956a9254415d319d19aefae877c5ea2ed173d28c766c365f81fef7f36210372a1ddb426be20619f16da4e07ef2f818fcca2e5b17528c577217