Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    150s
  • max time network
    122s
  • platform
    windows7_x64
  • resource
    win7-20240221-en
  • resource tags

    arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
  • submitted
    09/03/2024, 04:54

General

  • Target

    2024-03-09_c54566c34316dbefd0d344311b24a766_ransomlock.exe

  • Size

    1.3MB

  • MD5

    c54566c34316dbefd0d344311b24a766

  • SHA1

    2bf940e1a7773ba76a55a32be936fa513eeb9b34

  • SHA256

    aac15814aec66587435c8e2abc6431ba09300e94de72ae94a8b60f6efad0876b

  • SHA512

    76939f6cf240d31022961d338995567584c067447356dd01f77689e253c5c1e0514038b8bba6b8ef91a4f79357bccb96632e3e5e5b03adb21ee8c6ea60d01e20

  • SSDEEP

    24576:DwxPanDWDAxfy+t4g6cBLi2iYQOlbBTAIUC:8xPpWTjPJplVTjUC

Malware Config

Signatures

  • UAC bypass 3 TTPs 1 IoCs
  • Detects executables embedding registry key / value combination indicative of disabling Windows Defender features 17 IoCs
  • Sets file execution options in registry 2 TTPs 12 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • Checks whether UAC is enabled 1 TTPs 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Creates scheduled task(s) 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 15 IoCs
  • System policy modification 1 TTPs 3 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

Processes

  • C:\Users\Admin\AppData\Local\Temp\2024-03-09_c54566c34316dbefd0d344311b24a766_ransomlock.exe
    "C:\Users\Admin\AppData\Local\Temp\2024-03-09_c54566c34316dbefd0d344311b24a766_ransomlock.exe"
    1⤵
    • UAC bypass
    • Sets file execution options in registry
    • Adds Run key to start application
    • Checks whether UAC is enabled
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: GetForegroundWindowSpam
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    • System policy modification
    PID:2224
    • C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe" /c schtasks /create /tn "GoogleUpdateTaskMachineUK" /sc MINUTE /mo 1 /tr "C:\Users\Admin\AppData\Local\Temp\2024-03-09_c54566c34316dbefd0d344311b24a766_ransomlock.exe" /rl HIGHEST /f
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:2140
      • C:\Windows\system32\schtasks.exe
        schtasks /create /tn "GoogleUpdateTaskMachineUK" /sc MINUTE /mo 1 /tr "C:\Users\Admin\AppData\Local\Temp\2024-03-09_c54566c34316dbefd0d344311b24a766_ransomlock.exe" /rl HIGHEST /f
        3⤵
        • Creates scheduled task(s)
        PID:2096
  • C:\Users\Admin\AppData\Local\Temp\2024-03-09_c54566c34316dbefd0d344311b24a766_ransomlock.exe
    C:\Users\Admin\AppData\Local\Temp\2024-03-09_c54566c34316dbefd0d344311b24a766_ransomlock.exe explorer.exe
    1⤵
      PID:2896
    • C:\Windows\system32\taskeng.exe
      taskeng.exe {CEB2BFC8-B907-41E6-8D06-E160ACCD5421} S-1-5-21-2297530677-1229052932-2803917579-1000:HKULBIBU\Admin:Interactive:[1]
      1⤵
      • Suspicious use of WriteProcessMemory
      PID:2700
      • C:\Users\Admin\AppData\Local\Temp\2024-03-09_c54566c34316dbefd0d344311b24a766_ransomlock.exe
        C:\Users\Admin\AppData\Local\Temp\2024-03-09_c54566c34316dbefd0d344311b24a766_ransomlock.exe
        2⤵
          PID:1952
        • C:\Users\Admin\AppData\Local\Temp\2024-03-09_c54566c34316dbefd0d344311b24a766_ransomlock.exe
          C:\Users\Admin\AppData\Local\Temp\2024-03-09_c54566c34316dbefd0d344311b24a766_ransomlock.exe
          2⤵
            PID:2408

        Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • memory/1952-98-0x0000000000230000-0x0000000000231000-memory.dmp

          Filesize

          4KB

        • memory/1952-99-0x0000000000400000-0x0000000000593000-memory.dmp

          Filesize

          1.6MB

        • memory/2224-108-0x0000000000400000-0x0000000000593000-memory.dmp

          Filesize

          1.6MB

        • memory/2224-133-0x0000000000400000-0x0000000000593000-memory.dmp

          Filesize

          1.6MB

        • memory/2224-42-0x0000000000400000-0x0000000000593000-memory.dmp

          Filesize

          1.6MB

        • memory/2224-47-0x00000000001C0000-0x00000000001C1000-memory.dmp

          Filesize

          4KB

        • memory/2224-68-0x0000000000400000-0x0000000000593000-memory.dmp

          Filesize

          1.6MB

        • memory/2224-87-0x0000000000400000-0x0000000000593000-memory.dmp

          Filesize

          1.6MB

        • memory/2224-297-0x0000000000400000-0x0000000000593000-memory.dmp

          Filesize

          1.6MB

        • memory/2224-278-0x0000000000400000-0x0000000000593000-memory.dmp

          Filesize

          1.6MB

        • memory/2224-0-0x00000000001C0000-0x00000000001C1000-memory.dmp

          Filesize

          4KB

        • memory/2224-23-0x0000000000400000-0x0000000000593000-memory.dmp

          Filesize

          1.6MB

        • memory/2224-152-0x0000000000400000-0x0000000000593000-memory.dmp

          Filesize

          1.6MB

        • memory/2224-171-0x0000000000400000-0x0000000000593000-memory.dmp

          Filesize

          1.6MB

        • memory/2224-190-0x0000000000400000-0x0000000000593000-memory.dmp

          Filesize

          1.6MB

        • memory/2224-215-0x0000000000400000-0x0000000000593000-memory.dmp

          Filesize

          1.6MB

        • memory/2224-259-0x0000000000400000-0x0000000000593000-memory.dmp

          Filesize

          1.6MB

        • memory/2224-234-0x0000000000400000-0x0000000000593000-memory.dmp

          Filesize

          1.6MB

        • memory/2408-225-0x0000000000400000-0x0000000000593000-memory.dmp

          Filesize

          1.6MB

        • memory/2408-224-0x0000000000230000-0x0000000000231000-memory.dmp

          Filesize

          4KB

        • memory/2896-11-0x0000000000230000-0x0000000000231000-memory.dmp

          Filesize

          4KB

        • memory/2896-12-0x0000000000400000-0x0000000000593000-memory.dmp

          Filesize

          1.6MB