Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

10

Static

static

3

8e82636194...24.exe

windows7-x64

10

8e82636194...24.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    117s
  • max time network
    118s
  • platform
    windows7_x64
  • resource
    win7-20240221-en
  • resource tags

    arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
  • submitted
    09/03/2024, 14:12

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    8e826361942a80ad091ebd86b78d5cd66de8e65608a69a6f26b7a9b1ace99a24.exe

  • Size

    337KB

  • MD5

    5ffeb931b50e87b4916efeff6d5dfc5f

  • SHA1

    fffde47659b90a099808f72655ca479c9d808ba2

  • SHA256

    8e826361942a80ad091ebd86b78d5cd66de8e65608a69a6f26b7a9b1ace99a24

  • SHA512

    69303d78fb5072f24493832959b96e3450a5d977324895d4f38ee066b1ab047e58f645689b9937d600c3ec3ceb9eb13efd162bbd0dec1798231a21ffb7e519b7

  • SSDEEP

    6144:Z10d91SHBFBnJwsOE/4tHzhvN3zXPyWYoJulae92:Z7HBFBnOc/4tHddz/yLv

Score
10/10
targetcompanyevasionransomware

Malware Config

Extracted

Path

F:\HOW TO BACK FILES.txt

Family

targetcompany

Ransom Note
Hello Your files are encrypted and can not be used We have downloaded your confidential data and are ready to publish it on our blog To return your files in work condition you need decryption tool Follow the instructions to decrypt all your data Do not try to change or restore files yourself, this will break them If you want, on our site you can decrypt one file for free. Free test decryption allowed only for not valuable file with size less than 3MB How to get decryption tool: 1) Download and install TOR browser by this link: https://www.torproject.org/download/ 2) If TOR blocked in your country and you can't access to the link then use any VPN software 3) Run TOR browser and open the site: wtyafjyhwqrgo4a45wdvvwhen3cx4euie73qvlhkhvlrexljoyuklaad.onion/mallox/privateSignin 4) Copy your private ID in the input field. Your Private key: 74F705556938A276491EBF6C 5) You will see payment information and we can make free test decryption here 6)After payment, you will receive a tool for decrypting files, and we will delete the data that was taken from you Our blog of leaked companies: wtyafjyhwqrgo4a45wdvvwhen3cx4euie73qvlhkhvlrexljoyuklaad.onion If you are unable to contact us through the site, then you can email us: [email protected] Waiting for a response via mail can be several days. Do not use it if you have not tried contacting through the site.�
URLs

http://wtyafjyhwqrgo4a45wdvvwhen3cx4euie73qvlhkhvlrexljoyuklaad.onion/mallox/privateSignin

http://wtyafjyhwqrgo4a45wdvvwhen3cx4euie73qvlhkhvlrexljoyuklaad.onion

Signatures

  • TargetCompany,Mallox

    TargetCompany (aka Mallox) is a ransomware which encrypts files using a combination of ChaCha20, AES-128, and Curve25519, first seen in June 2021.

    ransomwaretargetcompany
  • Modifies boot configuration data using bcdedit 1 TTPs 2 IoCs
    ransomwareevasion
  • Renames multiple (2697) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

    ransomware
  • Loads dropped DLL 11 IoCs
  • Enumerates connected drives 3 TTPs 46 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Looks up external IP address via web service 1 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 12 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious behavior: EnumeratesProcesses 5 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of WriteProcessMemory 24 IoCs
  • System policy modification 1 TTPs 2 IoCs
    evasion

Processes

  • C:\Users\Admin\AppData\Local\Temp\8e826361942a80ad091ebd86b78d5cd66de8e65608a69a6f26b7a9b1ace99a24.exe
    "C:\Users\Admin\AppData\Local\Temp\8e826361942a80ad091ebd86b78d5cd66de8e65608a69a6f26b7a9b1ace99a24.exe"
    1⤵
    • Enumerates connected drives
    • Drops file in Program Files directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    • System policy modification
    PID:2272
    • C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe" /c bcdedit /set {current} bootstatuspolicy ignoreallfailures
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:2892
      • C:\Windows\system32\bcdedit.exe
        bcdedit /set {current} bootstatuspolicy ignoreallfailures
        3⤵
        • Modifies boot configuration data using bcdedit
        PID:2536
    • C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe" /c bcdedit /set {current} recoveryenabled no
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:2936
      • C:\Windows\system32\bcdedit.exe
        bcdedit /set {current} recoveryenabled no
        3⤵
        • Modifies boot configuration data using bcdedit
        PID:2600
  • C:\Windows\system32\msiexec.exe
    C:\Windows\system32\msiexec.exe /V
    1⤵
    • Loads dropped DLL
    • Enumerates connected drives
    • Drops file in Windows directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:1176
    • C:\Windows\syswow64\MsiExec.exe
      C:\Windows\syswow64\MsiExec.exe -Embedding ADE1538CA7A5FCBBE92218332E24B247
      2⤵
      • Loads dropped DLL
      PID:1844
    • C:\Windows\system32\MsiExec.exe
      C:\Windows\system32\MsiExec.exe -Embedding 96525174C789712727A7DA03C439A8BA
      2⤵
      • Loads dropped DLL
      PID:2872

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Windows\Installer\MSI1239.tmp
    Filesize

    257KB

    MD5

    d1f5ce6b23351677e54a245f46a9f8d2

    SHA1

    0d5c6749401248284767f16df92b726e727718ca

    SHA256

    57cb8f01cf553c3886760180d1a74839f2f676640115504485aca9692f577acc

    SHA512

    960e90894e7bedcc89894e77e57e8ee0c99dd2c530d02665e8bbd3a1793eccc1e295c5923d1f37c757fa1158097fbaae70898c16052882d3d210c29ea801b3ba

    Download Submit

  • C:\Windows\Installer\MSI12D6.tmp
    Filesize

    363KB

    MD5

    4a843a97ae51c310b573a02ffd2a0e8e

    SHA1

    063fa914ccb07249123c0d5f4595935487635b20

    SHA256

    727ecf287fb6f4953ee7748913dd559b4f8d3a022fa2ca55bc51cf5886c52086

    SHA512

    905c081552d95b523ecf1155b6c7e157652e5ff00cda30c1c21124d266eb7d305c3398d6832316f403dc45d1b639f1a5a67aea29922cd1a032f52e5247ec55d2

    Download Submit

  • C:\Windows\Installer\MSI1558.tmp
    Filesize

    28KB

    MD5

    85221b3bcba8dbe4b4a46581aa49f760

    SHA1

    746645c92594bfc739f77812d67cfd85f4b92474

    SHA256

    f6e34a4550e499346f5ab1d245508f16bf765ff24c4988984b89e049ca55737f

    SHA512

    060e35c4de14a03a2cda313f968e372291866cc4acd59977d7a48ac3745494abc54df83fff63cf30be4e10ff69a3b3c8b6c38f43ebd2a8d23d6c86fbee7ba87d

    Download Submit

  • C:\Windows\Installer\MSI15E6.tmp
    Filesize

    148KB

    MD5

    33908aa43ac0aaabc06a58d51b1c2cca

    SHA1

    0a0d1ce3435abe2eed635481bac69e1999031291

    SHA256

    4447faacefaba8f040822101e2a4103031660de9139e70ecff9aa3a89455a783

    SHA512

    d5216a53df9cfbe1a78629c103286eb17042f639149c46b6a1cd76498531ae82afd265462fbe0ba9baaff275fc95c66504804f107c449f3fc5833b1ed9c3da46

    Download Submit

  • F:\HOW TO BACK FILES.txt
    Filesize

    1KB

    MD5

    768365a6f2fd3c95ae64e723c02cc71d

    SHA1

    48ff0a97025839adf1eaef13395c8c7add7e56f7

    SHA256

    c109244ce1c69fc883f79ccdd0b319604456cbf9d2044d0c320bbffac61676ea

    SHA512

    046171f03946920aa40f5e66ea589ecd1a4db345ffe994b0444e1d87a77f6213733275144c39d88900ec308ff3d424be895814fdb187baf9f668b10a10b8bc09

    Download Submit

  • \Program Files\Common Files\Microsoft Shared\Filters\VISFILT.DLL
    Filesize

    2.0MB

    MD5

    90337628f1e989316f1347b71356276c

    SHA1

    a856f464469a08cadfea5a4dcad45ee80f06a74d

    SHA256

    02af0bc52cf2dda77f672a7e93099f4de511436ea3c3a2308d2bbe90788d06e3

    SHA512

    71dc61de5888ab4e642970928eb91a2e555ad9d538a7cbc09b12d8f0f268683d0c7ebf4fd5dca61db58b94edd397d75ec241885aef016d3ed1d8ecc27131c779

    Download Submit

  • \Windows\Installer\MSI16F1.tmp
    Filesize

    86KB

    MD5

    ff58cd07bf4913ef899efd2dfb112553

    SHA1

    f14c1681de808543071602f17a6299f8b4ba2ae8

    SHA256

    1afafe9157ff5670bbec8ce622f45d1ce51b3ee77b7348d3a237e232f06c5391

    SHA512

    23e27444b6cdc17fe56f3a80d6325c2be61ae84213bc7cdaad7bb96daa7e8d2d3defc1b96c3cee4a3f32dc464b0e05720bcf1c0e99626bf83de1b6d5aac000a3

    Download Submit