Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    118s
  • max time network
    147s
  • platform
    windows7_x64
  • resource
    win7-20240221-en
  • resource tags

    arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
  • submitted
    15/03/2024, 21:43

General

  • Target

    ransomwares/InfinityCrypt/InfinityCrypt.exe

  • Size

    211KB

  • MD5

    b805db8f6a84475ef76b795b0d1ed6ae

  • SHA1

    7711cb4873e58b7adcf2a2b047b090e78d10c75b

  • SHA256

    f5d002bfe80b48386a6c99c41528931b7f5df736cd34094463c3f85dde0180bf

  • SHA512

    62a2c329b43d186c4c602c5f63efc8d2657aa956f21184334263e4f6d0204d7c31f86bda6e85e65e3b99b891c1630d805b70997731c174f6081ecc367ccf9416

  • SSDEEP

    1536:YoCFfC303p22fkZrRQpnqjoi7l832fbu9ZXILwVENbM:rCVC303p22sZrRQpnviB832Du9WMON

Malware Config

Signatures

  • InfinityLock Ransomware

    Also known as InfinityCrypt. Based on the open-source HiddenTear ransomware.

  • Drops file in Program Files directory 64 IoCs
  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\ransomwares\InfinityCrypt\InfinityCrypt.exe
    "C:\Users\Admin\AppData\Local\Temp\ransomwares\InfinityCrypt\InfinityCrypt.exe"
    1⤵
    • Drops file in Program Files directory
    • Checks processor information in registry
    • Suspicious use of AdjustPrivilegeToken
    PID:2084

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Program Files (x86)\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\BrightYellow\TAB_OFF.GIF.224E0A0F22B55426959D5C835814CD88907CE3F9EABCF17907C4078FD23C5792

    Filesize

    352B

    MD5

    773a05228980894adce048dd56f865b9

    SHA1

    d67d16841f7f7f0848a57702a304c492ffa920ab

    SHA256

    bc2e5de6eb1de540081a806e05d1a3c4ffd4d8d249312ccffad708f1175b3dda

    SHA512

    aa762abfe03299f3a69636f00b608f44cd1ce8c7b594fc9df39dbcb2036993e9f1199a74cced6856db5e036269d46523596c64a40533e150b79f3d3825a8ed1c

  • C:\Program Files (x86)\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\BrightYellow\TAB_ON.GIF.224E0A0F22B55426959D5C835814CD88907CE3F9EABCF17907C4078FD23C5792

    Filesize

    224B

    MD5

    455a95137e907aef6efb1992b13a69e7

    SHA1

    b5c4c2001de000b22f51aa14b4ad7a0c9bcf76a7

    SHA256

    d042c848e337a71da5d6bcdce3971925ca84f8cdd46dc723a0e2436911f11c58

    SHA512

    0988ec981ef3fe646659aa382f8009ff86d0031acf5675a00dae210996c7671cbd6270b2e96306feb1b331f8a6d1bf5bff21cd6f46e40987e0a6f39e9cb06c8a

  • C:\Program Files (x86)\Microsoft Office\Office14\1033\INFOPATH_F_COL.HXK.224E0A0F22B55426959D5C835814CD88907CE3F9EABCF17907C4078FD23C5792

    Filesize

    128B

    MD5

    71a4b849e9902bc075ce6b455e905151

    SHA1

    3d881c8b70277ef265a45b879e2ae2b57287b271

    SHA256

    3b9a982a59538485183b99702d883a6643ca031fb429166e6439c84a6c838b47

    SHA512

    91dc8b308bce2e824d852edc918ceb6b5592bb760e24d0a314d80cda4683c6bc8305e8a956f131317834531244c9879f2f00f0276430459db8a06519ce280346

  • C:\Program Files (x86)\Microsoft Office\Office14\1033\INFOPATH_K_COL.HXK.224E0A0F22B55426959D5C835814CD88907CE3F9EABCF17907C4078FD23C5792

    Filesize

    128B

    MD5

    891205e848b5a72f6668eff589af9e25

    SHA1

    3d2af432130199f344e897624a7b0c58e55a8ac2

    SHA256

    3bea55c1cbd046e59c972e60f3f02c79b22addae2277a8e02ea6ad0797beeabd

    SHA512

    00a07675b7d7c584c4dc8b443bedae289b7bc8c5184fb5464a2cf120e3e935c11bda17210eb1d63810f4747bf8ca877fc3be57ac4f041a7722abf735651a6564

  • C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\BabyBlue\BUTTON.GIF.224E0A0F22B55426959D5C835814CD88907CE3F9EABCF17907C4078FD23C5792

    Filesize

    192B

    MD5

    1aa5aca8b232fd1f0f76980adf8aba3f

    SHA1

    7ff65bf388a3042db182d9a6bd52c8db0638d49c

    SHA256

    7f7a66c80032c9c6ac8dad68186f834af0a12efb61cd4bdeb6b4349b10acea0d

    SHA512

    fc064b2cd8329aed66064dc84b5b2fccf42249f6396fcb6ba3852443cfc6d37da10c4d785e0f7fed69d3c892467e67a5d1c259e8669c500ce6351d19ede1550c

  • C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\Desert\TAB_OFF.GIF.224E0A0F22B55426959D5C835814CD88907CE3F9EABCF17907C4078FD23C5792

    Filesize

    512B

    MD5

    014d5f6b811476a438b74aabd158fbb4

    SHA1

    64a163fd9075c0054fa849d3a1fb3895fe972494

    SHA256

    b82239e172fcd4b189b443b8bb3182a19e90ab77e54b601f1fc0f095ffad9a2f

    SHA512

    658ff306ffcc97c7258fc9fae273c4bc875d62d43a6b6498fe44229a358d7e62c275438eca8e38d5438d1b0cb6e5d873e482730b9f37607bb63f24846e2dc40f

  • C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\Desert\TAB_ON.GIF.224E0A0F22B55426959D5C835814CD88907CE3F9EABCF17907C4078FD23C5792

    Filesize

    1KB

    MD5

    76022f0027c29e3287d6a89a3d1e460f

    SHA1

    da77a4dcb4a3ce0743b32aaaa6f79d0f5ae77636

    SHA256

    6bf207678bb1ed2dd35915b5ae2ef294cfa8059daf317c4046ac114ef1b7c5a3

    SHA512

    dbbf9cb87ec549f5944b0ccf2eff20295fc39b9bf000204fff3f9c20400bc7a42ef631b28e3af0d91c419679f0970021782926ccc6623ad12c276c693f8f70fb

  • C:\Program Files (x86)\Microsoft Office\Office14\OutlookAutoDiscover\YAHOO.NO.XML.224E0A0F22B55426959D5C835814CD88907CE3F9EABCF17907C4078FD23C5792

    Filesize

    816B

    MD5

    bd39cedc709c44513d5d9d1b38f719f6

    SHA1

    cabed2760b3d648f57897892b8ca557e635fe355

    SHA256

    2fc20d9a5a5ba2384290d4bc815d33f74525233afe06a1d191e9948ddde5f560

    SHA512

    f1f5ae77e0ec1bd966b90ca535b6f23c82a7f365f50b3402c70b3296f5419a5f61ed6280d7590411edbe61b4b806785f818edb938203efcdb226d6574e1d67b5

  • memory/2084-3096-0x0000000074900000-0x0000000074FEE000-memory.dmp

    Filesize

    6.9MB

  • memory/2084-3293-0x0000000004E50000-0x0000000004E90000-memory.dmp

    Filesize

    256KB

  • memory/2084-0-0x00000000011D0000-0x000000000120C000-memory.dmp

    Filesize

    240KB

  • memory/2084-2-0x0000000004E50000-0x0000000004E90000-memory.dmp

    Filesize

    256KB

  • memory/2084-1-0x0000000074900000-0x0000000074FEE000-memory.dmp

    Filesize

    6.9MB

  • memory/2084-5321-0x0000000004E50000-0x0000000004E90000-memory.dmp

    Filesize

    256KB