Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

10

Static

static

10

1c72875191...e4.exe

windows7-x64

10

1c72875191...e4.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    119s
  • max time network
    124s
  • platform
    windows7_x64
  • resource
    win7-20240221-en
  • resource tags

    arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
  • submitted
    14/05/2024, 04:14

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    1c72875191a80e6e69d6e6c2edda738ad206767979851cfbb18dc0398ea191e4.exe

  • Size

    136KB

  • MD5

    ce1eefe48010f4946cf45ffd6c4bebfa

  • SHA1

    18522badae740c53c22b0b05f58a233d390caab6

  • SHA256

    1c72875191a80e6e69d6e6c2edda738ad206767979851cfbb18dc0398ea191e4

  • SHA512

    9c021178294d28a5cb83732a99c5d8bc5dc375c716895ef1aa53df24af45b01bb221029fede634e72ca2e3c3711d5f992f181820c35a80fa315db4231ddb4ff8

  • SSDEEP

    1536:Nxd+ReKXU/MQaL7k0B/L7s+Zi+GrZxtQpfyHvtICS4A4UdZls8XzUXiWr4X5F4GC:NtchTojrZxtMhiiZHjUyWr4X5FTDU

Score
10/10
evasionransomware

Malware Config

Extracted

Path

C:\Users\oreh4i-readme.txt

Ransom Note
---=== Welcome. Again. ===--- [-] Whats HapPen? [-] Your files are encrypted, and currently unavailable. You can check it: all files on your system has extension oreh4i. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practice - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/DE9B6522CECF0BF4 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decoder.re/DE9B6522CECF0BF4 Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: ml0wH1SsdFBZfJ5SVWzvskOpGky84/5ATYnAyq2x0QinSlZx9ziHosqI3ZinE8XY GIS86AKGLMZPAsTgLoNZk1WxTXyD25xcs+WGxpZYNf47N2bMjJoFIBTeiHPfoPIz kaTtxh/dn8Z5NG3Y8GogTp3b7zkN3A23lX/ey7fZOTGumTCinfedFEHg0v3691LI uZk21eVaL7DYQpGyM1VdwxCIjdceokH2nWv6w0kFp74PCqUyP0qjZfhHKOP1papn uNGaJ/RrTVhthZIKqTphelIYjDPomVMxGLWaLsmfPBfkSeJ2U4bHuXs4j6rSMlkB +B0kWHiIjtchSiEiywZ9iiYnEE4ZeLfqZo7rQomM4f7T3G02b+XWO6n0NvQV6z+y n78y7EK6Sm1B4mIrZai5+qHCsZXM5KZV+Wbw/eqfmIZ/JHESo0K5/LHEzN1a/eNE WXuM0N6vf77I0mVg+PfvdLwswK5aGtTEqOVey6n/xD1meyavvTuHhrVhI3VWJzZp sdlACF6nlCmdXTtojdIsJUObKnJniN4C/ZCyqiW2ThVPQ4ow9luv4LaY1B+SNVTW ljvSadGztBLfXF5xbqKaNPuh8ch9oEmcIC2IyBqR3Etl81V2l9GS9PCF+fjCKlwe 9Lx6fzyqr1HfcNuMVIAYhSk3c9mJra8+M+OyEWHG4xJbDPBHpEAYuGEi4GPUXycE L6PGG4bHIPxUwB3z+qtDJl9psqGqR6pjlVRmh1aG7FoxG5hSEN5jtuR9i+HnYc35 gK6FQDmY/AWAWw6hdyJf0Ka5CA3CWHeAlc5UdPV3TWlrSQoGPLSNI5INvtxbadIP Ndz88XD728tAPAE40k03KbxC+Ec+PAfh15KfHzSn9TN5PDlqeIQiyMIkZnkXKsJV Wd5Kbfkv9OlNSwBc/DmumztNzTzDlIQM+foz2Whw1Et+IugETP2lQ3iGe2tF+08m IJeZjKdtl0/gWK6+mUUIz+RIsE5EInTpn2eYNFa9YJDyCTYqm4XmCmFaXu5LsDL8 k3UeSYULIYltDpQVsOtt8P8RSBwDqQ+XI3D/S6rPmybcAqzAPxIc8SgK8CDCJ7r7 hohYqXwB5ecQUeM+ouBDuhIOBaDnUxeIuy81i7iawCIAsNJeKZDC6liTx27rSewm QeNrFd4o+cmH0GIjNt9YugKfFl4kRtKWsGIC1eYnG7MVthxIcQQt/vgOb8zhG0ds 6nv3u3QxlN3zvK7KCQOtpqBKjc3uJnI1cHo060tYhaCoZuqqE7mgedz0LpDYpBcG rI+YBAXkExGd3JMJ1U41uvwcgKBDW5og9aeWT4WBKKxWwk4EjQBsDdK0FuxZJyc+ LzOHIakqyFPW6UJ4E/IzrlYtoFWa6w== ----------------------------------------------------------------------------------------- !!! DANGER !!! DON'T try to change files by yourself, DON'T use any third party software for restoring your data or antivirus solutions - its may entail damage of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!
URLs

http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/DE9B6522CECF0BF4

http://decoder.re/DE9B6522CECF0BF4

Signatures

  • Modifies Windows Firewall 2 TTPs 1 IoCs
    evasion
  • Enumerates connected drives 3 TTPs 25 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Sets desktop wallpaper using registry 2 TTPs 1 IoCs
    ransomware
  • Drops file in Program Files directory 27 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious behavior: EnumeratesProcesses 5 IoCs
  • Suspicious use of AdjustPrivilegeToken 5 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware

Processes

  • C:\Users\Admin\AppData\Local\Temp\1c72875191a80e6e69d6e6c2edda738ad206767979851cfbb18dc0398ea191e4.exe
    "C:\Users\Admin\AppData\Local\Temp\1c72875191a80e6e69d6e6c2edda738ad206767979851cfbb18dc0398ea191e4.exe"
    1⤵
    • Enumerates connected drives
    • Sets desktop wallpaper using registry
    • Drops file in Program Files directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:2812
    • C:\Windows\SysWOW64\netsh.exe
      netsh advfirewall firewall set rule group="Network Discovery" new enable=Yes
      2⤵
      • Modifies Windows Firewall
      PID:2248
  • C:\Windows\system32\wbem\unsecapp.exe
    C:\Windows\system32\wbem\unsecapp.exe -Embedding
    1⤵
      PID:1492
    • C:\Windows\system32\vssvc.exe
      C:\Windows\system32\vssvc.exe
      1⤵
      • Suspicious use of AdjustPrivilegeToken
      PID:828

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\oreh4i-readme.txt
      Filesize

      6KB

      MD5

      3e03be3491237a87a39a988109f74da8

      SHA1

      c31144fa9633c44bf005b94c76c125d759bb6328

      SHA256

      a0da750c747468ac4161ac8585e93f864e0792ae195d1d5329b80d15dba35d86

      SHA512

      f2bf156361c03adee0bb58c00a045cc4d6c8c5785a9d5636b02a787fe491ed0527b9d7d29bb26e75d5a556dd63812a6394a0bd9526d089cc5521121436aaae62

      Download Submit