Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

10

Static

static

3

d6629a9b61...08.iso

windows7-x64

10

d6629a9b61...08.iso

windows10-2004-x64

10

Analysis

  • max time kernel
    150s
  • max time network
    152s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240508-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
  • submitted
    03/06/2024, 09:23

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    d6629a9b618ede05e9e75a2cebfb69bc7b1a34fe00a42ff60d88828a307c0d08.iso

  • Size

    544KB

  • MD5

    d201bd19e60d500963aff0c235b07727

  • SHA1

    341552a8650d2bdad5f3ec12e333e3153172ee66

  • SHA256

    d6629a9b618ede05e9e75a2cebfb69bc7b1a34fe00a42ff60d88828a307c0d08

  • SHA512

    4afa7da1bf2a86dc9a3b94b674ecffea638304c42c43c955631bbe29c605be673b7182ed1fcb8997c55c6bbd2a48e5ec46177e8327e9e903781d1ffb2abd991c

  • SSDEEP

    6144:h0wmbI4/Z4SHvrxw6zaIST1w9wEPDasWxxsBhS37b8o6XCFyPwCMa6qnXxq/y:Gzv66zaISTW9asWxxAh4IlXC4PUqBq/

Score
10/10
targetcompanyevasionexecutionransomware

Malware Config

Extracted

Path

\Device\HarddiskVolume1\HOW TO BACK FILES.txt

Ransom Note
Hello Your data has been stolen and encrypted We will delete the stolen data and help with the recovery of encrypted files after payment has been made Do not try to change or restore files yourself, this will break them We provide free decryption for any 3 files up to 3MB in size on our website How to contact with us: 1) Download and install TOR browser by this link: https://www.torproject.org/download/ 2) If TOR blocked in your country and you can't access to the link then use any VPN software 3) Run TOR browser and open the site: wtyafjyhwqrgo4a45wdvvwhen3cx4euie73qvlhkhvlrexljoyuklaad.onion/mallox/privateSignin 4) Copy your private ID in the input field. Your Private key: C20BBF8E22A6E8D22DF798B4 5) You will see chat, payment information and we can make free test decryption here Our blog of leaked companies: wtyafjyhwqrgo4a45wdvvwhen3cx4euie73qvlhkhvlrexljoyuklaad.onion �
URLs

http://wtyafjyhwqrgo4a45wdvvwhen3cx4euie73qvlhkhvlrexljoyuklaad.onion/mallox/privateSignin

http://wtyafjyhwqrgo4a45wdvvwhen3cx4euie73qvlhkhvlrexljoyuklaad.onion

Signatures

  • TargetCompany,Mallox

    TargetCompany (aka Mallox) is a ransomware which encrypts files using a combination of ChaCha20, AES-128, and Curve25519, first seen in June 2021.

    ransomwaretargetcompany
  • Modifies boot configuration data using bcdedit 1 TTPs 4 IoCs
    ransomwareevasion
  • Renames multiple (6514) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

    ransomware
  • Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

    Run Powershell and hide display window.

    execution
  • Checks computer location settings 2 TTPs 2 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 2 IoCs
  • Enumerates connected drives 3 TTPs 24 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Looks up external IP address via web service 1 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Drops file in Program Files directory 64 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Modifies registry class 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 9 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 2 IoCs
  • Suspicious use of WriteProcessMemory 18 IoCs
  • System policy modification 1 TTPs 3 IoCs
    evasion

Processes

  • C:\Windows\system32\cmd.exe
    cmd /c C:\Users\Admin\AppData\Local\Temp\d6629a9b618ede05e9e75a2cebfb69bc7b1a34fe00a42ff60d88828a307c0d08.iso
    1⤵
    • Modifies registry class
    • Suspicious use of AdjustPrivilegeToken
    PID:1588
  • C:\Windows\System32\rundll32.exe
    C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
    1⤵
      PID:1192
    • C:\Program Files\7-Zip\7zFM.exe
      "C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\AppData\Local\Temp\d6629a9b618ede05e9e75a2cebfb69bc7b1a34fe00a42ff60d88828a307c0d08.iso"
      1⤵
      • Suspicious behavior: GetForegroundWindowSpam
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of FindShellTrayWindow
      PID:4660
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -w hidden -command start red.exe "1"
      1⤵
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:4904
      • C:\Users\Admin\Desktop\red.exe
        "C:\Users\Admin\Desktop\red.exe" 1
        2⤵
        • Checks computer location settings
        • Executes dropped EXE
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        • System policy modification
        PID:4268
        • C:\Windows\System32\cmd.exe
          "C:\Windows\System32\cmd.exe" /c bcdedit /set {current} bootstatuspolicy ignoreallfailures
          3⤵
          • Suspicious use of WriteProcessMemory
          PID:4636
          • C:\Windows\system32\bcdedit.exe
            bcdedit /set {current} bootstatuspolicy ignoreallfailures
            4⤵
            • Modifies boot configuration data using bcdedit
            PID:4372
        • C:\Windows\System32\cmd.exe
          "C:\Windows\System32\cmd.exe" /c bcdedit /set {current} recoveryenabled no
          3⤵
          • Suspicious use of WriteProcessMemory
          PID:2088
          • C:\Windows\system32\bcdedit.exe
            bcdedit /set {current} recoveryenabled no
            4⤵
            • Modifies boot configuration data using bcdedit
            PID:4936
    • C:\Users\Admin\Desktop\red.exe
      "C:\Users\Admin\Desktop\red.exe"
      1⤵
      • Checks computer location settings
      • Executes dropped EXE
      • Enumerates connected drives
      • Drops file in Program Files directory
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      • System policy modification
      PID:1060
      • C:\Windows\System32\cmd.exe
        "C:\Windows\System32\cmd.exe" /c bcdedit /set {current} bootstatuspolicy ignoreallfailures
        2⤵
        • Suspicious use of WriteProcessMemory
        PID:2216
        • C:\Windows\system32\bcdedit.exe
          bcdedit /set {current} bootstatuspolicy ignoreallfailures
          3⤵
          • Modifies boot configuration data using bcdedit
          PID:3508
      • C:\Windows\System32\cmd.exe
        "C:\Windows\System32\cmd.exe" /c bcdedit /set {current} recoveryenabled no
        2⤵
        • Suspicious use of WriteProcessMemory
        PID:1056
        • C:\Windows\system32\bcdedit.exe
          bcdedit /set {current} recoveryenabled no
          3⤵
          • Modifies boot configuration data using bcdedit
          PID:2252

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Documents and Settings\Admin\Local Settings\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
      Filesize

      3KB

      MD5

      98f2bd054ee794188c9d78982b5bc4a9

      SHA1

      b8348efb577d250f2cc1988265a25a0302ddf0e3

      SHA256

      b1b43928560fb71e14c95836e96b6533d0d7fd1eaf0b65523e76f493414f9e71

      SHA512

      c856414d4a9667e3ae620a4c51df5b163e721df245af5184c55d37572304ee4dd2fd1d790efb37814c6f04fcec4bd8461bf0171971817bc1513baf10cb790264

      Download Submit

    • C:\Documents and Settings\Admin\Recent\CustomDestinations\d2905e77b2d1aac0.customDestinations-ms
      Filesize

      5KB

      MD5

      0b5e3e7f28b428068e2ee68779a5ace4

      SHA1

      77716ce25e77177b1204b53b0577a4e01a2d1a6d

      SHA256

      4c921f19a39fb95e8ed20e74b3e9ad50229c7f9f38bf3d008ed4f3fe4447ce61

      SHA512

      dcac0a18c7edfe585f01b084f475f8aac86b0225eca3836dba508565813cb261d252614ede978d162c7890e513a0574172b1de00d54a0ce833b7248cf44b2cd0

      Download Submit

    • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_yhzwx1xh.4is.ps1
      Filesize

      60B

      MD5

      d17fe0a3f47be24a6453e9ef58c94641

      SHA1

      6ab83620379fc69f80c0242105ddffd7d98d5d9d

      SHA256

      96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

      SHA512

      5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

      Download Submit

    • C:\Users\Admin\Desktop\Reader.lnk
      Filesize

      2KB

      MD5

      66bb9363e23c7ef2d16c89cd654b491e

      SHA1

      c20e8d536804cf97584eec93d9a89c09541155bc

      SHA256

      61f36c5ae038faa2b58a9a17b464d01414b4265e46634f353319c471d0a35789

      SHA512

      b7a751e49218230d574ca9cc4cbbb1995d89798268124b1617889c7558c66902f81fdb77a299edcc6d96452cec81adb76768172710e00c9272d30821ab0089c5

      Download Submit

    • C:\Users\Admin\Desktop\red.exe
      Filesize

      478KB

      MD5

      71efe7a21da183c407682261612afc0f

      SHA1

      0f1aea2cf0c9f2de55d2b920618a5948c5e5e119

      SHA256

      45a236e7aa80515aafb6c656c758faad6e77fb435b35bfa407aef3918212078d

      SHA512

      3cff597dbd7f0d5ab45b04e3c3731e38626b7b082a0ede7ab9a7826921848edb3c033f640da2cb13916febf84164f7415ca9ac50c3d927f04d9b61fcadb7801c

      Download Submit

    • \Device\HarddiskVolume1\HOW TO BACK FILES.txt
      Filesize

      910B

      MD5

      5888b20d7fc5d16555c5d7f18bb5d92e

      SHA1

      50cd96f988cc3ac399767296ddf07b8050e99a27

      SHA256

      cdcf517b57695aa656793de12b8de971493d460a6bf020bd6cfb84ac46159f2d

      SHA512

      9a4fd5edf870ba66ef5511acd092e87f2b031f2850af123dd2e0d429168fe8679621aba35762e9fde4b4dd4106ad865c39f2762780ab4876c10c043467cae1b3

      Download Submit

    • memory/4904-6-0x00000182EAC10000-0x00000182EAC32000-memory.dmp

      Filesize

      136KB

      Download