Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Overview
overview
7Static
static
3勒索12x ...e4.exe
windows7-x64
1勒索12x ...e4.exe
windows10-2004-x64
5勒索12x ...1b.exe
windows7-x64
1勒索12x ...1b.exe
windows10-2004-x64
3勒索12x ...13.exe
windows7-x64
3勒索12x ...13.exe
windows10-2004-x64
3勒索12x ...88.exe
windows7-x64
3勒索12x ...88.exe
windows10-2004-x64
3勒索12x ...30.exe
windows7-x64
6勒索12x ...30.exe
windows10-2004-x64
7勒索12x ...c0.exe
windows7-x64
1勒索12x ...c0.exe
windows10-2004-x64
3Analysis
-
max time kernel
93s -
max time network
134s -
platform
windows10-2004_x64 -
resource
win10v2004-20240709-en -
resource tags
arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system -
submitted
26/07/2024, 13:56
Static task
static1
Behavioral task
behavioral1
Sample
勒索12x 240726/1/19f80d6a588f3515d03eb9b8e0692baf1df7deeee827c2377e201ac0cadb78e4.exe
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
勒索12x 240726/1/19f80d6a588f3515d03eb9b8e0692baf1df7deeee827c2377e201ac0cadb78e4.exe
Resource
win10v2004-20240709-en
Behavioral task
behavioral3
Sample
勒索12x 240726/1/5f34856bdbb5dae28dfa973096be5fe30b69227c676c667f7e37f6451439d11b.exe
Resource
win7-20240708-en
Behavioral task
behavioral4
Sample
勒索12x 240726/1/5f34856bdbb5dae28dfa973096be5fe30b69227c676c667f7e37f6451439d11b.exe
Resource
win10v2004-20240709-en
Behavioral task
behavioral5
Sample
勒索12x 240726/1/9e98c9335528c966fbe9e11c53fdba7a7cd5c9760518df8e2563327f267ef813.exe
Resource
win7-20240708-en
Behavioral task
behavioral6
Sample
勒索12x 240726/1/9e98c9335528c966fbe9e11c53fdba7a7cd5c9760518df8e2563327f267ef813.exe
Resource
win10v2004-20240709-en
Behavioral task
behavioral7
Sample
勒索12x 240726/1/b6a29f656a71657d48b6db75e9b929da8358bc937cdfee714fa4f6111f286488.exe
Resource
win7-20240708-en
Behavioral task
behavioral8
Sample
勒索12x 240726/1/b6a29f656a71657d48b6db75e9b929da8358bc937cdfee714fa4f6111f286488.exe
Resource
win10v2004-20240709-en
Behavioral task
behavioral9
Sample
勒索12x 240726/1/b7fb0600b6c1bd7c8adafc5a2f4e9dee0afe1a0a5c219e44dbe92fcb39ab6930.exe
Resource
win7-20240705-en
Behavioral task
behavioral10
Sample
勒索12x 240726/1/b7fb0600b6c1bd7c8adafc5a2f4e9dee0afe1a0a5c219e44dbe92fcb39ab6930.exe
Resource
win10v2004-20240709-en
Behavioral task
behavioral11
Sample
勒索12x 240726/1/e7f04f0ee06f2addd4f33ecddfd4981d5f7a05f0a596d02acb630cb5377beac0.exe
Resource
win7-20240704-en
Behavioral task
behavioral12
Sample
勒索12x 240726/1/e7f04f0ee06f2addd4f33ecddfd4981d5f7a05f0a596d02acb630cb5377beac0.exe
Resource
win10v2004-20240709-en
General
-
Target
勒索12x 240726/1/19f80d6a588f3515d03eb9b8e0692baf1df7deeee827c2377e201ac0cadb78e4.exe
-
Size
18KB
-
MD5
01106a9779647bdd6b1cf425c36c53fc
-
SHA1
2a7adfbd4515c737858a0849302576421b186f33
-
SHA256
19f80d6a588f3515d03eb9b8e0692baf1df7deeee827c2377e201ac0cadb78e4
-
SHA512
2949a319be64da0a825008270daa47857cd8bed7b46afa3337bfc8a708a517784c06223d4b95f6e34878bc3273f13a0082b20df27eda526d2f2b71de74205a44
-
SSDEEP
384:0ZVL+cMdVyNq313v3U3BuBlgsshG4PLt:djQIl/E3sshGi
Malware Config
Signatures
-
Drops file in System32 directory 8 IoCs
description ioc Process File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506 svchost.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_0FB9553B978E7F00C6B2309507DEB64A svchost.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_363582827213C09529A76F35FB615187 svchost.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_6372E0472AFF76BB926C97818BC773B9 svchost.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_CBDCCBFE4F7A916411C1E69BDD97BB04 svchost.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\FB0D848F74F70BB2EAA93746D24D9749 svchost.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\57C8EDB95DF3F0AD4EE2DC2B8CFD4157 svchost.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776 svchost.exe -
Modifies data under HKEY_USERS 8 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-20\SOFTWARE\Classes\Local Settings\MuiCache\26\52C64B7E\@%SystemRoot%\system32\WindowsPowerShell\v1.0\powershell.exe,-124 = "Document Encryption" svchost.exe Set value (str) \REGISTRY\USER\S-1-5-20\SOFTWARE\Classes\Local Settings\MuiCache\26\52C64B7E\@%SystemRoot%\system32\NgcRecovery.dll,-100 = "Windows Hello Recovery Key Encryption" svchost.exe Set value (str) \REGISTRY\USER\S-1-5-20\SOFTWARE\Classes\Local Settings\MuiCache\26\52C64B7E\@%SystemRoot%\System32\ci.dll,-100 = "Isolated User Mode (IUM)" svchost.exe Set value (str) \REGISTRY\USER\S-1-5-20\SOFTWARE\Classes\Local Settings\MuiCache\26\52C64B7E\@%SystemRoot%\System32\ci.dll,-101 = "Enclave" svchost.exe Set value (str) \REGISTRY\USER\S-1-5-20\SOFTWARE\Classes\Local Settings\MuiCache\26\52C64B7E\@%SystemRoot%\system32\dnsapi.dll,-103 = "Domain Name System (DNS) Server Trust" svchost.exe Set value (str) \REGISTRY\USER\S-1-5-20\SOFTWARE\Classes\Local Settings\MuiCache\26\52C64B7E\@%SystemRoot%\System32\fveui.dll,-843 = "BitLocker Drive Encryption" svchost.exe Set value (str) \REGISTRY\USER\S-1-5-20\SOFTWARE\Classes\Local Settings\MuiCache\26\52C64B7E\@%SystemRoot%\System32\fveui.dll,-844 = "BitLocker Data Recovery Agent" svchost.exe Set value (str) \REGISTRY\USER\S-1-5-20\SOFTWARE\Classes\Local Settings\MuiCache\26\52C64B7E\@%SystemRoot%\System32\wuaueng.dll,-400 = "Windows Update" svchost.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\勒索12x 240726\1\19f80d6a588f3515d03eb9b8e0692baf1df7deeee827c2377e201ac0cadb78e4.exe"C:\Users\Admin\AppData\Local\Temp\勒索12x 240726\1\19f80d6a588f3515d03eb9b8e0692baf1df7deeee827c2377e201ac0cadb78e4.exe"1⤵PID:4476
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k NetworkService -p -s CryptSvc1⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
PID:4520