Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
145s -
max time network
140s -
platform
windows10-1703_x64 -
resource
win10-20240404-en -
resource tags
-
submitted
30/07/2024, 08:24
General
-
Target
VoiceMod-Full-Version-Setup/Voicemod_setup.exe
-
Size
146KB
-
MD5
3d49478072bf18339ef810c8ea7546b2
-
SHA1
c1047d72d4cdce21af4bb989ad1bee437edb7f80
-
SHA256
e3300e30997c5a355f02ca6972711b2ca843d00a393b62c75818a43c27ff128d
-
SHA512
f47f6a1c51b92cc34a1dc264bc2b151690f1c314c5f97b08530e9efd6929c860985f9410f411cb31e0f3acd75b8969e4791ca9fb080901f6f4cb70322255a91c
-
SSDEEP
3072:A6glyuxE4GsUPnliByocWepU0DxwbL2LUnPaZw:A6gDBGpvEByocWeTDxOL2LScw
Malware Config
Extracted
C:\3R9qG8i3Z.README.txt
https://t.me/mr_robot_unlock
Signatures
-
Renames multiple (570) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Deletes itself 1 IoCs
-
Executes dropped EXE 1 IoCs
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Drops desktop.ini file(s) 2 IoCs
-
Indicator Removal: File Deletion 1 TTPs
Adversaries may delete files left behind by the actions of their intrusion activity.
-
Drops file in System32 directory 4 IoCs
-
Sets desktop wallpaper using registry 2 TTPs 2 IoCs
-
Suspicious use of NtSetInformationThreadHideFromDebugger 5 IoCs
-
Drops file in Windows directory 1 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
-
Enumerates system info in registry 2 TTPs 3 IoCs
-
Modifies Control Panel 2 IoCs
-
Modifies registry class 5 IoCs
-
Suspicious behavior: EnumeratesProcesses 28 IoCs
-
Suspicious behavior: RenamesItself 26 IoCs
-
Suspicious use of AdjustPrivilegeToken 64 IoCs
-
Suspicious use of SetWindowsHookEx 13 IoCs
-
Suspicious use of WriteProcessMemory 11 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\VoiceMod-Full-Version-Setup\Voicemod_setup.exe"C:\Users\Admin\AppData\Local\Temp\VoiceMod-Full-Version-Setup\Voicemod_setup.exe"1⤵
- Drops desktop.ini file(s)
- Sets desktop wallpaper using registry
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Modifies Control Panel
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\splwow64.exeC:\Windows\splwow64.exe 122882⤵
- Drops file in System32 directory
-
-
C:\ProgramData\9403.tmp"C:\ProgramData\9403.tmp"2⤵
- Deletes itself
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C DEL /F /Q C:\PROGRA~3\9403.tmp >> NUL3⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k appmodel -s tiledatamodelsvc1⤵
- Drops file in Windows directory
-
C:\Windows\system32\printfilterpipelinesvc.exeC:\Windows\system32\printfilterpipelinesvc.exe -Embedding1⤵
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Microsoft Office\root\Office16\ONENOTE.EXE/insertdoc "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\{AB7E7804-C01C-42CB-8E0E-11D529B387E4}.xps" 1336680150363000002⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
129B
MD5d2a5cfa7821497840f75db61a2aebb6a
SHA1a93e5c4800925fbdba8ffe6ff4bda96ef48b42ca
SHA25658a56d1482ed1eabf7014f40e73fd52099ec05f9933ff6782b1be874d2c0bcf4
SHA51211c8347ec48fb7ad8cbd78765be1e34f1884ae422be0b6495556d25df2185e0a307551799fdf65529b2f91069a3d7d73d536e8c5c0f335f93c15a966ca41cc82
-
Filesize
953B
MD559c1819f8b3b3e274f52fc145a88a331
SHA1fe4b5bb97d84c3c05da6883acf4cc06b4cd67474
SHA25622aabb2dd8e3f376b8ca281e363077ba406a35704ae88f347d25df179f61933b
SHA512bf7e7a5a2ef7029a431f6372df7feee62ec5f4b6ea9580062ae74dbef93688ba3f5123dba6e018f3369048af32a7f1d368025cdac4bc08d5306cb3e1c76bb4a2
-
Filesize
14KB
MD5294e9f64cb1642dd89229fff0592856b
SHA197b148c27f3da29ba7b18d6aee8a0db9102f47c9
SHA256917e115cc403e29b4388e0d175cbfac3e7e40ca1742299fbdb353847db2de7c2
SHA512b87d531890bf1577b9b4af41dddb2cdbbfa164cf197bd5987df3a3075983645a3acba443e289b7bfd338422978a104f55298fbfe346872de0895bde44adc89cf
-
Filesize
146KB
MD5d303b4cdc36b0c19119d065df84ada13
SHA17c4f6a9430f0d52fb6b0acef72559edadafb13fc
SHA2565509348d10406ff4d4c0cb1a5a91a9a3ec1e9079cdbab3a615489b9c58bb27e0
SHA51296887ed3f78e02ad2afe2276c1fa5e319557bc516a4b1ea98b4570ad972b46bf3b91826532505bfd03526213017179d84438d1c1de43a3378d5b50e0e3787dd4
-
Filesize
4KB
MD52aee95b955f0c2c614047fe953f9bf95
SHA10c2663e422cdb5680a620a5daa50c1ae31048335
SHA25626c73f656e2dc85e38669905ebfd9050486881dbdbb6869db43f2a8254363702
SHA51249189f53c4e9001b766d7e0fd6fa3fc447e78a7140f0a28b7fb0ce47ff83a62eb55f6b83699fa2be093931b88450bb532f804b72e84551b7d348bef1e6c18cbf
-
Filesize
4KB
MD5e5a1c5cced3d4e6ae41625e88a4ebfd4
SHA1e2738fff78ff9ba600d4a1df339a9d5b287921f8
SHA2562a7ac4683f306fc15bb464c4ee9e42a95213e89a5f95aa4811f8142f107e3383
SHA512d4e5bd05e4c1e005ab2fbd4cf4149935fc2e4592630406182434332d29752df68e5a2f7a0e47078d6c8af6ed16efcd8142f071a1379237386d3944677d7bcc9e
-
Filesize
129B
MD5e188bb9f536f6d94aa5322a34a98e6a2
SHA113da7948e160312543115caec96a13613826fdb8
SHA2561027a5af1c686aa78695cbc2cfd9c2406c26da1fb2c3be69fbca099682fe61e4
SHA512d8b2bc77f9089621d97ac9a60adcc8ec7096a9113c3c7c3fbd9317202052d2ff29477c50414a91578d36e9e26c539ef94f8eee1a05a569ae34cda6d7b7b1c7ee
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
1.0MB
-
Filesize
1.0MB