Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

10

Static

static

10

VoiceMod-F...up.exe

windows10-1703-x64

10

VoiceMod-F...up.exe

windows11-21h2-x64

10

Analysis

  • max time kernel
    90s
  • max time network
    140s
  • platform
    windows11-21h2_x64
  • resource
    win11-20240729-en
  • resource tags

    arch:x64arch:x86image:win11-20240729-enlocale:en-usos:windows11-21h2-x64system
  • submitted
    30/07/2024, 08:24

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    VoiceMod-Full-Version-Setup/Voicemod_setup.exe

  • Size

    146KB

  • MD5

    3d49478072bf18339ef810c8ea7546b2

  • SHA1

    c1047d72d4cdce21af4bb989ad1bee437edb7f80

  • SHA256

    e3300e30997c5a355f02ca6972711b2ca843d00a393b62c75818a43c27ff128d

  • SHA512

    f47f6a1c51b92cc34a1dc264bc2b151690f1c314c5f97b08530e9efd6929c860985f9410f411cb31e0f3acd75b8969e4791ca9fb080901f6f4cb70322255a91c

  • SSDEEP

    3072:A6glyuxE4GsUPnliByocWepU0DxwbL2LUnPaZw:A6gDBGpvEByocWeTDxOL2LScw

Score
10/10
defense_evasiondiscoveryransomwarespywarestealer

Malware Config

Extracted

Path

C:\3R9qG8i3Z.README.txt

Ransom Note
~~~ PC Locker 3.0 by Mr.Robot~~~ >>>> Your data are stolen and encrypted To get your files back you will have to pay a one-time fee of $45 in bitcoin or monero. >>>> You need contact us and decrypt one file for free on these platforms with your personal DECRYPTION ID Contact the following account on telegram @mr_robot_unlock or paste this link in your browser https://t.me/mr_robot_unlock >>>> Your personal DECRYPTION ID: 4B75BFA39AA770FC59CC762BBFD3B285 >>>> Warning! Do not DELETE or MODIFY any files, it can lead to recovery problems! >>>> Warning! If you do not pay the ransom you will not receive you files NO EXCEPTIONS! >>>> Warning! Any attempt to negotiate or you don't want to pay is INSTANT BLOCK! >>>> Advertisement Would you like to earn thousands of dollars $$$ ? We sell mentorship for stealers, DDOS and ransomware. We only work with professionals and people with money DO NOT WASTE OUR TIME.
URLs

https://t.me/mr_robot_unlock

Signatures

  • Renames multiple (603) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

    ransomware
  • Deletes itself 1 IoCs
  • Executes dropped EXE 1 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Drops desktop.ini file(s) 2 IoCs
  • Indicator Removal: File Deletion 1 TTPs

    Adversaries may delete files left behind by the actions of their intrusion activity.

    defense_evasion
  • Drops file in System32 directory 4 IoCs
  • Sets desktop wallpaper using registry 2 TTPs 2 IoCs
    ransomware
  • Suspicious use of NtSetInformationThreadHideFromDebugger 5 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Checks processor information in registry 2 TTPs 3 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Modifies Control Panel 2 IoCs
    evasion
  • Modifies registry class 9 IoCs
  • Opens file in notepad (likely ransom note) 1 IoCs
    ransomware
  • Suspicious behavior: AddClipboardFormatListener 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious behavior: RenamesItself 26 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of SetWindowsHookEx 18 IoCs
  • Suspicious use of WriteProcessMemory 11 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\VoiceMod-Full-Version-Setup\Voicemod_setup.exe
    "C:\Users\Admin\AppData\Local\Temp\VoiceMod-Full-Version-Setup\Voicemod_setup.exe"
    1⤵
    • Drops desktop.ini file(s)
    • Sets desktop wallpaper using registry
    • Suspicious use of NtSetInformationThreadHideFromDebugger
    • System Location Discovery: System Language Discovery
    • Modifies Control Panel
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:4636
    • C:\Windows\splwow64.exe
      C:\Windows\splwow64.exe 12288
      2⤵
      • Drops file in System32 directory
      PID:1052
    • C:\ProgramData\E417.tmp
      "C:\ProgramData\E417.tmp"
      2⤵
      • Deletes itself
      • Executes dropped EXE
      • Suspicious use of NtSetInformationThreadHideFromDebugger
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: RenamesItself
      • Suspicious use of WriteProcessMemory
      PID:4056
      • C:\Windows\SysWOW64\cmd.exe
        "C:\Windows\System32\cmd.exe" /C DEL /F /Q C:\PROGRA~3\E417.tmp >> NUL
        3⤵
        • System Location Discovery: System Language Discovery
        PID:2692
  • C:\Windows\system32\svchost.exe
    C:\Windows\system32\svchost.exe -k PrintWorkflow -s PrintWorkflowUserSvc
    1⤵
      PID:572
    • C:\Windows\system32\printfilterpipelinesvc.exe
      C:\Windows\system32\printfilterpipelinesvc.exe -Embedding
      1⤵
      • Drops file in System32 directory
      • Suspicious use of WriteProcessMemory
      PID:2648
      • C:\Program Files\Microsoft Office\root\Office16\ONENOTE.EXE
        /insertdoc "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\{2AD454E7-9AC2-4758-AF0D-AB937F918D2D}.xps" 133668014962220000
        2⤵
        • Checks processor information in registry
        • Enumerates system info in registry
        • Suspicious behavior: AddClipboardFormatListener
        • Suspicious use of SetWindowsHookEx
        PID:1232
    • C:\Windows\System32\rundll32.exe
      C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
      1⤵
        PID:1592
      • C:\Windows\system32\NOTEPAD.EXE
        "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Downloads\3R9qG8i3Z.README.txt
        1⤵
        • Opens file in notepad (likely ransom note)
        PID:2644
      • C:\Windows\system32\OpenWith.exe
        C:\Windows\system32\OpenWith.exe -Embedding
        1⤵
        • Modifies registry class
        • Suspicious use of SetWindowsHookEx
        PID:3316
      • C:\Windows\system32\OpenWith.exe
        C:\Windows\system32\OpenWith.exe -Embedding
        1⤵
        • Modifies registry class
        • Suspicious use of SetWindowsHookEx
        PID:3788
      • C:\Windows\system32\OpenWith.exe
        C:\Windows\system32\OpenWith.exe -Embedding
        1⤵
        • Modifies registry class
        • Suspicious use of SetWindowsHookEx
        PID:2016
      • C:\Windows\system32\OpenWith.exe
        C:\Windows\system32\OpenWith.exe -Embedding
        1⤵
        • Modifies registry class
        • Suspicious behavior: GetForegroundWindowSpam
        • Suspicious use of SetWindowsHookEx
        PID:2536

      Network

      MITRE ATT&CK Enterprise v15

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\$Recycle.Bin\S-1-5-21-1190969173-1381737754-2099412069-1000\FFFFFFFFFFF
        Filesize

        129B

        MD5

        33b2120febb1c1421f8ff4ead0a6313d

        SHA1

        8b91f76a089b42f1dd7c66d65161e1dbe8535273

        SHA256

        1107b77481812ab8aa6bbffcc5e5f93237d03379fbe8c6c751f3e10bdb7b028c

        SHA512

        051b030877b2600b562407ccf150a705d0a9d6ad1e97d1e5424c6c3030db2170393bc8d38b2aa2439a78a53f057d80b43668efb5d6bfedc4af50a9b8d819de59

        Download Submit

      • C:\3R9qG8i3Z.README.txt
        Filesize

        953B

        MD5

        6746d927820d53e67b4c039bed67b671

        SHA1

        01f1074c189a3f53afcbb5c57c79258f999e289f

        SHA256

        90d19e7ed22b890ba88a810bcd2f7ac794d24715bb78faf081e05804a03775bb

        SHA512

        3e2665a75cc6155c0f3385b9efa2153110699ec1fe553dda82a8be0b9dd3efb993076de37bbbb5d5707c01a0377f2d8dd89ed501703650edc0bf5336e2f31d49

        Download Submit

      • C:\ProgramData\E417.tmp
        Filesize

        14KB

        MD5

        294e9f64cb1642dd89229fff0592856b

        SHA1

        97b148c27f3da29ba7b18d6aee8a0db9102f47c9

        SHA256

        917e115cc403e29b4388e0d175cbfac3e7e40ca1742299fbdb353847db2de7c2

        SHA512

        b87d531890bf1577b9b4af41dddb2cdbbfa164cf197bd5987df3a3075983645a3acba443e289b7bfd338422978a104f55298fbfe346872de0895bde44adc89cf

        Download Submit

      • C:\Users\Admin\AppData\Local\Temp\VoiceMod-Full-Version-Setup\EEEEEEEEEEEEEEEEEE
        Filesize

        146KB

        MD5

        4bdc1018de481a81f9b0d98bd4b92183

        SHA1

        8878ea7150260c15121c8bbe9d0f8d61290da524

        SHA256

        b839a78256c7b03405524b49b417a7e080101637823c05fdb4a67ce9d3ce6735

        SHA512

        47ff869bb0ffb6e5329dc099b477473f5c9e2d81df52873d431ba197b412ce4534fc9c52d17552f1d5872d9a9cd87895da774a3859149f4f8c1b604c7595b878

        Download Submit

      • C:\Users\Admin\Documents\OneNote Notebooks\My Notebook\Open Notebook.onetoc2
        Filesize

        4KB

        MD5

        4ef67b768410c233f3d5a89934a6b6f7

        SHA1

        b8dab6fd4d77d81a189563f6f12a41393926bae3

        SHA256

        3a5a87a73c99332c92cb20c4746a31e3f5ca204831f799a2a6a5143f9247d6fd

        SHA512

        ca5fc4b1aab3b70a84e66eada0574e6a4023e6b5e962e51d6da98b703963d61a1ff77edd8e9c335a4954245b86b6ccd369199547ccb6dffdbdd039489f17fd53

        Download Submit

      • C:\Users\Admin\Documents\OneNote Notebooks\My Notebook\Open Notebook.onetoc2
        Filesize

        4KB

        MD5

        63149a4d2ef87ad9ba1890d09ce31237

        SHA1

        1b74348b8288f079e43a1f53f4d34ca333c2179f

        SHA256

        51621bf7b0d43bb326d90bd06d95261d13e6944c1c4af8c6d40074dfb22fe5a6

        SHA512

        173418a289359b3a5f9dceabfc62806ed355f5a0f178cb74c8577ac8414e5653d6d5a937cb95e5e0c18f8cc4a64c996d98743b3e36fd9d159990e483e840a3b8

        Download Submit

      • F:\$RECYCLE.BIN\S-1-5-21-1190969173-1381737754-2099412069-1000\DDDDDDDDDDD
        Filesize

        129B

        MD5

        550bed6769e8f26d97329ac29a7b913c

        SHA1

        e276c7b3aeff294a151020532c422a2b17a5ba20

        SHA256

        2c0edb9b5b820c956f4c9a6ff0372ad6ac4921d8c29f954d2bd2a366dad3490f

        SHA512

        0e62af2a09b208f10f15b259dabc08f03e136c1d38d6ada9efcc81fab0bac44c96ce450aba342ac6ac6819529f610963e4a4dd4beb385a5f5aa7f5cd52eabf24

        Download Submit

      • memory/1232-2899-0x00007FF840880000-0x00007FF840890000-memory.dmp

        Filesize

        64KB

        Download

      • memory/1232-2929-0x00007FF842C30000-0x00007FF842C40000-memory.dmp

        Filesize

        64KB

        Download

      • memory/1232-2867-0x00007FF842C30000-0x00007FF842C40000-memory.dmp

        Filesize

        64KB

        Download

      • memory/1232-2869-0x00007FF842C30000-0x00007FF842C40000-memory.dmp

        Filesize

        64KB

        Download

      • memory/1232-2870-0x00007FF842C30000-0x00007FF842C40000-memory.dmp

        Filesize

        64KB

        Download

      • memory/1232-2927-0x00007FF842C30000-0x00007FF842C40000-memory.dmp

        Filesize

        64KB

        Download

      • memory/1232-2900-0x00007FF840880000-0x00007FF840890000-memory.dmp

        Filesize

        64KB

        Download

      • memory/1232-2866-0x00007FF842C30000-0x00007FF842C40000-memory.dmp

        Filesize

        64KB

        Download

      • memory/1232-2868-0x00007FF842C30000-0x00007FF842C40000-memory.dmp

        Filesize

        64KB

        Download

      • memory/1232-2928-0x00007FF842C30000-0x00007FF842C40000-memory.dmp

        Filesize

        64KB

        Download

      • memory/1232-2926-0x00007FF842C30000-0x00007FF842C40000-memory.dmp

        Filesize

        64KB

        Download

      • memory/4636-2-0x00000000028C0000-0x00000000028D0000-memory.dmp

        Filesize

        64KB

        Download

      • memory/4636-1-0x00000000028C0000-0x00000000028D0000-memory.dmp

        Filesize

        64KB

        Download

      • memory/4636-0-0x00000000028C0000-0x00000000028D0000-memory.dmp

        Filesize

        64KB

        Download