Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
95s -
max time network
125s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
19/08/2024, 22:17
Static task
static1
Behavioral task
behavioral1
Sample
ransom.exe
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
ransom.exe
Resource
win10v2004-20240802-en
General
-
Target
ransom.exe
-
Size
3.1MB
-
MD5
7b165424e046c129ed68d167aabaee01
-
SHA1
0cde2e763fb1e21ea738b3255007ea6dff32f19f
-
SHA256
6dec307953243ac4218ac5bb70fdec783cc40be380254a1402d31e21c14704fd
-
SHA512
f0020dbfce6e441f0854b89007c646495ef288b84e3658efa330571cd9aa2a484cb6fb22e776156176a6e8e4fc1b41f1f7271deed33f992723ca38aacca474d7
-
SSDEEP
49152:suwlfTeFiqtUaqTsuYYq1ibpA4f5uw41doGWo4:QeZndio
Malware Config
Signatures
-
Drops desktop.ini file(s) 7 IoCs
description ioc Process File opened for modification C:\Users\Admin\Videos\desktop.ini ransom.exe File opened for modification C:\Users\Admin\Desktop\desktop.ini ransom.exe File opened for modification C:\Users\Admin\Documents\desktop.ini ransom.exe File opened for modification C:\Users\Admin\Downloads\desktop.ini ransom.exe File opened for modification C:\Users\Admin\Pictures\Camera Roll\desktop.ini ransom.exe File opened for modification C:\Users\Admin\Pictures\desktop.ini ransom.exe File opened for modification C:\Users\Admin\Pictures\Saved Pictures\desktop.ini ransom.exe -
Indicator Removal: File Deletion 1 TTPs
Adversaries may delete files left behind by the actions of their intrusion activity.
-
Drops file in System32 directory 2 IoCs
description ioc Process File opened for modification C:\Windows\system32\Recovery ReAgentc.exe File opened for modification C:\Windows\system32\Recovery\ReAgent.xml ReAgentc.exe -
Drops file in Windows directory 4 IoCs
description ioc Process File opened for modification C:\Windows\Logs\ReAgent\ReAgent.log ReAgentc.exe File opened for modification C:\Windows\Panther\UnattendGC\setuperr.log ReAgentc.exe File opened for modification C:\Windows\Panther\UnattendGC\diagerr.xml ReAgentc.exe File opened for modification C:\Windows\Panther\UnattendGC\diagwrn.xml ReAgentc.exe -
pid Process 1220 powershell.exe 1440 powershell.exe -
Modifies registry class 5 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2718105630-359604950-2820636825-1000_Classes\.enc ransom.exe Set value (str) \REGISTRY\USER\S-1-5-21-2718105630-359604950-2820636825-1000_Classes\.enc\ = "encfile" ransom.exe Key created \REGISTRY\USER\S-1-5-21-2718105630-359604950-2820636825-1000_Classes\encfile\DefaultIcon ransom.exe Key created \REGISTRY\USER\S-1-5-21-2718105630-359604950-2820636825-1000_Classes\encfile ransom.exe Set value (str) \REGISTRY\USER\S-1-5-21-2718105630-359604950-2820636825-1000_Classes\encfile\DefaultIcon\ = "C:\\Users\\Admin\\icon.ico" ransom.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 1220 powershell.exe 1220 powershell.exe 1440 powershell.exe 1440 powershell.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 1220 powershell.exe Token: SeDebugPrivilege 1440 powershell.exe -
Suspicious use of WriteProcessMemory 8 IoCs
description pid Process procid_target PID 4932 wrote to memory of 512 4932 ransom.exe 88 PID 4932 wrote to memory of 512 4932 ransom.exe 88 PID 512 wrote to memory of 1220 512 cmd.exe 89 PID 512 wrote to memory of 1220 512 cmd.exe 89 PID 4932 wrote to memory of 1440 4932 ransom.exe 92 PID 4932 wrote to memory of 1440 4932 ransom.exe 92 PID 1440 wrote to memory of 2672 1440 powershell.exe 93 PID 1440 wrote to memory of 2672 1440 powershell.exe 93
Processes
-
C:\Users\Admin\AppData\Local\Temp\ransom.exe"C:\Users\Admin\AppData\Local\Temp\ransom.exe"1⤵
- Drops desktop.ini file(s)
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:4932 -
C:\Windows\system32\cmd.exe"cmd" /C "powershell -Command \" Stop-Process -Name explorer -Force Remove-Item -Path '$env:localappdata\IconCache.db' -ErrorAction SilentlyContinue Start-Process explorer \""2⤵
- Suspicious use of WriteProcessMemory
PID:512 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command \"3⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1220
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command "reagentc.exe /disable"2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1440 -
C:\Windows\system32\ReAgentc.exe"C:\Windows\system32\ReAgentc.exe" /disable3⤵
- Drops file in System32 directory
- Drops file in Windows directory
PID:2672
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2KB
MD5d85ba6ff808d9e5444a4b369f5bc2730
SHA131aa9d96590fff6981b315e0b391b575e4c0804a
SHA25684739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f
SHA5128c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249
-
Filesize
944B
MD577d622bb1a5b250869a3238b9bc1402b
SHA1d47f4003c2554b9dfc4c16f22460b331886b191b
SHA256f97ff12a8abf4bf88bb6497bd2ac2da12628c8847a8ba5a9026bdbb76507cdfb
SHA512d6789b5499f23c9035375a102271e17a8a82e57d6f5312fa24242e08a83efdeb8becb7622f55c4cf1b89c7d864b445df11f4d994cf7e2f87a900535bcca12fd9
-
Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82