Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
29/08/2024, 12:06
Static task
static1
Behavioral task
behavioral1
Sample
2024-08-29_7579555177f0851d82b416c87e4f809d_bkransomware_hijackloader_revil.exe
Resource
win7-20240729-en
windows7-x64
11 signatures
150 seconds
Behavioral task
behavioral2
Sample
2024-08-29_7579555177f0851d82b416c87e4f809d_bkransomware_hijackloader_revil.exe
Resource
win10v2004-20240802-en
windows10-2004-x64
12 signatures
150 seconds
General
-
Target
2024-08-29_7579555177f0851d82b416c87e4f809d_bkransomware_hijackloader_revil.exe
-
Size
15.7MB
-
MD5
7579555177f0851d82b416c87e4f809d
-
SHA1
04998bfed4c632fb42b4be4c52b1b04964b7ad37
-
SHA256
be2f54f7285dd05c6054b6560e4576d88e699c858ffd6daa2da3017cb1e6a9ea
-
SHA512
ed820f9921006213a6aa9e394814e0d7163c4db314fb349b020551cffe32605d26108d119a47c38a9999af40153c781bd17428c1b9ec0b450c6a5d612945003c
-
SSDEEP
196608:PfEkDV4aV49RjOF5hK9TMICeEnE5rigt/a4PKKOjw+dLnWaKxYfRNrcAGTeOSKxS:3gs09TMJeEnEQoKgaKxYpSAP87w5Fz
Score
6/10
Malware Config
Signatures
-
Blocklisted process makes network request 1 IoCs
flow pid Process 27 3216 msiexec.exe -
Enumerates connected drives 3 TTPs 64 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\U: 2024-08-29_7579555177f0851d82b416c87e4f809d_bkransomware_hijackloader_revil.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\Z: 2024-08-29_7579555177f0851d82b416c87e4f809d_bkransomware_hijackloader_revil.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\Y: 2024-08-29_7579555177f0851d82b416c87e4f809d_bkransomware_hijackloader_revil.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\L: 2024-08-29_7579555177f0851d82b416c87e4f809d_bkransomware_hijackloader_revil.exe File opened (read-only) \??\X: 2024-08-29_7579555177f0851d82b416c87e4f809d_bkransomware_hijackloader_revil.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\J: 2024-08-29_7579555177f0851d82b416c87e4f809d_bkransomware_hijackloader_revil.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\N: 2024-08-29_7579555177f0851d82b416c87e4f809d_bkransomware_hijackloader_revil.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\S: 2024-08-29_7579555177f0851d82b416c87e4f809d_bkransomware_hijackloader_revil.exe File opened (read-only) \??\W: 2024-08-29_7579555177f0851d82b416c87e4f809d_bkransomware_hijackloader_revil.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\E: 2024-08-29_7579555177f0851d82b416c87e4f809d_bkransomware_hijackloader_revil.exe File opened (read-only) \??\K: 2024-08-29_7579555177f0851d82b416c87e4f809d_bkransomware_hijackloader_revil.exe File opened (read-only) \??\M: 2024-08-29_7579555177f0851d82b416c87e4f809d_bkransomware_hijackloader_revil.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\H: 2024-08-29_7579555177f0851d82b416c87e4f809d_bkransomware_hijackloader_revil.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\V: 2024-08-29_7579555177f0851d82b416c87e4f809d_bkransomware_hijackloader_revil.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\P: 2024-08-29_7579555177f0851d82b416c87e4f809d_bkransomware_hijackloader_revil.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\R: 2024-08-29_7579555177f0851d82b416c87e4f809d_bkransomware_hijackloader_revil.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\G: 2024-08-29_7579555177f0851d82b416c87e4f809d_bkransomware_hijackloader_revil.exe File opened (read-only) \??\O: 2024-08-29_7579555177f0851d82b416c87e4f809d_bkransomware_hijackloader_revil.exe File opened (read-only) \??\Q: 2024-08-29_7579555177f0851d82b416c87e4f809d_bkransomware_hijackloader_revil.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-2412658365-3084825385-3340777666-1000\Control Panel\International\Geo\Nation 2024-08-29_7579555177f0851d82b416c87e4f809d_bkransomware_hijackloader_revil.exe -
Loads dropped DLL 2 IoCs
pid Process 4360 MsiExec.exe 4360 MsiExec.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2024-08-29_7579555177f0851d82b416c87e4f809d_bkransomware_hijackloader_revil.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language msiexec.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MsiExec.exe -
Modifies registry class 1 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2412658365-3084825385-3340777666-1000_Classes\Local Settings 2024-08-29_7579555177f0851d82b416c87e4f809d_bkransomware_hijackloader_revil.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 3216 msiexec.exe Token: SeIncreaseQuotaPrivilege 3216 msiexec.exe Token: SeSecurityPrivilege 4772 msiexec.exe Token: SeCreateTokenPrivilege 3216 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 3216 msiexec.exe Token: SeLockMemoryPrivilege 3216 msiexec.exe Token: SeIncreaseQuotaPrivilege 3216 msiexec.exe Token: SeMachineAccountPrivilege 3216 msiexec.exe Token: SeTcbPrivilege 3216 msiexec.exe Token: SeSecurityPrivilege 3216 msiexec.exe Token: SeTakeOwnershipPrivilege 3216 msiexec.exe Token: SeLoadDriverPrivilege 3216 msiexec.exe Token: SeSystemProfilePrivilege 3216 msiexec.exe Token: SeSystemtimePrivilege 3216 msiexec.exe Token: SeProfSingleProcessPrivilege 3216 msiexec.exe Token: SeIncBasePriorityPrivilege 3216 msiexec.exe Token: SeCreatePagefilePrivilege 3216 msiexec.exe Token: SeCreatePermanentPrivilege 3216 msiexec.exe Token: SeBackupPrivilege 3216 msiexec.exe Token: SeRestorePrivilege 3216 msiexec.exe Token: SeShutdownPrivilege 3216 msiexec.exe Token: SeDebugPrivilege 3216 msiexec.exe Token: SeAuditPrivilege 3216 msiexec.exe Token: SeSystemEnvironmentPrivilege 3216 msiexec.exe Token: SeChangeNotifyPrivilege 3216 msiexec.exe Token: SeRemoteShutdownPrivilege 3216 msiexec.exe Token: SeUndockPrivilege 3216 msiexec.exe Token: SeSyncAgentPrivilege 3216 msiexec.exe Token: SeEnableDelegationPrivilege 3216 msiexec.exe Token: SeManageVolumePrivilege 3216 msiexec.exe Token: SeImpersonatePrivilege 3216 msiexec.exe Token: SeCreateGlobalPrivilege 3216 msiexec.exe Token: SeCreateTokenPrivilege 3216 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 3216 msiexec.exe Token: SeLockMemoryPrivilege 3216 msiexec.exe Token: SeIncreaseQuotaPrivilege 3216 msiexec.exe Token: SeMachineAccountPrivilege 3216 msiexec.exe Token: SeTcbPrivilege 3216 msiexec.exe Token: SeSecurityPrivilege 3216 msiexec.exe Token: SeTakeOwnershipPrivilege 3216 msiexec.exe Token: SeLoadDriverPrivilege 3216 msiexec.exe Token: SeSystemProfilePrivilege 3216 msiexec.exe Token: SeSystemtimePrivilege 3216 msiexec.exe Token: SeProfSingleProcessPrivilege 3216 msiexec.exe Token: SeIncBasePriorityPrivilege 3216 msiexec.exe Token: SeCreatePagefilePrivilege 3216 msiexec.exe Token: SeCreatePermanentPrivilege 3216 msiexec.exe Token: SeBackupPrivilege 3216 msiexec.exe Token: SeRestorePrivilege 3216 msiexec.exe Token: SeShutdownPrivilege 3216 msiexec.exe Token: SeDebugPrivilege 3216 msiexec.exe Token: SeAuditPrivilege 3216 msiexec.exe Token: SeSystemEnvironmentPrivilege 3216 msiexec.exe Token: SeChangeNotifyPrivilege 3216 msiexec.exe Token: SeRemoteShutdownPrivilege 3216 msiexec.exe Token: SeUndockPrivilege 3216 msiexec.exe Token: SeSyncAgentPrivilege 3216 msiexec.exe Token: SeEnableDelegationPrivilege 3216 msiexec.exe Token: SeManageVolumePrivilege 3216 msiexec.exe Token: SeImpersonatePrivilege 3216 msiexec.exe Token: SeCreateGlobalPrivilege 3216 msiexec.exe Token: SeCreateTokenPrivilege 3216 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 3216 msiexec.exe Token: SeLockMemoryPrivilege 3216 msiexec.exe -
Suspicious use of FindShellTrayWindow 3 IoCs
pid Process 1096 2024-08-29_7579555177f0851d82b416c87e4f809d_bkransomware_hijackloader_revil.exe 1096 2024-08-29_7579555177f0851d82b416c87e4f809d_bkransomware_hijackloader_revil.exe 3216 msiexec.exe -
Suspicious use of SendNotifyMessage 2 IoCs
pid Process 1096 2024-08-29_7579555177f0851d82b416c87e4f809d_bkransomware_hijackloader_revil.exe 1096 2024-08-29_7579555177f0851d82b416c87e4f809d_bkransomware_hijackloader_revil.exe -
Suspicious use of SetWindowsHookEx 4 IoCs
pid Process 1096 2024-08-29_7579555177f0851d82b416c87e4f809d_bkransomware_hijackloader_revil.exe 1096 2024-08-29_7579555177f0851d82b416c87e4f809d_bkransomware_hijackloader_revil.exe 1096 2024-08-29_7579555177f0851d82b416c87e4f809d_bkransomware_hijackloader_revil.exe 1096 2024-08-29_7579555177f0851d82b416c87e4f809d_bkransomware_hijackloader_revil.exe -
Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 1096 wrote to memory of 3216 1096 2024-08-29_7579555177f0851d82b416c87e4f809d_bkransomware_hijackloader_revil.exe 93 PID 1096 wrote to memory of 3216 1096 2024-08-29_7579555177f0851d82b416c87e4f809d_bkransomware_hijackloader_revil.exe 93 PID 1096 wrote to memory of 3216 1096 2024-08-29_7579555177f0851d82b416c87e4f809d_bkransomware_hijackloader_revil.exe 93 PID 4772 wrote to memory of 4360 4772 msiexec.exe 96 PID 4772 wrote to memory of 4360 4772 msiexec.exe 96 PID 4772 wrote to memory of 4360 4772 msiexec.exe 96
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-08-29_7579555177f0851d82b416c87e4f809d_bkransomware_hijackloader_revil.exe"C:\Users\Admin\AppData\Local\Temp\2024-08-29_7579555177f0851d82b416c87e4f809d_bkransomware_hijackloader_revil.exe"1⤵
- Enumerates connected drives
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1096 -
C:\Windows\SysWOW64\msiexec.exe"C:\Windows\System32\msiexec.exe" /i "C:\Users\Admin\AppData\Local\WirelessMedia\WMMeeting.msi"2⤵
- Blocklisted process makes network request
- Enumerates connected drives
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:3216
-
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4772 -
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 11B5D848A748A5D2FB176B6A17805D3A C2⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:4360
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
285KB
MD5db6ba08b76531f4e4cabb16e591ba8dc
SHA13912d40f26dbe43b456f17141545b5cba9bcd875
SHA25683e33f07f0a0ef4ef54c32ece108a932a93567fb4699692e375026170b8f87c4
SHA512c4867d48360eaf78606fedc504d2d896fbc4e85acbe567ff89cf6c71586f4939340194988c8c826484d8e08b66c30598095ab5f888b9b9b64bd49a66e383becf
-
Filesize
891KB
MD5e582489b588726147e5ecceb9286ea8d
SHA1bcfbffafcd947fab7c0ccf16cd24ffd27d9907bf
SHA256f7acb2ffe0f45083acf9f24c7b8d7baf90146065973ebe1a609874b2ecd233b8
SHA512a4bd54dc3712f20dc1b49caddadd6e9cf5bcfa73fdad325d719cd68a6f0b1c897b532c5fd7e19a7c9dca97b9d18fb9659c667755a1c407c5883a045408e91d1e
-
Filesize
29B
MD507b6a1e0c5ee0bdf354868d45b80f325
SHA137aeb217266dd8a71cfff7c6b93d03ca55d5085c
SHA2569f09af33af7d82b40e9c2aa28e27dce4058766ac59708af216ed6ff7d1fadd9b
SHA512a1a0cd7692a0646bd2d1c7698505a140fb9d5cc3e63f53b2bd348d91db43d09338f322c2a3c14ee8bc2e9f588dc4fc6e2dcac2be04df7ac5b8f7bb0648287d31