Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
148s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
12/09/2024, 04:29
Static task
static1
Behavioral task
behavioral1
Sample
ecc6369f4bf0bc1d0ad9e7afba34c21f4614641ecff396911817829b534cb1d8.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
ecc6369f4bf0bc1d0ad9e7afba34c21f4614641ecff396911817829b534cb1d8.exe
Resource
win10v2004-20240802-en
General
-
Target
ecc6369f4bf0bc1d0ad9e7afba34c21f4614641ecff396911817829b534cb1d8.exe
-
Size
20KB
-
MD5
ff9b155b365dd09203582cdc96cfed50
-
SHA1
0020fe6ded8eb9fbaaea8c285a273058028077de
-
SHA256
ecc6369f4bf0bc1d0ad9e7afba34c21f4614641ecff396911817829b534cb1d8
-
SHA512
9d23ce4634cacc4c316d983a435c3ac1e34db2c2db7adc5d6b06f328069835dbf707e13c680835f66a5b2ae7543bad68de4ab7024637d4f5c00afee7d2725d89
-
SSDEEP
384:2/WqRiFLIuRbjpLr2VKjq32VuzJKOj8Ulfjmc5wR4QqcrHnrK:1VRjRr3jq2Vsoa8+7R3QjrH2
Malware Config
Extracted
C:\ProgramData\Adobe\#RECOVERY#.txt
https://getsession.org
https://t.me/Files_decrypt
Signatures
-
Credentials from Password Stores: Credentials from Web Browsers 1 TTPs
Malicious Access or copy of Web Browser Credential store.
-
Deletes shadow copies 3 TTPs
Ransomware often targets backup files to inhibit system recovery.
-
Modifies boot configuration data using bcdedit 1 TTPs 2 IoCs
pid Process 452 bcdedit.exe 400 bcdedit.exe -
Renames multiple (2205) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Modifies Windows Firewall 2 TTPs 1 IoCs
pid Process 3932 netsh.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000\Control Panel\International\Geo\Nation ecc6369f4bf0bc1d0ad9e7afba34c21f4614641ecff396911817829b534cb1d8.exe -
Credentials from Password Stores: Windows Credential Manager 1 TTPs
Suspicious access to Credentials History.
-
Drops startup file 1 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\#RECOVERY#.txt ecc6369f4bf0bc1d0ad9e7afba34c21f4614641ecff396911817829b534cb1d8.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Drops desktop.ini file(s) 28 IoCs
description ioc Process File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini ecc6369f4bf0bc1d0ad9e7afba34c21f4614641ecff396911817829b534cb1d8.exe File opened for modification C:\Users\Public\Pictures\desktop.ini ecc6369f4bf0bc1d0ad9e7afba34c21f4614641ecff396911817829b534cb1d8.exe File opened for modification C:\Users\Public\Videos\desktop.ini ecc6369f4bf0bc1d0ad9e7afba34c21f4614641ecff396911817829b534cb1d8.exe File opened for modification C:\Users\Admin\Searches\desktop.ini ecc6369f4bf0bc1d0ad9e7afba34c21f4614641ecff396911817829b534cb1d8.exe File opened for modification C:\Users\Admin\Desktop\desktop.ini ecc6369f4bf0bc1d0ad9e7afba34c21f4614641ecff396911817829b534cb1d8.exe File opened for modification C:\Users\Public\Downloads\desktop.ini ecc6369f4bf0bc1d0ad9e7afba34c21f4614641ecff396911817829b534cb1d8.exe File opened for modification C:\Users\Admin\Contacts\desktop.ini ecc6369f4bf0bc1d0ad9e7afba34c21f4614641ecff396911817829b534cb1d8.exe File opened for modification C:\Users\Admin\Favorites\Links\desktop.ini ecc6369f4bf0bc1d0ad9e7afba34c21f4614641ecff396911817829b534cb1d8.exe File opened for modification C:\Users\Admin\Pictures\Saved Pictures\desktop.ini ecc6369f4bf0bc1d0ad9e7afba34c21f4614641ecff396911817829b534cb1d8.exe File opened for modification C:\Users\Admin\OneDrive\desktop.ini ecc6369f4bf0bc1d0ad9e7afba34c21f4614641ecff396911817829b534cb1d8.exe File opened for modification C:\Users\Admin\Documents\desktop.ini ecc6369f4bf0bc1d0ad9e7afba34c21f4614641ecff396911817829b534cb1d8.exe File opened for modification C:\Users\Admin\Videos\desktop.ini ecc6369f4bf0bc1d0ad9e7afba34c21f4614641ecff396911817829b534cb1d8.exe File opened for modification C:\Users\Public\AccountPictures\desktop.ini ecc6369f4bf0bc1d0ad9e7afba34c21f4614641ecff396911817829b534cb1d8.exe File opened for modification C:\Users\Public\Desktop\desktop.ini ecc6369f4bf0bc1d0ad9e7afba34c21f4614641ecff396911817829b534cb1d8.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini ecc6369f4bf0bc1d0ad9e7afba34c21f4614641ecff396911817829b534cb1d8.exe File opened for modification C:\Users\Admin\Downloads\desktop.ini ecc6369f4bf0bc1d0ad9e7afba34c21f4614641ecff396911817829b534cb1d8.exe File opened for modification C:\Users\Admin\Pictures\Camera Roll\desktop.ini ecc6369f4bf0bc1d0ad9e7afba34c21f4614641ecff396911817829b534cb1d8.exe File opened for modification C:\Users\Admin\Pictures\desktop.ini ecc6369f4bf0bc1d0ad9e7afba34c21f4614641ecff396911817829b534cb1d8.exe File opened for modification C:\Users\Public\desktop.ini ecc6369f4bf0bc1d0ad9e7afba34c21f4614641ecff396911817829b534cb1d8.exe File opened for modification C:\Users\Public\Music\desktop.ini ecc6369f4bf0bc1d0ad9e7afba34c21f4614641ecff396911817829b534cb1d8.exe File opened for modification C:\Users\Admin\3D Objects\desktop.ini ecc6369f4bf0bc1d0ad9e7afba34c21f4614641ecff396911817829b534cb1d8.exe File opened for modification C:\Users\Public\Libraries\desktop.ini ecc6369f4bf0bc1d0ad9e7afba34c21f4614641ecff396911817829b534cb1d8.exe File opened for modification C:\Users\Admin\Favorites\desktop.ini ecc6369f4bf0bc1d0ad9e7afba34c21f4614641ecff396911817829b534cb1d8.exe File opened for modification C:\Users\Admin\Links\desktop.ini ecc6369f4bf0bc1d0ad9e7afba34c21f4614641ecff396911817829b534cb1d8.exe File opened for modification C:\Users\Admin\Music\desktop.ini ecc6369f4bf0bc1d0ad9e7afba34c21f4614641ecff396911817829b534cb1d8.exe File opened for modification C:\Users\Admin\Saved Games\desktop.ini ecc6369f4bf0bc1d0ad9e7afba34c21f4614641ecff396911817829b534cb1d8.exe File opened for modification C:\Users\Public\Documents\desktop.ini ecc6369f4bf0bc1d0ad9e7afba34c21f4614641ecff396911817829b534cb1d8.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\desktop.ini ecc6369f4bf0bc1d0ad9e7afba34c21f4614641ecff396911817829b534cb1d8.exe -
Sets desktop wallpaper using registry 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Local\\Temp\\BB80.tmp.jpg" ecc6369f4bf0bc1d0ad9e7afba34c21f4614641ecff396911817829b534cb1d8.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Event Triggered Execution: Netsh Helper DLL 1 TTPs 3 IoCs
Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.
description ioc Process Key opened \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe Key queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe Key value enumerated \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe -
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language timeout.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ecc6369f4bf0bc1d0ad9e7afba34c21f4614641ecff396911817829b534cb1d8.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe -
Delays execution with timeout.exe 1 IoCs
pid Process 5100 timeout.exe -
Interacts with shadow copies 3 TTPs 1 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
pid Process 5064 vssadmin.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 3164 ecc6369f4bf0bc1d0ad9e7afba34c21f4614641ecff396911817829b534cb1d8.exe 3164 ecc6369f4bf0bc1d0ad9e7afba34c21f4614641ecff396911817829b534cb1d8.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
description pid Process Token: SeBackupPrivilege 2076 vssvc.exe Token: SeRestorePrivilege 2076 vssvc.exe Token: SeAuditPrivilege 2076 vssvc.exe -
Suspicious use of WriteProcessMemory 20 IoCs
description pid Process procid_target PID 3164 wrote to memory of 5064 3164 ecc6369f4bf0bc1d0ad9e7afba34c21f4614641ecff396911817829b534cb1d8.exe 84 PID 3164 wrote to memory of 5064 3164 ecc6369f4bf0bc1d0ad9e7afba34c21f4614641ecff396911817829b534cb1d8.exe 84 PID 3164 wrote to memory of 4428 3164 ecc6369f4bf0bc1d0ad9e7afba34c21f4614641ecff396911817829b534cb1d8.exe 88 PID 3164 wrote to memory of 4428 3164 ecc6369f4bf0bc1d0ad9e7afba34c21f4614641ecff396911817829b534cb1d8.exe 88 PID 3164 wrote to memory of 4548 3164 ecc6369f4bf0bc1d0ad9e7afba34c21f4614641ecff396911817829b534cb1d8.exe 89 PID 3164 wrote to memory of 4548 3164 ecc6369f4bf0bc1d0ad9e7afba34c21f4614641ecff396911817829b534cb1d8.exe 89 PID 3164 wrote to memory of 4136 3164 ecc6369f4bf0bc1d0ad9e7afba34c21f4614641ecff396911817829b534cb1d8.exe 92 PID 3164 wrote to memory of 4136 3164 ecc6369f4bf0bc1d0ad9e7afba34c21f4614641ecff396911817829b534cb1d8.exe 92 PID 4428 wrote to memory of 452 4428 cmd.exe 94 PID 4428 wrote to memory of 452 4428 cmd.exe 94 PID 4548 wrote to memory of 400 4548 cmd.exe 95 PID 4548 wrote to memory of 400 4548 cmd.exe 95 PID 4136 wrote to memory of 3932 4136 cmd.exe 96 PID 4136 wrote to memory of 3932 4136 cmd.exe 96 PID 3164 wrote to memory of 3740 3164 ecc6369f4bf0bc1d0ad9e7afba34c21f4614641ecff396911817829b534cb1d8.exe 110 PID 3164 wrote to memory of 3740 3164 ecc6369f4bf0bc1d0ad9e7afba34c21f4614641ecff396911817829b534cb1d8.exe 110 PID 3164 wrote to memory of 3740 3164 ecc6369f4bf0bc1d0ad9e7afba34c21f4614641ecff396911817829b534cb1d8.exe 110 PID 3740 wrote to memory of 5100 3740 cmd.exe 112 PID 3740 wrote to memory of 5100 3740 cmd.exe 112 PID 3740 wrote to memory of 5100 3740 cmd.exe 112 -
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\ecc6369f4bf0bc1d0ad9e7afba34c21f4614641ecff396911817829b534cb1d8.exe"C:\Users\Admin\AppData\Local\Temp\ecc6369f4bf0bc1d0ad9e7afba34c21f4614641ecff396911817829b534cb1d8.exe"1⤵
- Checks computer location settings
- Drops startup file
- Drops desktop.ini file(s)
- Sets desktop wallpaper using registry
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3164 -
C:\Windows\system32\vssadmin.exedelete shadows /all /quiet2⤵
- Interacts with shadow copies
PID:5064
-
-
C:\Windows\system32\cmd.exe"C:\Windows\sysnative\cmd.exe" /c bcdedit /set {current} bootstatuspolicy ignoreallfailures2⤵
- Suspicious use of WriteProcessMemory
PID:4428 -
C:\Windows\system32\bcdedit.exebcdedit /set {current} bootstatuspolicy ignoreallfailures3⤵
- Modifies boot configuration data using bcdedit
PID:452
-
-
-
C:\Windows\system32\cmd.exe"C:\Windows\sysnative\cmd.exe" /c bcdedit /set {current} recoveryenabled no2⤵
- Suspicious use of WriteProcessMemory
PID:4548 -
C:\Windows\system32\bcdedit.exebcdedit /set {current} recoveryenabled no3⤵
- Modifies boot configuration data using bcdedit
PID:400
-
-
-
C:\Windows\system32\cmd.exe"C:\Windows\sysnative\cmd.exe" /c netsh advfirewall set allprofiles state off2⤵
- Suspicious use of WriteProcessMemory
PID:4136 -
C:\Windows\system32\netsh.exenetsh advfirewall set allprofiles state off3⤵
- Modifies Windows Firewall
- Event Triggered Execution: Netsh Helper DLL
PID:3932
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c timeout 1 && del "C:\Users\Admin\AppData\Local\Temp\ecc6369f4bf0bc1d0ad9e7afba34c21f4614641ecff396911817829b534cb1d8.exe" >> NUL2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3740 -
C:\Windows\SysWOW64\timeout.exetimeout 13⤵
- System Location Discovery: System Language Discovery
- Delays execution with timeout.exe
PID:5100
-
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2076
Network
MITRE ATT&CK Enterprise v15
Persistence
Create or Modify System Process
1Windows Service
1Event Triggered Execution
1Netsh Helper DLL
1Privilege Escalation
Create or Modify System Process
1Windows Service
1Event Triggered Execution
1Netsh Helper DLL
1Defense Evasion
Direct Volume Access
1Impair Defenses
1Disable or Modify System Firewall
1Indicator Removal
2File Deletion
2Modify Registry
1Credential Access
Credentials from Password Stores
2Credentials from Web Browsers
1Windows Credential Manager
1Unsecured Credentials
1Credentials In Files
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
6KB
MD51c1e2fd0a32025b00ef584172b18b366
SHA1574c681ab4b14b385095dc1fa5a0d36ad11e889e
SHA256617a162065162097025146d86ba40ff56cc3425c4d626a6db4e87de09c4ff6c0
SHA51209f7144fdbb60f5c7d18ac0bc04843db4020e91f2c6cb8dff351641cbdd222dbe5109a17d8a05e007f8f1353ff2aa28b634097033409b0da5953ace9f9a39862