Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

10

Static

static

7

devilransom.exe

windows7-x64

10

devilransom.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    150s
  • max time network
    98s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    14/09/2024, 19:57

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    devilransom.exe

  • Size

    240KB

  • MD5

    b834c44a3e5298a3f23a1355409d2578

  • SHA1

    ba9fc22891f7480c49ee9e4d9409f833fc9484d8

  • SHA256

    a6ddcbca65d8fdd771f1d9e271a42e601fcebb5e6f6c49ec30113e930b2cd790

  • SHA512

    dad2007f6ffdae861cd7eec928a0b1dacf6058595bb9d33e1cd08701c721e347a04921e177e8639fef6e80e3fe29885f7067448f978921075b1e7490b40c0ad3

  • SSDEEP

    6144:UeLttJ+VSjv6S0qhH6NAw497/WBzzcT22sW6fvyENEb1HwoS:HLttJ+VSeS0e6N697/+zca2sFf6wtoS

Score
10/10
discoveryevasionpersistenceransomwaretrojanupx

Malware Config

Signatures

  • Modifies WinLogon for persistence 2 TTPs 1 IoCs
    persistence
  • UAC bypass 3 TTPs 2 IoCs
    evasiontrojan
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 1 IoCs
  • UPX packed file 2 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Sets desktop wallpaper using registry 2 TTPs 1 IoCs
    ransomware
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 34 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Modifies registry class 1 IoCs
  • Modifies registry key 1 TTPs 2 IoCs
  • Opens file in notepad (likely ransom note) 1 IoCs
    ransomware
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 4 IoCs
  • Suspicious use of FindShellTrayWindow 64 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\devilransom.exe
    "C:\Users\Admin\AppData\Local\Temp\devilransom.exe"
    1⤵
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:1460
    • C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\1613.tmp\devilransom.bat""
      2⤵
      • Checks computer location settings
      • System Location Discovery: System Language Discovery
      • Modifies registry class
      • Suspicious use of WriteProcessMemory
      PID:4724
      • C:\Windows\SysWOW64\reg.exe
        reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v ConsentPromptBehaviorAdmin /t REG_DWORD /d 0 /f
        3⤵
        • UAC bypass
        • System Location Discovery: System Language Discovery
        • Modifies registry key
        PID:3988
      • C:\Windows\SysWOW64\reg.exe
        reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWORD /d 0 /f
        3⤵
        • UAC bypass
        • System Location Discovery: System Language Discovery
        • Modifies registry key
        PID:4832
      • C:\Windows\SysWOW64\reg.exe
        reg add "HKEY_CURRENT_USER\Control Panel\Desktop" /v Wallpaper /t REG_SZ /d c:\bg.bmp /f
        3⤵
        • Sets desktop wallpaper using registry
        • System Location Discovery: System Language Discovery
        PID:464
      • C:\Windows\SysWOW64\rundll32.exe
        RUNDLL32.EXE user32.dll,UpdatePerUserSystemParameters
        3⤵
        • System Location Discovery: System Language Discovery
        PID:4084
      • C:\Windows\SysWOW64\rundll32.exe
        RUNDLL32.EXE user32.dll,UpdatePerUserSystemParameters
        3⤵
        • System Location Discovery: System Language Discovery
        PID:1504
      • C:\Windows\SysWOW64\rundll32.exe
        RUNDLL32.EXE user32.dll,UpdatePerUserSystemParameters
        3⤵
        • System Location Discovery: System Language Discovery
        PID:2008
      • C:\Windows\SysWOW64\rundll32.exe
        RUNDLL32.EXE user32.dll,UpdatePerUserSystemParameters
        3⤵
        • System Location Discovery: System Language Discovery
        PID:1600
      • C:\Windows\SysWOW64\rundll32.exe
        RUNDLL32.EXE user32.dll,UpdatePerUserSystemParameters
        3⤵
        • System Location Discovery: System Language Discovery
        PID:2536
      • C:\Windows\SysWOW64\rundll32.exe
        RUNDLL32.EXE user32.dll,UpdatePerUserSystemParameters
        3⤵
        • System Location Discovery: System Language Discovery
        PID:4500
      • C:\Windows\SysWOW64\NOTEPAD.EXE
        "C:\Windows\system32\NOTEPAD.EXE" C:\devilransom.txt
        3⤵
        • System Location Discovery: System Language Discovery
        • Opens file in notepad (likely ransom note)
        PID:4680
      • C:\Users\Admin\AppData\Local\Temp\1613.tmp\installsetupupdate.exe
        installsetupupdate.exe
        3⤵
        • Modifies WinLogon for persistence
        • Executes dropped EXE
        • Adds Run key to start application
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of FindShellTrayWindow
        PID:2716
      • C:\Windows\SysWOW64\rundll32.exe
        RUNDLL32.EXE user32.dll,UpdatePerUserSystemParameters
        3⤵
        • System Location Discovery: System Language Discovery
        PID:4784
      • C:\Windows\SysWOW64\rundll32.exe
        RUNDLL32.EXE user32.dll,UpdatePerUserSystemParameters
        3⤵
        • System Location Discovery: System Language Discovery
        PID:2956
      • C:\Windows\SysWOW64\rundll32.exe
        RUNDLL32.EXE user32.dll,UpdatePerUserSystemParameters
        3⤵
        • System Location Discovery: System Language Discovery
        PID:3252
      • C:\Windows\SysWOW64\rundll32.exe
        RUNDLL32.EXE user32.dll,UpdatePerUserSystemParameters
        3⤵
        • System Location Discovery: System Language Discovery
        PID:4288
      • C:\Windows\SysWOW64\rundll32.exe
        RUNDLL32.EXE user32.dll,UpdatePerUserSystemParameters
        3⤵
        • System Location Discovery: System Language Discovery
        PID:4040
      • C:\Windows\SysWOW64\rundll32.exe
        RUNDLL32.EXE user32.dll,UpdatePerUserSystemParameters
        3⤵
        • System Location Discovery: System Language Discovery
        PID:1120
      • C:\Windows\SysWOW64\rundll32.exe
        RUNDLL32.EXE user32.dll,UpdatePerUserSystemParameters
        3⤵
        • System Location Discovery: System Language Discovery
        PID:2464
      • C:\Windows\SysWOW64\rundll32.exe
        RUNDLL32.EXE user32.dll,UpdatePerUserSystemParameters
        3⤵
        • System Location Discovery: System Language Discovery
        PID:4708
      • C:\Windows\SysWOW64\rundll32.exe
        RUNDLL32.EXE user32.dll,UpdatePerUserSystemParameters
        3⤵
        • System Location Discovery: System Language Discovery
        PID:4472
      • C:\Windows\SysWOW64\rundll32.exe
        RUNDLL32.EXE user32.dll,UpdatePerUserSystemParameters
        3⤵
        • System Location Discovery: System Language Discovery
        PID:2312
      • C:\Windows\SysWOW64\rundll32.exe
        RUNDLL32.EXE user32.dll,UpdatePerUserSystemParameters
        3⤵
        • System Location Discovery: System Language Discovery
        PID:3640
      • C:\Windows\SysWOW64\rundll32.exe
        RUNDLL32.EXE user32.dll,UpdatePerUserSystemParameters
        3⤵
        • System Location Discovery: System Language Discovery
        PID:4476
      • C:\Windows\SysWOW64\rundll32.exe
        RUNDLL32.EXE user32.dll,UpdatePerUserSystemParameters
        3⤵
        • System Location Discovery: System Language Discovery
        PID:3272
      • C:\Windows\SysWOW64\rundll32.exe
        RUNDLL32.EXE user32.dll,UpdatePerUserSystemParameters
        3⤵
        • System Location Discovery: System Language Discovery
        PID:1192
      • C:\Windows\SysWOW64\rundll32.exe
        RUNDLL32.EXE user32.dll,UpdatePerUserSystemParameters
        3⤵
        • System Location Discovery: System Language Discovery
        PID:4908
      • C:\Windows\SysWOW64\rundll32.exe
        RUNDLL32.EXE user32.dll,UpdatePerUserSystemParameters
        3⤵
        • System Location Discovery: System Language Discovery
        PID:2616
      • C:\Windows\SysWOW64\rundll32.exe
        RUNDLL32.EXE user32.dll,UpdatePerUserSystemParameters
        3⤵
        • System Location Discovery: System Language Discovery
        PID:2088
      • C:\Windows\SysWOW64\rundll32.exe
        RUNDLL32.EXE user32.dll,UpdatePerUserSystemParameters
        3⤵
        • System Location Discovery: System Language Discovery
        PID:3212
      • C:\Windows\SysWOW64\rundll32.exe
        RUNDLL32.EXE user32.dll,UpdatePerUserSystemParameters
        3⤵
        • System Location Discovery: System Language Discovery
        PID:220
      • C:\Windows\SysWOW64\rundll32.exe
        RUNDLL32.EXE user32.dll,UpdatePerUserSystemParameters
        3⤵
        • System Location Discovery: System Language Discovery
        PID:5072
      • C:\Windows\SysWOW64\rundll32.exe
        RUNDLL32.EXE user32.dll,UpdatePerUserSystemParameters
        3⤵
        • System Location Discovery: System Language Discovery
        PID:4944
  • C:\Windows\explorer.exe
    explorer.exe
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    PID:1472

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

2
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Winlogon Helper DLL

1
T1547.004

Privilege Escalation

Abuse Elevation Control Mechanism

1
T1548

Bypass User Account Control

1
T1548.002

Boot or Logon Autostart Execution

2
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Winlogon Helper DLL

1
T1547.004

Defense Evasion

Abuse Elevation Control Mechanism

1
T1548

Bypass User Account Control

1
T1548.002

Impair Defenses

1
T1562

Disable or Modify Tools

1
T1562.001

Modify Registry

5
T1112

Credential Access

Discovery

Query Registry

1
T1012

System Information Discovery

2
T1082

System Location Discovery

1
T1614

System Language Discovery

1
T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Defacement

1
T1491

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\1613.tmp\bg.bmp
    Filesize

    506KB

    MD5

    ee1b910539fb2e71ed52d051c6a5c9b5

    SHA1

    ffee3fdfaf7e62ea14fd52f6a9d5b774d58ab720

    SHA256

    4b23052d3e199074c625ba9c5ed3969e8122190ce602917105a4c34efdfe826a

    SHA512

    097ab1ee2a2207264f789defb6b78d8bb1b4538461eb3af0ce7a6163f1007ecdab678eeeaebcd65853fa2430a9890f8e0ecac5b89908e045cf9493fc4017e23d

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\1613.tmp\devilransom.bat
    Filesize

    2KB

    MD5

    accb994f867d9220d44459a0c8c04de7

    SHA1

    411d8675cab78d319a38dbc9b056c45cc19eba63

    SHA256

    36329399497e0e53e89d66a7ad23ce8094cd08601aac65173a4d73135f1d77ff

    SHA512

    93558ca1e9e941dde6e77337a53f6929d9ef62d4b676490be78550ec0ae93b24545100cf15f8b8ed1138cd8fbe25a1399d862e1e40a2f6a826eca0619dad0f6e

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\1613.tmp\installsetupupdate.exe
    Filesize

    436KB

    MD5

    6c5a3a112b3940c55f8653597b1b7152

    SHA1

    3578eb4cf6c30d3bd779c5e3b1ddbf6a8a2ab3b5

    SHA256

    471a338122025eb481779092de78653df6434715590d741c95e5138c87147488

    SHA512

    12edede68b9b473cbe0f0a650643912f394d3ad60b2687e465f7a27d15ac5fd94568c29692140b84c5a194b65a450a65358f6278a6f1025bfd44071d357c716b

    Download Submit

  • C:\devilransom.txt
    Filesize

    106B

    MD5

    f9cfc983bdfc1fb2f265918fbe0d9c65

    SHA1

    ee5d34343e484e8133c3423db32bd458779896b9

    SHA256

    eb2521cac865e84299e54641b5036ec4c789b012850c859fb38de0599e408312

    SHA512

    a97fb3e00139a1ab40648ff645700cebdfabacf2ac117c10f6e24efd8bf05fc2218fa866c8189e67ea99295f0966eafaea2f3e5dd19eb3bb46d78a89ba25f5d6

    Download Submit

  • memory/1460-0-0x0000000000400000-0x00000000004FD000-memory.dmp

    Filesize

    1012KB

    Download

  • memory/1460-19-0x0000000000400000-0x00000000004FD000-memory.dmp

    Filesize

    1012KB

    Download

  • memory/2716-20-0x0000000000400000-0x0000000000474000-memory.dmp

    Filesize

    464KB

    Download

  • memory/2716-21-0x0000000000400000-0x0000000000474000-memory.dmp

    Filesize

    464KB

    Download

  • memory/2716-23-0x0000000000400000-0x0000000000474000-memory.dmp

    Filesize

    464KB

    Download

  • memory/2716-25-0x0000000000400000-0x0000000000474000-memory.dmp

    Filesize

    464KB

    Download

  • memory/2716-27-0x0000000000400000-0x0000000000474000-memory.dmp

    Filesize

    464KB

    Download