Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

10

Static

static

3

d4a847fa9c...66.exe

windows7-x64

10

d4a847fa9c...66.exe

windows10-2004-x64

10

Resubmissions

25/09/2024, 04:58

240925-fl3nvszang 10

06/09/2023, 03:10

230906-dn8lsada93 10

Analysis

  • max time kernel
    150s
  • max time network
    18s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    25/09/2024, 04:58

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    d4a847fa9c4c7130a852a2e197b205493170a8b44426d9ec481fc4b285a92666.exe

  • Size

    146KB

  • MD5

    059175be5681a633190cd9631e2975f6

  • SHA1

    fb4ad5d21f0d8c6755eb4addba0ac288bd2574b6

  • SHA256

    d4a847fa9c4c7130a852a2e197b205493170a8b44426d9ec481fc4b285a92666

  • SHA512

    3a6c7667161ad9122785b6ef988d59f473b517e32e93c786c6a551d4c631f0ca82de1d262a056928935f05aa6723a7fe983158011e53042743194899c3e912e7

  • SSDEEP

    3072:sdjFOoTVq4m0zRilymyU3pQuz1T5SKiVi6:4M2ZmEoL3Cu6K

Score
10/10
undergrounddefense_evasionexecutionimpactransomware

Malware Config

Extracted

Path

C:\Program Files\7-Zip\!!readme!!!.txt

Family

underground

Ransom Note
The Underground team welcomes you! We would like to inform that your network has been tested by us for vulnerabilities. Poor network security could cause your data to be lost forever. Your files are currently encrypted, they can be restored to their original state with a decryptor key that only we have. The key is in a single copy on our server. Attempting to recover data by your own efforts may result in data loss. It is important not to change their current state. Each file additionally has a unique cipher, which you can restore only with our help. We also examined your infrastructure and downloaded the most sensitive data. The list of hosts from which the information was downloaded: - 172.16.10.77 (NBA230.tpa.local) - 172.16.10.51 (SBAFS02.TPA.LOCAL) - 172.16.10.75 (NBA191.tpa.local) - 172.16.10.85 (NBA235.tpa.local) - 172.16.10.87 (NBA254.tpa.local) - 10.10.10.30 Synology (access via OpenVPN 46.29.3.77:1194) ---------------------------------- -email communications with clients that contain confidential agreements -accounting and tax reports for each client -audit documents -companys and clients financial documents -clients passports/ID's and private information -documents contain privileged and confidential information -password-protected documents from a bank -payroll data -company financial and performance data -employees personal information (Tc Identification Numbers) The total amount of downloaded information more than 200 Gb If you do not contact us within 3 days, or we cannot reach an agreement, all data will be published on a site that no one can block. Confidential data can be helpful for your competitors, enemies and darknet market hackers from over the world. The consequences will be unpredictable and the process cannot be stopped. Information about data leaks is bound to get into the media. Your company's reputation will be damaged. We value and respect every business, including yours. Therefore, we suggest you avoid further negative consequences and return to your work as soon as possible. We guarantee a fair and confidential deal in the shortest possible time. You will not only receive a decryptor, but also a description of your network vulnerabilities and information security recommendations. If necessary, you will be provided with qualified data recovery assistance. You can trust us! Reputation is important to everyone. As a proof of our statements, we are ready to restore some files for free and demonstrate how our product works. Best regards, Underground team ! Contacts for communication via chat: login to your account (Tor Browser) http://undgrddapc4reaunnrdrmnagvdelqfvmgycuvilgwb5uxm25sxawaoqd.onion/ your login: TPA your password: 7knCN#zQo@zuDZi your ID: dc6cb895e1681c716fcbbea57a8417a2
URLs

http://undgrddapc4reaunnrdrmnagvdelqfvmgycuvilgwb5uxm25sxawaoqd.onion/

Signatures

  • Underground Team

    Underground Team is a ransomware first seen in July 2023 that is primarily distriuted via exploting vulnerabilities.

    ransomwareunderground
  • Deletes shadow copies 3 TTPs

    Ransomware often targets backup files to inhibit system recovery.

    ransomwaredefense_evasionimpactexecution
  • Drops desktop.ini file(s) 40 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Interacts with shadow copies 3 TTPs 2 IoCs

    Shadow copies are often targeted by ransomware to inhibit system recovery.

    ransomware
  • Modifies registry key 1 TTPs 2 IoCs
  • Runs net.exe
  • Suspicious use of AdjustPrivilegeToken 3 IoCs
  • Suspicious use of WriteProcessMemory 24 IoCs
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware

Processes

  • C:\Users\Admin\AppData\Local\Temp\d4a847fa9c4c7130a852a2e197b205493170a8b44426d9ec481fc4b285a92666.exe
    "C:\Users\Admin\AppData\Local\Temp\d4a847fa9c4c7130a852a2e197b205493170a8b44426d9ec481fc4b285a92666.exe"
    1⤵
    • Drops desktop.ini file(s)
    • Drops file in Program Files directory
    • Suspicious use of WriteProcessMemory
    PID:280
    • C:\Windows\System32\vssadmin.exe
      "C:\Windows\System32\vssadmin.exe" delete shadows /all /quiet
      2⤵
      • Interacts with shadow copies
      PID:2588
    • C:\Windows\System32\reg.exe
      "C:\Windows\System32\reg.exe" add HKLM\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services / v MaxDisconnectionTime / t REG_DWORD / d 1209600000 / f
      2⤵
      • Modifies registry key
      PID:2836
    • C:\Windows\System32\net.exe
      "C:\Windows\System32\net.exe" stop MSSQLSERVER /f /m
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:2744
      • C:\Windows\system32\net1.exe
        C:\Windows\system32\net1 stop MSSQLSERVER /f /m
        3⤵
          PID:2800
      • C:\Windows\System32\vssadmin.exe
        "C:\Windows\System32\vssadmin.exe" delete shadows /all /quiet
        2⤵
        • Interacts with shadow copies
        PID:2604
      • C:\Windows\System32\reg.exe
        "C:\Windows\System32\reg.exe" add HKLM\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services / v MaxDisconnectionTime / t REG_DWORD / d 1209600000 / f
        2⤵
        • Modifies registry key
        PID:2100
      • C:\Windows\System32\net.exe
        "C:\Windows\System32\net.exe" stop MSSQLSERVER /f /m
        2⤵
        • Suspicious use of WriteProcessMemory
        PID:2372
        • C:\Windows\system32\net1.exe
          C:\Windows\system32\net1 stop MSSQLSERVER /f /m
          3⤵
            PID:1624
      • C:\Windows\system32\vssvc.exe
        C:\Windows\system32\vssvc.exe
        1⤵
        • Suspicious use of AdjustPrivilegeToken
        PID:2928

      Network

      MITRE ATT&CK Enterprise v15

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\Program Files\7-Zip\!!readme!!!.txt
        Filesize

        2KB

        MD5

        138279c8f0163f97e43be9764db21a86

        SHA1

        f95395e97a0668fb0770fbdf1fe0f2aa23398ed2

        SHA256

        ea63e6798b94e184ce486048867abfd0f0fd2268c19909d5251dc07b137208f1

        SHA512

        4d64f91ed7dedc6e1c6abe99b8fc110802ff52505a1bb8ce8f9c36378cb12dcce5aff45914220cba3026b3d4a089bc96499ac5979c99ce5e2c5ad347c8ad588a

        Download Submit