Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
110s -
max time network
117s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
07/01/2025, 02:26
General
-
Target
fe95cbedb9018ba0dbd0d78a82110a775a131c57f627e620171300f1fe0a40c6.exe
-
Size
395KB
-
MD5
9b55e3dbb34b1d422fe46487f42019a6
-
SHA1
ecc8ee4fe83f00d2b307a17ce4a323646aece2e0
-
SHA256
fe95cbedb9018ba0dbd0d78a82110a775a131c57f627e620171300f1fe0a40c6
-
SHA512
8a0fca1dc36bf9053eab2a2c4e549e83e192b2b34e8ef814e031274d37157d13b2d02befb795195acb28af1a201a39dcb9356f2dad2187aaf4f5e86de051ae45
-
SSDEEP
6144:j/44D6oSKZyjhi7+jxF07ETxj85zdBdy+66lmppOLZB5wr:rp67KUA+jxG7eIHB6QLF+
Malware Config
Extracted
C:\Users\Admin\AppData\Roaming\# DECRYPT MY FILES #.txt
cerber
http://bqyjebfh25oellur.onion.to/E924-E80A-35C0-0072-BFD1
http://bqyjebfh25oellur.onion.cab/E924-E80A-35C0-0072-BFD1
http://bqyjebfh25oellur.onion.nu/E924-E80A-35C0-0072-BFD1
http://bqyjebfh25oellur.onion.link/E924-E80A-35C0-0072-BFD1
http://bqyjebfh25oellur.tor2web.org/E924-E80A-35C0-0072-BFD1
http://bqyjebfh25oellur.onion/E924-E80A-35C0-0072-BFD1
Extracted
C:\Users\Admin\AppData\Roaming\# DECRYPT MY FILES #.html
Signatures
-
Cerber
Cerber is a widely used ransomware-as-a-service (RaaS), first seen in 2017.
-
Cerber family
-
Adds policy Run key to start application 2 TTPs 2 IoCs
-
Contacts a large (524) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
-
Deletes itself 1 IoCs
-
Drops startup file 2 IoCs
-
Executes dropped EXE 2 IoCs
-
Loads dropped DLL 3 IoCs
-
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 4 IoCs
-
Checks whether UAC is enabled 1 TTPs 1 IoCs
-
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Sets desktop wallpaper using registry 2 TTPs 1 IoCs
-
Drops file in Program Files directory 15 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 9 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 4 IoCs
Adversaries may check for Internet connectivity on compromised systems.
-
Kills process with taskkill 2 IoCs
-
Modifies Control Panel 4 IoCs
-
Modifies Internet Explorer settings 1 TTPs 57 IoCs
-
Runs ping.exe 1 TTPs 2 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of AdjustPrivilegeToken 5 IoCs
-
Suspicious use of FindShellTrayWindow 2 IoCs
-
Suspicious use of SetWindowsHookEx 10 IoCs
-
Suspicious use of UnmapMainImage 3 IoCs
-
Suspicious use of WriteProcessMemory 50 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\fe95cbedb9018ba0dbd0d78a82110a775a131c57f627e620171300f1fe0a40c6.exe"C:\Users\Admin\AppData\Local\Temp\fe95cbedb9018ba0dbd0d78a82110a775a131c57f627e620171300f1fe0a40c6.exe"1⤵
- Adds policy Run key to start application
- Drops startup file
- Loads dropped DLL
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Modifies Control Panel
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\{0FB3C083-DBC2-04E3-36AB-7D13DD964B1E}\expand.exe"C:\Users\Admin\AppData\Roaming\{0FB3C083-DBC2-04E3-36AB-7D13DD964B1E}\expand.exe"2⤵
- Adds policy Run key to start application
- Drops startup file
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Checks whether UAC is enabled
- Sets desktop wallpaper using registry
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Modifies Control Panel
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\Desktop\# DECRYPT MY FILES #.html3⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1952 CREDAT:275457 /prefetch:24⤵
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
-
-
-
C:\Windows\system32\NOTEPAD.EXE"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\# DECRYPT MY FILES #.txt3⤵
-
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\# DECRYPT MY FILES #.vbs"3⤵
-
-
C:\Windows\system32\cmd.exe/d /c taskkill /t /f /im "expand.exe" > NUL & ping -n 1 127.0.0.1 > NUL & del "C:\Users\Admin\AppData\Roaming\{0FB3C083-DBC2-04E3-36AB-7D13DD964B1E}\expand.exe" > NUL3⤵
- System Network Configuration Discovery: Internet Connection Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\taskkill.exetaskkill /t /f /im "expand.exe"4⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\PING.EXEping -n 1 127.0.0.14⤵
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
-
-
-
-
C:\Windows\SysWOW64\cmd.exe/d /c taskkill /t /f /im "fe95cbedb9018ba0dbd0d78a82110a775a131c57f627e620171300f1fe0a40c6.exe" > NUL & ping -n 1 127.0.0.1 > NUL & del "C:\Users\Admin\AppData\Local\Temp\fe95cbedb9018ba0dbd0d78a82110a775a131c57f627e620171300f1fe0a40c6.exe" > NUL2⤵
- Deletes itself
- System Location Discovery: System Language Discovery
- System Network Configuration Discovery: Internet Connection Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\taskkill.exetaskkill /t /f /im "fe95cbedb9018ba0dbd0d78a82110a775a131c57f627e620171300f1fe0a40c6.exe"3⤵
- System Location Discovery: System Language Discovery
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\PING.EXEping -n 1 127.0.0.13⤵
- System Location Discovery: System Language Discovery
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
-
-
-
C:\Windows\system32\taskeng.exetaskeng.exe {766D71AA-23B7-40A0-88A9-B31F16D94BC1} S-1-5-21-2872745919-2748461613-2989606286-1000:CCJBVTGQ\Admin:Interactive:[1]1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\{0FB3C083-DBC2-04E3-36AB-7D13DD964B1E}\expand.exeC:\Users\Admin\AppData\Roaming\{0FB3C083-DBC2-04E3-36AB-7D13DD964B1E}\expand.exe2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of UnmapMainImage
-
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" -Embedding1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2988 CREDAT:275457 /prefetch:22⤵
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
-
-
C:\Windows\SysWOW64\DllHost.exeC:\Windows\SysWOW64\DllHost.exe /Processid:{3F6B5E16-092A-41ED-930B-0B4125D91D4E}1⤵
- System Location Discovery: System Language Discovery
Network
MITRE ATT&CK Enterprise v15
Privilege Escalation
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
2Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
342B
MD58f3e8fc80654cfed9f66cf762a4c7c21
SHA195ee7fc8216cd26bd503e3679898aa241df0dbba
SHA2567858097cf2423dba31da00e1e1fb1af65d4a985d283076b6117218847434dc27
SHA512d1b2ab42d7ec27ed18c1f865cb32e2c93d11c8f010696d2812ac5fb10ffa61c4da97095e0ca7b88a5b2724d05fff46ceab6be2144638cf05ac81905af276c88b
-
Filesize
342B
MD5af0eb69eb02778e915d36351e7fd61c9
SHA1a1e2a7c5a7e7421c085905db3019439416f94197
SHA25692b07d5e7389d3b0fd09abe156d818ed8884c39ee98c3b3496f17be218e56f94
SHA51291a895403e503667c3e54d2fff4c8c1b13d1fb93fa6e4b00a59418c32ba932b5f16c069f3f5b242cbff42569ff8417afef02919147a39f4d6e5113ae11f02158
-
Filesize
342B
MD51a2eec03cae4119e45501fabd1a1a511
SHA1a3c5b2dc5cb6a1456f6fcfa6c5909e2aa314705d
SHA256e38af88f4428a320636a9a1af228098b23cdc575ddd5e71aec7c2f7504694cc2
SHA51271132dd91f389a44ea0b2aa6eb1e64feb5922332068c9223ff9dbaf16a0952c59013923d1c2f92143aed292f1708826e026696bb0ba29a87deaf44019bc684d3
-
Filesize
342B
MD569c9c081dca603954e2b05d41993cf59
SHA14c6c9471da4d19d38f6ff2bd984d025033452375
SHA2565fe56894995f769110c013b5685ed210dc065c94b8dddbe44f39df111502f0ef
SHA5120e0a27e2a89a3c5369dd86f8713e9cae085c1f27189cd5431f2469bdef8a591c1003e115233cee15981e1fc81819bc4431fe8848bfd8903f0e03b0f20a7856b8
-
Filesize
342B
MD50b57500342b3d39acb676b818f97fd82
SHA1455165b34d091cd0c34df86c29d9e5975554eb95
SHA25656ecbfc9a075f02e8d7ba156ff34ce58e3be3da2795ed9256bad5af8f6e6c370
SHA5125336f59367dcc4c3ecb7154c1783d33c81bbc8202db9fabf31b2eebacbcf2f928a3074668d9c183ab8857d7cbbfcb36937242748b478dedef58f2eb98bafd48a
-
Filesize
342B
MD5ba25f32103ae129869f81e87a495f3db
SHA11eb98419c8c2c58b36a65c841ed2a085056933d9
SHA256adea9d5b3af9a2ba04398c11d4a1372f601ee369c01491ba2127239dbe9896f1
SHA512085304d63a7b6ac1df6288c12c2a4f2114c451f7e470be8f78d7da351e5001a89b4d39bc35baecca04c48849472f12075bc036a34b9495960493cb2a364c879f
-
Filesize
342B
MD59a75f99aedccb078f1378b6a34006389
SHA14c77db2bd9cdb60e9b9dc5948af81096b8515b4a
SHA2560b52bb9bbe1149c8eb1c491a47167ea1c98c0bc424006157c1d956ee5660e273
SHA51233f2c23a22d018f91e65b7cda892aa2a2fe7271dba3d5fee53ccaa1ad4df16940dcf43bbef80a29c6da8f86c43ef965f9b9e479945f589d890f8388c2872f565
-
Filesize
342B
MD550ba995867961b81fcf11064a6b0cbff
SHA1ffc7f38896ab1812e6b40ceaa891311ac37b6d5f
SHA2569a731dd565d806ed3644e7daa30da3c7deda6e45548dd956fccf87ca47abbe92
SHA512fd1536c15ba6e1f2b2454365704315bbe73a9a23ef81edf60d8e4062c660a1917c96a6893f1c962362daa1225f7eedf1e63b9a2283604d59c34ee415a2fcd644
-
Filesize
342B
MD5f86be057140f26bed891fa69804e6df1
SHA1bddefc96ca0bf2acc171d297e0c15bca5f22171d
SHA25600ce96d7338f5fa48ae26bd6aaca0f992b0aabccb34edba205de66fcab89cb9d
SHA512f500f13c09307991e69eef9a31c91978bc677486a6b09ee4b0d6fd8048533771de6d4eacd2a1fdb09e28c368da9780e5d8d117f579a4c52281cac58170770b88
-
Filesize
342B
MD59d65c69386cf72fa6b5004b8a8bf937d
SHA1a0bec025457ab2d6dca75253b723a45f7f30aadc
SHA2567808ed74643a76c79aaa5fa8d2a6dca3d498aa2fb29dad20bae8ab70be269420
SHA512d1f781e89ce8cd2a4ad24d62c2c160c559b241c3c1e5fa6fa70cea9f76a6a8280bd8611babc39b7de30b8ad4c5cbbd5147016616f3cc1781211809251f7019e5
-
Filesize
342B
MD59b65e582d1c90c0d9c5400a3aad81420
SHA1019193651eea8aaa3b27500083f106832b1e36b2
SHA256d389785b409609734371797be364807c9bb9c532ba39553bac346373d3af8d60
SHA512101e10b89925d8af42d96a094b989c3f7378fb727c72432a7569f12089cd6421782c13994128fa674e6cc133744bda8aecedc2089e4c651d01d2879751235854
-
Filesize
4KB
MD57e40e72d17bb268f4467760ec55dea74
SHA182446a7d6cbb50a31e550f965fb70fc35940d1fe
SHA25621b51de0966c759f6d7ccdd9edc3a4662e78ca28b507fbd3a791fdce9de5613b
SHA51273d3caffac317a6c96e71754ea49f72227b118fd7ac1d77e9035433992d726ec6f031967e9e7ae50a2f14d1962397a44ffda2c14357caecc3870f3d04cfe5f51
-
Filesize
5KB
MD5777851f97b532eab74009b5a7e41f072
SHA17a16f5820310cd442d255f992642e68b4cefa98d
SHA2561dde14d16c541944ba14691698eb03dbebfe9f21ede41d8c5778b8d8898f31d3
SHA512a95ee4f65d676d549fe46fd921f8c0e4831b97de9eda29a6ace1649e0a9ac7e7e9da07182c8cb2b5e9bb1d71ed1d03dd06fe6e4e4498a98faa2c6422d89ac751
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b
-
Filesize
19KB
MD5591e3e3f8b979af27c5f9976624a788a
SHA17cacddfb92862c5523c39f9f0d8336fec268253e
SHA2562d1ffcfcf262bfffb2d0da71c0ea1546505a9f27ed07b4861537b101fd701831
SHA5128383e6b07465030dfa2f2ab1c19c04d39372b860b66b6eba9c65ee54ca031f68c699ea595835eeeabb2c964b891d31e7bde2768a4d376f04e50e6be8461b3ae3
-
Filesize
10KB
MD54f18dad2f65051cf69a1d948ee4cf910
SHA17f292f68ba52d64668f37f3acc3de4d6bd6f46c2
SHA2569ca6f4ea9a1b301a86c314be05b32c764b7ef55e42b57dd9f52d9de8fad0df0d
SHA512f486d58861513bdd1932f24ef8015d1106684665acbac4b7cab166d5ef63b52461532f6fb32afee6c5661dd3eefa8f0a8b3f74ea5082db4ad6219ab1f5d42def
-
Filesize
88B
MD5bdd8c37b1087f50df57785d650b14612
SHA18e9dfc5dba89cdbeb753ec5b1347575b3d32b145
SHA256278d50cc2cb82845e56ae2dfc9a6ddd3a7b5355b2848a47b8e894e25c04f80e2
SHA5126fed56ea695bd6c7d45913fce4cc3a7b675e6a847dda9596acc5468dabdf7869f1a4ae3fe0ac9b093c6a6e5de6047594344082ac0d2cda4ca73a49249be83550
-
Filesize
246B
MD5d3e80e1e6dffc81a2e72c05c9b482fc6
SHA1bdcca42f5f612531bc5a4d14af649fa8a80bab34
SHA256f7902386a8d4572575441be399933b81fa4a16090925ef49a3914cff256f806b
SHA5123e5bfc95e0b3c80b6edf8d63157456f3a918d93db972ed4868539eabf63a1e737dbbb8d320e9f9e490d08aa7f7458bad67e8220f7df3e3f725b01b44b0564680
-
Filesize
1KB
MD5276abd64b9020529b33506a8e36844e2
SHA12733afb714001de12f8e9caf2fcd8d92738fb9fd
SHA256dbbe3bf855f9c36ad2068dcb39f203596d736226ae6b44029a831f80851f4184
SHA51215df00fb5010093e654145a171f315c2644b6308073c0126bde013cb1d740a137176f865f10d337259c583cc03b77b7a3a7cde27ef895f6ad99bcb96fb059f7b
-
Filesize
395KB
MD59b55e3dbb34b1d422fe46487f42019a6
SHA1ecc8ee4fe83f00d2b307a17ce4a323646aece2e0
SHA256fe95cbedb9018ba0dbd0d78a82110a775a131c57f627e620171300f1fe0a40c6
SHA5128a0fca1dc36bf9053eab2a2c4e549e83e192b2b34e8ef814e031274d37157d13b2d02befb795195acb28af1a201a39dcb9356f2dad2187aaf4f5e86de051ae45
-
Filesize
160KB
-
Filesize
160KB
-
Filesize
160KB
-
Filesize
160KB
-
Filesize
160KB
-
Filesize
160KB
-
Filesize
160KB
-
Filesize
160KB
-
Filesize
160KB
-
Filesize
160KB
-
Filesize
160KB
-
Filesize
160KB
-
Filesize
160KB
-
Filesize
160KB
-
Filesize
8KB
-
Filesize
160KB
-
Filesize
160KB
-
Filesize
160KB
-
Filesize
160KB
-
Filesize
160KB
-
Filesize
160KB
-
Filesize
160KB
-
Filesize
160KB
-
Filesize
160KB
-
Filesize
152KB
-
Filesize
160KB
-
Filesize
160KB
-
Filesize
160KB
-
Filesize
160KB