Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    8s
  • max time network
    21s
  • platform
    windows11-21h2_x64
  • resource
    win11-20250217-en
  • resource tags

    arch:x64arch:x86image:win11-20250217-enlocale:en-usos:windows11-21h2-x64system
  • submitted
    25/02/2025, 19:56

General

  • Target

    2adcf43d221de2f72ba5088dac3a3193219412882df711d095f04e3f5b40767c.exe

  • Size

    2.1MB

  • MD5

    57ebf50902949e13220b379c136db8a7

  • SHA1

    75d55564986c8fb2d24c2f467e9c0cd2196a2055

  • SHA256

    2adcf43d221de2f72ba5088dac3a3193219412882df711d095f04e3f5b40767c

  • SHA512

    77d90317289a247c1bda59e378b9073cf2c1a8d30763bd68c33b8a256f1dc2edb1f380dafd1572a2f762a4400f15d52c9375d4314c07faa3f78ee7011508de33

  • SSDEEP

    49152:6VkETZV9OLiWLunGxHqsEbtNPDLzA7YzminZ:VETAi4EgHqsEpFL

Malware Config

Signatures

  • BlackSuit

    A ransomware first detected in May 2023 linked to the Conti group.

  • Blacksuit_windows family
  • Detects the Windows variant of BlackSuit Ransomware 14 IoCs
  • Creates a large amount of network flows 1 TTPs

    This may indicate a network scan to discover remotely running services.

  • Renames multiple (967) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

  • Drops file in Program Files directory 64 IoCs
  • Program crash 1 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2adcf43d221de2f72ba5088dac3a3193219412882df711d095f04e3f5b40767c.exe
    C:\Users\Admin\AppData\Local\Temp\2adcf43d221de2f72ba5088dac3a3193219412882df711d095f04e3f5b40767c.exe cmd /c %payload% -id 00000000000000000000000000000000
    1⤵
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:1120
    • C:\Windows\SysWOW64\cmd.exe
      cmd.exe /c vssadmin delete shadows /all /quiet
      2⤵
      • System Location Discovery: System Language Discovery
      PID:3572
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 1120 -s 68268
      2⤵
      • Program crash
      PID:2344
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 364 -p 1120 -ip 1120
    1⤵
      PID:2424

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\ProgramData\readme.blacksuit.txt

      Filesize

      1KB

      MD5

      b998d433168b18428f7f7713d1851f23

      SHA1

      0a5023d699ed0d9b1c2b1d4d5138747d0eb8955a

      SHA256

      06453319ed3bd3fa04da6b9d1c2ada5eb445e1e0a878c0eb3af54f751dace513

      SHA512

      c1b2d9282cf887c5c41b9365aec04284c420442cd33d4eeded89a3a74501fe1bfe5058bcc26af952fe3e5c04b896db70352e3b6324d2d5329225138af9f0e11a

    • memory/1120-9-0x00000000024E0000-0x0000000002539000-memory.dmp

      Filesize

      356KB

    • memory/1120-6-0x00000000024E0000-0x0000000002539000-memory.dmp

      Filesize

      356KB

    • memory/1120-4-0x00000000024E0000-0x0000000002539000-memory.dmp

      Filesize

      356KB

    • memory/1120-11-0x00000000024E0000-0x0000000002539000-memory.dmp

      Filesize

      356KB

    • memory/1120-12-0x00000000024E0000-0x0000000002539000-memory.dmp

      Filesize

      356KB

    • memory/1120-3-0x00000000024E0000-0x0000000002539000-memory.dmp

      Filesize

      356KB

    • memory/1120-1-0x00000000024E0000-0x0000000002539000-memory.dmp

      Filesize

      356KB

    • memory/1120-8-0x00000000024E0000-0x0000000002539000-memory.dmp

      Filesize

      356KB

    • memory/1120-10-0x00000000024E0000-0x0000000002539000-memory.dmp

      Filesize

      356KB

    • memory/1120-7-0x00000000024E0000-0x0000000002539000-memory.dmp

      Filesize

      356KB

    • memory/1120-0-0x0000000000400000-0x0000000000622000-memory.dmp

      Filesize

      2.1MB

    • memory/1120-5-0x00000000024E0000-0x0000000002539000-memory.dmp

      Filesize

      356KB

    • memory/1120-15-0x00000000024E0000-0x0000000002539000-memory.dmp

      Filesize

      356KB

    • memory/1120-2-0x00000000024E0000-0x0000000002539000-memory.dmp

      Filesize

      356KB

    • memory/1120-200-0x00000000024E0000-0x0000000002539000-memory.dmp

      Filesize

      356KB