Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

10

Static

static

4cae449450...58.exe

windows7_x64

10

4cae449450...58.exe

windows10_x64

10

Analysis

  • max time kernel
    142s
  • max time network
    36s
  • platform
    windows7_x64
  • resource
    win7v200430
  • submitted
    28/06/2020, 16:12

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    4cae449450c07b7aa74314173c7b00d409eabfe22b86859f3b3acedd66010458.exe

  • Size

    156KB

  • MD5

    fcd21c6fca3b9378961aa1865bee7ecb

  • SHA1

    0abaa05da2a05977e0baf68838cff1712f1789e0

  • SHA256

    4cae449450c07b7aa74314173c7b00d409eabfe22b86859f3b3acedd66010458

  • SHA512

    e39c1f965f6faeaa33dfec6eba23fbfff14b287f4777797ea79480bb037d6d806516bda7046315e051961fce12e935ac546819c1e0bef5c33568d68955a9792a

Score
10/10
ransomwareevasion

Malware Config

Extracted

Path

C:\MSOCache\All Users\{90140000-0011-0000-1000-0000000FF1CE}-C\!TXDOT_READ_ME!.txt

Ransom Note
Greetings, Texas Department of Transportation! Read this message CAREFULLY and contact someone from IT department. Your files are securely ENCRYPTED. No third party decryption software EXISTS. MODIFICATION or RENAMING encrypted files may cause decryption failure. You can send us an encrypted file (not greater than 400KB) and we will decrypt it FOR FREE, so you have no doubts in possibility to restore all files from all affected systems ANY TIME. Encrypted file SHOULD NOT contain sensitive information (technical, backups, databases, large documents). The rest of data will be available after the PAYMENT. Infrastructure rebuild will cost you MUCH more. Contact us ONLY if you officially represent the whole affected network. The ONLY attachments we accept are non archived encrypted files for test decryption. Speak ENGLISH when contacting us. Mail us: [email protected] We kindly ask you not to use GMAIL, YAHOO or LIVE to contact us. The PRICE depends on how quickly you do it. �

Signatures

  • Deletes backup catalog 3 TTPs 1 IoCs

    Uses wbadmin.exe to inhibit system recovery.

    ransomware
  • Suspicious use of AdjustPrivilegeToken 13 IoCs
  • Disables use of System Restore points 1 TTPs
    evasion
  • Deletes system backup catalog 2 TTPs

    Ransomware often tries to delete backup files to inhibit system recovery.

    ransomware
  • Clears Windows event logs 1 TTPs
    evasionransomware
  • Suspicious behavior: EnumeratesProcesses 9 IoCs
  • Suspicious use of WriteProcessMemory 48 IoCs
  • Modifies boot configuration data using bcdedit 1 TTPs 2 IoCs
    ransomwareevasion

Processes

  • C:\Users\Admin\AppData\Local\Temp\4cae449450c07b7aa74314173c7b00d409eabfe22b86859f3b3acedd66010458.exe
    "C:\Users\Admin\AppData\Local\Temp\4cae449450c07b7aa74314173c7b00d409eabfe22b86859f3b3acedd66010458.exe"
    1⤵
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:1520
    • C:\Windows\System32\fsutil.exe
      "C:\Windows\System32\fsutil.exe" usn deletejournal /D C:
      2⤵
        PID:1340
      • C:\Windows\System32\schtasks.exe
        "C:\Windows\System32\schtasks.exe" /Change /TN "\Microsoft\Windows\SystemRestore\SR" /disable
        2⤵
          PID:628
        • C:\Windows\SysWOW64\cipher.exe
          "C:\Windows\System32\cipher.exe" /w:D:
          2⤵
            PID:956
          • C:\Windows\SysWOW64\cipher.exe
            "C:\Windows\System32\cipher.exe" /w:C:
            2⤵
              PID:300
            • C:\Windows\System32\bcdedit.exe
              "C:\Windows\System32\bcdedit.exe" /set {default} bootstatuspolicy ignoreallfailures
              2⤵
              • Modifies boot configuration data using bcdedit
              PID:632
            • C:\Windows\System32\bcdedit.exe
              "C:\Windows\System32\bcdedit.exe" /set {default} recoveryenabled no
              2⤵
              • Modifies boot configuration data using bcdedit
              PID:1904
            • C:\Windows\System32\wbadmin.exe
              "C:\Windows\System32\wbadmin.exe" delete catalog -quiet
              2⤵
              • Deletes backup catalog
              PID:1644
            • C:\Windows\System32\wevtutil.exe
              "C:\Windows\System32\wevtutil.exe" sl Security /e:false
              2⤵
              • Suspicious use of AdjustPrivilegeToken
              PID:1604
            • C:\Windows\System32\wevtutil.exe
              "C:\Windows\System32\wevtutil.exe" cl Security
              2⤵
              • Suspicious use of AdjustPrivilegeToken
              PID:1616
            • C:\Windows\System32\wevtutil.exe
              "C:\Windows\System32\wevtutil.exe" cl System
              2⤵
              • Suspicious use of AdjustPrivilegeToken
              PID:1608
            • C:\Windows\System32\wevtutil.exe
              "C:\Windows\System32\wevtutil.exe" cl Setup
              2⤵
              • Suspicious use of AdjustPrivilegeToken
              PID:1648
            • C:\Windows\System32\wevtutil.exe
              "C:\Windows\System32\wevtutil.exe" cl Application
              2⤵
              • Suspicious use of AdjustPrivilegeToken
              PID:1624
          • C:\Windows\system32\wbengine.exe
            "C:\Windows\system32\wbengine.exe"
            1⤵
            • Suspicious use of AdjustPrivilegeToken
            PID:1864
          • C:\Windows\System32\vdsldr.exe
            C:\Windows\System32\vdsldr.exe -Embedding
            1⤵
              PID:1932
            • C:\Windows\System32\vds.exe
              C:\Windows\System32\vds.exe
              1⤵
                PID:1916

              Network

              MITRE ATT&CK Enterprise v6

              Replay Monitor

              Loading Replay Monitor...

              Downloads