Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
113s -
max time network
159s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
02/10/2022, 13:32
Static task
static1
Behavioral task
behavioral1
Sample
5040f8ecb29928c42b4c2987a2720ae531e03e5befd2fe798f0779fa99286620.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
5040f8ecb29928c42b4c2987a2720ae531e03e5befd2fe798f0779fa99286620.exe
Resource
win10v2004-20220812-en
General
-
Target
5040f8ecb29928c42b4c2987a2720ae531e03e5befd2fe798f0779fa99286620.exe
-
Size
139KB
-
MD5
6ec08512d5f95271c8a8317654c9c700
-
SHA1
8e0836c1d793863d76ea4e463c50ea70c6d1bff0
-
SHA256
5040f8ecb29928c42b4c2987a2720ae531e03e5befd2fe798f0779fa99286620
-
SHA512
ab4777cab7c7671ddbb63766a2b4f9524eebe1fcedb7db1eadd9e7936f613fad2f9bb77f931ed60306c3dcffbac47a793127ff93766d1077d14f686bd5d46e08
-
SSDEEP
3072:4gXdZt9P6D3XJcMufNC0Rc1SOCsC3FFkX1Sl9vwlH6EePM2d+a:4e34fENCEVFklSl9oVs+a
Malware Config
Signatures
-
Executes dropped EXE 2 IoCs
pid Process 1108 LTransmogProvider.exe 948 LTransmogProvider.exe -
Loads dropped DLL 3 IoCs
pid Process 1472 5040f8ecb29928c42b4c2987a2720ae531e03e5befd2fe798f0779fa99286620.exe 1472 5040f8ecb29928c42b4c2987a2720ae531e03e5befd2fe798f0779fa99286620.exe 1108 LTransmogProvider.exe -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce LTransmogProvider.exe -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 1108 set thread context of 948 1108 LTransmogProvider.exe 29 -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 948 LTransmogProvider.exe 948 LTransmogProvider.exe 948 LTransmogProvider.exe 948 LTransmogProvider.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 1108 LTransmogProvider.exe -
Suspicious use of WriteProcessMemory 13 IoCs
description pid Process procid_target PID 1472 wrote to memory of 1108 1472 5040f8ecb29928c42b4c2987a2720ae531e03e5befd2fe798f0779fa99286620.exe 28 PID 1472 wrote to memory of 1108 1472 5040f8ecb29928c42b4c2987a2720ae531e03e5befd2fe798f0779fa99286620.exe 28 PID 1472 wrote to memory of 1108 1472 5040f8ecb29928c42b4c2987a2720ae531e03e5befd2fe798f0779fa99286620.exe 28 PID 1472 wrote to memory of 1108 1472 5040f8ecb29928c42b4c2987a2720ae531e03e5befd2fe798f0779fa99286620.exe 28 PID 1108 wrote to memory of 948 1108 LTransmogProvider.exe 29 PID 1108 wrote to memory of 948 1108 LTransmogProvider.exe 29 PID 1108 wrote to memory of 948 1108 LTransmogProvider.exe 29 PID 1108 wrote to memory of 948 1108 LTransmogProvider.exe 29 PID 1108 wrote to memory of 948 1108 LTransmogProvider.exe 29 PID 1108 wrote to memory of 948 1108 LTransmogProvider.exe 29 PID 1108 wrote to memory of 948 1108 LTransmogProvider.exe 29 PID 1108 wrote to memory of 948 1108 LTransmogProvider.exe 29 PID 1108 wrote to memory of 948 1108 LTransmogProvider.exe 29
Processes
-
C:\Users\Admin\AppData\Local\Temp\5040f8ecb29928c42b4c2987a2720ae531e03e5befd2fe798f0779fa99286620.exe"C:\Users\Admin\AppData\Local\Temp\5040f8ecb29928c42b4c2987a2720ae531e03e5befd2fe798f0779fa99286620.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1472 -
C:\Users\Admin\AppData\Local\Temp\LTransmogProvider.exeC:\Users\Admin\AppData\Local\Temp\LTransmogProvider.exe2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1108 -
C:\Users\Admin\AppData\Local\Temp\LTransmogProvider.exeC:\Users\Admin\AppData\Local\Temp\LTransmogProvider.exe3⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
PID:948
-
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
76KB
MD57c2b1af9b725c26a53c16f68db686b34
SHA19b7cdca383f9cdb524a36fbb8ed67454c2232bea
SHA256c518973042a48ea9a3c29690407d0e89d5c5da199e0d7647f087f15989126a8b
SHA512afe87e2f984f8e94ff9297fb180d624e4d5279d923427566fe3c465d5f9f839d602163b1a36e0b6af0edeca400c547d9076da49d132740f52b15c70502d81138
-
Filesize
76KB
MD57c2b1af9b725c26a53c16f68db686b34
SHA19b7cdca383f9cdb524a36fbb8ed67454c2232bea
SHA256c518973042a48ea9a3c29690407d0e89d5c5da199e0d7647f087f15989126a8b
SHA512afe87e2f984f8e94ff9297fb180d624e4d5279d923427566fe3c465d5f9f839d602163b1a36e0b6af0edeca400c547d9076da49d132740f52b15c70502d81138
-
Filesize
76KB
MD57c2b1af9b725c26a53c16f68db686b34
SHA19b7cdca383f9cdb524a36fbb8ed67454c2232bea
SHA256c518973042a48ea9a3c29690407d0e89d5c5da199e0d7647f087f15989126a8b
SHA512afe87e2f984f8e94ff9297fb180d624e4d5279d923427566fe3c465d5f9f839d602163b1a36e0b6af0edeca400c547d9076da49d132740f52b15c70502d81138
-
Filesize
83KB
MD598c52c6a9ed7a21e856a1436bcc81b12
SHA1b2d5b87dde9e396063ca6074eccef01bd088dd0f
SHA2569dc59a3a6411646c1708c375a19ed2b57823fb5f033df44cb6959fea6dc8268e
SHA5123acd7ede5203607e6bd9430b86b6ab27e2e81f487ac0b4db61acf4c0cbd8b93d5ad9c0e59cebf30753d174bbc43e5732557e062c51738bba23dad2b1f30ef77d
-
Filesize
76KB
MD57c2b1af9b725c26a53c16f68db686b34
SHA19b7cdca383f9cdb524a36fbb8ed67454c2232bea
SHA256c518973042a48ea9a3c29690407d0e89d5c5da199e0d7647f087f15989126a8b
SHA512afe87e2f984f8e94ff9297fb180d624e4d5279d923427566fe3c465d5f9f839d602163b1a36e0b6af0edeca400c547d9076da49d132740f52b15c70502d81138
-
Filesize
76KB
MD57c2b1af9b725c26a53c16f68db686b34
SHA19b7cdca383f9cdb524a36fbb8ed67454c2232bea
SHA256c518973042a48ea9a3c29690407d0e89d5c5da199e0d7647f087f15989126a8b
SHA512afe87e2f984f8e94ff9297fb180d624e4d5279d923427566fe3c465d5f9f839d602163b1a36e0b6af0edeca400c547d9076da49d132740f52b15c70502d81138
-
Filesize
76KB
MD57c2b1af9b725c26a53c16f68db686b34
SHA19b7cdca383f9cdb524a36fbb8ed67454c2232bea
SHA256c518973042a48ea9a3c29690407d0e89d5c5da199e0d7647f087f15989126a8b
SHA512afe87e2f984f8e94ff9297fb180d624e4d5279d923427566fe3c465d5f9f839d602163b1a36e0b6af0edeca400c547d9076da49d132740f52b15c70502d81138