Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

8

Static

static

LenovoLegi...up.exe

windows10-1703-x64

8

LenovoLegi...up.exe

windows10-2004-x64

8

Resubmissions

06/10/2022, 12:44

221006-pyhc5ahdc6 8

06/10/2022, 12:40

221006-pwakhahdc4 8

Sharing

Copy URL
Twitter E-mail

General

  • Target

    LenovoLegionToolkitSetup.exe

  • Size

    4.8MB

  • Sample

    221006-pwakhahdc4

  • MD5

    4bb04adada4e23c0bbb20ea5cbb744eb

  • SHA1

    f4f270a57c89cfe44ea20cda0d6d83cd1b471ac9

  • SHA256

    879e45078db5e25ff7d7f06162da04982b63fdb60a91b578626124c50186d26b

  • SHA512

    c01a41d165a8ce4c912f60b6b4fc08791239b8a487e2537e49ce2d37251948fb98b24d4af6320aaa6cdee22cff6b5a0b96cfa2a190e1621f9923c037145eb558

  • SSDEEP

    98304:7kLjeoEDK0ONsA41YOuEDb28kpgmCyKr3xZ2XilWDnE55ljf:w6oEDfQiYvE32Gy43xZ2Xt2nr

Score
8/10
discoverypersistence

Malware Config

Targets

    • Target

      LenovoLegionToolkitSetup.exe

    • Size

      4.8MB

    • MD5

      4bb04adada4e23c0bbb20ea5cbb744eb

    • SHA1

      f4f270a57c89cfe44ea20cda0d6d83cd1b471ac9

    • SHA256

      879e45078db5e25ff7d7f06162da04982b63fdb60a91b578626124c50186d26b

    • SHA512

      c01a41d165a8ce4c912f60b6b4fc08791239b8a487e2537e49ce2d37251948fb98b24d4af6320aaa6cdee22cff6b5a0b96cfa2a190e1621f9923c037145eb558

    • SSDEEP

      98304:7kLjeoEDK0ONsA41YOuEDb28kpgmCyKr3xZ2XilWDnE55ljf:w6oEDfQiYvE32Gy43xZ2Xt2nr

    Score
    8/10
    discoverypersistence

    • Blocklisted process makes network request

    • Downloads MZ/PE file

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

      discovery

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks