Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    134s
  • max time network
    153s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220812-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
  • submitted
    03/11/2022, 21:39

General

  • Target

    file.exe

  • Size

    811KB

  • MD5

    cc25b34fae0fab4310a268da338a6fca

  • SHA1

    54ae3e4451557295cefc0cad7685ba223a66ef29

  • SHA256

    1c4b01e1cc2b754ed518f940a1ac36d0b41a6b2ef0699679d970ebaadcc42446

  • SHA512

    39a52578f9e21cf78b7be5bf5447a677110c407b4e8b05aec17fd43c8ad1afc15f1c0c4825bd5e82abae9ec1859ccdf4ef47290feb2189085848142454dc519b

  • SSDEEP

    12288:5zOf/G5jWDiMB00nwVzMmd9CRnm1cNj9KHhShnKjxazKes7H:5yXIjaFLwRMmWm1cNh6hShKjxaq

Malware Config

Signatures

  • Detects LgoogLoader payload 1 IoCs
  • LgoogLoader

    A downloader capable of dropping and executing other malware families.

  • Executes dropped EXE 2 IoCs
  • Loads dropped DLL 6 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Enumerates processes with tasklist 1 TTPs 2 IoCs
  • Runs ping.exe 1 TTPs 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 6 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of FindShellTrayWindow 3 IoCs
  • Suspicious use of SendNotifyMessage 3 IoCs
  • Suspicious use of WriteProcessMemory 38 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\file.exe
    "C:\Users\Admin\AppData\Local\Temp\file.exe"
    1⤵
    • Adds Run key to start application
    • Suspicious use of WriteProcessMemory
    PID:5000
    • C:\Windows\SysWOW64\bitsadmin.exe
      bitsadmin bitsadmin bitsadmin bitsadmin bitsadmin bitsadmin bitsadmin
      2⤵
        PID:3956
      • C:\Windows\SysWOW64\cmd.exe
        cmd /c cmd < Hazard.mdb & ping -n 5 localhost
        2⤵
        • Suspicious use of WriteProcessMemory
        PID:4944
        • C:\Windows\SysWOW64\cmd.exe
          cmd
          3⤵
          • Suspicious use of WriteProcessMemory
          PID:4304
          • C:\Windows\SysWOW64\tasklist.exe
            tasklist /FI "imagename eq AvastUI.exe"
            4⤵
            • Enumerates processes with tasklist
            • Suspicious use of AdjustPrivilegeToken
            PID:2240
          • C:\Windows\SysWOW64\find.exe
            find /I /N "avastui.exe"
            4⤵
              PID:3160
            • C:\Windows\SysWOW64\tasklist.exe
              tasklist /FI "imagename eq AVGUI.exe"
              4⤵
              • Enumerates processes with tasklist
              • Suspicious use of AdjustPrivilegeToken
              PID:4848
            • C:\Windows\SysWOW64\find.exe
              find /I /N "avgui.exe"
              4⤵
                PID:4756
              • C:\Windows\SysWOW64\findstr.exe
                findstr /V /R "^zTPUrZ$" Lamps.mdb
                4⤵
                  PID:3320
                • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Actively.exe.pif
                  Actively.exe.pif o
                  4⤵
                  • Executes dropped EXE
                  • Loads dropped DLL
                  • Suspicious use of SetThreadContext
                  • Suspicious behavior: EnumeratesProcesses
                  • Suspicious use of FindShellTrayWindow
                  • Suspicious use of SendNotifyMessage
                  • Suspicious use of WriteProcessMemory
                  PID:1748
                  • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Actively.exe.pif
                    C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Actively.exe.pif
                    5⤵
                    • Executes dropped EXE
                    PID:5108
                • C:\Windows\SysWOW64\PING.EXE
                  ping localhost -n 5
                  4⤵
                  • Runs ping.exe
                  PID:4348
              • C:\Windows\SysWOW64\PING.EXE
                ping -n 5 localhost
                3⤵
                • Runs ping.exe
                PID:2004

          Network

          MITRE ATT&CK Enterprise v6

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Actively.exe.pif

            Filesize

            924KB

            MD5

            6987e4cd3f256462f422326a7ef115b9

            SHA1

            71672a495b4603ecfec40a65254cb3ba8766bbe0

            SHA256

            3e26723394ade92f8163b5643960189cb07358b0f96529a477d37176d68aa0a0

            SHA512

            4b1d7f7ffee39a2d65504767beeddd4c3374807a93889b14e7e73db11e478492dec349aedca03ce828f21a66bb666a68d3735443f4249556e10825a4cd7dfeb4

          • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Actively.exe.pif

            Filesize

            924KB

            MD5

            6987e4cd3f256462f422326a7ef115b9

            SHA1

            71672a495b4603ecfec40a65254cb3ba8766bbe0

            SHA256

            3e26723394ade92f8163b5643960189cb07358b0f96529a477d37176d68aa0a0

            SHA512

            4b1d7f7ffee39a2d65504767beeddd4c3374807a93889b14e7e73db11e478492dec349aedca03ce828f21a66bb666a68d3735443f4249556e10825a4cd7dfeb4

          • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Actively.exe.pif

            Filesize

            924KB

            MD5

            6987e4cd3f256462f422326a7ef115b9

            SHA1

            71672a495b4603ecfec40a65254cb3ba8766bbe0

            SHA256

            3e26723394ade92f8163b5643960189cb07358b0f96529a477d37176d68aa0a0

            SHA512

            4b1d7f7ffee39a2d65504767beeddd4c3374807a93889b14e7e73db11e478492dec349aedca03ce828f21a66bb666a68d3735443f4249556e10825a4cd7dfeb4

          • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\GehZwiu.dll

            Filesize

            1.6MB

            MD5

            4f3387277ccbd6d1f21ac5c07fe4ca68

            SHA1

            e16506f662dc92023bf82def1d621497c8ab5890

            SHA256

            767a3fc4a7a6818cdc3f0b99aaa95db694f6bcde719d2057a88b3d4df3d74fac

            SHA512

            9da199ac69e3c0d4e0c6307e0ab8178f12cc25cb2f14c3511f6b64e6e60a925c860f3263cb38353a97b55a71ef4d27f8cb7fa3cfc08e7c1a349fd8d209dfa219

          • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\GehZwiu.dll

            Filesize

            1.6MB

            MD5

            4f3387277ccbd6d1f21ac5c07fe4ca68

            SHA1

            e16506f662dc92023bf82def1d621497c8ab5890

            SHA256

            767a3fc4a7a6818cdc3f0b99aaa95db694f6bcde719d2057a88b3d4df3d74fac

            SHA512

            9da199ac69e3c0d4e0c6307e0ab8178f12cc25cb2f14c3511f6b64e6e60a925c860f3263cb38353a97b55a71ef4d27f8cb7fa3cfc08e7c1a349fd8d209dfa219

          • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\GehZwiu.dll

            Filesize

            1.6MB

            MD5

            4f3387277ccbd6d1f21ac5c07fe4ca68

            SHA1

            e16506f662dc92023bf82def1d621497c8ab5890

            SHA256

            767a3fc4a7a6818cdc3f0b99aaa95db694f6bcde719d2057a88b3d4df3d74fac

            SHA512

            9da199ac69e3c0d4e0c6307e0ab8178f12cc25cb2f14c3511f6b64e6e60a925c860f3263cb38353a97b55a71ef4d27f8cb7fa3cfc08e7c1a349fd8d209dfa219

          • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\GehZwiu.dll

            Filesize

            1.6MB

            MD5

            4f3387277ccbd6d1f21ac5c07fe4ca68

            SHA1

            e16506f662dc92023bf82def1d621497c8ab5890

            SHA256

            767a3fc4a7a6818cdc3f0b99aaa95db694f6bcde719d2057a88b3d4df3d74fac

            SHA512

            9da199ac69e3c0d4e0c6307e0ab8178f12cc25cb2f14c3511f6b64e6e60a925c860f3263cb38353a97b55a71ef4d27f8cb7fa3cfc08e7c1a349fd8d209dfa219

          • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\GehZwiu.dll

            Filesize

            1.6MB

            MD5

            4f3387277ccbd6d1f21ac5c07fe4ca68

            SHA1

            e16506f662dc92023bf82def1d621497c8ab5890

            SHA256

            767a3fc4a7a6818cdc3f0b99aaa95db694f6bcde719d2057a88b3d4df3d74fac

            SHA512

            9da199ac69e3c0d4e0c6307e0ab8178f12cc25cb2f14c3511f6b64e6e60a925c860f3263cb38353a97b55a71ef4d27f8cb7fa3cfc08e7c1a349fd8d209dfa219

          • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\GehZwiu.dll

            Filesize

            1.6MB

            MD5

            4f3387277ccbd6d1f21ac5c07fe4ca68

            SHA1

            e16506f662dc92023bf82def1d621497c8ab5890

            SHA256

            767a3fc4a7a6818cdc3f0b99aaa95db694f6bcde719d2057a88b3d4df3d74fac

            SHA512

            9da199ac69e3c0d4e0c6307e0ab8178f12cc25cb2f14c3511f6b64e6e60a925c860f3263cb38353a97b55a71ef4d27f8cb7fa3cfc08e7c1a349fd8d209dfa219

          • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Hazard.mdb

            Filesize

            11KB

            MD5

            5d0469a1e816e965cd346d8ba30b28f5

            SHA1

            a2f79b197da7abe6a917928a9557de7e5a6f1796

            SHA256

            463a10b81a8f5c4af516d625532482fc104aa8beb8c89a688e21ba8e4d00d97f

            SHA512

            08850e22a9ba9479f6f8e727421feff68d5dcebb80c58f77ba5ae607e8e2a2ae4050de40f81f9c58fbb67c40a4f9c6b4c665c2d42206823dc0ee84db9b666d32

          • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Lamps.mdb

            Filesize

            924KB

            MD5

            545276413a197c589079736c0ef600de

            SHA1

            123bf26466ca4e9a7455d062d879e59767f988ea

            SHA256

            ef65bc00ca7ed7edb46131cebaa59b70ca2126d1ddfe45953e711553b4813b93

            SHA512

            3190b0c6e81c98ad2d14fb5966c6fe63e7f1ed1b821ea0e1ee3d692d9dbe664ee45dbc4caf4695a3495ede137cbde976afd5a7e17749a664eda5504a4d9327b1

          • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Raising.mdb

            Filesize

            816KB

            MD5

            4ffd563ff148d0e4a73e2eb5e1e9fd70

            SHA1

            19d14c6887810ee41fbdcd5c264439901f987d53

            SHA256

            3a4ecc310ee4a9019145e92fce4efbe1f80031c645768255247e9a7c6046cf46

            SHA512

            1ca14857567e6878a455d5d6f5429dcada7c9f2fc095ca9bcd9fc0cf17462fe1bd99cc1cb041f3bea7f5473945e51846b426c301638e3882d10357e1cbce003c

          • memory/5108-153-0x0000000000400000-0x0000000000439000-memory.dmp

            Filesize

            228KB

          • memory/5108-158-0x0000000000400000-0x0000000000439000-memory.dmp

            Filesize

            228KB

          • memory/5108-161-0x0000000000CF0000-0x0000000000CFD000-memory.dmp

            Filesize

            52KB

          • memory/5108-160-0x00000000009F0000-0x00000000009F9000-memory.dmp

            Filesize

            36KB

          • memory/5108-159-0x0000000000400000-0x0000000000439000-memory.dmp

            Filesize

            228KB