Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
33s -
platform
windows7_x64 -
resource
win7-20230220-en -
resource tags
arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system -
submitted
20/04/2023, 11:09
Static task
static1
Behavioral task
behavioral1
Sample
tmp.exe
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
tmp.exe
Resource
win10v2004-20230220-en
General
-
Target
tmp.exe
-
Size
375KB
-
MD5
8c1fdfac9ebd282be0a85164120445ae
-
SHA1
249647954c4d28aea0f517c6831102430cd9cd3f
-
SHA256
340c89d0d81447bbe9855d625048e84b7226beb0bc9c4cbb7cc54891449d785a
-
SHA512
d18cae71203ca7bf8e2ab85559932a0896a139237f4732fa382aac80f3cedf514d22dd17107173ae3706eb65b1dbe35fa98d4d772dd5a13979993b0624f22a3d
-
SSDEEP
6144:PYa6Blr2Uv5LIYxmevmwwYztxy4yY0n4Av1ZYQ9yra/EpCsMjACt+wPp6g7m1Q/r:PYzlCqY7wjx04sZ1ycV8Q+wPtCC
Malware Config
Signatures
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-3430344531-3702557399-3004411149-1000\Control Panel\International\Geo\Nation lgrjzad.exe -
Executes dropped EXE 2 IoCs
pid Process 1976 lgrjzad.exe 1484 lgrjzad.exe -
Loads dropped DLL 2 IoCs
pid Process 2012 tmp.exe 1976 lgrjzad.exe -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 1976 set thread context of 1484 1976 lgrjzad.exe 29 -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 31 IoCs
pid Process 1484 lgrjzad.exe 1484 lgrjzad.exe 1484 lgrjzad.exe 1484 lgrjzad.exe 1484 lgrjzad.exe 1484 lgrjzad.exe 1484 lgrjzad.exe 1484 lgrjzad.exe 1484 lgrjzad.exe 1484 lgrjzad.exe 1484 lgrjzad.exe 1484 lgrjzad.exe 1484 lgrjzad.exe 1484 lgrjzad.exe 1484 lgrjzad.exe 1484 lgrjzad.exe 1484 lgrjzad.exe 1484 lgrjzad.exe 1484 lgrjzad.exe 1484 lgrjzad.exe 1484 lgrjzad.exe 1484 lgrjzad.exe 1484 lgrjzad.exe 1484 lgrjzad.exe 1484 lgrjzad.exe 1484 lgrjzad.exe 1484 lgrjzad.exe 1484 lgrjzad.exe 1484 lgrjzad.exe 1484 lgrjzad.exe 1484 lgrjzad.exe -
Suspicious behavior: MapViewOfSection 1 IoCs
pid Process 1976 lgrjzad.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 1484 lgrjzad.exe -
Suspicious use of WriteProcessMemory 9 IoCs
description pid Process procid_target PID 2012 wrote to memory of 1976 2012 tmp.exe 28 PID 2012 wrote to memory of 1976 2012 tmp.exe 28 PID 2012 wrote to memory of 1976 2012 tmp.exe 28 PID 2012 wrote to memory of 1976 2012 tmp.exe 28 PID 1976 wrote to memory of 1484 1976 lgrjzad.exe 29 PID 1976 wrote to memory of 1484 1976 lgrjzad.exe 29 PID 1976 wrote to memory of 1484 1976 lgrjzad.exe 29 PID 1976 wrote to memory of 1484 1976 lgrjzad.exe 29 PID 1976 wrote to memory of 1484 1976 lgrjzad.exe 29
Processes
-
C:\Users\Admin\AppData\Local\Temp\tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmp.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2012 -
C:\Users\Admin\AppData\Local\Temp\lgrjzad.exe"C:\Users\Admin\AppData\Local\Temp\lgrjzad.exe" C:\Users\Admin\AppData\Local\Temp\ovlmifu.st2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:1976 -
C:\Users\Admin\AppData\Local\Temp\lgrjzad.exe"C:\Users\Admin\AppData\Local\Temp\lgrjzad.exe"3⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1484
-
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
206KB
MD53d2b994d23fbf53a10e5d02b708b901b
SHA1642201f31c3c7adf90208d5b13ef553a3a5c9a46
SHA25629c66e8e087271ac091326936c796454cc0961ab6f5805c9a91cd087894b9a8b
SHA512a2638b327a7742653f2ec8c56359eb8c934f91f687e83118676220ccf83d24f21f60d9256acfbccc9337c22ada47d1ba2ab70806676b8b2b16e1078cbfab77ad
-
Filesize
323KB
MD5720c9c0fa6c97ff562bd780799354bea
SHA181a64489fe39f0669812506734386a68089b321d
SHA256b957df3ad091d5012b8490c42a2044b9e754ee4300aa2bca54d95500a7aadb2f
SHA512eca45676d11eef6e2836881dc0e6ed8b3f0b918fba5e8bb17372ce06cc619e9e1f389189f1c4fc4d9468320172c3b3e369643fb22f3533ec1dcb5d6e14c796a5
-
Filesize
323KB
MD5720c9c0fa6c97ff562bd780799354bea
SHA181a64489fe39f0669812506734386a68089b321d
SHA256b957df3ad091d5012b8490c42a2044b9e754ee4300aa2bca54d95500a7aadb2f
SHA512eca45676d11eef6e2836881dc0e6ed8b3f0b918fba5e8bb17372ce06cc619e9e1f389189f1c4fc4d9468320172c3b3e369643fb22f3533ec1dcb5d6e14c796a5
-
Filesize
323KB
MD5720c9c0fa6c97ff562bd780799354bea
SHA181a64489fe39f0669812506734386a68089b321d
SHA256b957df3ad091d5012b8490c42a2044b9e754ee4300aa2bca54d95500a7aadb2f
SHA512eca45676d11eef6e2836881dc0e6ed8b3f0b918fba5e8bb17372ce06cc619e9e1f389189f1c4fc4d9468320172c3b3e369643fb22f3533ec1dcb5d6e14c796a5
-
Filesize
5KB
MD51888157b960f14ecc9a310dc35bca5ad
SHA173cfaadd5c99ea41bb8bd27441898a63f7c31251
SHA2560fdeb156d6ec7bbfba51f0167d7ce92b31b2aa862eaac92db52de594ce3460df
SHA512df0035e7f672a2f00c81e3a2e287798b6b979a1f5527faa387418092b75c2a8151a893597453afbf8942b3d656b55d52ad0b415e3e0352c889e32942a6d685bc
-
Filesize
323KB
MD5720c9c0fa6c97ff562bd780799354bea
SHA181a64489fe39f0669812506734386a68089b321d
SHA256b957df3ad091d5012b8490c42a2044b9e754ee4300aa2bca54d95500a7aadb2f
SHA512eca45676d11eef6e2836881dc0e6ed8b3f0b918fba5e8bb17372ce06cc619e9e1f389189f1c4fc4d9468320172c3b3e369643fb22f3533ec1dcb5d6e14c796a5
-
Filesize
323KB
MD5720c9c0fa6c97ff562bd780799354bea
SHA181a64489fe39f0669812506734386a68089b321d
SHA256b957df3ad091d5012b8490c42a2044b9e754ee4300aa2bca54d95500a7aadb2f
SHA512eca45676d11eef6e2836881dc0e6ed8b3f0b918fba5e8bb17372ce06cc619e9e1f389189f1c4fc4d9468320172c3b3e369643fb22f3533ec1dcb5d6e14c796a5