Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
143s -
max time network
154s -
platform
windows10-2004_x64 -
resource
win10v2004-20230220-en -
resource tags
arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system -
submitted
20/04/2023, 11:09
Static task
static1
Behavioral task
behavioral1
Sample
tmp.exe
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
tmp.exe
Resource
win10v2004-20230220-en
General
-
Target
tmp.exe
-
Size
375KB
-
MD5
8c1fdfac9ebd282be0a85164120445ae
-
SHA1
249647954c4d28aea0f517c6831102430cd9cd3f
-
SHA256
340c89d0d81447bbe9855d625048e84b7226beb0bc9c4cbb7cc54891449d785a
-
SHA512
d18cae71203ca7bf8e2ab85559932a0896a139237f4732fa382aac80f3cedf514d22dd17107173ae3706eb65b1dbe35fa98d4d772dd5a13979993b0624f22a3d
-
SSDEEP
6144:PYa6Blr2Uv5LIYxmevmwwYztxy4yY0n4Av1ZYQ9yra/EpCsMjACt+wPp6g7m1Q/r:PYzlCqY7wjx04sZ1ycV8Q+wPtCC
Malware Config
Signatures
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000\Control Panel\International\Geo\Nation lgrjzad.exe -
Executes dropped EXE 2 IoCs
pid Process 4340 lgrjzad.exe 2016 lgrjzad.exe -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 4340 set thread context of 2016 4340 lgrjzad.exe 85 -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 62 IoCs
pid Process 2016 lgrjzad.exe 2016 lgrjzad.exe 2016 lgrjzad.exe 2016 lgrjzad.exe 2016 lgrjzad.exe 2016 lgrjzad.exe 2016 lgrjzad.exe 2016 lgrjzad.exe 2016 lgrjzad.exe 2016 lgrjzad.exe 2016 lgrjzad.exe 2016 lgrjzad.exe 2016 lgrjzad.exe 2016 lgrjzad.exe 2016 lgrjzad.exe 2016 lgrjzad.exe 2016 lgrjzad.exe 2016 lgrjzad.exe 2016 lgrjzad.exe 2016 lgrjzad.exe 2016 lgrjzad.exe 2016 lgrjzad.exe 2016 lgrjzad.exe 2016 lgrjzad.exe 2016 lgrjzad.exe 2016 lgrjzad.exe 2016 lgrjzad.exe 2016 lgrjzad.exe 2016 lgrjzad.exe 2016 lgrjzad.exe 2016 lgrjzad.exe 2016 lgrjzad.exe 2016 lgrjzad.exe 2016 lgrjzad.exe 2016 lgrjzad.exe 2016 lgrjzad.exe 2016 lgrjzad.exe 2016 lgrjzad.exe 2016 lgrjzad.exe 2016 lgrjzad.exe 2016 lgrjzad.exe 2016 lgrjzad.exe 2016 lgrjzad.exe 2016 lgrjzad.exe 2016 lgrjzad.exe 2016 lgrjzad.exe 2016 lgrjzad.exe 2016 lgrjzad.exe 2016 lgrjzad.exe 2016 lgrjzad.exe 2016 lgrjzad.exe 2016 lgrjzad.exe 2016 lgrjzad.exe 2016 lgrjzad.exe 2016 lgrjzad.exe 2016 lgrjzad.exe 2016 lgrjzad.exe 2016 lgrjzad.exe 2016 lgrjzad.exe 2016 lgrjzad.exe 2016 lgrjzad.exe 2016 lgrjzad.exe -
Suspicious behavior: MapViewOfSection 1 IoCs
pid Process 4340 lgrjzad.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 2016 lgrjzad.exe -
Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 2680 wrote to memory of 4340 2680 tmp.exe 84 PID 2680 wrote to memory of 4340 2680 tmp.exe 84 PID 2680 wrote to memory of 4340 2680 tmp.exe 84 PID 4340 wrote to memory of 2016 4340 lgrjzad.exe 85 PID 4340 wrote to memory of 2016 4340 lgrjzad.exe 85 PID 4340 wrote to memory of 2016 4340 lgrjzad.exe 85 PID 4340 wrote to memory of 2016 4340 lgrjzad.exe 85
Processes
-
C:\Users\Admin\AppData\Local\Temp\tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmp.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2680 -
C:\Users\Admin\AppData\Local\Temp\lgrjzad.exe"C:\Users\Admin\AppData\Local\Temp\lgrjzad.exe" C:\Users\Admin\AppData\Local\Temp\ovlmifu.st2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:4340 -
C:\Users\Admin\AppData\Local\Temp\lgrjzad.exe"C:\Users\Admin\AppData\Local\Temp\lgrjzad.exe"3⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2016
-
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
206KB
MD53d2b994d23fbf53a10e5d02b708b901b
SHA1642201f31c3c7adf90208d5b13ef553a3a5c9a46
SHA25629c66e8e087271ac091326936c796454cc0961ab6f5805c9a91cd087894b9a8b
SHA512a2638b327a7742653f2ec8c56359eb8c934f91f687e83118676220ccf83d24f21f60d9256acfbccc9337c22ada47d1ba2ab70806676b8b2b16e1078cbfab77ad
-
Filesize
323KB
MD5720c9c0fa6c97ff562bd780799354bea
SHA181a64489fe39f0669812506734386a68089b321d
SHA256b957df3ad091d5012b8490c42a2044b9e754ee4300aa2bca54d95500a7aadb2f
SHA512eca45676d11eef6e2836881dc0e6ed8b3f0b918fba5e8bb17372ce06cc619e9e1f389189f1c4fc4d9468320172c3b3e369643fb22f3533ec1dcb5d6e14c796a5
-
Filesize
323KB
MD5720c9c0fa6c97ff562bd780799354bea
SHA181a64489fe39f0669812506734386a68089b321d
SHA256b957df3ad091d5012b8490c42a2044b9e754ee4300aa2bca54d95500a7aadb2f
SHA512eca45676d11eef6e2836881dc0e6ed8b3f0b918fba5e8bb17372ce06cc619e9e1f389189f1c4fc4d9468320172c3b3e369643fb22f3533ec1dcb5d6e14c796a5
-
Filesize
323KB
MD5720c9c0fa6c97ff562bd780799354bea
SHA181a64489fe39f0669812506734386a68089b321d
SHA256b957df3ad091d5012b8490c42a2044b9e754ee4300aa2bca54d95500a7aadb2f
SHA512eca45676d11eef6e2836881dc0e6ed8b3f0b918fba5e8bb17372ce06cc619e9e1f389189f1c4fc4d9468320172c3b3e369643fb22f3533ec1dcb5d6e14c796a5
-
Filesize
5KB
MD51888157b960f14ecc9a310dc35bca5ad
SHA173cfaadd5c99ea41bb8bd27441898a63f7c31251
SHA2560fdeb156d6ec7bbfba51f0167d7ce92b31b2aa862eaac92db52de594ce3460df
SHA512df0035e7f672a2f00c81e3a2e287798b6b979a1f5527faa387418092b75c2a8151a893597453afbf8942b3d656b55d52ad0b415e3e0352c889e32942a6d685bc