Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    56s
  • max time network
    65s
  • platform
    windows10-1703_x64
  • resource
    win10-20230220-en
  • resource tags

    arch:x64arch:x86image:win10-20230220-enlocale:en-usos:windows10-1703-x64system
  • submitted
    03/05/2023, 13:05

General

  • Target

    d314e4f2c5e7f5eb404d1ba5e72e44c55641f3a930304088183e27e14c2918de.exe

  • Size

    640KB

  • MD5

    f32e6f696a6c68a1f86f1ec6a42ae6de

  • SHA1

    a50aff89fd87afe4269c77997d8beb7478d37035

  • SHA256

    d314e4f2c5e7f5eb404d1ba5e72e44c55641f3a930304088183e27e14c2918de

  • SHA512

    87fab9cd754586b2f31958c6c5b3581ae94fbe95a4fdde3bedc2ded57f150146b75487226c8729f326f2ab6f934fefcffc94067830554c3c3c968356092e6565

  • SSDEEP

    12288:0iODgTlUNTxvBCwI/zO+nKomSgBQbAD1NpWaRvZU0LXZ6jEC:pxTsv0XKomSgSbABNpWavzLJUE

Malware Config

Signatures

  • Detects LgoogLoader payload 1 IoCs
  • LgoogLoader

    A downloader capable of dropping and executing other malware families.

  • Sets service image path in registry 2 TTPs 1 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 20 IoCs
  • Suspicious behavior: LoadsDriver 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 3 IoCs
  • Suspicious use of WriteProcessMemory 30 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\d314e4f2c5e7f5eb404d1ba5e72e44c55641f3a930304088183e27e14c2918de.exe
    "C:\Users\Admin\AppData\Local\Temp\d314e4f2c5e7f5eb404d1ba5e72e44c55641f3a930304088183e27e14c2918de.exe"
    1⤵
    • Sets service image path in registry
    • Suspicious use of SetThreadContext
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: LoadsDriver
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:2320
    • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\RegSvcs.exe
      "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\RegSvcs.exe"
      2⤵
        PID:2496
      • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_compiler.exe
        "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_compiler.exe"
        2⤵
          PID:2552
        • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
          "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe"
          2⤵
            PID:2512
          • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_regsql.exe
            "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_regsql.exe"
            2⤵
              PID:2672
            • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe
              "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe"
              2⤵
                PID:2120
              • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe
                "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe"
                2⤵
                  PID:3016
                • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AppLaunch.exe
                  "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AppLaunch.exe"
                  2⤵
                    PID:3052
                  • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ilasm.exe
                    "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ilasm.exe"
                    2⤵
                      PID:3060
                    • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess.exe
                      "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess.exe"
                      2⤵
                        PID:3108
                      • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
                        "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe"
                        2⤵
                          PID:3240
                        • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess32.exe
                          "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess32.exe"
                          2⤵
                            PID:3940

                        Network

                        MITRE ATT&CK Enterprise v6

                        Replay Monitor

                        Loading Replay Monitor...

                        Downloads

                        • memory/2320-121-0x00000187545E0000-0x0000018754684000-memory.dmp

                          Filesize

                          656KB

                        • memory/2320-122-0x000001876EAC0000-0x000001876EB36000-memory.dmp

                          Filesize

                          472KB

                        • memory/2320-123-0x000001876EA40000-0x000001876EABA000-memory.dmp

                          Filesize

                          488KB

                        • memory/2320-124-0x00000187549D0000-0x00000187549EE000-memory.dmp

                          Filesize

                          120KB

                        • memory/2320-125-0x000001876EC00000-0x000001876EC10000-memory.dmp

                          Filesize

                          64KB

                        • memory/3940-127-0x0000000000400000-0x0000000000434000-memory.dmp

                          Filesize

                          208KB

                        • memory/3940-129-0x0000000000400000-0x0000000000434000-memory.dmp

                          Filesize

                          208KB

                        • memory/3940-130-0x0000000000400000-0x0000000000434000-memory.dmp

                          Filesize

                          208KB

                        • memory/3940-131-0x0000000001350000-0x0000000001359000-memory.dmp

                          Filesize

                          36KB

                        • memory/3940-132-0x00000000018D0000-0x00000000018DD000-memory.dmp

                          Filesize

                          52KB