Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
146s -
max time network
151s -
platform
windows7_x64 -
resource
win7-20230220-en -
resource tags
arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system -
submitted
21/06/2023, 07:50
Behavioral task
behavioral1
Sample
921db56e4de5605b3759de43727f62be0f4c158a2837cf08ff376c427b85bec8.exe
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
921db56e4de5605b3759de43727f62be0f4c158a2837cf08ff376c427b85bec8.exe
Resource
win10v2004-20230220-en
General
-
Target
921db56e4de5605b3759de43727f62be0f4c158a2837cf08ff376c427b85bec8.exe
-
Size
80KB
-
MD5
b8d23f55d8924b617a57035db1cd3eb0
-
SHA1
94f84b29f47762afa6f44b39dea910286381f296
-
SHA256
921db56e4de5605b3759de43727f62be0f4c158a2837cf08ff376c427b85bec8
-
SHA512
656c74a552e068e20f234a7f66fd49a2c2477b991385c563443856d0b1e7668cb79f839f06f846eed14cfb009dd0fb4b1ad9f96fd1d0313d38cfb6d213e68099
-
SSDEEP
1536:Q+uA+pnOZyTfpU9tE6lrY4eOmunPXqDMlsKrKN08LpSMm+IEQFTm:RuBA+hME6+SnPQasBN0cSN+IlFTm
Malware Config
Signatures
-
Detects Lobshot family 3 IoCs
resource yara_rule behavioral1/files/0x000b00000001230b-55.dat family_lobshot behavioral1/files/0x000b00000001230b-56.dat family_lobshot behavioral1/files/0x000b00000001230b-57.dat family_lobshot -
Deletes itself 1 IoCs
pid Process 1524 cmd.exe -
Executes dropped EXE 1 IoCs
pid Process 468 service.exe -
Loads dropped DLL 1 IoCs
pid Process 1524 cmd.exe -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000\Software\Microsoft\Windows\CurrentVersion\Run\Shell Extension = "C:\\ProgramData\\service.exe" 921db56e4de5605b3759de43727f62be0f4c158a2837cf08ff376c427b85bec8.exe -
Runs ping.exe 1 TTPs 1 IoCs
pid Process 568 PING.EXE -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 1668 921db56e4de5605b3759de43727f62be0f4c158a2837cf08ff376c427b85bec8.exe 468 service.exe -
Suspicious use of WriteProcessMemory 12 IoCs
description pid Process procid_target PID 1668 wrote to memory of 1524 1668 921db56e4de5605b3759de43727f62be0f4c158a2837cf08ff376c427b85bec8.exe 28 PID 1668 wrote to memory of 1524 1668 921db56e4de5605b3759de43727f62be0f4c158a2837cf08ff376c427b85bec8.exe 28 PID 1668 wrote to memory of 1524 1668 921db56e4de5605b3759de43727f62be0f4c158a2837cf08ff376c427b85bec8.exe 28 PID 1668 wrote to memory of 1524 1668 921db56e4de5605b3759de43727f62be0f4c158a2837cf08ff376c427b85bec8.exe 28 PID 1524 wrote to memory of 568 1524 cmd.exe 30 PID 1524 wrote to memory of 568 1524 cmd.exe 30 PID 1524 wrote to memory of 568 1524 cmd.exe 30 PID 1524 wrote to memory of 568 1524 cmd.exe 30 PID 1524 wrote to memory of 468 1524 cmd.exe 31 PID 1524 wrote to memory of 468 1524 cmd.exe 31 PID 1524 wrote to memory of 468 1524 cmd.exe 31 PID 1524 wrote to memory of 468 1524 cmd.exe 31
Processes
-
C:\Users\Admin\AppData\Local\Temp\921db56e4de5605b3759de43727f62be0f4c158a2837cf08ff376c427b85bec8.exe"C:\Users\Admin\AppData\Local\Temp\921db56e4de5605b3759de43727f62be0f4c158a2837cf08ff376c427b85bec8.exe"1⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1668 -
C:\Windows\SysWOW64\cmd.execmd.exe /c (ping 127.0.0.1) & (del /F /Q "C:\Users\Admin\AppData\Local\Temp\921db56e4de5605b3759de43727f62be0f4c158a2837cf08ff376c427b85bec8.exe") & (start "" "C:\ProgramData\service.exe")2⤵
- Deletes itself
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1524 -
C:\Windows\SysWOW64\PING.EXEping 127.0.0.13⤵
- Runs ping.exe
PID:568
-
-
C:\ProgramData\service.exe"C:\ProgramData\service.exe"3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:468
-
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
80KB
MD5b8d23f55d8924b617a57035db1cd3eb0
SHA194f84b29f47762afa6f44b39dea910286381f296
SHA256921db56e4de5605b3759de43727f62be0f4c158a2837cf08ff376c427b85bec8
SHA512656c74a552e068e20f234a7f66fd49a2c2477b991385c563443856d0b1e7668cb79f839f06f846eed14cfb009dd0fb4b1ad9f96fd1d0313d38cfb6d213e68099
-
Filesize
80KB
MD5b8d23f55d8924b617a57035db1cd3eb0
SHA194f84b29f47762afa6f44b39dea910286381f296
SHA256921db56e4de5605b3759de43727f62be0f4c158a2837cf08ff376c427b85bec8
SHA512656c74a552e068e20f234a7f66fd49a2c2477b991385c563443856d0b1e7668cb79f839f06f846eed14cfb009dd0fb4b1ad9f96fd1d0313d38cfb6d213e68099
-
Filesize
80KB
MD5b8d23f55d8924b617a57035db1cd3eb0
SHA194f84b29f47762afa6f44b39dea910286381f296
SHA256921db56e4de5605b3759de43727f62be0f4c158a2837cf08ff376c427b85bec8
SHA512656c74a552e068e20f234a7f66fd49a2c2477b991385c563443856d0b1e7668cb79f839f06f846eed14cfb009dd0fb4b1ad9f96fd1d0313d38cfb6d213e68099