Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    146s
  • max time network
    153s
  • platform
    windows7_x64
  • resource
    win7-20230621-en
  • resource tags

    arch:x64arch:x86image:win7-20230621-enlocale:en-usos:windows7-x64system
  • submitted
    21/06/2023, 13:22

General

  • Target

    04346899.exe

  • Size

    96KB

  • MD5

    9315eb6ecab91d17c13e8e12c850fd1a

  • SHA1

    412eed3de0dd1714b4b27d77dec8d653e6d604cf

  • SHA256

    15ec54cd2b2605ec8395645fe545204a89ddfe6fef656c98c0578006184d0228

  • SHA512

    c41bd3d7df65388927c5d8a46bcaa5d329741c9e690ef26e3a2a03021949a67ddda01c8f50d78b5faff8c0911ffaae33d3cf891de4b8b28360e3c3726827a216

  • SSDEEP

    1536:QX1tIEY/6mS2I4bD7jrFgkfTeXslrYNJJpnPEqQFXB00Gdhp4VjlK+I/QX205eBj:QX1tIM2IOXjdfTeXsirnPgu4PK+Iocc

Malware Config

Signatures

  • Detects Lobshot family 3 IoCs
  • Lobshot

    Lobshot is a backdoor module written in c++.

  • Deletes itself 1 IoCs
  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 1 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • Runs ping.exe 1 TTPs 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of WriteProcessMemory 12 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\04346899.exe
    "C:\Users\Admin\AppData\Local\Temp\04346899.exe"
    1⤵
    • Adds Run key to start application
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:1528
    • C:\Windows\SysWOW64\cmd.exe
      cmd.exe /c (ping 127.0.0.1) & (del /F /Q "C:\Users\Admin\AppData\Local\Temp\04346899.exe") & (start "" "C:\ProgramData\service.exe")
      2⤵
      • Deletes itself
      • Loads dropped DLL
      • Suspicious use of WriteProcessMemory
      PID:268
      • C:\Windows\SysWOW64\PING.EXE
        ping 127.0.0.1
        3⤵
        • Runs ping.exe
        PID:1420
      • C:\ProgramData\service.exe
        "C:\ProgramData\service.exe"
        3⤵
        • Executes dropped EXE
        • Suspicious behavior: EnumeratesProcesses
        PID:1864

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\ProgramData\cln_log.txt

    Filesize

    350B

    MD5

    69426ea8a584487310330dee2e5b75a5

    SHA1

    cc8fd6a60cf52cf65b7fb09f0c6b57a5d5da7e85

    SHA256

    ec083d7d173c4ec0110811f3f83c58262d0f1aec4461ca1178d1fc147d5a3aea

    SHA512

    7b0f23640163243a42fa2dc97b7b484415a38b75d2445f167b9b8e7e2054712deb827309bc1129acbb7b9d608bb17440bcd4a8b9e46acc34366e815dc62ed76c

  • C:\ProgramData\service.exe

    Filesize

    96KB

    MD5

    9315eb6ecab91d17c13e8e12c850fd1a

    SHA1

    412eed3de0dd1714b4b27d77dec8d653e6d604cf

    SHA256

    15ec54cd2b2605ec8395645fe545204a89ddfe6fef656c98c0578006184d0228

    SHA512

    c41bd3d7df65388927c5d8a46bcaa5d329741c9e690ef26e3a2a03021949a67ddda01c8f50d78b5faff8c0911ffaae33d3cf891de4b8b28360e3c3726827a216

  • C:\ProgramData\service.exe

    Filesize

    96KB

    MD5

    9315eb6ecab91d17c13e8e12c850fd1a

    SHA1

    412eed3de0dd1714b4b27d77dec8d653e6d604cf

    SHA256

    15ec54cd2b2605ec8395645fe545204a89ddfe6fef656c98c0578006184d0228

    SHA512

    c41bd3d7df65388927c5d8a46bcaa5d329741c9e690ef26e3a2a03021949a67ddda01c8f50d78b5faff8c0911ffaae33d3cf891de4b8b28360e3c3726827a216

  • \ProgramData\service.exe

    Filesize

    96KB

    MD5

    9315eb6ecab91d17c13e8e12c850fd1a

    SHA1

    412eed3de0dd1714b4b27d77dec8d653e6d604cf

    SHA256

    15ec54cd2b2605ec8395645fe545204a89ddfe6fef656c98c0578006184d0228

    SHA512

    c41bd3d7df65388927c5d8a46bcaa5d329741c9e690ef26e3a2a03021949a67ddda01c8f50d78b5faff8c0911ffaae33d3cf891de4b8b28360e3c3726827a216