Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
146s -
max time network
153s -
platform
windows7_x64 -
resource
win7-20230621-en -
resource tags
arch:x64arch:x86image:win7-20230621-enlocale:en-usos:windows7-x64system -
submitted
21/06/2023, 13:22
Behavioral task
behavioral1
Sample
04346899.exe
Resource
win7-20230621-en
Behavioral task
behavioral2
Sample
04346899.exe
Resource
win10v2004-20230621-en
General
-
Target
04346899.exe
-
Size
96KB
-
MD5
9315eb6ecab91d17c13e8e12c850fd1a
-
SHA1
412eed3de0dd1714b4b27d77dec8d653e6d604cf
-
SHA256
15ec54cd2b2605ec8395645fe545204a89ddfe6fef656c98c0578006184d0228
-
SHA512
c41bd3d7df65388927c5d8a46bcaa5d329741c9e690ef26e3a2a03021949a67ddda01c8f50d78b5faff8c0911ffaae33d3cf891de4b8b28360e3c3726827a216
-
SSDEEP
1536:QX1tIEY/6mS2I4bD7jrFgkfTeXslrYNJJpnPEqQFXB00Gdhp4VjlK+I/QX205eBj:QX1tIM2IOXjdfTeXsirnPgu4PK+Iocc
Malware Config
Signatures
-
Detects Lobshot family 3 IoCs
resource yara_rule behavioral1/files/0x0008000000014497-62.dat family_lobshot behavioral1/files/0x0008000000014497-63.dat family_lobshot behavioral1/files/0x0008000000014497-64.dat family_lobshot -
Deletes itself 1 IoCs
pid Process 268 cmd.exe -
Executes dropped EXE 1 IoCs
pid Process 1864 service.exe -
Loads dropped DLL 1 IoCs
pid Process 268 cmd.exe -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3419557010-3639509551-242374962-1000\Software\Microsoft\Windows\CurrentVersion\Run\Shell Extension = "C:\\ProgramData\\service.exe" 04346899.exe -
Runs ping.exe 1 TTPs 1 IoCs
pid Process 1420 PING.EXE -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 1528 04346899.exe 1864 service.exe -
Suspicious use of WriteProcessMemory 12 IoCs
description pid Process procid_target PID 1528 wrote to memory of 268 1528 04346899.exe 28 PID 1528 wrote to memory of 268 1528 04346899.exe 28 PID 1528 wrote to memory of 268 1528 04346899.exe 28 PID 1528 wrote to memory of 268 1528 04346899.exe 28 PID 268 wrote to memory of 1420 268 cmd.exe 30 PID 268 wrote to memory of 1420 268 cmd.exe 30 PID 268 wrote to memory of 1420 268 cmd.exe 30 PID 268 wrote to memory of 1420 268 cmd.exe 30 PID 268 wrote to memory of 1864 268 cmd.exe 31 PID 268 wrote to memory of 1864 268 cmd.exe 31 PID 268 wrote to memory of 1864 268 cmd.exe 31 PID 268 wrote to memory of 1864 268 cmd.exe 31
Processes
-
C:\Users\Admin\AppData\Local\Temp\04346899.exe"C:\Users\Admin\AppData\Local\Temp\04346899.exe"1⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1528 -
C:\Windows\SysWOW64\cmd.execmd.exe /c (ping 127.0.0.1) & (del /F /Q "C:\Users\Admin\AppData\Local\Temp\04346899.exe") & (start "" "C:\ProgramData\service.exe")2⤵
- Deletes itself
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:268 -
C:\Windows\SysWOW64\PING.EXEping 127.0.0.13⤵
- Runs ping.exe
PID:1420
-
-
C:\ProgramData\service.exe"C:\ProgramData\service.exe"3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:1864
-
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
350B
MD569426ea8a584487310330dee2e5b75a5
SHA1cc8fd6a60cf52cf65b7fb09f0c6b57a5d5da7e85
SHA256ec083d7d173c4ec0110811f3f83c58262d0f1aec4461ca1178d1fc147d5a3aea
SHA5127b0f23640163243a42fa2dc97b7b484415a38b75d2445f167b9b8e7e2054712deb827309bc1129acbb7b9d608bb17440bcd4a8b9e46acc34366e815dc62ed76c
-
Filesize
96KB
MD59315eb6ecab91d17c13e8e12c850fd1a
SHA1412eed3de0dd1714b4b27d77dec8d653e6d604cf
SHA25615ec54cd2b2605ec8395645fe545204a89ddfe6fef656c98c0578006184d0228
SHA512c41bd3d7df65388927c5d8a46bcaa5d329741c9e690ef26e3a2a03021949a67ddda01c8f50d78b5faff8c0911ffaae33d3cf891de4b8b28360e3c3726827a216
-
Filesize
96KB
MD59315eb6ecab91d17c13e8e12c850fd1a
SHA1412eed3de0dd1714b4b27d77dec8d653e6d604cf
SHA25615ec54cd2b2605ec8395645fe545204a89ddfe6fef656c98c0578006184d0228
SHA512c41bd3d7df65388927c5d8a46bcaa5d329741c9e690ef26e3a2a03021949a67ddda01c8f50d78b5faff8c0911ffaae33d3cf891de4b8b28360e3c3726827a216
-
Filesize
96KB
MD59315eb6ecab91d17c13e8e12c850fd1a
SHA1412eed3de0dd1714b4b27d77dec8d653e6d604cf
SHA25615ec54cd2b2605ec8395645fe545204a89ddfe6fef656c98c0578006184d0228
SHA512c41bd3d7df65388927c5d8a46bcaa5d329741c9e690ef26e3a2a03021949a67ddda01c8f50d78b5faff8c0911ffaae33d3cf891de4b8b28360e3c3726827a216