Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20240709-en -
resource tags
-
submitted
09/07/2024, 18:20
General
-
Target
lockfolder.exe
-
Size
943KB
-
MD5
6485f94e7623906927dbf2d80674d8fb
-
SHA1
766ee84733a14d0715799c954b42887ee3d02366
-
SHA256
4cf1567186a276ad04f7c63e2c726924f97b78314bcb28f6af810201ae182782
-
SHA512
c73d2ebdc3f164c6be568dfb3d2d4d5277b968dcf97a0570d2b91c31eb22b0fb0ca61e81333866a86fda2539a6d39d9291386e4ab2b7d40ab29c41443650746c
-
SSDEEP
24576:fxA3Z0z9d6/aqD1y62w0Wx/qkWYP4DpDzrrrpb/XKEqLBQI9mNl:fuZu9IpKoykWYP4DRwNQ4m
Malware Config
Signatures
-
Loads dropped DLL 3 IoCs
-
UPX packed file 41 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Installs/modifies Browser Helper Object 2 TTPs 1 IoCs
BHOs are DLL modules which act as plugins for Internet Explorer.
-
Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
-
Drops file in System32 directory 5 IoCs
-
Drops file in Windows directory 3 IoCs
-
Modifies registry class 18 IoCs
-
Suspicious behavior: LoadsDriver 1 IoCs
-
Suspicious use of SetWindowsHookEx 3 IoCs
-
Suspicious use of WriteProcessMemory 6 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\lockfolder.exe"C:\Users\Admin\AppData\Local\Temp\lockfolder.exe"1⤵
- Writes to the Master Boot Record (MBR)
- Drops file in System32 directory
- Drops file in Windows directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\regsvr32.exeregsvr32.exe FileHook.dll /s2⤵
- Loads dropped DLL
- Modifies registry class
-
-
C:\Windows\SysWOW64\regsvr32.exeregsvr32.exe FileBho.dll /s2⤵
- Loads dropped DLL
- Installs/modifies Browser Helper Object
- Modifies registry class
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
442KB
MD53fcdcbae358301e557fa2786078e5552
SHA176137300f6527076add1b819083db3a46854dee0
SHA256a8443d0bfa626b818dbb09de2305e56ab0f1ebeebb1da6aabd7599523c0daf77
SHA5121028a719a56a91a48979b324904edd34ab54811a1c2c9d5fe34189a2b8bea31a9bc384abdaf43b9dad824d7662b83566745e9a3a14fff08e0998456cb782d20d
-
Filesize
127KB
MD5a5da15da770f9b00926cdcc6baed7fff
SHA10abb35c6b3f6d27c08bdd5679891c1a9a43179d2
SHA25638c8637696d8f485889b9ab2a995d8c86573915e2f1c74878bbe6bfd8165dbf8
SHA51238740e71a9db1725f3a50ea90407b61948d09ef9a29995bb3480d9a382a90f2bdd46bd5e09416f894625ad6c8a80bde88802a540002bd5530c557551b5b3979c
-
Filesize
464KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
2.4MB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
24KB
-
Filesize
248KB
-
Filesize
36KB
-
Filesize
2.4MB
-
Filesize
2.4MB
-
Filesize
24KB
-
Filesize
36KB
-
Filesize
2.4MB
-
Filesize
2.4MB
-
Filesize
2.4MB
-
Filesize
2.4MB
-
Filesize
2.4MB
-
Filesize
2.4MB
-
Filesize
2.4MB
-
Filesize
2.4MB
-
Filesize
2.4MB
-
Filesize
2.4MB
-
Filesize
2.4MB
-
Filesize
2.4MB