Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    140s
  • max time network
    121s
  • platform
    windows7_x64
  • resource
    win7-20240708-en
  • resource tags

    arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
  • submitted
    06/08/2024, 01:22

General

  • Target

    2024-08-06_972d19f890b2ca5357dad0d4f817546e_jeefo_lockergoga.exe

  • Size

    2.0MB

  • MD5

    972d19f890b2ca5357dad0d4f817546e

  • SHA1

    25610d97100ccc718dffc29b18335f04ddb0f02a

  • SHA256

    d5fd117393f2286ded80aff3ea60dba71e1b7b411e07a741ea4337cc9cf33e87

  • SHA512

    285a18dac7c7bae8eca7046615ec079fb9c4ebe6ae22e2b7b0bbd47a419b286ba2d061de9b330a3f6c8a4d84ef8db6e3f1fe3726ae1b9e309590155a83775815

  • SSDEEP

    49152:ttQyxbBsDA3f8pDLFIG3c2027/1HTGkOA5nmnDyMxm4yu/jIuNBCXQtu0uqtnSkz:ttLx138pDLFIG3c2027/1HTGkO2nmnDt

Score
7/10

Malware Config

Signatures

  • Executes dropped EXE 3 IoCs
  • Loads dropped DLL 1 IoCs
  • Drops file in Program Files directory 14 IoCs
  • Drops file in Windows directory 1 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious use of WriteProcessMemory 8 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2024-08-06_972d19f890b2ca5357dad0d4f817546e_jeefo_lockergoga.exe
    "C:\Users\Admin\AppData\Local\Temp\2024-08-06_972d19f890b2ca5357dad0d4f817546e_jeefo_lockergoga.exe"
    1⤵
    • Drops file in Windows directory
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:2484
    • C:\Windows\svchost.exe
      "C:\Windows\svchost.exe" "C:\Users\Admin\AppData\Local\Temp\2024-08-06_972d19f890b2ca5357dad0d4f817546e_jeefo_lockergoga.exe"
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:1900
      • C:\Users\Admin\AppData\Local\Temp\2024-08-06_972d19f890b2ca5357dad0d4f817546e_jeefo_lockergoga.exe
        "C:\Users\Admin\AppData\Local\Temp\2024-08-06_972d19f890b2ca5357dad0d4f817546e_jeefo_lockergoga.exe"
        3⤵
        • Executes dropped EXE
        PID:3020
  • C:\Windows\svchost.exe
    C:\Windows\svchost.exe
    1⤵
    • Executes dropped EXE
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    PID:2344

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Windows\svchost.exe

    Filesize

    35KB

    MD5

    9e3c13b6556d5636b745d3e466d47467

    SHA1

    2ac1c19e268c49bc508f83fe3d20f495deb3e538

    SHA256

    20af03add533a6870d524a7c4753b42bfceb56cddd46016c051e23581ba743f8

    SHA512

    5a07ba8a7fcb15f64b129fada2621252b8bc37eb34d4f614c075c064f8ac0d367301eba0c32c5e28b8aa633f6ab604f0dfcc363b34734ce0207ef0d4e8817c4b

  • \Users\Admin\AppData\Local\Temp\2024-08-06_972d19f890b2ca5357dad0d4f817546e_jeefo_lockergoga.exe

    Filesize

    1.9MB

    MD5

    9aaa63305a6da2d4ef659531605e38dd

    SHA1

    505be4d7784964ac2737bb15cb3e4b2c285b21dc

    SHA256

    b0eafb5a014a11f82204370bcd5ae3a9d355e2f9fefc51de8dffa3dc21c4c308

    SHA512

    862b275327b588c2e42704217f3c5bcad4119ba0c36dfda9b1a01d4f3aa98fd3663064970614024e0f372e6b137e4650db22462739a3dc7275ab166695deab1c

  • memory/1900-15-0x0000000000400000-0x000000000040D000-memory.dmp

    Filesize

    52KB

  • memory/2344-18-0x0000000000400000-0x000000000040D000-memory.dmp

    Filesize

    52KB

  • memory/2344-30-0x0000000000400000-0x000000000040D000-memory.dmp

    Filesize

    52KB

  • memory/2484-5-0x0000000000400000-0x0000000000496000-memory.dmp

    Filesize

    600KB