Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
140s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system -
submitted
06/08/2024, 01:22
Static task
static1
Behavioral task
behavioral1
Sample
2024-08-06_972d19f890b2ca5357dad0d4f817546e_jeefo_lockergoga.exe
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
2024-08-06_972d19f890b2ca5357dad0d4f817546e_jeefo_lockergoga.exe
Resource
win10v2004-20240802-en
General
-
Target
2024-08-06_972d19f890b2ca5357dad0d4f817546e_jeefo_lockergoga.exe
-
Size
2.0MB
-
MD5
972d19f890b2ca5357dad0d4f817546e
-
SHA1
25610d97100ccc718dffc29b18335f04ddb0f02a
-
SHA256
d5fd117393f2286ded80aff3ea60dba71e1b7b411e07a741ea4337cc9cf33e87
-
SHA512
285a18dac7c7bae8eca7046615ec079fb9c4ebe6ae22e2b7b0bbd47a419b286ba2d061de9b330a3f6c8a4d84ef8db6e3f1fe3726ae1b9e309590155a83775815
-
SSDEEP
49152:ttQyxbBsDA3f8pDLFIG3c2027/1HTGkOA5nmnDyMxm4yu/jIuNBCXQtu0uqtnSkz:ttLx138pDLFIG3c2027/1HTGkO2nmnDt
Malware Config
Signatures
-
Executes dropped EXE 3 IoCs
pid Process 1900 svchost.exe 3020 2024-08-06_972d19f890b2ca5357dad0d4f817546e_jeefo_lockergoga.exe 2344 svchost.exe -
Loads dropped DLL 1 IoCs
pid Process 1900 svchost.exe -
Drops file in Program Files directory 14 IoCs
description ioc Process File opened for modification C:\Program Files\7-Zip\7z.exe svchost.exe File opened for modification C:\Program Files\7-Zip\Uninstall.exe svchost.exe File opened for modification C:\Program Files\Google\Chrome\Application\chrome.exe svchost.exe File opened for modification C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\chrmstp.exe svchost.exe File opened for modification C:\Program Files\7-Zip\7zG.exe svchost.exe File opened for modification C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe svchost.exe File opened for modification C:\Program Files\Google\Chrome\Application\106.0.5249.119\notification_helper.exe svchost.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE svchost.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\VSTO\10.0\VSTOInstaller.exe svchost.exe File opened for modification C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\setup.exe svchost.exe File opened for modification C:\Program Files\7-Zip\7zFM.exe svchost.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\OFFICE14\MSOXMLED.EXE svchost.exe File opened for modification C:\Program Files\Google\Chrome\Application\chrome_proxy.exe svchost.exe File opened for modification C:\Program Files\Google\Chrome\Application\106.0.5249.119\chrome_pwa_launcher.exe svchost.exe -
Drops file in Windows directory 1 IoCs
description ioc Process File created C:\Windows\svchost.exe 2024-08-06_972d19f890b2ca5357dad0d4f817546e_jeefo_lockergoga.exe -
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2024-08-06_972d19f890b2ca5357dad0d4f817546e_jeefo_lockergoga.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.exe -
Suspicious use of WriteProcessMemory 8 IoCs
description pid Process procid_target PID 2484 wrote to memory of 1900 2484 2024-08-06_972d19f890b2ca5357dad0d4f817546e_jeefo_lockergoga.exe 30 PID 2484 wrote to memory of 1900 2484 2024-08-06_972d19f890b2ca5357dad0d4f817546e_jeefo_lockergoga.exe 30 PID 2484 wrote to memory of 1900 2484 2024-08-06_972d19f890b2ca5357dad0d4f817546e_jeefo_lockergoga.exe 30 PID 2484 wrote to memory of 1900 2484 2024-08-06_972d19f890b2ca5357dad0d4f817546e_jeefo_lockergoga.exe 30 PID 1900 wrote to memory of 3020 1900 svchost.exe 31 PID 1900 wrote to memory of 3020 1900 svchost.exe 31 PID 1900 wrote to memory of 3020 1900 svchost.exe 31 PID 1900 wrote to memory of 3020 1900 svchost.exe 31
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-08-06_972d19f890b2ca5357dad0d4f817546e_jeefo_lockergoga.exe"C:\Users\Admin\AppData\Local\Temp\2024-08-06_972d19f890b2ca5357dad0d4f817546e_jeefo_lockergoga.exe"1⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2484 -
C:\Windows\svchost.exe"C:\Windows\svchost.exe" "C:\Users\Admin\AppData\Local\Temp\2024-08-06_972d19f890b2ca5357dad0d4f817546e_jeefo_lockergoga.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1900 -
C:\Users\Admin\AppData\Local\Temp\2024-08-06_972d19f890b2ca5357dad0d4f817546e_jeefo_lockergoga.exe"C:\Users\Admin\AppData\Local\Temp\2024-08-06_972d19f890b2ca5357dad0d4f817546e_jeefo_lockergoga.exe"3⤵
- Executes dropped EXE
PID:3020
-
-
-
C:\Windows\svchost.exeC:\Windows\svchost.exe1⤵
- Executes dropped EXE
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:2344
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
35KB
MD59e3c13b6556d5636b745d3e466d47467
SHA12ac1c19e268c49bc508f83fe3d20f495deb3e538
SHA25620af03add533a6870d524a7c4753b42bfceb56cddd46016c051e23581ba743f8
SHA5125a07ba8a7fcb15f64b129fada2621252b8bc37eb34d4f614c075c064f8ac0d367301eba0c32c5e28b8aa633f6ab604f0dfcc363b34734ce0207ef0d4e8817c4b
-
Filesize
1.9MB
MD59aaa63305a6da2d4ef659531605e38dd
SHA1505be4d7784964ac2737bb15cb3e4b2c285b21dc
SHA256b0eafb5a014a11f82204370bcd5ae3a9d355e2f9fefc51de8dffa3dc21c4c308
SHA512862b275327b588c2e42704217f3c5bcad4119ba0c36dfda9b1a01d4f3aa98fd3663064970614024e0f372e6b137e4650db22462739a3dc7275ab166695deab1c