Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
66s -
max time network
25s -
platform
windows7_x64 -
resource
win7-20240729-en -
resource tags
-
submitted
02/09/2024, 12:26
General
-
Target
lk.exe
-
Size
146KB
-
MD5
7f6830b77ad13b244bc5d702d67137bf
-
SHA1
1fbd763388a3e9679ac66b35da8a78e041611fe4
-
SHA256
e097f98ea3416330ed2fd7856743d68a7ca880c6d57e8c264a384a112ac5a390
-
SHA512
488cb83c7267cfc70989e09489373f4372325531f7c02b1711fbdf6dfeaa377c39b84d5e971136e0e41d0a6dcde52ec4d21a749169eedb9e9ba43eb9caf077de
-
SSDEEP
3072:c6glyuxE4GsUPnliByocWep0XL63DjDeprS:c6gDBGpvEByocWeOmuNS
Malware Config
Signatures
-
Renames multiple (333) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Deletes itself 1 IoCs
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 1 IoCs
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Drops desktop.ini file(s) 2 IoCs
-
Indicator Removal: File Deletion 1 TTPs
Adversaries may delete files left behind by the actions of their intrusion activity.
-
Sets desktop wallpaper using registry 2 TTPs 2 IoCs
-
Suspicious use of NtSetInformationThreadHideFromDebugger 5 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Modifies Control Panel 2 IoCs
-
Modifies registry class 5 IoCs
-
Suspicious behavior: EnumeratesProcesses 14 IoCs
-
Suspicious behavior: RenamesItself 26 IoCs
-
Suspicious use of AdjustPrivilegeToken 64 IoCs
-
Suspicious use of WriteProcessMemory 9 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\lk.exe"C:\Users\Admin\AppData\Local\Temp\lk.exe"1⤵
- Loads dropped DLL
- Drops desktop.ini file(s)
- Sets desktop wallpaper using registry
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Modifies Control Panel
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\ProgramData\9656.tmp"C:\ProgramData\9656.tmp"2⤵
- Deletes itself
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C DEL /F /Q C:\PROGRA~3\9656.tmp >> NUL3⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x14c1⤵
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
129B
MD552b0adf62990590eee6229a9a0f76861
SHA1220fbbd3ad461e7c0e983b6f2ef4daaad01b1350
SHA2569023a90265171dfe6a26d01558b974b060ac8821b90d876f95c7361564f0994b
SHA512df56ef1b640eea469de667c97245e969c07f3c8093d040937a48b5304deeae2edc47cf93049a262a846fb4461d8e11c9ba7fcfa1367df6630617d7ced7c53efc
-
Filesize
146KB
MD5ce188eb730844aa46ffa99c420b9d913
SHA11c7fa0d542accb478c9cf0f87ce2c65d91ed7988
SHA256a319d59c0d32b75dff8b5bb4808968fe421c3b2dedfc4f0e5bb7f02323f164fd
SHA5124f586cc67ab5faf444471a903b28df65aceaadb621c95f55db5b1e70df6f6a5dd2ebf5f22db6bfc8695fb139878c8c0d11fc162c1793fa28a3ec530ca0521f9a
-
Filesize
343B
MD572b1ffaeb7de456483f491ecceadb088
SHA1ee1953abc295245ab01f35a4a823883826bf2b41
SHA256eb892eac9899b995047733bb17acd4945eb42b7b49f2ee8ad52b8026bc0297a7
SHA512c0e7cad617cf1490bb25fc47936edc3ae164b190ed34f2d2a50e7e84ce6e0d6712a6ba9ab351cca1589266078326a00317516c53fecf96f20eaefe15e92ce445
-
Filesize
129B
MD5da634a9ec1c124d701419ca58ec8fa85
SHA13cc2a4801bfdefde435bbf460157eb4ea2a181c0
SHA2562be29134faafc42a4d43dc1e972f3dd5ed3a06df4d1cfc84824e25f4af4cb189
SHA51252287ca130c0c9a1ad528a22145d0d77a3a999d56439bae0b1ca4d2949fc9758096519607d52965883d01220a9bc0ec213bc1d5bbdd1f764bdba71ba74537c7f
-
Filesize
14KB
MD5294e9f64cb1642dd89229fff0592856b
SHA197b148c27f3da29ba7b18d6aee8a0db9102f47c9
SHA256917e115cc403e29b4388e0d175cbfac3e7e40ca1742299fbdb353847db2de7c2
SHA512b87d531890bf1577b9b4af41dddb2cdbbfa164cf197bd5987df3a3075983645a3acba443e289b7bfd338422978a104f55298fbfe346872de0895bde44adc89cf
-
Filesize
256KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
256KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
256KB