Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Static task
static1
Behavioral task
behavioral1
Sample
2024-09-05_98ce8b1f4cbab8f928ab14218d6644f3_lockbit.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
2024-09-05_98ce8b1f4cbab8f928ab14218d6644f3_lockbit.exe
Resource
win10v2004-20240802-en
General
-
Target
2024-09-05_98ce8b1f4cbab8f928ab14218d6644f3_lockbit
-
Size
39KB
-
MD5
98ce8b1f4cbab8f928ab14218d6644f3
-
SHA1
8d87e9cf4f24c2f350b66621483e78e7aa7dd329
-
SHA256
f7a46a36557755b954141b8d61893ff475b217171b696cf305bc03ec319bcd16
-
SHA512
907b3230fcf985b8c4565748ee76fa5b1071e0a7c8989e810f5d793eaee4aed39d19fe7e260136ebccb3cc74e910606a8486d07f460925b2d89a9c69f3dc198a
-
SSDEEP
768:9Ef/gFsuJmTvK5AxGfM2lvpTSzyBsYw/B8MSyg5S4g8a/3x58evKEYWmVjj5uAz/:if/zuJmTn2lvpSzyOvBWg8g3xeevKE2t
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 2024-09-05_98ce8b1f4cbab8f928ab14218d6644f3_lockbit
Files
-
2024-09-05_98ce8b1f4cbab8f928ab14218d6644f3_lockbit.exe windows:5 windows x86 arch:x86
2a45a55dd76530400b6ccc67f08677d7
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
ws2_32
setsockopt
shutdown
closesocket
htons
getsockname
send
WSAGetLastError
select
WSASocketW
WSAConnect
WSAStartup
getpeername
freeaddrinfo
getaddrinfo
recv
shlwapi
PathRemoveFileSpecA
PathFindFileNameW
PathAddBackslashA
PathRemoveBackslashA
wvnsprintfW
wvnsprintfA
StrStrIW
StrCmpNIW
PathSkipRootW
PathMatchSpecW
PathCombineW
PathUnquoteSpacesW
crypt32
CryptQueryObject
CryptMsgGetParam
CertFindCertificateInStore
CertFreeCertificateContext
CertGetNameStringW
version
VerQueryValueW
GetFileVersionInfoW
GetFileVersionInfoSizeW
msvcrt
memcpy
sprintf
tolower
strtod
memset
strncmp
_except_handler3
psapi
GetProcessImageFileNameW
kernel32
ReadFile
GetComputerNameExW
GetComputerNameW
CreateDirectoryW
GetModuleHandleW
GetNativeSystemInfo
GetCurrentThread
SetThreadPriority
BeginUpdateResourceW
EnumResourceNamesW
EndUpdateResourceW
LockResource
SizeofResource
UpdateResourceW
lstrlenA
GetCurrentProcessId
HeapValidate
GetProcessHeaps
HeapSetInformation
HeapCreate
HeapAlloc
HeapReAlloc
HeapFree
GetProcAddress
LoadLibraryExW
lstrlenW
WideCharToMultiByte
lstrcpynW
lstrcatW
FreeLibrary
LoadLibraryW
LoadResource
FindResourceW
GetVolumeNameForVolumeMountPointA
DeleteFileW
MoveFileExW
TerminateProcess
WaitForSingleObject
CreateProcessW
CreateEventW
SetFileAttributesW
CloseHandle
WriteFile
CreateFileW
GetTempFileNameW
GetTickCount
GetModuleFileNameW
OpenMutexW
GetFileAttributesW
GetModuleHandleA
Sleep
lstrcpyW
FindClose
FindFirstFileW
GetSystemDirectoryW
CopyFileW
GetCurrentProcess
ExitProcess
SetCurrentDirectoryW
CreateThread
SetFilePointerEx
GetUserDefaultLCID
FreeResource
GetFileSize
GetFullPathNameW
GetLastError
CreateMutexW
LocalFree
SetEvent
OpenEventW
lstrcmpiW
GetCommandLineW
OutputDebugStringA
GetCommandLineA
FindNextFileW
OpenProcess
SetFileTime
UnmapViewOfFile
MapViewOfFile
CreateFileMappingW
GetFileTime
Process32NextW
Process32FirstW
CreateToolhelp32Snapshot
GetWindowsDirectoryW
SearchPathW
GetTempPathW
user32
wsprintfW
wvsprintfA
wvsprintfW
wsprintfA
advapi32
RegisterServiceCtrlHandlerExW
LookupAccountSidW
DuplicateToken
CreateWellKnownSid
CheckTokenMembership
IsWellKnownSid
GetTokenInformation
OpenProcessToken
EnumServicesStatusExW
QueryServiceConfigW
CreateServiceW
ChangeServiceConfig2W
RegSetValueW
OpenSCManagerW
OpenServiceW
QueryServiceStatus
StartServiceW
DeleteService
CloseServiceHandle
CryptGenRandom
SetServiceStatus
RegEnumValueW
RegDeleteValueW
InitializeSecurityDescriptor
SetSecurityDescriptorDacl
StartServiceCtrlDispatcherW
CryptCreateHash
CryptHashData
CryptGetHashParam
CryptDestroyHash
CryptReleaseContext
RegCreateKeyExW
CryptAcquireContextW
RegCloseKey
RegQueryValueExW
RegOpenKeyExW
RegSetValueExW
shell32
ShellExecuteExW
SHChangeNotify
SHGetFolderPathW
CommandLineToArgvW
SHGetSpecialFolderPathW
SHGetFolderPathA
ole32
CoInitialize
CoCreateInstance
CoInitializeSecurity
CoUninitialize
IIDFromString
CoGetObject
CoInitializeEx
ntdll
NtQuerySystemTime
RtlDosPathNameToNtPathName_U
ZwDeleteFile
RtlFreeUnicodeString
RtlAcquirePebLock
RtlReleasePebLock
LdrEnumerateLoadedModules
ZwQueryInformationProcess
RtlTimeToSecondsSince1980
ZwSetInformationProcess
Sections
.text Size: 24KB - Virtual size: 24KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 11KB - Virtual size: 11KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 1024B - Virtual size: 196KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 1024B - Virtual size: 996B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ