Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
143s -
max time network
148s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
21/09/2024, 04:27
Static task
static1
Behavioral task
behavioral1
Sample
2024-09-21_c1e80dc69b7b74cc5eac95c315d62d83_lockbit.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
2024-09-21_c1e80dc69b7b74cc5eac95c315d62d83_lockbit.exe
Resource
win10v2004-20240802-en
General
-
Target
2024-09-21_c1e80dc69b7b74cc5eac95c315d62d83_lockbit.exe
-
Size
37KB
-
MD5
c1e80dc69b7b74cc5eac95c315d62d83
-
SHA1
531b5886d64ce1a228ea921999fb593396943325
-
SHA256
d8791625d86dff22d527f72b69d314f9a34e88d1129e3ef1d29e040fcb433208
-
SHA512
391c48bf1110d4b02f8aa15029e362a6ee3121b37057b6dbf936dfe451ed1f4c5855f4f22edbffe8175f25fea4eaaf9e41627e28b1db6d5663554fba3d11687d
-
SSDEEP
768:ETEjmqVxAxuZY9AldyQSRA2wnXw/uaLoBB5Ux4PC74801h2w:cgxAxuW2ldyYvhauBSx40480Ow
Malware Config
Signatures
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-2170637797-568393320-3232933035-1000\Control Panel\International\Geo\Nation 2024-09-21_c1e80dc69b7b74cc5eac95c315d62d83_lockbit.exe -
Executes dropped EXE 1 IoCs
pid Process 4360 quickassist.exe -
Subvert Trust Controls: Mark-of-the-Web Bypass 1 TTPs 1 IoCs
When files are downloaded from the Internet, they are tagged with a hidden NTFS Alternate Data Stream (ADS) named Zone.Identifier with a specific value known as the MOTW.
description ioc Process File opened for modification C:\ProgramData\Microsoft\v2.0_2.0.0.0__df9c1b2fa7a5f2cb\quickassist.exe:Zone.Identifier 2024-09-21_c1e80dc69b7b74cc5eac95c315d62d83_lockbit.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 5 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language PING.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fsutil.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2024-09-21_c1e80dc69b7b74cc5eac95c315d62d83_lockbit.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language quickassist.exe -
System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 2 IoCs
Adversaries may check for Internet connectivity on compromised systems.
pid Process 4960 cmd.exe 4080 PING.EXE -
NTFS ADS 1 IoCs
description ioc Process File opened for modification C:\ProgramData\Microsoft\v2.0_2.0.0.0__df9c1b2fa7a5f2cb\quickassist.exe:Zone.Identifier 2024-09-21_c1e80dc69b7b74cc5eac95c315d62d83_lockbit.exe -
Runs ping.exe 1 TTPs 1 IoCs
pid Process 4080 PING.EXE -
Suspicious use of WriteProcessMemory 9 IoCs
description pid Process procid_target PID 3396 wrote to memory of 4960 3396 2024-09-21_c1e80dc69b7b74cc5eac95c315d62d83_lockbit.exe 98 PID 3396 wrote to memory of 4960 3396 2024-09-21_c1e80dc69b7b74cc5eac95c315d62d83_lockbit.exe 98 PID 3396 wrote to memory of 4960 3396 2024-09-21_c1e80dc69b7b74cc5eac95c315d62d83_lockbit.exe 98 PID 4960 wrote to memory of 4080 4960 cmd.exe 100 PID 4960 wrote to memory of 4080 4960 cmd.exe 100 PID 4960 wrote to memory of 4080 4960 cmd.exe 100 PID 4960 wrote to memory of 636 4960 cmd.exe 101 PID 4960 wrote to memory of 636 4960 cmd.exe 101 PID 4960 wrote to memory of 636 4960 cmd.exe 101
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-09-21_c1e80dc69b7b74cc5eac95c315d62d83_lockbit.exe"C:\Users\Admin\AppData\Local\Temp\2024-09-21_c1e80dc69b7b74cc5eac95c315d62d83_lockbit.exe"1⤵
- Checks computer location settings
- Subvert Trust Controls: Mark-of-the-Web Bypass
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of WriteProcessMemory
PID:3396 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /d /c ping -n 2 127.0.0.1 > NUL & fsutil file setzerodata offset=0 length=524288 "C:\Users\Admin\AppData\Local\Temp\2024-09-21_c1e80dc69b7b74cc5eac95c315d62d83_lockbit.exe" & del "C:\Users\Admin\AppData\Local\Temp\2024-09-21_c1e80dc69b7b74cc5eac95c315d62d83_lockbit.exe" > NUL & exit2⤵
- System Location Discovery: System Language Discovery
- System Network Configuration Discovery: Internet Connection Discovery
- Suspicious use of WriteProcessMemory
PID:4960 -
C:\Windows\SysWOW64\PING.EXEping -n 2 127.0.0.13⤵
- System Location Discovery: System Language Discovery
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
PID:4080
-
-
C:\Windows\SysWOW64\fsutil.exefsutil file setzerodata offset=0 length=524288 "C:\Users\Admin\AppData\Local\Temp\2024-09-21_c1e80dc69b7b74cc5eac95c315d62d83_lockbit.exe"3⤵
- System Location Discovery: System Language Discovery
PID:636
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --field-trial-handle=4616,i,15336851255456239337,16379811035920490645,262144 --variations-seed-version --mojo-platform-channel-handle=1008 /prefetch:81⤵PID:228
-
C:\ProgramData\Microsoft\v2.0_2.0.0.0__df9c1b2fa7a5f2cb\quickassist.exeC:\ProgramData\Microsoft\v2.0_2.0.0.0__df9c1b2fa7a5f2cb\quickassist.exe1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4360
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
67KB
MD56f250371c7fecac6c02476d7fdfe5241
SHA1000dacde56656a7cb3b192eb5dd3742bb8096935
SHA25609b84a4e33ad286e7a461b08ca2e51e5654c9c552a0e7bc7ddbc860bcbcf643e
SHA512d8f65b0d426b2ea153d244d2bb6a7a99bea140d33b9089a8d98c5beba587495b066840fe467ac7370a5786ef3d0af2cbb8e6a332b5f418d780da7170d048c093
-
Filesize
37KB
MD5c1e80dc69b7b74cc5eac95c315d62d83
SHA1531b5886d64ce1a228ea921999fb593396943325
SHA256d8791625d86dff22d527f72b69d314f9a34e88d1129e3ef1d29e040fcb433208
SHA512391c48bf1110d4b02f8aa15029e362a6ee3121b37057b6dbf936dfe451ed1f4c5855f4f22edbffe8175f25fea4eaaf9e41627e28b1db6d5663554fba3d11687d