Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
10/10/2024, 13:26
Static task
static1
Behavioral task
behavioral1
Sample
2024-10-10_d4cd2ff91baf898d3afa5c34109e27c8_lockbit.exe
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
2024-10-10_d4cd2ff91baf898d3afa5c34109e27c8_lockbit.exe
Resource
win10v2004-20241007-en
General
-
Target
2024-10-10_d4cd2ff91baf898d3afa5c34109e27c8_lockbit.exe
-
Size
93KB
-
MD5
d4cd2ff91baf898d3afa5c34109e27c8
-
SHA1
bd17e4452b292080cb0087fd4e5b100cccfe1c2d
-
SHA256
b8a646dd0931a3b455c720e4f3a6346447a3b4d7f1d41ff4336d29eac44055e0
-
SHA512
b3104d8f541483d6cfb1897b1cf809be9ed47c951621be830c6abbff6578d40d5e95256a312a8e8a833cec700e6fd9190be1babe306a37aef1cac26496e08687
-
SSDEEP
768:GlKar8kr2D6AKlLO+SNhBgCHDck4MV0ggv8KoETBB9D3xvjHhx4eC7Xj8Qc17/PT:qo/6A0q5HDR4oWBx3xrBx41z8QctT
Malware Config
Signatures
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\Control Panel\International\Geo\Nation 2024-10-10_d4cd2ff91baf898d3afa5c34109e27c8_lockbit.exe -
Executes dropped EXE 1 IoCs
pid Process 3448 PackagedCWALauncher.exe -
Impair Defenses: Safe Mode Boot 1 TTPs 2 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal\NGEN847_32 2024-10-10_d4cd2ff91baf898d3afa5c34109e27c8_lockbit.exe Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal\NGEN847_32\ = "Service" 2024-10-10_d4cd2ff91baf898d3afa5c34109e27c8_lockbit.exe -
Subvert Trust Controls: Mark-of-the-Web Bypass 1 TTPs 1 IoCs
When files are downloaded from the Internet, they are tagged with a hidden NTFS Alternate Data Stream (ADS) named Zone.Identifier with a specific value known as the MOTW.
description ioc Process File opened for modification C:\ProgramData\Microsoft\v2.0_2.0.0.0__de087c08862ce68f\PackagedCWALauncher.exe:Zone.Identifier 2024-10-10_d4cd2ff91baf898d3afa5c34109e27c8_lockbit.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 5 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2024-10-10_d4cd2ff91baf898d3afa5c34109e27c8_lockbit.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language PackagedCWALauncher.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language PING.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fsutil.exe -
System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 2 IoCs
Adversaries may check for Internet connectivity on compromised systems.
pid Process 4484 PING.EXE 1848 cmd.exe -
NTFS ADS 1 IoCs
description ioc Process File opened for modification C:\ProgramData\Microsoft\v2.0_2.0.0.0__de087c08862ce68f\PackagedCWALauncher.exe:Zone.Identifier 2024-10-10_d4cd2ff91baf898d3afa5c34109e27c8_lockbit.exe -
Runs ping.exe 1 TTPs 1 IoCs
pid Process 4484 PING.EXE -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 3448 PackagedCWALauncher.exe 3448 PackagedCWALauncher.exe 3448 PackagedCWALauncher.exe 3448 PackagedCWALauncher.exe 3448 PackagedCWALauncher.exe 3448 PackagedCWALauncher.exe 3448 PackagedCWALauncher.exe 3448 PackagedCWALauncher.exe 3448 PackagedCWALauncher.exe 3448 PackagedCWALauncher.exe 3448 PackagedCWALauncher.exe 3448 PackagedCWALauncher.exe 3448 PackagedCWALauncher.exe 3448 PackagedCWALauncher.exe 3448 PackagedCWALauncher.exe 3448 PackagedCWALauncher.exe 3448 PackagedCWALauncher.exe 3448 PackagedCWALauncher.exe 3448 PackagedCWALauncher.exe 3448 PackagedCWALauncher.exe 3448 PackagedCWALauncher.exe 3448 PackagedCWALauncher.exe 3448 PackagedCWALauncher.exe 3448 PackagedCWALauncher.exe 3448 PackagedCWALauncher.exe 3448 PackagedCWALauncher.exe 3448 PackagedCWALauncher.exe 3448 PackagedCWALauncher.exe 3448 PackagedCWALauncher.exe 3448 PackagedCWALauncher.exe 3448 PackagedCWALauncher.exe 3448 PackagedCWALauncher.exe 3448 PackagedCWALauncher.exe 3448 PackagedCWALauncher.exe 3448 PackagedCWALauncher.exe 3448 PackagedCWALauncher.exe 3448 PackagedCWALauncher.exe 3448 PackagedCWALauncher.exe 3448 PackagedCWALauncher.exe 3448 PackagedCWALauncher.exe 3448 PackagedCWALauncher.exe 3448 PackagedCWALauncher.exe 3448 PackagedCWALauncher.exe 3448 PackagedCWALauncher.exe 3448 PackagedCWALauncher.exe 3448 PackagedCWALauncher.exe 3448 PackagedCWALauncher.exe 3448 PackagedCWALauncher.exe 3448 PackagedCWALauncher.exe 3448 PackagedCWALauncher.exe 3448 PackagedCWALauncher.exe 3448 PackagedCWALauncher.exe 3448 PackagedCWALauncher.exe 3448 PackagedCWALauncher.exe 3448 PackagedCWALauncher.exe 3448 PackagedCWALauncher.exe 3448 PackagedCWALauncher.exe 3448 PackagedCWALauncher.exe 3448 PackagedCWALauncher.exe 3448 PackagedCWALauncher.exe 3448 PackagedCWALauncher.exe 3448 PackagedCWALauncher.exe 3448 PackagedCWALauncher.exe 3448 PackagedCWALauncher.exe -
Suspicious use of WriteProcessMemory 9 IoCs
description pid Process procid_target PID 5076 wrote to memory of 1848 5076 2024-10-10_d4cd2ff91baf898d3afa5c34109e27c8_lockbit.exe 86 PID 5076 wrote to memory of 1848 5076 2024-10-10_d4cd2ff91baf898d3afa5c34109e27c8_lockbit.exe 86 PID 5076 wrote to memory of 1848 5076 2024-10-10_d4cd2ff91baf898d3afa5c34109e27c8_lockbit.exe 86 PID 1848 wrote to memory of 4484 1848 cmd.exe 88 PID 1848 wrote to memory of 4484 1848 cmd.exe 88 PID 1848 wrote to memory of 4484 1848 cmd.exe 88 PID 1848 wrote to memory of 4324 1848 cmd.exe 89 PID 1848 wrote to memory of 4324 1848 cmd.exe 89 PID 1848 wrote to memory of 4324 1848 cmd.exe 89
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-10-10_d4cd2ff91baf898d3afa5c34109e27c8_lockbit.exe"C:\Users\Admin\AppData\Local\Temp\2024-10-10_d4cd2ff91baf898d3afa5c34109e27c8_lockbit.exe"1⤵
- Checks computer location settings
- Impair Defenses: Safe Mode Boot
- Subvert Trust Controls: Mark-of-the-Web Bypass
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of WriteProcessMemory
PID:5076 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /d /c ping -n 2 127.0.0.1 > NUL & fsutil file setzerodata offset=0 length=524288 "C:\Users\Admin\AppData\Local\Temp\2024-10-10_d4cd2ff91baf898d3afa5c34109e27c8_lockbit.exe" & del "C:\Users\Admin\AppData\Local\Temp\2024-10-10_d4cd2ff91baf898d3afa5c34109e27c8_lockbit.exe" > NUL & exit2⤵
- System Location Discovery: System Language Discovery
- System Network Configuration Discovery: Internet Connection Discovery
- Suspicious use of WriteProcessMemory
PID:1848 -
C:\Windows\SysWOW64\PING.EXEping -n 2 127.0.0.13⤵
- System Location Discovery: System Language Discovery
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
PID:4484
-
-
C:\Windows\SysWOW64\fsutil.exefsutil file setzerodata offset=0 length=524288 "C:\Users\Admin\AppData\Local\Temp\2024-10-10_d4cd2ff91baf898d3afa5c34109e27c8_lockbit.exe"3⤵
- System Location Discovery: System Language Discovery
PID:4324
-
-
-
C:\ProgramData\Microsoft\v2.0_2.0.0.0__de087c08862ce68f\PackagedCWALauncher.exeC:\ProgramData\Microsoft\v2.0_2.0.0.0__de087c08862ce68f\PackagedCWALauncher.exe1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:3448
Network
MITRE ATT&CK Enterprise v15
Defense Evasion
Impair Defenses
1Safe Mode Boot
1Subvert Trust Controls
1SIP and Trust Provider Hijacking
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
38KB
MD56af7ca9aa162ff723d5cd9f9e67053cd
SHA1cbb5d698f6a6cca466bf6439bea912cc34f83692
SHA2566b6cf819e0b3191c6785ac99e040cfb14e71ddc8ce13ddd1190a7fc36f337ee1
SHA512fee897a15156983b17ab9ed8891bd4b08cc85db43d3c47ecf615c5d819fb4cc687794a439f229e6aa6484afd1f3a564a03f64c812dbf9d3ae6965ec0858cd318
-
Filesize
93KB
MD5d4cd2ff91baf898d3afa5c34109e27c8
SHA1bd17e4452b292080cb0087fd4e5b100cccfe1c2d
SHA256b8a646dd0931a3b455c720e4f3a6346447a3b4d7f1d41ff4336d29eac44055e0
SHA512b3104d8f541483d6cfb1897b1cf809be9ed47c951621be830c6abbff6578d40d5e95256a312a8e8a833cec700e6fd9190be1babe306a37aef1cac26496e08687