Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
84s -
max time network
141s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
10/01/2025, 12:41
General
-
Target
6375e7e4c7cdc3f96afd991c4dfedd5cdfe4b31bf0662dccfa703c117e951f71.exe
-
Size
1.7MB
-
MD5
927426bafb84fe8daff84cff77258e0d
-
SHA1
320a91f6b810e4f5dbb38f58fd2949c780d4c807
-
SHA256
6375e7e4c7cdc3f96afd991c4dfedd5cdfe4b31bf0662dccfa703c117e951f71
-
SHA512
1eb9eb0e65a6cb5ea43db76b476f8a0a78942664980eee67e46929685005f40d7f7d85be3e1dec98fce3ca7bfdce62ad2d6daafdc96a4844e84a72a721d55181
-
SSDEEP
24576:/5dZufOrzvckB+Fr+waFHTcqunNW3QdWvPiVD2CWgrUE94FFs+n9rQOF8nux8igX:/5dVwPaFHTTgkAAn2IQ39y9rRF8uxG
Malware Config
Extracted
C:\ZQXLByuZ3.README.txt
lockbit
http://lockbitapt2yfbt7lchxejug47kmqvqqxvvjpqkmevv4l3azl3gy6pyd.onion
http://lockbitapt5x4zkjbcqmz6frdhecqqgadevyiwqxukksspnlidyvd7qd.onion
http://lockbitapt6vx57t3eeqjofwgcglmutr3a35nygvokja5uuccip4ykyd.onion
http://lockbitapt34kvrip6xojylohhxrwsvpzdffgs5z4pbbsywnzsbdguqd.onion
http://lockbitaptc2iq4atewz2ise62q63wfktyrl4qtwuk5qax262kgtzjqd.onion
http://lockbitaptjpikdqjynvgozhgc6bgetgucdk5xjacozeaawihmoio6yd.onion
http://lockbitaptq7ephv2oigdncfhtwhpqgwmqojnxqdyhprxxfpcllqdxad.onion
http://lockbitaptstzf3er2lz6ku3xuifafq2yh5lmiqj5ncur6rtlmkteiqd.onion
http://lockbitaptoofrpignlz6dt2wqqc5z3a4evjevoa3eqdfcntxad5lmyd.onion
http://lockbitapt.uz
http://lockbitapt2yfbt7lchxejug47kmqvqqxvvjpqkmevv4l3azl3gy6pyd.onion.ly
http://lockbitapt5x4zkjbcqmz6frdhecqqgadevyiwqxukksspnlidyvd7qd.onion.ly
http://lockbitapt6vx57t3eeqjofwgcglmutr3a35nygvokja5uuccip4ykyd.onion.ly
http://lockbitapt34kvrip6xojylohhxrwsvpzdffgs5z4pbbsywnzsbdguqd.onion.ly
http://lockbitaptc2iq4atewz2ise62q63wfktyrl4qtwuk5qax262kgtzjqd.onion.ly
http://lockbitaptjpikdqjynvgozhgc6bgetgucdk5xjacozeaawihmoio6yd.onion.ly
http://lockbitaptq7ephv2oigdncfhtwhpqgwmqojnxqdyhprxxfpcllqdxad.onion.ly
http://lockbitaptstzf3er2lz6ku3xuifafq2yh5lmiqj5ncur6rtlmkteiqd.onion.ly
http://lockbitaptoofrpignlz6dt2wqqc5z3a4evjevoa3eqdfcntxad5lmyd.onion.ly
https://twitter.com/hashtag/lockbit?f=live
Signatures
-
Lockbit
Ransomware family with multiple variants released since late 2019.
-
Lockbit family
-
Renames multiple (614) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
-
Deletes itself 1 IoCs
-
Executes dropped EXE 1 IoCs
-
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Drops desktop.ini file(s) 2 IoCs
-
Indicator Removal: File Deletion 1 TTPs
Adversaries may delete files left behind by the actions of their intrusion activity.
-
Drops file in System32 directory 4 IoCs
-
Sets desktop wallpaper using registry 2 TTPs 2 IoCs
-
Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
-
Suspicious use of SetThreadContext 1 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 5 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
-
Enumerates system info in registry 2 TTPs 3 IoCs
-
Modifies Control Panel 2 IoCs
-
Modifies registry class 9 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious behavior: RenamesItself 26 IoCs
-
Suspicious use of AdjustPrivilegeToken 64 IoCs
-
Suspicious use of SetWindowsHookEx 13 IoCs
-
Suspicious use of WriteProcessMemory 27 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\6375e7e4c7cdc3f96afd991c4dfedd5cdfe4b31bf0662dccfa703c117e951f71.exe"C:\Users\Admin\AppData\Local\Temp\6375e7e4c7cdc3f96afd991c4dfedd5cdfe4b31bf0662dccfa703c117e951f71.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\6375e7e4c7cdc3f96afd991c4dfedd5cdfe4b31bf0662dccfa703c117e951f71.exe"C:\Users\Admin\AppData\Local\Temp\6375e7e4c7cdc3f96afd991c4dfedd5cdfe4b31bf0662dccfa703c117e951f71.exe"2⤵
- Checks BIOS information in registry
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\6375e7e4c7cdc3f96afd991c4dfedd5cdfe4b31bf0662dccfa703c117e951f71.exeC:\Users\Admin\AppData\Local\Temp\6375e7e4c7cdc3f96afd991c4dfedd5cdfe4b31bf0662dccfa703c117e951f71.exe3⤵
- Drops desktop.ini file(s)
- Sets desktop wallpaper using registry
- System Location Discovery: System Language Discovery
- Modifies Control Panel
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\splwow64.exeC:\Windows\splwow64.exe 122884⤵
- Drops file in System32 directory
-
-
C:\ProgramData\F1B4.tmp"C:\ProgramData\F1B4.tmp"4⤵
- Checks computer location settings
- Deletes itself
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C DEL /F /Q C:\PROGRA~3\F1B4.tmp >> NUL5⤵
- System Location Discovery: System Language Discovery
-
-
-
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k PrintWorkflow -s PrintWorkflowUserSvc1⤵
-
C:\Windows\system32\printfilterpipelinesvc.exeC:\Windows\system32\printfilterpipelinesvc.exe -Embedding1⤵
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Microsoft Office\root\Office16\ONENOTE.EXE/insertdoc "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\{5C2BA39F-D202-407C-BEEF-F6E076BC853C}.xps" 1338098653668100002⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious use of SetWindowsHookEx
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
129B
MD5660a760ac007f3234f2967d5e45a50f3
SHA199c59f9264fa2d218e97879990f1cd3434ab56bf
SHA256169809a62cb05c19cfb32de2d5808875c5547237022cafc6debf354e61aee878
SHA5121c612620b0a4245378168cd1d014600ef17832da88d21afc47dab09382aa016ec8d6685e7a6e7a82995862000a3fe396063995cac51e45a26c240ca95baaf2ef
-
Filesize
14KB
MD5294e9f64cb1642dd89229fff0592856b
SHA197b148c27f3da29ba7b18d6aee8a0db9102f47c9
SHA256917e115cc403e29b4388e0d175cbfac3e7e40ca1742299fbdb353847db2de7c2
SHA512b87d531890bf1577b9b4af41dddb2cdbbfa164cf197bd5987df3a3075983645a3acba443e289b7bfd338422978a104f55298fbfe346872de0895bde44adc89cf
-
Filesize
1.7MB
MD5b1dbf96cbac92d09620f908add74123a
SHA1721311bb9f042a8d0298f294f9a9c25386a5bb5d
SHA256c74cb00fc0ab4dab4011220be8ebbc98928fbd7185ea1ce20644f2918c0756a6
SHA51286c930d9321d2b7d0f9d283017d19c5548c9d75935e7611dfb711d883d01f03dbc9bfd2cdb91e3ab34f526886358e7bc62ca2e0e3c1b50cbb776ecc42612e96d
-
Filesize
4KB
MD592313fcabf805e0c0a68a0a1cdc55496
SHA19bce924befffc639553461690094652d35888f62
SHA2565316481275c4115fa3727da7ce1326d479a3a7edf006803fb0153d1b24810ef8
SHA5124cdb68b6d5397c0f1db692986a4ec8e410174db8283c879a80363efbb89b9d62582b2fd2c9a7626adab6a30bc4a419a6bc03a3bcbf40733f0c1240b35611881a
-
Filesize
4KB
MD55bc945a644003e24c49b83dbebd4ee70
SHA1d174db67cc1092ecd56e85cc2f448c7b85b1f8e6
SHA256e6d37f749ad25aba9687523acaa0dead6dde371df68a566210d3fec73172f930
SHA5122e476eb4bafd59b94348d01aa46a8ba91979e3ed74a96e8cca5f9c2a4bfe4504f9cb2fd985076a59161515b55633e8e7d8f99aa14926c3f67205c9d809dc2465
-
Filesize
5KB
MD55d059a43265f2b6dee086721bf8a251a
SHA112abeec0e1c9b55caa73ae01ca33e156a1eea434
SHA25681a9270f3478012eaa0ac8ae38663d477a62d3606bb1508c1ece53a9b61a1d7d
SHA512e8548d7a846a869edcd2e719ad2f097af23053f26a672a06ca639417db61cfb46dbaec98a76aa76d31d81486847a9a41bc9b75a7e46c26555a16551b4d572c5e
-
Filesize
129B
MD5747a098b8318582aefec952f67120be3
SHA145e0a2e7712161e9c1006fd3996acdfb470f3c9a
SHA2563981ea8b56bb90f02302f0467e14aa159c1bd7af67168f2c7a8dc1b5c7fc5c45
SHA512d5d7dd38b5fd4afd0f90c9ed28049b0ea1c1c7dc766b53d65c0309ac6700f2f1be343e98ab7a7329d5579d2d691f59b263710fc280505fbbaf8d0c4357da83ef
-
Filesize
64KB
-
Filesize
168KB
-
Filesize
168KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
168KB
-
Filesize
168KB
-
Filesize
168KB
-
Filesize
168KB
-
Filesize
168KB
-
Filesize
168KB
-
Filesize
168KB
-
Filesize
168KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
168KB
-
Filesize
168KB
-
Filesize
168KB
-
Filesize
168KB
-
Filesize
168KB
-
Filesize
168KB
-
Filesize
168KB
-
Filesize
168KB
-
Filesize
168KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
1.7MB
-
Filesize
1.7MB
-
Filesize
1.7MB
-
Filesize
1.4MB
-
Filesize
1.4MB
-
Filesize
1.4MB
-
Filesize
1.7MB
-
Filesize
1.4MB
-
Filesize
1.7MB
-
Filesize
1.7MB
-
Filesize
1.7MB