Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    119s
  • max time network
    120s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    17/01/2025, 08:19

General

  • Target

    {04830965-76E6-6A9A-8EE1-6AF7499C1D08}.zip

  • Size

    160KB

  • MD5

    ba9ad420b3560110b323b1145212fa0f

  • SHA1

    37c0b397385c14c181f9d29dde39996a0394cbe9

  • SHA256

    b711d6247a467d516c23151639608177e37c80e80d09d6afd4766a7daac1637e

  • SHA512

    20a8baf51e11ab081be713166e2f48884f200a019b571816ea93c7f86d125e6fdbb1e892f7765b2f6c36aa800c913970ad0e59bef94d3c56f9a88a3b2c7541fd

  • SSDEEP

    3072:93FuyHZtF389cNNTK5rX81YVvyeH83xqemprWMvhD6O7PMshMaeT8oBP:9c6FsWNNTUrsmt5chhmYsl6O7PMYjA8a

Malware Config

Signatures

  • Lockbit

    Ransomware family with multiple variants released since late 2019.

  • Lockbit family
  • Rule to detect Lockbit 3.0 ransomware Windows payload 3 IoCs
  • Executes dropped EXE 3 IoCs
  • Loads dropped DLL 3 IoCs
  • Program crash 1 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious behavior: EnumeratesProcesses 1 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 4 IoCs
  • Suspicious use of FindShellTrayWindow 3 IoCs
  • Suspicious use of WriteProcessMemory 8 IoCs

Processes

  • C:\Program Files\7-Zip\7zFM.exe
    "C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\AppData\Local\Temp\{04830965-76E6-6A9A-8EE1-6AF7499C1D08}.zip"
    1⤵
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: GetForegroundWindowSpam
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of WriteProcessMemory
    PID:1852
    • C:\Users\Admin\AppData\Local\Temp\7zOC375B6A6\{04830965-76E6-6A9A-8EE1-6AF7499C1D08}.exe
      "C:\Users\Admin\AppData\Local\Temp\7zOC375B6A6\{04830965-76E6-6A9A-8EE1-6AF7499C1D08}.exe"
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:2216
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 2216 -s 88
        3⤵
        • Loads dropped DLL
        • Program crash
        PID:2716
  • C:\Users\Admin\Desktop\{04830965-76E6-6A9A-8EE1-6AF7499C1D08}.exe
    "C:\Users\Admin\Desktop\{04830965-76E6-6A9A-8EE1-6AF7499C1D08}.exe"
    1⤵
    • Executes dropped EXE
    PID:2224
  • C:\Users\Admin\Desktop\{04830965-76E6-6A9A-8EE1-6AF7499C1D08}.exe
    "C:\Users\Admin\Desktop\{04830965-76E6-6A9A-8EE1-6AF7499C1D08}.exe"
    1⤵
    • Executes dropped EXE
    PID:2964

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\7zOC375B6A6\{04830965-76E6-6A9A-8EE1-6AF7499C1D08}.exe

    Filesize

    162KB

    MD5

    38745539b71cf201bb502437f891d799

    SHA1

    f2a72bee623659d3ba16b365024020868246d901

    SHA256

    80e8defa5377018b093b5b90de0f2957f7062144c83a09a56bba1fe4eda932ce

    SHA512

    772e76757069c3375cf1ffd659ff03f47f2d4becae61a852adbc27ae467551210d8832994f944c05fccc8486a8a88322021c94217a8bd962c2459af41067132b

  • memory/2216-12-0x0000000000400000-0x000000000042C000-memory.dmp

    Filesize

    176KB

  • memory/2216-16-0x0000000000400000-0x000000000042C000-memory.dmp

    Filesize

    176KB