Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
119s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
17/01/2025, 08:19
Static task
static1
Behavioral task
behavioral1
Sample
{04830965-76E6-6A9A-8EE1-6AF7499C1D08}.zip
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
{04830965-76E6-6A9A-8EE1-6AF7499C1D08}.zip
Resource
win10v2004-20241007-en
General
-
Target
{04830965-76E6-6A9A-8EE1-6AF7499C1D08}.zip
-
Size
160KB
-
MD5
ba9ad420b3560110b323b1145212fa0f
-
SHA1
37c0b397385c14c181f9d29dde39996a0394cbe9
-
SHA256
b711d6247a467d516c23151639608177e37c80e80d09d6afd4766a7daac1637e
-
SHA512
20a8baf51e11ab081be713166e2f48884f200a019b571816ea93c7f86d125e6fdbb1e892f7765b2f6c36aa800c913970ad0e59bef94d3c56f9a88a3b2c7541fd
-
SSDEEP
3072:93FuyHZtF389cNNTK5rX81YVvyeH83xqemprWMvhD6O7PMshMaeT8oBP:9c6FsWNNTUrsmt5chhmYsl6O7PMYjA8a
Malware Config
Signatures
-
Lockbit
Ransomware family with multiple variants released since late 2019.
-
Lockbit family
-
Rule to detect Lockbit 3.0 ransomware Windows payload 3 IoCs
resource yara_rule behavioral1/files/0x0008000000019234-4.dat family_lockbit behavioral1/memory/2216-12-0x0000000000400000-0x000000000042C000-memory.dmp family_lockbit behavioral1/memory/2216-16-0x0000000000400000-0x000000000042C000-memory.dmp family_lockbit -
Executes dropped EXE 3 IoCs
pid Process 2216 {04830965-76E6-6A9A-8EE1-6AF7499C1D08}.exe 2224 {04830965-76E6-6A9A-8EE1-6AF7499C1D08}.exe 2964 {04830965-76E6-6A9A-8EE1-6AF7499C1D08}.exe -
Loads dropped DLL 3 IoCs
pid Process 2716 WerFault.exe 2716 WerFault.exe 2716 WerFault.exe -
Program crash 1 IoCs
pid pid_target Process procid_target 2716 2216 WerFault.exe 31 -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language {04830965-76E6-6A9A-8EE1-6AF7499C1D08}.exe -
Suspicious behavior: EnumeratesProcesses 1 IoCs
pid Process 1852 7zFM.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 1852 7zFM.exe -
Suspicious use of AdjustPrivilegeToken 4 IoCs
description pid Process Token: SeRestorePrivilege 1852 7zFM.exe Token: 35 1852 7zFM.exe Token: SeSecurityPrivilege 1852 7zFM.exe Token: SeSecurityPrivilege 1852 7zFM.exe -
Suspicious use of FindShellTrayWindow 3 IoCs
pid Process 1852 7zFM.exe 1852 7zFM.exe 1852 7zFM.exe -
Suspicious use of WriteProcessMemory 8 IoCs
description pid Process procid_target PID 1852 wrote to memory of 2216 1852 7zFM.exe 31 PID 1852 wrote to memory of 2216 1852 7zFM.exe 31 PID 1852 wrote to memory of 2216 1852 7zFM.exe 31 PID 1852 wrote to memory of 2216 1852 7zFM.exe 31 PID 2216 wrote to memory of 2716 2216 {04830965-76E6-6A9A-8EE1-6AF7499C1D08}.exe 32 PID 2216 wrote to memory of 2716 2216 {04830965-76E6-6A9A-8EE1-6AF7499C1D08}.exe 32 PID 2216 wrote to memory of 2716 2216 {04830965-76E6-6A9A-8EE1-6AF7499C1D08}.exe 32 PID 2216 wrote to memory of 2716 2216 {04830965-76E6-6A9A-8EE1-6AF7499C1D08}.exe 32
Processes
-
C:\Program Files\7-Zip\7zFM.exe"C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\AppData\Local\Temp\{04830965-76E6-6A9A-8EE1-6AF7499C1D08}.zip"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:1852 -
C:\Users\Admin\AppData\Local\Temp\7zOC375B6A6\{04830965-76E6-6A9A-8EE1-6AF7499C1D08}.exe"C:\Users\Admin\AppData\Local\Temp\7zOC375B6A6\{04830965-76E6-6A9A-8EE1-6AF7499C1D08}.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2216 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2216 -s 883⤵
- Loads dropped DLL
- Program crash
PID:2716
-
-
-
C:\Users\Admin\Desktop\{04830965-76E6-6A9A-8EE1-6AF7499C1D08}.exe"C:\Users\Admin\Desktop\{04830965-76E6-6A9A-8EE1-6AF7499C1D08}.exe"1⤵
- Executes dropped EXE
PID:2224
-
C:\Users\Admin\Desktop\{04830965-76E6-6A9A-8EE1-6AF7499C1D08}.exe"C:\Users\Admin\Desktop\{04830965-76E6-6A9A-8EE1-6AF7499C1D08}.exe"1⤵
- Executes dropped EXE
PID:2964
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
162KB
MD538745539b71cf201bb502437f891d799
SHA1f2a72bee623659d3ba16b365024020868246d901
SHA25680e8defa5377018b093b5b90de0f2957f7062144c83a09a56bba1fe4eda932ce
SHA512772e76757069c3375cf1ffd659ff03f47f2d4becae61a852adbc27ae467551210d8832994f944c05fccc8486a8a88322021c94217a8bd962c2459af41067132b