Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
119s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20241010-en -
resource tags
arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system -
submitted
17/01/2025, 08:20
Behavioral task
behavioral1
Sample
LB3.exe
Resource
win7-20241010-en
Behavioral task
behavioral2
Sample
LB3.exe
Resource
win10v2004-20241007-en
General
-
Target
LB3.exe
-
Size
153KB
-
MD5
68113e278e0a5dce97f0f4476fb869f2
-
SHA1
f61827624bb4a84c11f8b2b1cb6c2f1b4e196b46
-
SHA256
6cf0cfd51b09634194d679fb2c3d8706548e02125346be33ac62deb68f6f0190
-
SHA512
b1e7c34ef6528e39bc17c3cf0dc7d568a51454238db8b31119ef271d6ece1ff57720d103640f8197a7aa0fa5906823ca576b5d31e8b9a0c92c07183b61f80894
-
SSDEEP
3072:vqJogYkcSNm9V7DYlzukbrnfQdbHu2mT:vq2kc4m9tDYlzuAwbHu2
Malware Config
Extracted
C:\6ZHghI9GZ.README.txt
lockbit
http://lockbitapt2yfbt7lchxejug47kmqvqqxvvjpqkmevv4l3azl3gy6pyd.onion
http://lockbitapt5x4zkjbcqmz6frdhecqqgadevyiwqxukksspnlidyvd7qd.onion
http://lockbitapt6vx57t3eeqjofwgcglmutr3a35nygvokja5uuccip4ykyd.onion
http://lockbitapt34kvrip6xojylohhxrwsvpzdffgs5z4pbbsywnzsbdguqd.onion
http://lockbitaptc2iq4atewz2ise62q63wfktyrl4qtwuk5qax262kgtzjqd.onion
http://lockbitaptjpikdqjynvgozhgc6bgetgucdk5xjacozeaawihmoio6yd.onion
http://lockbitaptq7ephv2oigdncfhtwhpqgwmqojnxqdyhprxxfpcllqdxad.onion
http://lockbitaptstzf3er2lz6ku3xuifafq2yh5lmiqj5ncur6rtlmkteiqd.onion
http://lockbitaptoofrpignlz6dt2wqqc5z3a4evjevoa3eqdfcntxad5lmyd.onion
http://lockbitapt.uz
http://lockbitapt2yfbt7lchxejug47kmqvqqxvvjpqkmevv4l3azl3gy6pyd.onion.ly
http://lockbitapt5x4zkjbcqmz6frdhecqqgadevyiwqxukksspnlidyvd7qd.onion.ly
http://lockbitapt6vx57t3eeqjofwgcglmutr3a35nygvokja5uuccip4ykyd.onion.ly
http://lockbitapt34kvrip6xojylohhxrwsvpzdffgs5z4pbbsywnzsbdguqd.onion.ly
http://lockbitaptc2iq4atewz2ise62q63wfktyrl4qtwuk5qax262kgtzjqd.onion.ly
http://lockbitaptjpikdqjynvgozhgc6bgetgucdk5xjacozeaawihmoio6yd.onion.ly
http://lockbitaptq7ephv2oigdncfhtwhpqgwmqojnxqdyhprxxfpcllqdxad.onion.ly
http://lockbitaptstzf3er2lz6ku3xuifafq2yh5lmiqj5ncur6rtlmkteiqd.onion.ly
http://lockbitaptoofrpignlz6dt2wqqc5z3a4evjevoa3eqdfcntxad5lmyd.onion.ly
https://twitter.com/hashtag/lockbit?f=live
http://lockbitsupt7nr3fa6e7xyb73lk6bw6rcneqhoyblniiabj4uwvzapqd.onion
http://lockbitsupuhswh4izvoucoxsbnotkmgq6durg7kficg6u33zfvq3oyd.onion
http://lockbitsupn2h6be2cnqpvncyhj4rgmnwn44633hnzzmtxdvjoqlp7yd.onion
http://lockbitsupp.uz
https://tox.chat/download.html
Signatures
-
Lockbit
Ransomware family with multiple variants released since late 2019.
-
Lockbit family
-
Renames multiple (338) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Deletes itself 1 IoCs
pid Process 2600 BF2.tmp -
Executes dropped EXE 1 IoCs
pid Process 2600 BF2.tmp -
Loads dropped DLL 1 IoCs
pid Process 2572 LB3.exe -
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Drops desktop.ini file(s) 2 IoCs
description ioc Process File opened for modification C:\$Recycle.Bin\S-1-5-21-3692679935-4019334568-335155002-1000\desktop.ini LB3.exe File opened for modification F:\$RECYCLE.BIN\S-1-5-21-3692679935-4019334568-335155002-1000\desktop.ini LB3.exe -
Indicator Removal: File Deletion 1 TTPs
Adversaries may delete files left behind by the actions of their intrusion activity.
-
Sets desktop wallpaper using registry 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Control Panel\Desktop\Wallpaper = "C:\\ProgramData\\6ZHghI9GZ.bmp" LB3.exe Set value (str) \REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Control Panel\Desktop\WallPaper = "C:\\ProgramData\\6ZHghI9GZ.bmp" LB3.exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
pid Process 2600 BF2.tmp -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language LB3.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BF2.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe -
Modifies Control Panel 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Control Panel\Desktop LB3.exe Set value (str) \REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Control Panel\Desktop\WallpaperStyle = "10" LB3.exe -
Modifies registry class 5 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\6ZHghI9GZ LB3.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\6ZHghI9GZ\DefaultIcon\ = "C:\\ProgramData\\6ZHghI9GZ.ico" LB3.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.6ZHghI9GZ LB3.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.6ZHghI9GZ\ = "6ZHghI9GZ" LB3.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\6ZHghI9GZ\DefaultIcon LB3.exe -
Opens file in notepad (likely ransom note) 1 IoCs
pid Process 1608 NOTEPAD.EXE -
Suspicious behavior: EnumeratesProcesses 14 IoCs
pid Process 2572 LB3.exe 2572 LB3.exe 2572 LB3.exe 2572 LB3.exe 2572 LB3.exe 2572 LB3.exe 2572 LB3.exe 2572 LB3.exe 2572 LB3.exe 2572 LB3.exe 2572 LB3.exe 2572 LB3.exe 2572 LB3.exe 2572 LB3.exe -
Suspicious behavior: RenamesItself 26 IoCs
pid Process 2600 BF2.tmp 2600 BF2.tmp 2600 BF2.tmp 2600 BF2.tmp 2600 BF2.tmp 2600 BF2.tmp 2600 BF2.tmp 2600 BF2.tmp 2600 BF2.tmp 2600 BF2.tmp 2600 BF2.tmp 2600 BF2.tmp 2600 BF2.tmp 2600 BF2.tmp 2600 BF2.tmp 2600 BF2.tmp 2600 BF2.tmp 2600 BF2.tmp 2600 BF2.tmp 2600 BF2.tmp 2600 BF2.tmp 2600 BF2.tmp 2600 BF2.tmp 2600 BF2.tmp 2600 BF2.tmp 2600 BF2.tmp -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeAssignPrimaryTokenPrivilege 2572 LB3.exe Token: SeBackupPrivilege 2572 LB3.exe Token: SeDebugPrivilege 2572 LB3.exe Token: 36 2572 LB3.exe Token: SeImpersonatePrivilege 2572 LB3.exe Token: SeIncBasePriorityPrivilege 2572 LB3.exe Token: SeIncreaseQuotaPrivilege 2572 LB3.exe Token: 33 2572 LB3.exe Token: SeManageVolumePrivilege 2572 LB3.exe Token: SeProfSingleProcessPrivilege 2572 LB3.exe Token: SeRestorePrivilege 2572 LB3.exe Token: SeSecurityPrivilege 2572 LB3.exe Token: SeSystemProfilePrivilege 2572 LB3.exe Token: SeTakeOwnershipPrivilege 2572 LB3.exe Token: SeShutdownPrivilege 2572 LB3.exe Token: SeDebugPrivilege 2572 LB3.exe Token: SeBackupPrivilege 2572 LB3.exe Token: SeBackupPrivilege 2572 LB3.exe Token: SeSecurityPrivilege 2572 LB3.exe Token: SeSecurityPrivilege 2572 LB3.exe Token: SeBackupPrivilege 2572 LB3.exe Token: SeBackupPrivilege 2572 LB3.exe Token: SeSecurityPrivilege 2572 LB3.exe Token: SeSecurityPrivilege 2572 LB3.exe Token: SeBackupPrivilege 2572 LB3.exe Token: SeBackupPrivilege 2572 LB3.exe Token: SeSecurityPrivilege 2572 LB3.exe Token: SeSecurityPrivilege 2572 LB3.exe Token: SeBackupPrivilege 2572 LB3.exe Token: SeBackupPrivilege 2572 LB3.exe Token: SeSecurityPrivilege 2572 LB3.exe Token: SeSecurityPrivilege 2572 LB3.exe Token: SeBackupPrivilege 2572 LB3.exe Token: SeBackupPrivilege 2572 LB3.exe Token: SeSecurityPrivilege 2572 LB3.exe Token: SeSecurityPrivilege 2572 LB3.exe Token: SeBackupPrivilege 2572 LB3.exe Token: SeBackupPrivilege 2572 LB3.exe Token: SeSecurityPrivilege 2572 LB3.exe Token: SeSecurityPrivilege 2572 LB3.exe Token: SeBackupPrivilege 2572 LB3.exe Token: SeBackupPrivilege 2572 LB3.exe Token: SeSecurityPrivilege 2572 LB3.exe Token: SeSecurityPrivilege 2572 LB3.exe Token: SeBackupPrivilege 2572 LB3.exe Token: SeBackupPrivilege 2572 LB3.exe Token: SeSecurityPrivilege 2572 LB3.exe Token: SeSecurityPrivilege 2572 LB3.exe Token: SeBackupPrivilege 2572 LB3.exe Token: SeBackupPrivilege 2572 LB3.exe Token: SeSecurityPrivilege 2572 LB3.exe Token: SeSecurityPrivilege 2572 LB3.exe Token: SeBackupPrivilege 2572 LB3.exe Token: SeBackupPrivilege 2572 LB3.exe Token: SeSecurityPrivilege 2572 LB3.exe Token: SeSecurityPrivilege 2572 LB3.exe Token: SeBackupPrivilege 2572 LB3.exe Token: SeBackupPrivilege 2572 LB3.exe Token: SeSecurityPrivilege 2572 LB3.exe Token: SeSecurityPrivilege 2572 LB3.exe Token: SeBackupPrivilege 2572 LB3.exe Token: SeBackupPrivilege 2572 LB3.exe Token: SeSecurityPrivilege 2572 LB3.exe Token: SeSecurityPrivilege 2572 LB3.exe -
Suspicious use of WriteProcessMemory 9 IoCs
description pid Process procid_target PID 2572 wrote to memory of 2600 2572 LB3.exe 33 PID 2572 wrote to memory of 2600 2572 LB3.exe 33 PID 2572 wrote to memory of 2600 2572 LB3.exe 33 PID 2572 wrote to memory of 2600 2572 LB3.exe 33 PID 2572 wrote to memory of 2600 2572 LB3.exe 33 PID 2600 wrote to memory of 2448 2600 BF2.tmp 34 PID 2600 wrote to memory of 2448 2600 BF2.tmp 34 PID 2600 wrote to memory of 2448 2600 BF2.tmp 34 PID 2600 wrote to memory of 2448 2600 BF2.tmp 34
Processes
-
C:\Users\Admin\AppData\Local\Temp\LB3.exe"C:\Users\Admin\AppData\Local\Temp\LB3.exe"1⤵
- Loads dropped DLL
- Drops desktop.ini file(s)
- Sets desktop wallpaper using registry
- System Location Discovery: System Language Discovery
- Modifies Control Panel
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2572 -
C:\ProgramData\BF2.tmp"C:\ProgramData\BF2.tmp"2⤵
- Deletes itself
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:2600 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C DEL /F /Q C:\PROGRA~3\BF2.tmp >> NUL3⤵
- System Location Discovery: System Language Discovery
PID:2448
-
-
-
C:\Windows\system32\NOTEPAD.EXE"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\6ZHghI9GZ.README.txt1⤵
- Opens file in notepad (likely ransom note)
PID:1608
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x1541⤵PID:2724
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
129B
MD5275fe596c020af46bf73f65f24c38070
SHA16ef05494492fcfce79fa4ec101b7fe3c6e7424ad
SHA2569791a06d6a769b01e4db5f8cc23d5ecd9ac12c85e83a2f08066eb4b1bb2682b2
SHA512e9ac882cfe9eb92947709ae54ec81dec963fb4b13eb65f8d1e8fe29ecd91bbbd6e7b9ed6407e8894fdbf278b0d64a0f479fb1f6f7c28352b38a4796e5114e92c
-
Filesize
6KB
MD5dd746ace17e44ace00885b91400f11d5
SHA14a0302d2dca400598f396e4230fdae71779cbeaa
SHA256b27c3c8a30faf7c76483b7e5d964ae85046a9713caa46508ee7a1e31b7dc6272
SHA5128ac26aa7262fdf1afdc74e604720a79ebde076c75f460d7d5f57ff4d81dedb1ad471eb114ddd428c1934029746f5c222339090680bc77a6ea09ce329e1da3ef1
-
Filesize
14KB
MD5294e9f64cb1642dd89229fff0592856b
SHA197b148c27f3da29ba7b18d6aee8a0db9102f47c9
SHA256917e115cc403e29b4388e0d175cbfac3e7e40ca1742299fbdb353847db2de7c2
SHA512b87d531890bf1577b9b4af41dddb2cdbbfa164cf197bd5987df3a3075983645a3acba443e289b7bfd338422978a104f55298fbfe346872de0895bde44adc89cf
-
Filesize
153KB
MD5227c51553dcc04fb121391b207701d70
SHA1f1081b26d70124ccb40638d664fb7420bb00b5fa
SHA256bcf637ebb4c7c47452e3e9ace2e497251883db67f99a2f5ac14d6f302f105191
SHA512ce56b12224c1803b3728d258ba7a20c56579a3e22b28aee85468a2f4fa9119937ff7d555334380b0a27bc41a296f950bb15c755049eb8aa9db350205c5f18e56
-
Filesize
129B
MD5ed360f5614b3707f56948d9601f29dd7
SHA1606dcbd8ff6dea2002b9e7db97fecf45ded3d9d9
SHA256637690c6c29794cf3ad430e0fc9b562a1be43fdbc0d1639f8a284ba45d997ea8
SHA512a8070690f68aa1e1438c4615c81b1a3ba1f038261a0c64ac630b1a2017e726d9773ef0409df20482ae3de815a9909f77db62490275fd747298fe159bc3683ad3