Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Overview
overview
10Static
static
1006038ed735...40.exe
windows10-ltsc 2021-x64
80673936fc0...9b.exe
windows10-ltsc 2021-x64
07b3c7c475...83.exe
windows10-ltsc 2021-x64
3097910dc61...d0.exe
windows10-ltsc 2021-x64
100bb3e9c660...40.exe
windows10-ltsc 2021-x64
100c80a0ef43...97.exe
windows10-ltsc 2021-x64
100cae214424...81.exe
windows10-ltsc 2021-x64
10b76a68b1da...15f.gz
windows10-ltsc 2021-x64
1bb7ad76bef...830.xz
windows10-ltsc 2021-x64
3cdb1365059...fbc.gz
windows10-ltsc 2021-x64
1Analysis
-
max time kernel
149s -
max time network
157s -
platform
windows10-ltsc 2021_x64 -
resource
win10ltsc2021-20250217-en -
resource tags
arch:x64arch:x86image:win10ltsc2021-20250217-enlocale:en-usos:windows10-ltsc 2021-x64system -
submitted
12/03/2025, 14:18
Static task
static1
Behavioral task
behavioral1
Sample
06038ed7357e8d00e0fcef11800dfb40.exe
Resource
win10ltsc2021-20250217-en
windows10-ltsc 2021-x64
Behavioral task
behavioral2
Sample
0673936fc0472890d129258bc6ce1f9b.exe
Resource
win10ltsc2021-20250217-en
windows10-ltsc 2021-x64
Behavioral task
behavioral3
Sample
07b3c7c475a0204f34408d806a4d0883.exe
Resource
win10ltsc2021-20250218-en
windows10-ltsc 2021-x64
Behavioral task
behavioral4
Sample
097910dc615bd581069c0ec67fa513d0.exe
Resource
win10ltsc2021-20250217-en
windows10-ltsc 2021-x64
Behavioral task
behavioral5
Sample
0bb3e9c660f99967ca4c8e21bc46e940.exe
Resource
win10ltsc2021-20250217-en
windows10-ltsc 2021-x64
Behavioral task
behavioral6
Sample
0c80a0ef434aaecd6b1c888567935b97.exe
Resource
win10ltsc2021-20250217-en
windows10-ltsc 2021-x64
Behavioral task
behavioral7
Sample
0cae2144249cca11917ce26657fc0281.exe
Resource
win10ltsc2021-20250217-en
windows10-ltsc 2021-x64
Behavioral task
behavioral8
Sample
b76a68b1da993f63c3363dc43739315f.gz
Resource
win10ltsc2021-20250217-en
windows10-ltsc 2021-x64
Behavioral task
behavioral9
Sample
bb7ad76bef5c5a974ccd0c1b94835830.xz
Resource
win10ltsc2021-20250218-en
windows10-ltsc 2021-x64
Behavioral task
behavioral10
Sample
cdb1365059c0e4973843dc0d0955bfbc.gz
Resource
win10ltsc2021-20250217-en
windows10-ltsc 2021-x64
General
-
Target
0bb3e9c660f99967ca4c8e21bc46e940.exe
-
Size
196KB
-
MD5
0bb3e9c660f99967ca4c8e21bc46e940
-
SHA1
4f4683250a24c1c752fc774d4c9b3c032f4e59ba
-
SHA256
c74fe9b5ed555b14d9b73d9fe53b4e3722f837ded57ae475d540d8b070410b97
-
SHA512
84aa508e7612098da66e689a1cc10880a62c9a498706b6a0cd3371f7144ce6a1006974987bcf6d39456a6b9b319cc77a6559ed0a5260639d12566ed2b3f93c38
-
SSDEEP
3072:OybtB0tQ9nLHbB9WJvA7DejJuKvEhfmHZ7:R4QxL7B9WSvejJuB+B
Malware Config
Signatures
-
Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-1639757381-2759246526-4253643256-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" 0bb3e9c660f99967ca4c8e21bc46e940.exe Set value (int) \REGISTRY\USER\S-1-5-21-1639757381-2759246526-4253643256-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" liqad.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-1639757381-2759246526-4253643256-1000\Control Panel\International\Geo\Nation 0bb3e9c660f99967ca4c8e21bc46e940.exe -
Executes dropped EXE 1 IoCs
pid Process 1368 liqad.exe -
Adds Run key to start application 2 TTPs 27 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-1639757381-2759246526-4253643256-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\liqad = "C:\\Users\\Admin\\liqad.exe /w" liqad.exe Set value (str) \REGISTRY\USER\S-1-5-21-1639757381-2759246526-4253643256-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\liqad = "C:\\Users\\Admin\\liqad.exe /z" 0bb3e9c660f99967ca4c8e21bc46e940.exe Set value (str) \REGISTRY\USER\S-1-5-21-1639757381-2759246526-4253643256-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\liqad = "C:\\Users\\Admin\\liqad.exe /x" liqad.exe Set value (str) \REGISTRY\USER\S-1-5-21-1639757381-2759246526-4253643256-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\liqad = "C:\\Users\\Admin\\liqad.exe /t" liqad.exe Set value (str) \REGISTRY\USER\S-1-5-21-1639757381-2759246526-4253643256-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\liqad = "C:\\Users\\Admin\\liqad.exe /r" liqad.exe Set value (str) \REGISTRY\USER\S-1-5-21-1639757381-2759246526-4253643256-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\liqad = "C:\\Users\\Admin\\liqad.exe /i" liqad.exe Set value (str) \REGISTRY\USER\S-1-5-21-1639757381-2759246526-4253643256-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\liqad = "C:\\Users\\Admin\\liqad.exe /j" liqad.exe Set value (str) \REGISTRY\USER\S-1-5-21-1639757381-2759246526-4253643256-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\liqad = "C:\\Users\\Admin\\liqad.exe /v" liqad.exe Set value (str) \REGISTRY\USER\S-1-5-21-1639757381-2759246526-4253643256-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\liqad = "C:\\Users\\Admin\\liqad.exe /e" liqad.exe Set value (str) \REGISTRY\USER\S-1-5-21-1639757381-2759246526-4253643256-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\liqad = "C:\\Users\\Admin\\liqad.exe /s" liqad.exe Set value (str) \REGISTRY\USER\S-1-5-21-1639757381-2759246526-4253643256-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\liqad = "C:\\Users\\Admin\\liqad.exe /z" liqad.exe Set value (str) \REGISTRY\USER\S-1-5-21-1639757381-2759246526-4253643256-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\liqad = "C:\\Users\\Admin\\liqad.exe /y" liqad.exe Set value (str) \REGISTRY\USER\S-1-5-21-1639757381-2759246526-4253643256-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\liqad = "C:\\Users\\Admin\\liqad.exe /d" liqad.exe Set value (str) \REGISTRY\USER\S-1-5-21-1639757381-2759246526-4253643256-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\liqad = "C:\\Users\\Admin\\liqad.exe /g" liqad.exe Set value (str) \REGISTRY\USER\S-1-5-21-1639757381-2759246526-4253643256-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\liqad = "C:\\Users\\Admin\\liqad.exe /c" liqad.exe Set value (str) \REGISTRY\USER\S-1-5-21-1639757381-2759246526-4253643256-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\liqad = "C:\\Users\\Admin\\liqad.exe /q" liqad.exe Set value (str) \REGISTRY\USER\S-1-5-21-1639757381-2759246526-4253643256-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\liqad = "C:\\Users\\Admin\\liqad.exe /m" liqad.exe Set value (str) \REGISTRY\USER\S-1-5-21-1639757381-2759246526-4253643256-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\liqad = "C:\\Users\\Admin\\liqad.exe /a" liqad.exe Set value (str) \REGISTRY\USER\S-1-5-21-1639757381-2759246526-4253643256-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\liqad = "C:\\Users\\Admin\\liqad.exe /l" liqad.exe Set value (str) \REGISTRY\USER\S-1-5-21-1639757381-2759246526-4253643256-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\liqad = "C:\\Users\\Admin\\liqad.exe /n" liqad.exe Set value (str) \REGISTRY\USER\S-1-5-21-1639757381-2759246526-4253643256-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\liqad = "C:\\Users\\Admin\\liqad.exe /p" liqad.exe Set value (str) \REGISTRY\USER\S-1-5-21-1639757381-2759246526-4253643256-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\liqad = "C:\\Users\\Admin\\liqad.exe /k" liqad.exe Set value (str) \REGISTRY\USER\S-1-5-21-1639757381-2759246526-4253643256-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\liqad = "C:\\Users\\Admin\\liqad.exe /f" liqad.exe Set value (str) \REGISTRY\USER\S-1-5-21-1639757381-2759246526-4253643256-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\liqad = "C:\\Users\\Admin\\liqad.exe /h" liqad.exe Set value (str) \REGISTRY\USER\S-1-5-21-1639757381-2759246526-4253643256-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\liqad = "C:\\Users\\Admin\\liqad.exe /b" liqad.exe Set value (str) \REGISTRY\USER\S-1-5-21-1639757381-2759246526-4253643256-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\liqad = "C:\\Users\\Admin\\liqad.exe /u" liqad.exe Set value (str) \REGISTRY\USER\S-1-5-21-1639757381-2759246526-4253643256-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\liqad = "C:\\Users\\Admin\\liqad.exe /o" liqad.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 0bb3e9c660f99967ca4c8e21bc46e940.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language liqad.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4688 0bb3e9c660f99967ca4c8e21bc46e940.exe 4688 0bb3e9c660f99967ca4c8e21bc46e940.exe 1368 liqad.exe 1368 liqad.exe 1368 liqad.exe 1368 liqad.exe 1368 liqad.exe 1368 liqad.exe 1368 liqad.exe 1368 liqad.exe 1368 liqad.exe 1368 liqad.exe 1368 liqad.exe 1368 liqad.exe 1368 liqad.exe 1368 liqad.exe 1368 liqad.exe 1368 liqad.exe 1368 liqad.exe 1368 liqad.exe 1368 liqad.exe 1368 liqad.exe 1368 liqad.exe 1368 liqad.exe 1368 liqad.exe 1368 liqad.exe 1368 liqad.exe 1368 liqad.exe 1368 liqad.exe 1368 liqad.exe 1368 liqad.exe 1368 liqad.exe 1368 liqad.exe 1368 liqad.exe 1368 liqad.exe 1368 liqad.exe 1368 liqad.exe 1368 liqad.exe 1368 liqad.exe 1368 liqad.exe 1368 liqad.exe 1368 liqad.exe 1368 liqad.exe 1368 liqad.exe 1368 liqad.exe 1368 liqad.exe 1368 liqad.exe 1368 liqad.exe 1368 liqad.exe 1368 liqad.exe 1368 liqad.exe 1368 liqad.exe 1368 liqad.exe 1368 liqad.exe 1368 liqad.exe 1368 liqad.exe 1368 liqad.exe 1368 liqad.exe 1368 liqad.exe 1368 liqad.exe 1368 liqad.exe 1368 liqad.exe 1368 liqad.exe 1368 liqad.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 4688 0bb3e9c660f99967ca4c8e21bc46e940.exe 1368 liqad.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 4688 wrote to memory of 1368 4688 0bb3e9c660f99967ca4c8e21bc46e940.exe 88 PID 4688 wrote to memory of 1368 4688 0bb3e9c660f99967ca4c8e21bc46e940.exe 88 PID 4688 wrote to memory of 1368 4688 0bb3e9c660f99967ca4c8e21bc46e940.exe 88
Processes
-
C:\Users\Admin\AppData\Local\Temp\0bb3e9c660f99967ca4c8e21bc46e940.exe"C:\Users\Admin\AppData\Local\Temp\0bb3e9c660f99967ca4c8e21bc46e940.exe"1⤵
- Modifies visiblity of hidden/system files in Explorer
- Checks computer location settings
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4688 -
C:\Users\Admin\liqad.exe"C:\Users\Admin\liqad.exe"2⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:1368
-
Network
MITRE ATT&CK Enterprise v15
Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Defense Evasion
Hide Artifacts
1Hidden Files and Directories
1Modify Registry
2Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
196KB
MD5c178c4ff8c5987698e7a9ec6a3ca348f
SHA16338e54b4d4be8fd291fb3c365f324fdda378c93
SHA25620cc5393161672cb3f3dad6ebc0ab4b18d9b4cb49329837b78fd93b58adc7d3d
SHA51238ce3cb39c9539a44da42fadc6ece012cb8c13c48a123041d29f432b1a3255f28833b0c705347e448289f7afa7bff1f881de7cc54f534dadfe3e881cb4066a3c