Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
135s -
max time network
144s -
platform
windows10-2004_x64 -
resource
win10v2004-20230220-en -
resource tags
arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system -
submitted
07/06/2023, 14:17
Static task
static1
Behavioral task
behavioral1
Sample
1dcd58bbe3a9cbfc071f9cd1f947a8b7acb5674b6aacb460dbfa1a3c1f94cddd.exe
Resource
win10v2004-20230220-en
General
-
Target
1dcd58bbe3a9cbfc071f9cd1f947a8b7acb5674b6aacb460dbfa1a3c1f94cddd.exe
-
Size
205KB
-
MD5
f4f6641c202f209e8abceb2207e9ad58
-
SHA1
213217704359ed3c7dae0142f487545426a3e366
-
SHA256
1dcd58bbe3a9cbfc071f9cd1f947a8b7acb5674b6aacb460dbfa1a3c1f94cddd
-
SHA512
84c35351276185659bef6be84bbd6f28c3efd47065348f3038890984185006a5a337e19094c6f43b69ec3ba319a69f039ce0eb3cc500c8f93f0dddedc719ad73
-
SSDEEP
3072:H/DmgskHbfHN+Pst60p0zuNmnKG7peNMQbuZAIqbey3lfbi:fDmfAfHN+wiuInRexuZAIij
Malware Config
Signatures
-
Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-2548970870-3691742953-3895070203-1000\Control Panel\International\Geo\Nation 1dcd58bbe3a9cbfc071f9cd1f947a8b7acb5674b6aacb460dbfa1a3c1f94cddd.exe Key value queried \REGISTRY\USER\S-1-5-21-2548970870-3691742953-3895070203-1000\Control Panel\International\Geo\Nation lamod.exe -
Executes dropped EXE 3 IoCs
pid Process 4532 lamod.exe 3852 lamod.exe 4840 lamod.exe -
Loads dropped DLL 1 IoCs
pid Process 4660 rundll32.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 400 schtasks.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 4968 1dcd58bbe3a9cbfc071f9cd1f947a8b7acb5674b6aacb460dbfa1a3c1f94cddd.exe -
Suspicious use of WriteProcessMemory 30 IoCs
description pid Process procid_target PID 4968 wrote to memory of 4532 4968 1dcd58bbe3a9cbfc071f9cd1f947a8b7acb5674b6aacb460dbfa1a3c1f94cddd.exe 84 PID 4968 wrote to memory of 4532 4968 1dcd58bbe3a9cbfc071f9cd1f947a8b7acb5674b6aacb460dbfa1a3c1f94cddd.exe 84 PID 4968 wrote to memory of 4532 4968 1dcd58bbe3a9cbfc071f9cd1f947a8b7acb5674b6aacb460dbfa1a3c1f94cddd.exe 84 PID 4532 wrote to memory of 400 4532 lamod.exe 85 PID 4532 wrote to memory of 400 4532 lamod.exe 85 PID 4532 wrote to memory of 400 4532 lamod.exe 85 PID 4532 wrote to memory of 2796 4532 lamod.exe 87 PID 4532 wrote to memory of 2796 4532 lamod.exe 87 PID 4532 wrote to memory of 2796 4532 lamod.exe 87 PID 2796 wrote to memory of 2220 2796 cmd.exe 89 PID 2796 wrote to memory of 2220 2796 cmd.exe 89 PID 2796 wrote to memory of 2220 2796 cmd.exe 89 PID 2796 wrote to memory of 2116 2796 cmd.exe 90 PID 2796 wrote to memory of 2116 2796 cmd.exe 90 PID 2796 wrote to memory of 2116 2796 cmd.exe 90 PID 2796 wrote to memory of 2204 2796 cmd.exe 91 PID 2796 wrote to memory of 2204 2796 cmd.exe 91 PID 2796 wrote to memory of 2204 2796 cmd.exe 91 PID 2796 wrote to memory of 1792 2796 cmd.exe 93 PID 2796 wrote to memory of 1792 2796 cmd.exe 93 PID 2796 wrote to memory of 1792 2796 cmd.exe 93 PID 2796 wrote to memory of 3640 2796 cmd.exe 92 PID 2796 wrote to memory of 3640 2796 cmd.exe 92 PID 2796 wrote to memory of 3640 2796 cmd.exe 92 PID 2796 wrote to memory of 4980 2796 cmd.exe 94 PID 2796 wrote to memory of 4980 2796 cmd.exe 94 PID 2796 wrote to memory of 4980 2796 cmd.exe 94 PID 4532 wrote to memory of 4660 4532 lamod.exe 103 PID 4532 wrote to memory of 4660 4532 lamod.exe 103 PID 4532 wrote to memory of 4660 4532 lamod.exe 103
Processes
-
C:\Users\Admin\AppData\Local\Temp\1dcd58bbe3a9cbfc071f9cd1f947a8b7acb5674b6aacb460dbfa1a3c1f94cddd.exe"C:\Users\Admin\AppData\Local\Temp\1dcd58bbe3a9cbfc071f9cd1f947a8b7acb5674b6aacb460dbfa1a3c1f94cddd.exe"1⤵
- Checks computer location settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:4968 -
C:\Users\Admin\AppData\Local\Temp\a9e2a16078\lamod.exe"C:\Users\Admin\AppData\Local\Temp\a9e2a16078\lamod.exe"2⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4532 -
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN lamod.exe /TR "C:\Users\Admin\AppData\Local\Temp\a9e2a16078\lamod.exe" /F3⤵
- Creates scheduled task(s)
PID:400
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k echo Y|CACLS "lamod.exe" /P "Admin:N"&&CACLS "lamod.exe" /P "Admin:R" /E&&echo Y|CACLS "..\a9e2a16078" /P "Admin:N"&&CACLS "..\a9e2a16078" /P "Admin:R" /E&&Exit3⤵
- Suspicious use of WriteProcessMemory
PID:2796 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"4⤵PID:2220
-
-
C:\Windows\SysWOW64\cacls.exeCACLS "lamod.exe" /P "Admin:N"4⤵PID:2116
-
-
C:\Windows\SysWOW64\cacls.exeCACLS "lamod.exe" /P "Admin:R" /E4⤵PID:2204
-
-
C:\Windows\SysWOW64\cacls.exeCACLS "..\a9e2a16078" /P "Admin:N"4⤵PID:3640
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"4⤵PID:1792
-
-
C:\Windows\SysWOW64\cacls.exeCACLS "..\a9e2a16078" /P "Admin:R" /E4⤵PID:4980
-
-
-
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll, Main3⤵
- Loads dropped DLL
PID:4660
-
-
-
C:\Users\Admin\AppData\Local\Temp\a9e2a16078\lamod.exeC:\Users\Admin\AppData\Local\Temp\a9e2a16078\lamod.exe1⤵
- Executes dropped EXE
PID:3852
-
C:\Users\Admin\AppData\Local\Temp\a9e2a16078\lamod.exeC:\Users\Admin\AppData\Local\Temp\a9e2a16078\lamod.exe1⤵
- Executes dropped EXE
PID:4840
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
205KB
MD5f4f6641c202f209e8abceb2207e9ad58
SHA1213217704359ed3c7dae0142f487545426a3e366
SHA2561dcd58bbe3a9cbfc071f9cd1f947a8b7acb5674b6aacb460dbfa1a3c1f94cddd
SHA51284c35351276185659bef6be84bbd6f28c3efd47065348f3038890984185006a5a337e19094c6f43b69ec3ba319a69f039ce0eb3cc500c8f93f0dddedc719ad73
-
Filesize
205KB
MD5f4f6641c202f209e8abceb2207e9ad58
SHA1213217704359ed3c7dae0142f487545426a3e366
SHA2561dcd58bbe3a9cbfc071f9cd1f947a8b7acb5674b6aacb460dbfa1a3c1f94cddd
SHA51284c35351276185659bef6be84bbd6f28c3efd47065348f3038890984185006a5a337e19094c6f43b69ec3ba319a69f039ce0eb3cc500c8f93f0dddedc719ad73
-
Filesize
205KB
MD5f4f6641c202f209e8abceb2207e9ad58
SHA1213217704359ed3c7dae0142f487545426a3e366
SHA2561dcd58bbe3a9cbfc071f9cd1f947a8b7acb5674b6aacb460dbfa1a3c1f94cddd
SHA51284c35351276185659bef6be84bbd6f28c3efd47065348f3038890984185006a5a337e19094c6f43b69ec3ba319a69f039ce0eb3cc500c8f93f0dddedc719ad73
-
Filesize
205KB
MD5f4f6641c202f209e8abceb2207e9ad58
SHA1213217704359ed3c7dae0142f487545426a3e366
SHA2561dcd58bbe3a9cbfc071f9cd1f947a8b7acb5674b6aacb460dbfa1a3c1f94cddd
SHA51284c35351276185659bef6be84bbd6f28c3efd47065348f3038890984185006a5a337e19094c6f43b69ec3ba319a69f039ce0eb3cc500c8f93f0dddedc719ad73
-
Filesize
205KB
MD5f4f6641c202f209e8abceb2207e9ad58
SHA1213217704359ed3c7dae0142f487545426a3e366
SHA2561dcd58bbe3a9cbfc071f9cd1f947a8b7acb5674b6aacb460dbfa1a3c1f94cddd
SHA51284c35351276185659bef6be84bbd6f28c3efd47065348f3038890984185006a5a337e19094c6f43b69ec3ba319a69f039ce0eb3cc500c8f93f0dddedc719ad73
-
Filesize
89KB
MD5a5ed103ec4719a27ab3d3c01dac66f01
SHA1c830d6980d7edea60568a518eccd36c0bc2a4924
SHA256dbcdc009781edffc3c4e5234d3d23d26364d6bff47e2e384cffdef148d7b5b36
SHA512b7fbe709a44f0e84a94c9e82f790d04e3d86b5409b5eb2d9f1d4d775b9669694c189042f04001acadb6da4c6284f4fbcbe39fd97427d41619191928510db9d80
-
Filesize
89KB
MD5a5ed103ec4719a27ab3d3c01dac66f01
SHA1c830d6980d7edea60568a518eccd36c0bc2a4924
SHA256dbcdc009781edffc3c4e5234d3d23d26364d6bff47e2e384cffdef148d7b5b36
SHA512b7fbe709a44f0e84a94c9e82f790d04e3d86b5409b5eb2d9f1d4d775b9669694c189042f04001acadb6da4c6284f4fbcbe39fd97427d41619191928510db9d80
-
Filesize
89KB
MD5a5ed103ec4719a27ab3d3c01dac66f01
SHA1c830d6980d7edea60568a518eccd36c0bc2a4924
SHA256dbcdc009781edffc3c4e5234d3d23d26364d6bff47e2e384cffdef148d7b5b36
SHA512b7fbe709a44f0e84a94c9e82f790d04e3d86b5409b5eb2d9f1d4d775b9669694c189042f04001acadb6da4c6284f4fbcbe39fd97427d41619191928510db9d80
-
Filesize
162B
MD51b7c22a214949975556626d7217e9a39
SHA1d01c97e2944166ed23e47e4a62ff471ab8fa031f
SHA256340c8464c2007ce3f80682e15dfafa4180b641d53c14201b929906b7b0284d87
SHA512ba64847cf1d4157d50abe4f4a1e5c1996fe387c5808e2f758c7fb3213bfefe1f3712d343f0c30a16819749840954654a70611d2250fd0f7b032429db7afd2cc5