Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    144s
  • max time network
    155s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230220-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
  • submitted
    07/06/2023, 14:22

General

  • Target

    6072ac1727aa0a579e897a8ca213fd7f372b0d359e09090f873c0d365d485e2b.exe

  • Size

    205KB

  • MD5

    d3e3f57652944cb222a70e48550ea014

  • SHA1

    9526d0ec10cc8a9e377d59f93e21e7e16532d712

  • SHA256

    6072ac1727aa0a579e897a8ca213fd7f372b0d359e09090f873c0d365d485e2b

  • SHA512

    5ca22ef8e53ef636eab14bd494030a8929c5f14e387d230298d0545b6d3d81d65a16398340b21879d50e32cb6079b602ba06863f58cf4494edd8174f193ab0f8

  • SSDEEP

    3072:H/DmgskHbfHN+Pst60p0zuNmnKG7peNMQbuZAIqbey3lfbi:fDmfAfHN+wiuInRexuZAIij

Score
7/10

Malware Config

Signatures

  • Checks computer location settings 2 TTPs 2 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 4 IoCs
  • Loads dropped DLL 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Creates scheduled task(s) 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of WriteProcessMemory 30 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\6072ac1727aa0a579e897a8ca213fd7f372b0d359e09090f873c0d365d485e2b.exe
    "C:\Users\Admin\AppData\Local\Temp\6072ac1727aa0a579e897a8ca213fd7f372b0d359e09090f873c0d365d485e2b.exe"
    1⤵
    • Checks computer location settings
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of WriteProcessMemory
    PID:1124
    • C:\Users\Admin\AppData\Local\Temp\a9e2a16078\lamod.exe
      "C:\Users\Admin\AppData\Local\Temp\a9e2a16078\lamod.exe"
      2⤵
      • Checks computer location settings
      • Executes dropped EXE
      • Suspicious use of WriteProcessMemory
      PID:1180
      • C:\Windows\SysWOW64\schtasks.exe
        "C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN lamod.exe /TR "C:\Users\Admin\AppData\Local\Temp\a9e2a16078\lamod.exe" /F
        3⤵
        • Creates scheduled task(s)
        PID:1884
      • C:\Windows\SysWOW64\cmd.exe
        "C:\Windows\System32\cmd.exe" /k echo Y|CACLS "lamod.exe" /P "Admin:N"&&CACLS "lamod.exe" /P "Admin:R" /E&&echo Y|CACLS "..\a9e2a16078" /P "Admin:N"&&CACLS "..\a9e2a16078" /P "Admin:R" /E&&Exit
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:2780
        • C:\Windows\SysWOW64\cmd.exe
          C:\Windows\system32\cmd.exe /S /D /c" echo Y"
          4⤵
            PID:1984
          • C:\Windows\SysWOW64\cacls.exe
            CACLS "lamod.exe" /P "Admin:N"
            4⤵
              PID:3892
            • C:\Windows\SysWOW64\cacls.exe
              CACLS "lamod.exe" /P "Admin:R" /E
              4⤵
                PID:452
              • C:\Windows\SysWOW64\cmd.exe
                C:\Windows\system32\cmd.exe /S /D /c" echo Y"
                4⤵
                  PID:3968
                • C:\Windows\SysWOW64\cacls.exe
                  CACLS "..\a9e2a16078" /P "Admin:N"
                  4⤵
                    PID:3936
                  • C:\Windows\SysWOW64\cacls.exe
                    CACLS "..\a9e2a16078" /P "Admin:R" /E
                    4⤵
                      PID:3152
                  • C:\Windows\SysWOW64\rundll32.exe
                    "C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll, Main
                    3⤵
                    • Loads dropped DLL
                    PID:1300
              • C:\Users\Admin\AppData\Local\Temp\a9e2a16078\lamod.exe
                C:\Users\Admin\AppData\Local\Temp\a9e2a16078\lamod.exe
                1⤵
                • Executes dropped EXE
                PID:2812
              • C:\Users\Admin\AppData\Local\Temp\a9e2a16078\lamod.exe
                C:\Users\Admin\AppData\Local\Temp\a9e2a16078\lamod.exe
                1⤵
                • Executes dropped EXE
                PID:2692
              • C:\Users\Admin\AppData\Local\Temp\a9e2a16078\lamod.exe
                C:\Users\Admin\AppData\Local\Temp\a9e2a16078\lamod.exe
                1⤵
                • Executes dropped EXE
                PID:4056

              Network

              MITRE ATT&CK Enterprise v6

              Replay Monitor

              Loading Replay Monitor...

              Downloads

              • C:\Users\Admin\AppData\Local\Temp\a9e2a16078\lamod.exe

                Filesize

                205KB

                MD5

                d3e3f57652944cb222a70e48550ea014

                SHA1

                9526d0ec10cc8a9e377d59f93e21e7e16532d712

                SHA256

                6072ac1727aa0a579e897a8ca213fd7f372b0d359e09090f873c0d365d485e2b

                SHA512

                5ca22ef8e53ef636eab14bd494030a8929c5f14e387d230298d0545b6d3d81d65a16398340b21879d50e32cb6079b602ba06863f58cf4494edd8174f193ab0f8

              • C:\Users\Admin\AppData\Local\Temp\a9e2a16078\lamod.exe

                Filesize

                205KB

                MD5

                d3e3f57652944cb222a70e48550ea014

                SHA1

                9526d0ec10cc8a9e377d59f93e21e7e16532d712

                SHA256

                6072ac1727aa0a579e897a8ca213fd7f372b0d359e09090f873c0d365d485e2b

                SHA512

                5ca22ef8e53ef636eab14bd494030a8929c5f14e387d230298d0545b6d3d81d65a16398340b21879d50e32cb6079b602ba06863f58cf4494edd8174f193ab0f8

              • C:\Users\Admin\AppData\Local\Temp\a9e2a16078\lamod.exe

                Filesize

                205KB

                MD5

                d3e3f57652944cb222a70e48550ea014

                SHA1

                9526d0ec10cc8a9e377d59f93e21e7e16532d712

                SHA256

                6072ac1727aa0a579e897a8ca213fd7f372b0d359e09090f873c0d365d485e2b

                SHA512

                5ca22ef8e53ef636eab14bd494030a8929c5f14e387d230298d0545b6d3d81d65a16398340b21879d50e32cb6079b602ba06863f58cf4494edd8174f193ab0f8

              • C:\Users\Admin\AppData\Local\Temp\a9e2a16078\lamod.exe

                Filesize

                205KB

                MD5

                d3e3f57652944cb222a70e48550ea014

                SHA1

                9526d0ec10cc8a9e377d59f93e21e7e16532d712

                SHA256

                6072ac1727aa0a579e897a8ca213fd7f372b0d359e09090f873c0d365d485e2b

                SHA512

                5ca22ef8e53ef636eab14bd494030a8929c5f14e387d230298d0545b6d3d81d65a16398340b21879d50e32cb6079b602ba06863f58cf4494edd8174f193ab0f8

              • C:\Users\Admin\AppData\Local\Temp\a9e2a16078\lamod.exe

                Filesize

                205KB

                MD5

                d3e3f57652944cb222a70e48550ea014

                SHA1

                9526d0ec10cc8a9e377d59f93e21e7e16532d712

                SHA256

                6072ac1727aa0a579e897a8ca213fd7f372b0d359e09090f873c0d365d485e2b

                SHA512

                5ca22ef8e53ef636eab14bd494030a8929c5f14e387d230298d0545b6d3d81d65a16398340b21879d50e32cb6079b602ba06863f58cf4494edd8174f193ab0f8

              • C:\Users\Admin\AppData\Local\Temp\a9e2a16078\lamod.exe

                Filesize

                205KB

                MD5

                d3e3f57652944cb222a70e48550ea014

                SHA1

                9526d0ec10cc8a9e377d59f93e21e7e16532d712

                SHA256

                6072ac1727aa0a579e897a8ca213fd7f372b0d359e09090f873c0d365d485e2b

                SHA512

                5ca22ef8e53ef636eab14bd494030a8929c5f14e387d230298d0545b6d3d81d65a16398340b21879d50e32cb6079b602ba06863f58cf4494edd8174f193ab0f8

              • C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll

                Filesize

                89KB

                MD5

                a5ed103ec4719a27ab3d3c01dac66f01

                SHA1

                c830d6980d7edea60568a518eccd36c0bc2a4924

                SHA256

                dbcdc009781edffc3c4e5234d3d23d26364d6bff47e2e384cffdef148d7b5b36

                SHA512

                b7fbe709a44f0e84a94c9e82f790d04e3d86b5409b5eb2d9f1d4d775b9669694c189042f04001acadb6da4c6284f4fbcbe39fd97427d41619191928510db9d80

              • C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll

                Filesize

                89KB

                MD5

                a5ed103ec4719a27ab3d3c01dac66f01

                SHA1

                c830d6980d7edea60568a518eccd36c0bc2a4924

                SHA256

                dbcdc009781edffc3c4e5234d3d23d26364d6bff47e2e384cffdef148d7b5b36

                SHA512

                b7fbe709a44f0e84a94c9e82f790d04e3d86b5409b5eb2d9f1d4d775b9669694c189042f04001acadb6da4c6284f4fbcbe39fd97427d41619191928510db9d80

              • C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll

                Filesize

                89KB

                MD5

                a5ed103ec4719a27ab3d3c01dac66f01

                SHA1

                c830d6980d7edea60568a518eccd36c0bc2a4924

                SHA256

                dbcdc009781edffc3c4e5234d3d23d26364d6bff47e2e384cffdef148d7b5b36

                SHA512

                b7fbe709a44f0e84a94c9e82f790d04e3d86b5409b5eb2d9f1d4d775b9669694c189042f04001acadb6da4c6284f4fbcbe39fd97427d41619191928510db9d80

              • C:\Users\Admin\AppData\Roaming\006700e5a2ab05\cred64.dll

                Filesize

                162B

                MD5

                1b7c22a214949975556626d7217e9a39

                SHA1

                d01c97e2944166ed23e47e4a62ff471ab8fa031f

                SHA256

                340c8464c2007ce3f80682e15dfafa4180b641d53c14201b929906b7b0284d87

                SHA512

                ba64847cf1d4157d50abe4f4a1e5c1996fe387c5808e2f758c7fb3213bfefe1f3712d343f0c30a16819749840954654a70611d2250fd0f7b032429db7afd2cc5