Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
110s -
max time network
148s -
platform
windows10-2004_x64 -
resource
win10v2004-20230220-en -
resource tags
arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system -
submitted
08/06/2023, 03:09
Static task
static1
Behavioral task
behavioral1
Sample
8c4c1420d9891c2a5b1e84efab9b83168c4d271d1075ede76d3c69072f87be34.exe
Resource
win10v2004-20230220-en
General
-
Target
8c4c1420d9891c2a5b1e84efab9b83168c4d271d1075ede76d3c69072f87be34.exe
-
Size
207KB
-
MD5
cf266ee2cc78f231785638b61e432355
-
SHA1
26c604b84e6e4e2a1a8eade0bee40800e1fc02de
-
SHA256
8c4c1420d9891c2a5b1e84efab9b83168c4d271d1075ede76d3c69072f87be34
-
SHA512
c02eb54cab1e64a2bcb0c774b6bbaf84b2c040b2a606d2bbdcb4a8baa87e8dce641edf67c8d36da07b80445615ff9d907c44de9c9287bc220c09e302e36d13de
-
SSDEEP
3072:H/DmgskHbfHN+Pst60p0zuNmnKG7peNMQbuZAIqbey3lfbi:fDmfAfHN+wiuInRexuZAIij
Malware Config
Signatures
-
Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000\Control Panel\International\Geo\Nation 8c4c1420d9891c2a5b1e84efab9b83168c4d271d1075ede76d3c69072f87be34.exe Key value queried \REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000\Control Panel\International\Geo\Nation lamod.exe -
Executes dropped EXE 3 IoCs
pid Process 4320 lamod.exe 772 lamod.exe 4160 lamod.exe -
Loads dropped DLL 1 IoCs
pid Process 3532 rundll32.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 4424 schtasks.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 4196 8c4c1420d9891c2a5b1e84efab9b83168c4d271d1075ede76d3c69072f87be34.exe -
Suspicious use of WriteProcessMemory 30 IoCs
description pid Process procid_target PID 4196 wrote to memory of 4320 4196 8c4c1420d9891c2a5b1e84efab9b83168c4d271d1075ede76d3c69072f87be34.exe 82 PID 4196 wrote to memory of 4320 4196 8c4c1420d9891c2a5b1e84efab9b83168c4d271d1075ede76d3c69072f87be34.exe 82 PID 4196 wrote to memory of 4320 4196 8c4c1420d9891c2a5b1e84efab9b83168c4d271d1075ede76d3c69072f87be34.exe 82 PID 4320 wrote to memory of 4424 4320 lamod.exe 83 PID 4320 wrote to memory of 4424 4320 lamod.exe 83 PID 4320 wrote to memory of 4424 4320 lamod.exe 83 PID 4320 wrote to memory of 1072 4320 lamod.exe 86 PID 4320 wrote to memory of 1072 4320 lamod.exe 86 PID 4320 wrote to memory of 1072 4320 lamod.exe 86 PID 1072 wrote to memory of 828 1072 cmd.exe 88 PID 1072 wrote to memory of 828 1072 cmd.exe 88 PID 1072 wrote to memory of 828 1072 cmd.exe 88 PID 1072 wrote to memory of 648 1072 cmd.exe 87 PID 1072 wrote to memory of 648 1072 cmd.exe 87 PID 1072 wrote to memory of 648 1072 cmd.exe 87 PID 1072 wrote to memory of 2904 1072 cmd.exe 89 PID 1072 wrote to memory of 2904 1072 cmd.exe 89 PID 1072 wrote to memory of 2904 1072 cmd.exe 89 PID 1072 wrote to memory of 2504 1072 cmd.exe 90 PID 1072 wrote to memory of 2504 1072 cmd.exe 90 PID 1072 wrote to memory of 2504 1072 cmd.exe 90 PID 1072 wrote to memory of 2064 1072 cmd.exe 91 PID 1072 wrote to memory of 2064 1072 cmd.exe 91 PID 1072 wrote to memory of 2064 1072 cmd.exe 91 PID 1072 wrote to memory of 5012 1072 cmd.exe 92 PID 1072 wrote to memory of 5012 1072 cmd.exe 92 PID 1072 wrote to memory of 5012 1072 cmd.exe 92 PID 4320 wrote to memory of 3532 4320 lamod.exe 101 PID 4320 wrote to memory of 3532 4320 lamod.exe 101 PID 4320 wrote to memory of 3532 4320 lamod.exe 101
Processes
-
C:\Users\Admin\AppData\Local\Temp\8c4c1420d9891c2a5b1e84efab9b83168c4d271d1075ede76d3c69072f87be34.exe"C:\Users\Admin\AppData\Local\Temp\8c4c1420d9891c2a5b1e84efab9b83168c4d271d1075ede76d3c69072f87be34.exe"1⤵
- Checks computer location settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:4196 -
C:\Users\Admin\AppData\Local\Temp\a9e2a16078\lamod.exe"C:\Users\Admin\AppData\Local\Temp\a9e2a16078\lamod.exe"2⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4320 -
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN lamod.exe /TR "C:\Users\Admin\AppData\Local\Temp\a9e2a16078\lamod.exe" /F3⤵
- Creates scheduled task(s)
PID:4424
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k echo Y|CACLS "lamod.exe" /P "Admin:N"&&CACLS "lamod.exe" /P "Admin:R" /E&&echo Y|CACLS "..\a9e2a16078" /P "Admin:N"&&CACLS "..\a9e2a16078" /P "Admin:R" /E&&Exit3⤵
- Suspicious use of WriteProcessMemory
PID:1072 -
C:\Windows\SysWOW64\cacls.exeCACLS "lamod.exe" /P "Admin:N"4⤵PID:648
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"4⤵PID:828
-
-
C:\Windows\SysWOW64\cacls.exeCACLS "lamod.exe" /P "Admin:R" /E4⤵PID:2904
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"4⤵PID:2504
-
-
C:\Windows\SysWOW64\cacls.exeCACLS "..\a9e2a16078" /P "Admin:N"4⤵PID:2064
-
-
C:\Windows\SysWOW64\cacls.exeCACLS "..\a9e2a16078" /P "Admin:R" /E4⤵PID:5012
-
-
-
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll, Main3⤵
- Loads dropped DLL
PID:3532
-
-
-
C:\Users\Admin\AppData\Local\Temp\a9e2a16078\lamod.exeC:\Users\Admin\AppData\Local\Temp\a9e2a16078\lamod.exe1⤵
- Executes dropped EXE
PID:772
-
C:\Users\Admin\AppData\Local\Temp\a9e2a16078\lamod.exeC:\Users\Admin\AppData\Local\Temp\a9e2a16078\lamod.exe1⤵
- Executes dropped EXE
PID:4160
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
207KB
MD5cf266ee2cc78f231785638b61e432355
SHA126c604b84e6e4e2a1a8eade0bee40800e1fc02de
SHA2568c4c1420d9891c2a5b1e84efab9b83168c4d271d1075ede76d3c69072f87be34
SHA512c02eb54cab1e64a2bcb0c774b6bbaf84b2c040b2a606d2bbdcb4a8baa87e8dce641edf67c8d36da07b80445615ff9d907c44de9c9287bc220c09e302e36d13de
-
Filesize
207KB
MD5cf266ee2cc78f231785638b61e432355
SHA126c604b84e6e4e2a1a8eade0bee40800e1fc02de
SHA2568c4c1420d9891c2a5b1e84efab9b83168c4d271d1075ede76d3c69072f87be34
SHA512c02eb54cab1e64a2bcb0c774b6bbaf84b2c040b2a606d2bbdcb4a8baa87e8dce641edf67c8d36da07b80445615ff9d907c44de9c9287bc220c09e302e36d13de
-
Filesize
207KB
MD5cf266ee2cc78f231785638b61e432355
SHA126c604b84e6e4e2a1a8eade0bee40800e1fc02de
SHA2568c4c1420d9891c2a5b1e84efab9b83168c4d271d1075ede76d3c69072f87be34
SHA512c02eb54cab1e64a2bcb0c774b6bbaf84b2c040b2a606d2bbdcb4a8baa87e8dce641edf67c8d36da07b80445615ff9d907c44de9c9287bc220c09e302e36d13de
-
Filesize
207KB
MD5cf266ee2cc78f231785638b61e432355
SHA126c604b84e6e4e2a1a8eade0bee40800e1fc02de
SHA2568c4c1420d9891c2a5b1e84efab9b83168c4d271d1075ede76d3c69072f87be34
SHA512c02eb54cab1e64a2bcb0c774b6bbaf84b2c040b2a606d2bbdcb4a8baa87e8dce641edf67c8d36da07b80445615ff9d907c44de9c9287bc220c09e302e36d13de
-
Filesize
207KB
MD5cf266ee2cc78f231785638b61e432355
SHA126c604b84e6e4e2a1a8eade0bee40800e1fc02de
SHA2568c4c1420d9891c2a5b1e84efab9b83168c4d271d1075ede76d3c69072f87be34
SHA512c02eb54cab1e64a2bcb0c774b6bbaf84b2c040b2a606d2bbdcb4a8baa87e8dce641edf67c8d36da07b80445615ff9d907c44de9c9287bc220c09e302e36d13de
-
Filesize
89KB
MD5a5ed103ec4719a27ab3d3c01dac66f01
SHA1c830d6980d7edea60568a518eccd36c0bc2a4924
SHA256dbcdc009781edffc3c4e5234d3d23d26364d6bff47e2e384cffdef148d7b5b36
SHA512b7fbe709a44f0e84a94c9e82f790d04e3d86b5409b5eb2d9f1d4d775b9669694c189042f04001acadb6da4c6284f4fbcbe39fd97427d41619191928510db9d80
-
Filesize
89KB
MD5a5ed103ec4719a27ab3d3c01dac66f01
SHA1c830d6980d7edea60568a518eccd36c0bc2a4924
SHA256dbcdc009781edffc3c4e5234d3d23d26364d6bff47e2e384cffdef148d7b5b36
SHA512b7fbe709a44f0e84a94c9e82f790d04e3d86b5409b5eb2d9f1d4d775b9669694c189042f04001acadb6da4c6284f4fbcbe39fd97427d41619191928510db9d80
-
Filesize
89KB
MD5a5ed103ec4719a27ab3d3c01dac66f01
SHA1c830d6980d7edea60568a518eccd36c0bc2a4924
SHA256dbcdc009781edffc3c4e5234d3d23d26364d6bff47e2e384cffdef148d7b5b36
SHA512b7fbe709a44f0e84a94c9e82f790d04e3d86b5409b5eb2d9f1d4d775b9669694c189042f04001acadb6da4c6284f4fbcbe39fd97427d41619191928510db9d80
-
Filesize
162B
MD51b7c22a214949975556626d7217e9a39
SHA1d01c97e2944166ed23e47e4a62ff471ab8fa031f
SHA256340c8464c2007ce3f80682e15dfafa4180b641d53c14201b929906b7b0284d87
SHA512ba64847cf1d4157d50abe4f4a1e5c1996fe387c5808e2f758c7fb3213bfefe1f3712d343f0c30a16819749840954654a70611d2250fd0f7b032429db7afd2cc5