Analysis
- max time kernel
113s - max time network
126s - platform
windows7_x64 - resource
win7-20230220-en - resource tags
arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system - submitted
08/06/2023, 11:41
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
8a54f6399d688f2a5662745191702696.exe
Resource
win7-20230220-en
windows7-x64
6 signatures
150 seconds
Behavioral task
behavioral2
Sample
8a54f6399d688f2a5662745191702696.exe
Resource
win10v2004-20230220-en
windows10-2004-x64
7 signatures
150 seconds
General
- Target 8a54f6399d688f2a5662745191702696.exe
- Size 208KB
- Sample230608-nte7jaff3x
- SHA256 05a7e5eebb670216cc5d295d409439e8838713ebcfadf3362543b1dc37848fe1
- MD5 8a54f6399d688f2a5662745191702696
- SHA1 a2c699125a87583efbf073bed514f0adcb68eb23
- SHA512 d9799c68f07b852b6b9746ca175549e834c1136cbba845d9e993f2e9669a7762ab02b28b0f1bc8193589b75f9b9c77177574bde24f0ae354b215047dbfbe6db4
- SSDEEP 3072:H/DmgskHbfHN+Pst60p0zuNmnKG7peNMQbuZAIqbey3lfbi:fDmfAfHN+wiuInRexuZAIij
- MD5 SHA1 SHA512 SSDEEP
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 3 IoCs
pid Process 564 lamod.exe 2044 lamod.exe 1568 lamod.exe - Loads dropped DLL 5 IoCs
pid Process 1724 8a54f6399d688f2a5662745191702696.exe 896 rundll32.exe 896 rundll32.exe 896 rundll32.exe 896 rundll32.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 468 schtasks.exe - Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 1724 8a54f6399d688f2a5662745191702696.exe - Suspicious use of WriteProcessMemory 51 IoCs
description pid Process procid_target PID 1724 wrote to memory of 564 1724 8a54f6399d688f2a5662745191702696.exe 28 PID 1724 wrote to memory of 564 1724 8a54f6399d688f2a5662745191702696.exe 28 PID 1724 wrote to memory of 564 1724 8a54f6399d688f2a5662745191702696.exe 28 PID 1724 wrote to memory of 564 1724 8a54f6399d688f2a5662745191702696.exe 28 PID 564 wrote to memory of 468 564 lamod.exe 29 PID 564 wrote to memory of 468 564 lamod.exe 29 PID 564 wrote to memory of 468 564 lamod.exe 29 PID 564 wrote to memory of 468 564 lamod.exe 29 PID 564 wrote to memory of 916 564 lamod.exe 31 PID 564 wrote to memory of 916 564 lamod.exe 31 PID 564 wrote to memory of 916 564 lamod.exe 31 PID 564 wrote to memory of 916 564 lamod.exe 31 PID 916 wrote to memory of 1256 916 cmd.exe 33 PID 916 wrote to memory of 1256 916 cmd.exe 33 PID 916 wrote to memory of 1256 916 cmd.exe 33 PID 916 wrote to memory of 1256 916 cmd.exe 33 PID 916 wrote to memory of 1896 916 cmd.exe 34 PID 916 wrote to memory of 1896 916 cmd.exe 34 PID 916 wrote to memory of 1896 916 cmd.exe 34 PID 916 wrote to memory of 1896 916 cmd.exe 34 PID 916 wrote to memory of 816 916 cmd.exe 35 PID 916 wrote to memory of 816 916 cmd.exe 35 PID 916 wrote to memory of 816 916 cmd.exe 35 PID 916 wrote to memory of 816 916 cmd.exe 35 PID 916 wrote to memory of 1312 916 cmd.exe 36 PID 916 wrote to memory of 1312 916 cmd.exe 36 PID 916 wrote to memory of 1312 916 cmd.exe 36 PID 916 wrote to memory of 1312 916 cmd.exe 36 PID 916 wrote to memory of 628 916 cmd.exe 37 PID 916 wrote to memory of 628 916 cmd.exe 37 PID 916 wrote to memory of 628 916 cmd.exe 37 PID 916 wrote to memory of 628 916 cmd.exe 37 PID 916 wrote to memory of 1868 916 cmd.exe 38 PID 916 wrote to memory of 1868 916 cmd.exe 38 PID 916 wrote to memory of 1868 916 cmd.exe 38 PID 916 wrote to memory of 1868 916 cmd.exe 38 PID 1672 wrote to memory of 2044 1672 taskeng.exe 42 PID 1672 wrote to memory of 2044 1672 taskeng.exe 42 PID 1672 wrote to memory of 2044 1672 taskeng.exe 42 PID 1672 wrote to memory of 2044 1672 taskeng.exe 42 PID 564 wrote to memory of 896 564 lamod.exe 43 PID 564 wrote to memory of 896 564 lamod.exe 43 PID 564 wrote to memory of 896 564 lamod.exe 43 PID 564 wrote to memory of 896 564 lamod.exe 43 PID 564 wrote to memory of 896 564 lamod.exe 43 PID 564 wrote to memory of 896 564 lamod.exe 43 PID 564 wrote to memory of 896 564 lamod.exe 43 PID 1672 wrote to memory of 1568 1672 taskeng.exe 44 PID 1672 wrote to memory of 1568 1672 taskeng.exe 44 PID 1672 wrote to memory of 1568 1672 taskeng.exe 44 PID 1672 wrote to memory of 1568 1672 taskeng.exe 44
Processes
-
C:\Users\Admin\AppData\Local\Temp\8a54f6399d688f2a5662745191702696.exe"C:\Users\Admin\AppData\Local\Temp\8a54f6399d688f2a5662745191702696.exe"1⤵
- Loads dropped DLL
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:1724 -
C:\Users\Admin\AppData\Local\Temp\a9e2a16078\lamod.exe"C:\Users\Admin\AppData\Local\Temp\a9e2a16078\lamod.exe"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:564 -
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN lamod.exe /TR "C:\Users\Admin\AppData\Local\Temp\a9e2a16078\lamod.exe" /F3⤵
- Creates scheduled task(s)
PID:468
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k echo Y|CACLS "lamod.exe" /P "Admin:N"&&CACLS "lamod.exe" /P "Admin:R" /E&&echo Y|CACLS "..\a9e2a16078" /P "Admin:N"&&CACLS "..\a9e2a16078" /P "Admin:R" /E&&Exit3⤵
- Suspicious use of WriteProcessMemory
PID:916 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"4⤵PID:1256
-
-
C:\Windows\SysWOW64\cacls.exeCACLS "lamod.exe" /P "Admin:N"4⤵PID:1896
-
-
C:\Windows\SysWOW64\cacls.exeCACLS "lamod.exe" /P "Admin:R" /E4⤵PID:816
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"4⤵PID:1312
-
-
C:\Windows\SysWOW64\cacls.exeCACLS "..\a9e2a16078" /P "Admin:N"4⤵PID:628
-
-
C:\Windows\SysWOW64\cacls.exeCACLS "..\a9e2a16078" /P "Admin:R" /E4⤵PID:1868
-
-
-
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll, Main3⤵
- Loads dropped DLL
PID:896
-
-
-
C:\Windows\system32\taskeng.exetaskeng.exe {B08F1601-F97E-421E-81B3-45148C142FBD} S-1-5-21-3499517378-2376672570-1134980332-1000:MLXLFKOI\Admin:Interactive:[1]1⤵
- Suspicious use of WriteProcessMemory
PID:1672 -
C:\Users\Admin\AppData\Local\Temp\a9e2a16078\lamod.exeC:\Users\Admin\AppData\Local\Temp\a9e2a16078\lamod.exe2⤵
- Executes dropped EXE
PID:2044
-
-
C:\Users\Admin\AppData\Local\Temp\a9e2a16078\lamod.exeC:\Users\Admin\AppData\Local\Temp\a9e2a16078\lamod.exe2⤵
- Executes dropped EXE
PID:1568
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Temp\a9e2a16078\lamod.exe
- Size 208KB
- SHA256 05a7e5eebb670216cc5d295d409439e8838713ebcfadf3362543b1dc37848fe1
- MD5 8a54f6399d688f2a5662745191702696
- SHA1 a2c699125a87583efbf073bed514f0adcb68eb23
- SHA512 d9799c68f07b852b6b9746ca175549e834c1136cbba845d9e993f2e9669a7762ab02b28b0f1bc8193589b75f9b9c77177574bde24f0ae354b215047dbfbe6db4
- SSDEEP 3072:H/DmgskHbfHN+Pst60p0zuNmnKG7peNMQbuZAIqbey3lfbi:fDmfAfHN+wiuInRexuZAIij
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\a9e2a16078\lamod.exe
- Size 208KB
- SHA256 05a7e5eebb670216cc5d295d409439e8838713ebcfadf3362543b1dc37848fe1
- MD5 8a54f6399d688f2a5662745191702696
- SHA1 a2c699125a87583efbf073bed514f0adcb68eb23
- SHA512 d9799c68f07b852b6b9746ca175549e834c1136cbba845d9e993f2e9669a7762ab02b28b0f1bc8193589b75f9b9c77177574bde24f0ae354b215047dbfbe6db4
- SSDEEP 3072:H/DmgskHbfHN+Pst60p0zuNmnKG7peNMQbuZAIqbey3lfbi:fDmfAfHN+wiuInRexuZAIij
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\a9e2a16078\lamod.exe
- Size 208KB
- SHA256 05a7e5eebb670216cc5d295d409439e8838713ebcfadf3362543b1dc37848fe1
- MD5 8a54f6399d688f2a5662745191702696
- SHA1 a2c699125a87583efbf073bed514f0adcb68eb23
- SHA512 d9799c68f07b852b6b9746ca175549e834c1136cbba845d9e993f2e9669a7762ab02b28b0f1bc8193589b75f9b9c77177574bde24f0ae354b215047dbfbe6db4
- SSDEEP 3072:H/DmgskHbfHN+Pst60p0zuNmnKG7peNMQbuZAIqbey3lfbi:fDmfAfHN+wiuInRexuZAIij
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\a9e2a16078\lamod.exe
- Size 208KB
- SHA256 05a7e5eebb670216cc5d295d409439e8838713ebcfadf3362543b1dc37848fe1
- MD5 8a54f6399d688f2a5662745191702696
- SHA1 a2c699125a87583efbf073bed514f0adcb68eb23
- SHA512 d9799c68f07b852b6b9746ca175549e834c1136cbba845d9e993f2e9669a7762ab02b28b0f1bc8193589b75f9b9c77177574bde24f0ae354b215047dbfbe6db4
- SSDEEP 3072:H/DmgskHbfHN+Pst60p0zuNmnKG7peNMQbuZAIqbey3lfbi:fDmfAfHN+wiuInRexuZAIij
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\a9e2a16078\lamod.exe
- Size 208KB
- SHA256 05a7e5eebb670216cc5d295d409439e8838713ebcfadf3362543b1dc37848fe1
- MD5 8a54f6399d688f2a5662745191702696
- SHA1 a2c699125a87583efbf073bed514f0adcb68eb23
- SHA512 d9799c68f07b852b6b9746ca175549e834c1136cbba845d9e993f2e9669a7762ab02b28b0f1bc8193589b75f9b9c77177574bde24f0ae354b215047dbfbe6db4
- SSDEEP 3072:H/DmgskHbfHN+Pst60p0zuNmnKG7peNMQbuZAIqbey3lfbi:fDmfAfHN+wiuInRexuZAIij
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll
- Size 89KB
- SHA256 dbcdc009781edffc3c4e5234d3d23d26364d6bff47e2e384cffdef148d7b5b36
- MD5 a5ed103ec4719a27ab3d3c01dac66f01
- SHA1 c830d6980d7edea60568a518eccd36c0bc2a4924
- SHA512 b7fbe709a44f0e84a94c9e82f790d04e3d86b5409b5eb2d9f1d4d775b9669694c189042f04001acadb6da4c6284f4fbcbe39fd97427d41619191928510db9d80
- SSDEEP 1536:Qo4NPCKLbqoYkbpplW9YoUsxXzbcouNhj2ZszsWuKcdJUQHaB89p:QoUCWbBNpplToUs1uNhj25LJUSaB89p
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll
- Size 89KB
- SHA256 dbcdc009781edffc3c4e5234d3d23d26364d6bff47e2e384cffdef148d7b5b36
- MD5 a5ed103ec4719a27ab3d3c01dac66f01
- SHA1 c830d6980d7edea60568a518eccd36c0bc2a4924
- SHA512 b7fbe709a44f0e84a94c9e82f790d04e3d86b5409b5eb2d9f1d4d775b9669694c189042f04001acadb6da4c6284f4fbcbe39fd97427d41619191928510db9d80
- SSDEEP 1536:Qo4NPCKLbqoYkbpplW9YoUsxXzbcouNhj2ZszsWuKcdJUQHaB89p:QoUCWbBNpplToUs1uNhj25LJUSaB89p
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Roaming\006700e5a2ab05\cred64.dll
- Size 162B
- SHA256 340c8464c2007ce3f80682e15dfafa4180b641d53c14201b929906b7b0284d87
- MD5 1b7c22a214949975556626d7217e9a39
- SHA1 d01c97e2944166ed23e47e4a62ff471ab8fa031f
- SHA512 ba64847cf1d4157d50abe4f4a1e5c1996fe387c5808e2f758c7fb3213bfefe1f3712d343f0c30a16819749840954654a70611d2250fd0f7b032429db7afd2cc5
- MD5 SHA1 SHA512
- Path \Users\Admin\AppData\Local\Temp\a9e2a16078\lamod.exe
- Size 208KB
- SHA256 05a7e5eebb670216cc5d295d409439e8838713ebcfadf3362543b1dc37848fe1
- MD5 8a54f6399d688f2a5662745191702696
- SHA1 a2c699125a87583efbf073bed514f0adcb68eb23
- SHA512 d9799c68f07b852b6b9746ca175549e834c1136cbba845d9e993f2e9669a7762ab02b28b0f1bc8193589b75f9b9c77177574bde24f0ae354b215047dbfbe6db4
- SSDEEP 3072:H/DmgskHbfHN+Pst60p0zuNmnKG7peNMQbuZAIqbey3lfbi:fDmfAfHN+wiuInRexuZAIij
- MD5 SHA1 SHA512 SSDEEP
- Path \Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll
- Size 89KB
- SHA256 dbcdc009781edffc3c4e5234d3d23d26364d6bff47e2e384cffdef148d7b5b36
- MD5 a5ed103ec4719a27ab3d3c01dac66f01
- SHA1 c830d6980d7edea60568a518eccd36c0bc2a4924
- SHA512 b7fbe709a44f0e84a94c9e82f790d04e3d86b5409b5eb2d9f1d4d775b9669694c189042f04001acadb6da4c6284f4fbcbe39fd97427d41619191928510db9d80
- SSDEEP 1536:Qo4NPCKLbqoYkbpplW9YoUsxXzbcouNhj2ZszsWuKcdJUQHaB89p:QoUCWbBNpplToUs1uNhj25LJUSaB89p
- MD5 SHA1 SHA512 SSDEEP
- Path \Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll
- Size 89KB
- SHA256 dbcdc009781edffc3c4e5234d3d23d26364d6bff47e2e384cffdef148d7b5b36
- MD5 a5ed103ec4719a27ab3d3c01dac66f01
- SHA1 c830d6980d7edea60568a518eccd36c0bc2a4924
- SHA512 b7fbe709a44f0e84a94c9e82f790d04e3d86b5409b5eb2d9f1d4d775b9669694c189042f04001acadb6da4c6284f4fbcbe39fd97427d41619191928510db9d80
- SSDEEP 1536:Qo4NPCKLbqoYkbpplW9YoUsxXzbcouNhj2ZszsWuKcdJUQHaB89p:QoUCWbBNpplToUs1uNhj25LJUSaB89p
- MD5 SHA1 SHA512 SSDEEP
- Path \Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll
- Size 89KB
- SHA256 dbcdc009781edffc3c4e5234d3d23d26364d6bff47e2e384cffdef148d7b5b36
- MD5 a5ed103ec4719a27ab3d3c01dac66f01
- SHA1 c830d6980d7edea60568a518eccd36c0bc2a4924
- SHA512 b7fbe709a44f0e84a94c9e82f790d04e3d86b5409b5eb2d9f1d4d775b9669694c189042f04001acadb6da4c6284f4fbcbe39fd97427d41619191928510db9d80
- SSDEEP 1536:Qo4NPCKLbqoYkbpplW9YoUsxXzbcouNhj2ZszsWuKcdJUQHaB89p:QoUCWbBNpplToUs1uNhj25LJUSaB89p
- MD5 SHA1 SHA512 SSDEEP
- Path \Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll
- Size 89KB
- SHA256 dbcdc009781edffc3c4e5234d3d23d26364d6bff47e2e384cffdef148d7b5b36
- MD5 a5ed103ec4719a27ab3d3c01dac66f01
- SHA1 c830d6980d7edea60568a518eccd36c0bc2a4924
- SHA512 b7fbe709a44f0e84a94c9e82f790d04e3d86b5409b5eb2d9f1d4d775b9669694c189042f04001acadb6da4c6284f4fbcbe39fd97427d41619191928510db9d80
- SSDEEP 1536:Qo4NPCKLbqoYkbpplW9YoUsxXzbcouNhj2ZszsWuKcdJUQHaB89p:QoUCWbBNpplToUs1uNhj25LJUSaB89p
- MD5 SHA1 SHA512 SSDEEP