Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    0s
  • max time network
    134s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231222-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system
  • submitted
    06/01/2024, 20:27

General

  • Target

    a155d99d5e5180ecb67b0fee8b88173c.exe

  • Size

    117KB

  • MD5

    a155d99d5e5180ecb67b0fee8b88173c

  • SHA1

    0b7b789da36ee8340dcb6fb208a80186db511656

  • SHA256

    b7ae31f75fca80dcdc93d57d6e42bffc0b1960a025b966f9b7afd1d54b860a08

  • SHA512

    2b0d889dc99934e2ecae7686b7691fbabf18a6b37a2fb7c1c3a8edfe65106394c5841f49b7345fed47078837aeff9411c92597a4f822cf69a203a74f9fa1fe67

  • SSDEEP

    3072:wcYXXWtEBgXRBOywlL77MBuqQC1HR9FFfUrQlM:w9X8RoywlL77M1nHR9TfMQ

Score
10/10

Malware Config

Signatures

  • Adds autorun key to be loaded by Explorer.exe on startup 2 TTPs 20 IoCs
  • Executes dropped EXE 10 IoCs
  • Drops file in System32 directory 30 IoCs
  • Program crash 1 IoCs
  • Modifies registry class 33 IoCs
  • Suspicious use of WriteProcessMemory 30 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\a155d99d5e5180ecb67b0fee8b88173c.exe
    "C:\Users\Admin\AppData\Local\Temp\a155d99d5e5180ecb67b0fee8b88173c.exe"
    1⤵
    • Adds autorun key to be loaded by Explorer.exe on startup
    • Drops file in System32 directory
    • Modifies registry class
    • Suspicious use of WriteProcessMemory
    PID:2856
    • C:\Windows\SysWOW64\Lgikfn32.exe
      C:\Windows\system32\Lgikfn32.exe
      2⤵
      • Adds autorun key to be loaded by Explorer.exe on startup
      • Executes dropped EXE
      • Drops file in System32 directory
      • Modifies registry class
      • Suspicious use of WriteProcessMemory
      PID:2000
  • C:\Windows\SysWOW64\Lilanioo.exe
    C:\Windows\system32\Lilanioo.exe
    1⤵
    • Executes dropped EXE
    PID:4988
    • C:\Windows\SysWOW64\Lpfijcfl.exe
      C:\Windows\system32\Lpfijcfl.exe
      2⤵
        PID:440
    • C:\Windows\SysWOW64\Mdiklqhm.exe
      C:\Windows\system32\Mdiklqhm.exe
      1⤵
        PID:4280
        • C:\Windows\SysWOW64\Mgghhlhq.exe
          C:\Windows\system32\Mgghhlhq.exe
          2⤵
            PID:2404
        • C:\Windows\SysWOW64\Mnapdf32.exe
          C:\Windows\system32\Mnapdf32.exe
          1⤵
            PID:2532
            • C:\Windows\SysWOW64\Mpolqa32.exe
              C:\Windows\system32\Mpolqa32.exe
              2⤵
                PID:2956
            • C:\Windows\SysWOW64\Mgidml32.exe
              C:\Windows\system32\Mgidml32.exe
              1⤵
                PID:4516
                • C:\Windows\SysWOW64\Mkepnjng.exe
                  C:\Windows\system32\Mkepnjng.exe
                  2⤵
                    PID:1920
                • C:\Windows\SysWOW64\Maaepd32.exe
                  C:\Windows\system32\Maaepd32.exe
                  1⤵
                    PID:464
                    • C:\Windows\SysWOW64\Mcbahlip.exe
                      C:\Windows\system32\Mcbahlip.exe
                      2⤵
                        PID:1828
                    • C:\Windows\SysWOW64\Mgnnhk32.exe
                      C:\Windows\system32\Mgnnhk32.exe
                      1⤵
                        PID:388
                        • C:\Windows\SysWOW64\Njljefql.exe
                          C:\Windows\system32\Njljefql.exe
                          2⤵
                            PID:3424
                        • C:\Windows\SysWOW64\Nqiogp32.exe
                          C:\Windows\system32\Nqiogp32.exe
                          1⤵
                            PID:220
                            • C:\Windows\SysWOW64\Ncgkcl32.exe
                              C:\Windows\system32\Ncgkcl32.exe
                              2⤵
                                PID:2728
                                • C:\Windows\SysWOW64\Njacpf32.exe
                                  C:\Windows\system32\Njacpf32.exe
                                  3⤵
                                    PID:5012
                              • C:\Windows\SysWOW64\WerFault.exe
                                C:\Windows\SysWOW64\WerFault.exe -pss -s 432 -p 2896 -ip 2896
                                1⤵
                                  PID:5156
                                • C:\Windows\SysWOW64\WerFault.exe
                                  C:\Windows\SysWOW64\WerFault.exe -u -p 2896 -s 412
                                  1⤵
                                  • Program crash
                                  PID:5208
                                • C:\Windows\SysWOW64\Nkcmohbg.exe
                                  C:\Windows\system32\Nkcmohbg.exe
                                  1⤵
                                    PID:2896
                                  • C:\Windows\SysWOW64\Nggqoj32.exe
                                    C:\Windows\system32\Nggqoj32.exe
                                    1⤵
                                      PID:2080
                                    • C:\Windows\SysWOW64\Ndidbn32.exe
                                      C:\Windows\system32\Ndidbn32.exe
                                      1⤵
                                        PID:3436
                                      • C:\Windows\SysWOW64\Nbkhfc32.exe
                                        C:\Windows\system32\Nbkhfc32.exe
                                        1⤵
                                          PID:4928
                                        • C:\Windows\SysWOW64\Nnolfdcn.exe
                                          C:\Windows\system32\Nnolfdcn.exe
                                          1⤵
                                            PID:3508
                                          • C:\Windows\SysWOW64\Nkqpjidj.exe
                                            C:\Windows\system32\Nkqpjidj.exe
                                            1⤵
                                              PID:3164
                                            • C:\Windows\SysWOW64\Ndghmo32.exe
                                              C:\Windows\system32\Ndghmo32.exe
                                              1⤵
                                                PID:4100
                                              • C:\Windows\SysWOW64\Nbhkac32.exe
                                                C:\Windows\system32\Nbhkac32.exe
                                                1⤵
                                                  PID:2864
                                                • C:\Windows\SysWOW64\Njogjfoj.exe
                                                  C:\Windows\system32\Njogjfoj.exe
                                                  1⤵
                                                    PID:2584
                                                  • C:\Windows\SysWOW64\Nceonl32.exe
                                                    C:\Windows\system32\Nceonl32.exe
                                                    1⤵
                                                      PID:1388
                                                    • C:\Windows\SysWOW64\Nqfbaq32.exe
                                                      C:\Windows\system32\Nqfbaq32.exe
                                                      1⤵
                                                        PID:4596
                                                      • C:\Windows\SysWOW64\Mjjmog32.exe
                                                        C:\Windows\system32\Mjjmog32.exe
                                                        1⤵
                                                          PID:3036
                                                        • C:\Windows\SysWOW64\Mglack32.exe
                                                          C:\Windows\system32\Mglack32.exe
                                                          1⤵
                                                            PID:4948
                                                          • C:\Windows\SysWOW64\Mcpebmkb.exe
                                                            C:\Windows\system32\Mcpebmkb.exe
                                                            1⤵
                                                              PID:1908
                                                            • C:\Windows\SysWOW64\Mpaifalo.exe
                                                              C:\Windows\system32\Mpaifalo.exe
                                                              1⤵
                                                                PID:368
                                                              • C:\Windows\SysWOW64\Mncmjfmk.exe
                                                                C:\Windows\system32\Mncmjfmk.exe
                                                                1⤵
                                                                  PID:2368
                                                                • C:\Windows\SysWOW64\Majopeii.exe
                                                                  C:\Windows\system32\Majopeii.exe
                                                                  1⤵
                                                                    PID:4932
                                                                  • C:\Windows\SysWOW64\Mjcgohig.exe
                                                                    C:\Windows\system32\Mjcgohig.exe
                                                                    1⤵
                                                                      PID:1516
                                                                    • C:\Windows\SysWOW64\Mgekbljc.exe
                                                                      C:\Windows\system32\Mgekbljc.exe
                                                                      1⤵
                                                                        PID:1148
                                                                      • C:\Windows\SysWOW64\Mpkbebbf.exe
                                                                        C:\Windows\system32\Mpkbebbf.exe
                                                                        1⤵
                                                                          PID:860
                                                                        • C:\Windows\SysWOW64\Mnlfigcc.exe
                                                                          C:\Windows\system32\Mnlfigcc.exe
                                                                          1⤵
                                                                            PID:2024
                                                                          • C:\Windows\SysWOW64\Lgbnmm32.exe
                                                                            C:\Windows\system32\Lgbnmm32.exe
                                                                            1⤵
                                                                              PID:2628
                                                                            • C:\Windows\SysWOW64\Lddbqa32.exe
                                                                              C:\Windows\system32\Lddbqa32.exe
                                                                              1⤵
                                                                                PID:4788
                                                                              • C:\Windows\SysWOW64\Laefdf32.exe
                                                                                C:\Windows\system32\Laefdf32.exe
                                                                                1⤵
                                                                                  PID:1564
                                                                                • C:\Windows\SysWOW64\Lnjjdgee.exe
                                                                                  C:\Windows\system32\Lnjjdgee.exe
                                                                                  1⤵
                                                                                    PID:2672
                                                                                  • C:\Windows\SysWOW64\Lgpagm32.exe
                                                                                    C:\Windows\system32\Lgpagm32.exe
                                                                                    1⤵
                                                                                      PID:5112
                                                                                    • C:\Windows\SysWOW64\Lgneampk.exe
                                                                                      C:\Windows\system32\Lgneampk.exe
                                                                                      1⤵
                                                                                      • Adds autorun key to be loaded by Explorer.exe on startup
                                                                                      • Executes dropped EXE
                                                                                      • Drops file in System32 directory
                                                                                      • Modifies registry class
                                                                                      • Suspicious use of WriteProcessMemory
                                                                                      PID:1396
                                                                                    • C:\Windows\SysWOW64\Ldohebqh.exe
                                                                                      C:\Windows\system32\Ldohebqh.exe
                                                                                      1⤵
                                                                                      • Adds autorun key to be loaded by Explorer.exe on startup
                                                                                      • Executes dropped EXE
                                                                                      • Drops file in System32 directory
                                                                                      • Modifies registry class
                                                                                      • Suspicious use of WriteProcessMemory
                                                                                      PID:1416
                                                                                    • C:\Windows\SysWOW64\Laalifad.exe
                                                                                      C:\Windows\system32\Laalifad.exe
                                                                                      1⤵
                                                                                      • Adds autorun key to be loaded by Explorer.exe on startup
                                                                                      • Executes dropped EXE
                                                                                      • Drops file in System32 directory
                                                                                      • Modifies registry class
                                                                                      • Suspicious use of WriteProcessMemory
                                                                                      PID:5036
                                                                                    • C:\Windows\SysWOW64\Lijdhiaa.exe
                                                                                      C:\Windows\system32\Lijdhiaa.exe
                                                                                      1⤵
                                                                                      • Adds autorun key to be loaded by Explorer.exe on startup
                                                                                      • Executes dropped EXE
                                                                                      • Drops file in System32 directory
                                                                                      • Modifies registry class
                                                                                      • Suspicious use of WriteProcessMemory
                                                                                      PID:4084
                                                                                    • C:\Windows\SysWOW64\Lkgdml32.exe
                                                                                      C:\Windows\system32\Lkgdml32.exe
                                                                                      1⤵
                                                                                      • Adds autorun key to be loaded by Explorer.exe on startup
                                                                                      • Executes dropped EXE
                                                                                      • Drops file in System32 directory
                                                                                      • Modifies registry class
                                                                                      • Suspicious use of WriteProcessMemory
                                                                                      PID:232
                                                                                    • C:\Windows\SysWOW64\Lcpllo32.exe
                                                                                      C:\Windows\system32\Lcpllo32.exe
                                                                                      1⤵
                                                                                      • Adds autorun key to be loaded by Explorer.exe on startup
                                                                                      • Executes dropped EXE
                                                                                      • Drops file in System32 directory
                                                                                      • Modifies registry class
                                                                                      • Suspicious use of WriteProcessMemory
                                                                                      PID:4232
                                                                                    • C:\Windows\SysWOW64\Lpappc32.exe
                                                                                      C:\Windows\system32\Lpappc32.exe
                                                                                      1⤵
                                                                                      • Adds autorun key to be loaded by Explorer.exe on startup
                                                                                      • Executes dropped EXE
                                                                                      • Drops file in System32 directory
                                                                                      • Modifies registry class
                                                                                      • Suspicious use of WriteProcessMemory
                                                                                      PID:1384
                                                                                    • C:\Windows\SysWOW64\Lmccchkn.exe
                                                                                      C:\Windows\system32\Lmccchkn.exe
                                                                                      1⤵
                                                                                      • Adds autorun key to be loaded by Explorer.exe on startup
                                                                                      • Executes dropped EXE
                                                                                      • Drops file in System32 directory
                                                                                      • Modifies registry class
                                                                                      • Suspicious use of WriteProcessMemory
                                                                                      PID:4856

                                                                                    Network

                                                                                    MITRE ATT&CK Enterprise v15

                                                                                    Replay Monitor

                                                                                    Loading Replay Monitor...

                                                                                    Downloads

                                                                                    • memory/220-309-0x0000000000400000-0x0000000000441000-memory.dmp

                                                                                      Filesize

                                                                                      260KB

                                                                                    • memory/232-42-0x0000000000400000-0x0000000000441000-memory.dmp

                                                                                      Filesize

                                                                                      260KB

                                                                                    • memory/368-231-0x0000000000400000-0x0000000000441000-memory.dmp

                                                                                      Filesize

                                                                                      260KB

                                                                                    • memory/388-372-0x0000000000400000-0x0000000000441000-memory.dmp

                                                                                      Filesize

                                                                                      260KB

                                                                                    • memory/388-274-0x0000000000400000-0x0000000000441000-memory.dmp

                                                                                      Filesize

                                                                                      260KB

                                                                                    • memory/440-88-0x0000000000400000-0x0000000000441000-memory.dmp

                                                                                      Filesize

                                                                                      260KB

                                                                                    • memory/464-262-0x0000000000400000-0x0000000000441000-memory.dmp

                                                                                      Filesize

                                                                                      260KB

                                                                                    • memory/464-375-0x0000000000400000-0x0000000000441000-memory.dmp

                                                                                      Filesize

                                                                                      260KB

                                                                                    • memory/860-144-0x0000000000400000-0x0000000000441000-memory.dmp

                                                                                      Filesize

                                                                                      260KB

                                                                                    • memory/1148-152-0x0000000000400000-0x0000000000441000-memory.dmp

                                                                                      Filesize

                                                                                      260KB

                                                                                    • memory/1384-24-0x0000000000400000-0x0000000000441000-memory.dmp

                                                                                      Filesize

                                                                                      260KB

                                                                                    • memory/1388-296-0x0000000000400000-0x0000000000441000-memory.dmp

                                                                                      Filesize

                                                                                      260KB

                                                                                    • memory/1396-71-0x0000000000400000-0x0000000000441000-memory.dmp

                                                                                      Filesize

                                                                                      260KB

                                                                                    • memory/1416-68-0x0000000000400000-0x0000000000441000-memory.dmp

                                                                                      Filesize

                                                                                      260KB

                                                                                    • memory/1516-160-0x0000000000400000-0x0000000000441000-memory.dmp

                                                                                      Filesize

                                                                                      260KB

                                                                                    • memory/1564-116-0x0000000000400000-0x0000000000441000-memory.dmp

                                                                                      Filesize

                                                                                      260KB

                                                                                    • memory/1828-373-0x0000000000400000-0x0000000000441000-memory.dmp

                                                                                      Filesize

                                                                                      260KB

                                                                                    • memory/1828-268-0x0000000000400000-0x0000000000441000-memory.dmp

                                                                                      Filesize

                                                                                      260KB

                                                                                    • memory/1908-239-0x0000000000400000-0x0000000000441000-memory.dmp

                                                                                      Filesize

                                                                                      260KB

                                                                                    • memory/1920-216-0x0000000000400000-0x0000000000441000-memory.dmp

                                                                                      Filesize

                                                                                      260KB

                                                                                    • memory/2000-8-0x0000000000400000-0x0000000000441000-memory.dmp

                                                                                      Filesize

                                                                                      260KB

                                                                                    • memory/2024-136-0x0000000000400000-0x0000000000441000-memory.dmp

                                                                                      Filesize

                                                                                      260KB

                                                                                    • memory/2080-358-0x0000000000400000-0x0000000000441000-memory.dmp

                                                                                      Filesize

                                                                                      260KB

                                                                                    • memory/2080-366-0x0000000000400000-0x0000000000441000-memory.dmp

                                                                                      Filesize

                                                                                      260KB

                                                                                    • memory/2368-224-0x0000000000400000-0x0000000000441000-memory.dmp

                                                                                      Filesize

                                                                                      260KB

                                                                                    • memory/2404-184-0x0000000000400000-0x0000000000441000-memory.dmp

                                                                                      Filesize

                                                                                      260KB

                                                                                    • memory/2532-192-0x0000000000400000-0x0000000000441000-memory.dmp

                                                                                      Filesize

                                                                                      260KB

                                                                                    • memory/2584-370-0x0000000000400000-0x0000000000441000-memory.dmp

                                                                                      Filesize

                                                                                      260KB

                                                                                    • memory/2584-298-0x0000000000400000-0x0000000000441000-memory.dmp

                                                                                      Filesize

                                                                                      260KB

                                                                                    • memory/2628-127-0x0000000000400000-0x0000000000441000-memory.dmp

                                                                                      Filesize

                                                                                      260KB

                                                                                    • memory/2672-104-0x0000000000400000-0x0000000000441000-memory.dmp

                                                                                      Filesize

                                                                                      260KB

                                                                                    • memory/2728-314-0x0000000000400000-0x0000000000441000-memory.dmp

                                                                                      Filesize

                                                                                      260KB

                                                                                    • memory/2856-0-0x0000000000400000-0x0000000000441000-memory.dmp

                                                                                      Filesize

                                                                                      260KB

                                                                                    • memory/2864-326-0x0000000000400000-0x0000000000441000-memory.dmp

                                                                                      Filesize

                                                                                      260KB

                                                                                    • memory/2896-364-0x0000000000400000-0x0000000000441000-memory.dmp

                                                                                      Filesize

                                                                                      260KB

                                                                                    • memory/2896-365-0x0000000000400000-0x0000000000441000-memory.dmp

                                                                                      Filesize

                                                                                      260KB

                                                                                    • memory/2956-200-0x0000000000400000-0x0000000000441000-memory.dmp

                                                                                      Filesize

                                                                                      260KB

                                                                                    • memory/3036-376-0x0000000000400000-0x0000000000441000-memory.dmp

                                                                                      Filesize

                                                                                      260KB

                                                                                    • memory/3036-256-0x0000000000400000-0x0000000000441000-memory.dmp

                                                                                      Filesize

                                                                                      260KB

                                                                                    • memory/3164-368-0x0000000000400000-0x0000000000441000-memory.dmp

                                                                                      Filesize

                                                                                      260KB

                                                                                    • memory/3164-334-0x0000000000400000-0x0000000000441000-memory.dmp

                                                                                      Filesize

                                                                                      260KB

                                                                                    • memory/3424-280-0x0000000000400000-0x0000000000441000-memory.dmp

                                                                                      Filesize

                                                                                      260KB

                                                                                    • memory/3424-374-0x0000000000400000-0x0000000000441000-memory.dmp

                                                                                      Filesize

                                                                                      260KB

                                                                                    • memory/3436-367-0x0000000000400000-0x0000000000441000-memory.dmp

                                                                                      Filesize

                                                                                      260KB

                                                                                    • memory/3436-352-0x0000000000400000-0x0000000000441000-memory.dmp

                                                                                      Filesize

                                                                                      260KB

                                                                                    • memory/3508-344-0x0000000000400000-0x0000000000441000-memory.dmp

                                                                                      Filesize

                                                                                      260KB

                                                                                    • memory/4084-55-0x0000000000400000-0x0000000000441000-memory.dmp

                                                                                      Filesize

                                                                                      260KB

                                                                                    • memory/4100-333-0x0000000000400000-0x0000000000441000-memory.dmp

                                                                                      Filesize

                                                                                      260KB

                                                                                    • memory/4232-36-0x0000000000400000-0x0000000000441000-memory.dmp

                                                                                      Filesize

                                                                                      260KB

                                                                                    • memory/4280-176-0x0000000000400000-0x0000000000441000-memory.dmp

                                                                                      Filesize

                                                                                      260KB

                                                                                    • memory/4516-212-0x0000000000400000-0x0000000000441000-memory.dmp

                                                                                      Filesize

                                                                                      260KB

                                                                                    • memory/4596-371-0x0000000000400000-0x0000000000441000-memory.dmp

                                                                                      Filesize

                                                                                      260KB

                                                                                    • memory/4596-290-0x0000000000400000-0x0000000000441000-memory.dmp

                                                                                      Filesize

                                                                                      260KB

                                                                                    • memory/4788-119-0x0000000000400000-0x0000000000441000-memory.dmp

                                                                                      Filesize

                                                                                      260KB

                                                                                    • memory/4856-20-0x0000000000400000-0x0000000000441000-memory.dmp

                                                                                      Filesize

                                                                                      260KB

                                                                                    • memory/4928-351-0x0000000000400000-0x0000000000441000-memory.dmp

                                                                                      Filesize

                                                                                      260KB

                                                                                    • memory/4932-168-0x0000000000400000-0x0000000000441000-memory.dmp

                                                                                      Filesize

                                                                                      260KB

                                                                                    • memory/4948-248-0x0000000000400000-0x0000000000441000-memory.dmp

                                                                                      Filesize

                                                                                      260KB

                                                                                    • memory/4948-377-0x0000000000400000-0x0000000000441000-memory.dmp

                                                                                      Filesize

                                                                                      260KB

                                                                                    • memory/4988-79-0x0000000000400000-0x0000000000441000-memory.dmp

                                                                                      Filesize

                                                                                      260KB

                                                                                    • memory/5012-369-0x0000000000400000-0x0000000000441000-memory.dmp

                                                                                      Filesize

                                                                                      260KB

                                                                                    • memory/5012-316-0x0000000000400000-0x0000000000441000-memory.dmp

                                                                                      Filesize

                                                                                      260KB

                                                                                    • memory/5036-60-0x0000000000400000-0x0000000000441000-memory.dmp

                                                                                      Filesize

                                                                                      260KB

                                                                                    • memory/5112-96-0x0000000000400000-0x0000000000441000-memory.dmp

                                                                                      Filesize

                                                                                      260KB