Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    142s
  • max time network
    143s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240709-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
  • submitted
    22/07/2024, 15:37

General

  • Target

    _Unpack Portable.cmd

  • Size

    1KB

  • MD5

    11bb19b34ae3d7efb2f2896416bdecfd

  • SHA1

    76749fa742a58c585c7a9e6044d798776fc35d00

  • SHA256

    7256488f34caa5538294556b0b728e291cbe635f8d3cc6cd8195ad4bef1f782d

  • SHA512

    8ced83bb80ca73c583890bacee3c2306c347e84c33bf883dd4589139b8d830d01131f6d8e3c6ea7a29b9bea59c40be447d5d2968a3d78bee2fb11d4116996377

Score
7/10

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 4 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SetWindowsHookEx 3 IoCs
  • Suspicious use of WriteProcessMemory 6 IoCs

Processes

  • C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\_Unpack Portable.cmd"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:4716
    • C:\Users\Admin\AppData\Local\Temp\Process Lasso 14.2.0.32.exe
      "Process Lasso 14.2.0.32.exe" /SILENT /PORTABLE=1
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:4416
      • C:\Users\Admin\AppData\Local\Temp\is-NGGDS.tmp\Process Lasso 14.2.0.32.tmp
        "C:\Users\Admin\AppData\Local\Temp\is-NGGDS.tmp\Process Lasso 14.2.0.32.tmp" /SL5="$F003E,4754140,60928,C:\Users\Admin\AppData\Local\Temp\Process Lasso 14.2.0.32.exe" /SILENT /PORTABLE=1
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SetWindowsHookEx
        PID:1916

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\is-JDKSS.tmp\ISTask.dll

    Filesize

    66KB

    MD5

    86a1311d51c00b278cb7f27796ea442e

    SHA1

    ac08ac9d08f8f5380e2a9a65f4117862aa861a19

    SHA256

    e916bdf232744e00cbd8d608168a019c9f41a68a7e8390aa48cfb525276c483d

    SHA512

    129e4b8dd2665bcfc5e72b4585343c51127b5d027dbb0234291e7a197baeca1bab5ed074e65e5e8c969ee01f9f65cc52c9993037416de9bfff2f872e5aeba7ec

  • C:\Users\Admin\AppData\Local\Temp\is-JDKSS.tmp\VclStylesInno.dll

    Filesize

    3.0MB

    MD5

    b0ca93ceb050a2feff0b19e65072bbb5

    SHA1

    7ebbbbe2d2acd8fd516f824338d254a33b69f08d

    SHA256

    0e93313f42084d804b9ac4be53d844e549cfcaf19e6f276a3b0f82f01b9b2246

    SHA512

    37242423e62af30179906660c6dbbadca3dc2ba9e562f84315a69f3114765bc08e88321632843dbd78ba1728f8d1ce54a4edfa3b96a9d13e540aee895ae2d8e2

  • C:\Users\Admin\AppData\Local\Temp\is-NGGDS.tmp\Process Lasso 14.2.0.32.tmp

    Filesize

    907KB

    MD5

    3754a5eb2b26e9b6a89bd0690718351a

    SHA1

    5356815f88cbcc512c74b401c5b1c89f8e950944

    SHA256

    2006b2b4d5eb64722f0bba35380057c9556a7e8bd4bf95b92cd68d84ba255be6

    SHA512

    9ad991d58a60924650523f3e59a02389a7e729fbf73a0b20479c590375f40f041e0a7101604d7305ef8d7a8d57ba53e8823a75aa27441757881c604236ab0bec

  • memory/1916-11-0x0000000000400000-0x00000000004F6000-memory.dmp

    Filesize

    984KB

  • memory/1916-17-0x0000000007270000-0x0000000007286000-memory.dmp

    Filesize

    88KB

  • memory/1916-23-0x00000000074A0000-0x00000000077BA000-memory.dmp

    Filesize

    3.1MB

  • memory/1916-30-0x00000000077C0000-0x0000000007900000-memory.dmp

    Filesize

    1.2MB

  • memory/1916-34-0x0000000007940000-0x0000000007941000-memory.dmp

    Filesize

    4KB

  • memory/1916-37-0x0000000007950000-0x0000000007951000-memory.dmp

    Filesize

    4KB

  • memory/1916-36-0x00000000077C0000-0x0000000007900000-memory.dmp

    Filesize

    1.2MB

  • memory/1916-35-0x00000000077C0000-0x0000000007900000-memory.dmp

    Filesize

    1.2MB

  • memory/1916-33-0x00000000077C0000-0x0000000007900000-memory.dmp

    Filesize

    1.2MB

  • memory/1916-32-0x00000000077C0000-0x0000000007900000-memory.dmp

    Filesize

    1.2MB

  • memory/1916-31-0x0000000007930000-0x0000000007931000-memory.dmp

    Filesize

    4KB

  • memory/1916-29-0x00000000077C0000-0x0000000007900000-memory.dmp

    Filesize

    1.2MB

  • memory/1916-28-0x0000000007920000-0x0000000007921000-memory.dmp

    Filesize

    4KB

  • memory/1916-27-0x00000000077C0000-0x0000000007900000-memory.dmp

    Filesize

    1.2MB

  • memory/1916-26-0x00000000077C0000-0x0000000007900000-memory.dmp

    Filesize

    1.2MB

  • memory/1916-25-0x0000000007910000-0x0000000007911000-memory.dmp

    Filesize

    4KB

  • memory/1916-42-0x00000000077C0000-0x0000000007900000-memory.dmp

    Filesize

    1.2MB

  • memory/1916-49-0x0000000007990000-0x0000000007991000-memory.dmp

    Filesize

    4KB

  • memory/1916-84-0x00000000077C0000-0x0000000007900000-memory.dmp

    Filesize

    1.2MB

  • memory/1916-83-0x00000000077C0000-0x0000000007900000-memory.dmp

    Filesize

    1.2MB

  • memory/1916-82-0x0000000007A40000-0x0000000007A41000-memory.dmp

    Filesize

    4KB

  • memory/1916-81-0x00000000077C0000-0x0000000007900000-memory.dmp

    Filesize

    1.2MB

  • memory/1916-80-0x00000000077C0000-0x0000000007900000-memory.dmp

    Filesize

    1.2MB

  • memory/1916-79-0x0000000007A30000-0x0000000007A31000-memory.dmp

    Filesize

    4KB

  • memory/1916-78-0x00000000077C0000-0x0000000007900000-memory.dmp

    Filesize

    1.2MB

  • memory/1916-77-0x00000000077C0000-0x0000000007900000-memory.dmp

    Filesize

    1.2MB

  • memory/1916-76-0x0000000007A20000-0x0000000007A21000-memory.dmp

    Filesize

    4KB

  • memory/1916-75-0x00000000077C0000-0x0000000007900000-memory.dmp

    Filesize

    1.2MB

  • memory/1916-74-0x00000000077C0000-0x0000000007900000-memory.dmp

    Filesize

    1.2MB

  • memory/1916-73-0x0000000007A10000-0x0000000007A11000-memory.dmp

    Filesize

    4KB

  • memory/1916-72-0x00000000077C0000-0x0000000007900000-memory.dmp

    Filesize

    1.2MB

  • memory/1916-71-0x00000000077C0000-0x0000000007900000-memory.dmp

    Filesize

    1.2MB

  • memory/1916-70-0x0000000007A00000-0x0000000007A01000-memory.dmp

    Filesize

    4KB

  • memory/1916-69-0x00000000077C0000-0x0000000007900000-memory.dmp

    Filesize

    1.2MB

  • memory/1916-68-0x00000000077C0000-0x0000000007900000-memory.dmp

    Filesize

    1.2MB

  • memory/1916-67-0x00000000079F0000-0x00000000079F1000-memory.dmp

    Filesize

    4KB

  • memory/1916-66-0x00000000077C0000-0x0000000007900000-memory.dmp

    Filesize

    1.2MB

  • memory/1916-65-0x00000000077C0000-0x0000000007900000-memory.dmp

    Filesize

    1.2MB

  • memory/1916-64-0x00000000079E0000-0x00000000079E1000-memory.dmp

    Filesize

    4KB

  • memory/1916-63-0x00000000077C0000-0x0000000007900000-memory.dmp

    Filesize

    1.2MB

  • memory/1916-62-0x00000000077C0000-0x0000000007900000-memory.dmp

    Filesize

    1.2MB

  • memory/1916-61-0x00000000079D0000-0x00000000079D1000-memory.dmp

    Filesize

    4KB

  • memory/1916-60-0x00000000077C0000-0x0000000007900000-memory.dmp

    Filesize

    1.2MB

  • memory/1916-59-0x00000000077C0000-0x0000000007900000-memory.dmp

    Filesize

    1.2MB

  • memory/1916-58-0x00000000079C0000-0x00000000079C1000-memory.dmp

    Filesize

    4KB

  • memory/1916-57-0x00000000077C0000-0x0000000007900000-memory.dmp

    Filesize

    1.2MB

  • memory/1916-56-0x00000000077C0000-0x0000000007900000-memory.dmp

    Filesize

    1.2MB

  • memory/1916-55-0x00000000079B0000-0x00000000079B1000-memory.dmp

    Filesize

    4KB

  • memory/1916-54-0x00000000077C0000-0x0000000007900000-memory.dmp

    Filesize

    1.2MB

  • memory/1916-53-0x00000000077C0000-0x0000000007900000-memory.dmp

    Filesize

    1.2MB

  • memory/1916-52-0x00000000079A0000-0x00000000079A1000-memory.dmp

    Filesize

    4KB

  • memory/1916-50-0x00000000077C0000-0x0000000007900000-memory.dmp

    Filesize

    1.2MB

  • memory/1916-48-0x00000000077C0000-0x0000000007900000-memory.dmp

    Filesize

    1.2MB

  • memory/1916-47-0x00000000077C0000-0x0000000007900000-memory.dmp

    Filesize

    1.2MB

  • memory/1916-46-0x0000000007980000-0x0000000007981000-memory.dmp

    Filesize

    4KB

  • memory/1916-45-0x00000000077C0000-0x0000000007900000-memory.dmp

    Filesize

    1.2MB

  • memory/1916-44-0x00000000077C0000-0x0000000007900000-memory.dmp

    Filesize

    1.2MB

  • memory/1916-43-0x0000000007970000-0x0000000007971000-memory.dmp

    Filesize

    4KB

  • memory/1916-51-0x00000000077C0000-0x0000000007900000-memory.dmp

    Filesize

    1.2MB

  • memory/1916-40-0x0000000007960000-0x0000000007961000-memory.dmp

    Filesize

    4KB

  • memory/1916-39-0x00000000077C0000-0x0000000007900000-memory.dmp

    Filesize

    1.2MB

  • memory/1916-38-0x00000000077C0000-0x0000000007900000-memory.dmp

    Filesize

    1.2MB

  • memory/1916-41-0x00000000077C0000-0x0000000007900000-memory.dmp

    Filesize

    1.2MB

  • memory/1916-88-0x0000000000400000-0x00000000004F6000-memory.dmp

    Filesize

    984KB

  • memory/1916-87-0x0000000000400000-0x00000000004F6000-memory.dmp

    Filesize

    984KB

  • memory/1916-89-0x0000000000400000-0x00000000004F6000-memory.dmp

    Filesize

    984KB

  • memory/1916-90-0x0000000000400000-0x00000000004F6000-memory.dmp

    Filesize

    984KB

  • memory/1916-229-0x0000000000400000-0x00000000004F6000-memory.dmp

    Filesize

    984KB

  • memory/1916-262-0x0000000000400000-0x00000000004F6000-memory.dmp

    Filesize

    984KB

  • memory/4416-0-0x0000000000400000-0x0000000000416000-memory.dmp

    Filesize

    88KB

  • memory/4416-2-0x0000000000401000-0x000000000040B000-memory.dmp

    Filesize

    40KB