Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
143s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
24/09/2024, 12:23
Static task
static1
Behavioral task
behavioral1
Sample
PO-A1702108.exe
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
PO-A1702108.exe
Resource
win10v2004-20240802-en
General
-
Target
PO-A1702108.exe
-
Size
1.2MB
-
MD5
514233f0589be5d977a1ee164fe8db1d
-
SHA1
bf713daec188be3a005e1a2097b4f5cb68ccc222
-
SHA256
6abd474c86db77c6943522762f5658eb58c523bb84d68fcc6495a2cbbff72e9e
-
SHA512
6f5b4d6175b593e2d287d25369dfdbba7bca44ea487ad7e7d39628670480eb63f8795f6ef56478d215b5f05ef76d74af26fe184d2d434416b657d1ba694b3261
-
SSDEEP
24576:uRmJkcoQricOIQxiZY1iaCbLRWEjIQeK88hCPbkfX6Jp:7JZoQrbTFZY1iaCbNkQN8SPap
Malware Config
Signatures
-
Drops startup file 1 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\lards.vbs lards.exe -
Executes dropped EXE 4 IoCs
pid Process 2248 lards.exe 1608 lards.exe 1600 lards.exe 1612 lards.exe -
AutoIT Executable 1 IoCs
AutoIT scripts compiled to PE executables.
resource yara_rule behavioral2/files/0x000700000002360b-5.dat autoit_exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Program crash 1 IoCs
pid pid_target Process procid_target 688 1612 WerFault.exe 95 -
System Location Discovery: System Language Discovery 1 TTPs 5 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language PO-A1702108.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lards.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lards.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lards.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lards.exe -
Suspicious behavior: MapViewOfSection 3 IoCs
pid Process 2248 lards.exe 1608 lards.exe 1600 lards.exe -
Suspicious use of FindShellTrayWindow 10 IoCs
pid Process 4564 PO-A1702108.exe 4564 PO-A1702108.exe 2248 lards.exe 2248 lards.exe 1608 lards.exe 1608 lards.exe 1600 lards.exe 1600 lards.exe 1612 lards.exe 1612 lards.exe -
Suspicious use of SendNotifyMessage 10 IoCs
pid Process 4564 PO-A1702108.exe 4564 PO-A1702108.exe 2248 lards.exe 2248 lards.exe 1608 lards.exe 1608 lards.exe 1600 lards.exe 1600 lards.exe 1612 lards.exe 1612 lards.exe -
Suspicious use of WriteProcessMemory 24 IoCs
description pid Process procid_target PID 4564 wrote to memory of 2248 4564 PO-A1702108.exe 89 PID 4564 wrote to memory of 2248 4564 PO-A1702108.exe 89 PID 4564 wrote to memory of 2248 4564 PO-A1702108.exe 89 PID 2248 wrote to memory of 4568 2248 lards.exe 90 PID 2248 wrote to memory of 4568 2248 lards.exe 90 PID 2248 wrote to memory of 4568 2248 lards.exe 90 PID 2248 wrote to memory of 1608 2248 lards.exe 91 PID 2248 wrote to memory of 1608 2248 lards.exe 91 PID 2248 wrote to memory of 1608 2248 lards.exe 91 PID 1608 wrote to memory of 1444 1608 lards.exe 92 PID 1608 wrote to memory of 1444 1608 lards.exe 92 PID 1608 wrote to memory of 1444 1608 lards.exe 92 PID 1608 wrote to memory of 1600 1608 lards.exe 93 PID 1608 wrote to memory of 1600 1608 lards.exe 93 PID 1608 wrote to memory of 1600 1608 lards.exe 93 PID 1600 wrote to memory of 3984 1600 lards.exe 94 PID 1600 wrote to memory of 3984 1600 lards.exe 94 PID 1600 wrote to memory of 3984 1600 lards.exe 94 PID 1600 wrote to memory of 1612 1600 lards.exe 95 PID 1600 wrote to memory of 1612 1600 lards.exe 95 PID 1600 wrote to memory of 1612 1600 lards.exe 95 PID 1612 wrote to memory of 4816 1612 lards.exe 97 PID 1612 wrote to memory of 4816 1612 lards.exe 97 PID 1612 wrote to memory of 4816 1612 lards.exe 97
Processes
-
C:\Users\Admin\AppData\Local\Temp\PO-A1702108.exe"C:\Users\Admin\AppData\Local\Temp\PO-A1702108.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4564 -
C:\Users\Admin\AppData\Local\hypopygidium\lards.exe"C:\Users\Admin\AppData\Local\Temp\PO-A1702108.exe"2⤵
- Drops startup file
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: MapViewOfSection
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2248 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"C:\Users\Admin\AppData\Local\Temp\PO-A1702108.exe"3⤵PID:4568
-
-
C:\Users\Admin\AppData\Local\hypopygidium\lards.exe"C:\Users\Admin\AppData\Local\hypopygidium\lards.exe"3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: MapViewOfSection
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1608 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"C:\Users\Admin\AppData\Local\hypopygidium\lards.exe"4⤵PID:1444
-
-
C:\Users\Admin\AppData\Local\hypopygidium\lards.exe"C:\Users\Admin\AppData\Local\hypopygidium\lards.exe"4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: MapViewOfSection
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1600 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"C:\Users\Admin\AppData\Local\hypopygidium\lards.exe"5⤵PID:3984
-
-
C:\Users\Admin\AppData\Local\hypopygidium\lards.exe"C:\Users\Admin\AppData\Local\hypopygidium\lards.exe"5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1612 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"C:\Users\Admin\AppData\Local\hypopygidium\lards.exe"6⤵PID:4816
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1612 -s 7206⤵
- Program crash
PID:688
-
-
-
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --field-trial-handle=1012,i,3861745594156495651,17595114179815238301,262144 --variations-seed-version --mojo-platform-channel-handle=4376 /prefetch:81⤵PID:5060
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 376 -p 1612 -ip 16121⤵PID:992
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
262KB
MD5b5fea9f65e26ee8f5d17ed6a9df5ccde
SHA119a115e780e7a7fce55ac3ab082b67c01d0fae1f
SHA256fc719699e640f78cbf469a5ffc73a1c0c68b9d580a4d850a30a4f46ea7e7e8b0
SHA5125a09eb1bac3d63feb8e95e660aee06a9fc49b96aa40b4f8a166cb206f0ad8b5869166fd9855dbe156bafce55ba662b2810ba4f6e0a0e35599974fcefc6df4405
-
Filesize
1.2MB
MD5514233f0589be5d977a1ee164fe8db1d
SHA1bf713daec188be3a005e1a2097b4f5cb68ccc222
SHA2566abd474c86db77c6943522762f5658eb58c523bb84d68fcc6495a2cbbff72e9e
SHA5126f5b4d6175b593e2d287d25369dfdbba7bca44ea487ad7e7d39628670480eb63f8795f6ef56478d215b5f05ef76d74af26fe184d2d434416b657d1ba694b3261