Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
136s -
max time network
101s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
17/10/2024, 21:32
Static task
static1
Behavioral task
behavioral1
Sample
lightcord perm.py
Resource
win7-20240903-en
windows7-x64
4 signatures
150 seconds
Behavioral task
behavioral2
Sample
lightcord perm.py
Resource
win10v2004-20241007-en
windows10-2004-x64
8 signatures
150 seconds
General
-
Target
lightcord perm.py
-
Size
11KB
-
MD5
2047a5a0bcf7d92699fe05378166dc13
-
SHA1
192fe9539af2881db82d583cdccab7e0e8d9b645
-
SHA256
55bede2315232f8317d06bd79dc8f05ec90a2e3e0f113fad0ecab9e311ab1c1f
-
SHA512
99b024b2df043f55c505822c690d41e2460189d0ad75b785ed936fcaca55e3b9d39df851db4b84cce4b90cdd1926f7dd397c43c1d3250e69af2b8898e3b9336c
-
SSDEEP
192:vSL3cGrVTgynsBszmBkDCF3R2b2xPbo6COrgEfT5QTIayXDOqTIKNnLwQ:vM3BrFTlCF3Uaho6CgpfDXDH
Score
3/10
Malware Config
Signatures
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 7 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language RdrCEF.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language RdrCEF.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language RdrCEF.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language RdrCEF.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language RdrCEF.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AcroRd32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language RdrCEF.exe -
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 AcroRd32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz AcroRd32.exe -
description ioc Process Key created \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION AcroRd32.exe -
Modifies registry class 11 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000_Classes\Local Settings cmd.exe Key created \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000_Classes\Local Settings OpenWith.exe Key created \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000_Classes\py_auto_file\shell\Read OpenWith.exe Key created \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000_Classes\py_auto_file\shell OpenWith.exe Key created \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000_Classes\py_auto_file\shell\Read\command OpenWith.exe Set value (str) \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000_Classes\py_auto_file\shell\Read\command\ = "\"C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\AcroRd32.exe\" \"%1\"" OpenWith.exe Key created \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000_Classes\.py OpenWith.exe Key created \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000_Classes\py_auto_file OpenWith.exe Set value (str) \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000_Classes\.py\ = "py_auto_file" OpenWith.exe Key created \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000_Classes\㵞℀耀 OpenWith.exe Set value (str) \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000_Classes\㵞℀耀\ = "py_auto_file" OpenWith.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 852 OpenWith.exe -
Suspicious use of SetWindowsHookEx 64 IoCs
pid Process 852 OpenWith.exe 852 OpenWith.exe 852 OpenWith.exe 852 OpenWith.exe 852 OpenWith.exe 852 OpenWith.exe 852 OpenWith.exe 852 OpenWith.exe 852 OpenWith.exe 852 OpenWith.exe 852 OpenWith.exe 852 OpenWith.exe 852 OpenWith.exe 852 OpenWith.exe 852 OpenWith.exe 852 OpenWith.exe 852 OpenWith.exe 852 OpenWith.exe 852 OpenWith.exe 852 OpenWith.exe 852 OpenWith.exe 852 OpenWith.exe 852 OpenWith.exe 852 OpenWith.exe 852 OpenWith.exe 852 OpenWith.exe 852 OpenWith.exe 852 OpenWith.exe 852 OpenWith.exe 852 OpenWith.exe 852 OpenWith.exe 852 OpenWith.exe 852 OpenWith.exe 852 OpenWith.exe 852 OpenWith.exe 852 OpenWith.exe 852 OpenWith.exe 852 OpenWith.exe 852 OpenWith.exe 852 OpenWith.exe 852 OpenWith.exe 852 OpenWith.exe 852 OpenWith.exe 852 OpenWith.exe 852 OpenWith.exe 852 OpenWith.exe 852 OpenWith.exe 852 OpenWith.exe 852 OpenWith.exe 852 OpenWith.exe 852 OpenWith.exe 852 OpenWith.exe 852 OpenWith.exe 852 OpenWith.exe 852 OpenWith.exe 852 OpenWith.exe 852 OpenWith.exe 852 OpenWith.exe 852 OpenWith.exe 852 OpenWith.exe 852 OpenWith.exe 852 OpenWith.exe 852 OpenWith.exe 852 OpenWith.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 852 wrote to memory of 1924 852 OpenWith.exe 101 PID 852 wrote to memory of 1924 852 OpenWith.exe 101 PID 852 wrote to memory of 1924 852 OpenWith.exe 101 PID 1924 wrote to memory of 4084 1924 AcroRd32.exe 105 PID 1924 wrote to memory of 4084 1924 AcroRd32.exe 105 PID 1924 wrote to memory of 4084 1924 AcroRd32.exe 105 PID 4084 wrote to memory of 2544 4084 RdrCEF.exe 106 PID 4084 wrote to memory of 2544 4084 RdrCEF.exe 106 PID 4084 wrote to memory of 2544 4084 RdrCEF.exe 106 PID 4084 wrote to memory of 2544 4084 RdrCEF.exe 106 PID 4084 wrote to memory of 2544 4084 RdrCEF.exe 106 PID 4084 wrote to memory of 2544 4084 RdrCEF.exe 106 PID 4084 wrote to memory of 2544 4084 RdrCEF.exe 106 PID 4084 wrote to memory of 2544 4084 RdrCEF.exe 106 PID 4084 wrote to memory of 2544 4084 RdrCEF.exe 106 PID 4084 wrote to memory of 2544 4084 RdrCEF.exe 106 PID 4084 wrote to memory of 2544 4084 RdrCEF.exe 106 PID 4084 wrote to memory of 2544 4084 RdrCEF.exe 106 PID 4084 wrote to memory of 2544 4084 RdrCEF.exe 106 PID 4084 wrote to memory of 2544 4084 RdrCEF.exe 106 PID 4084 wrote to memory of 2544 4084 RdrCEF.exe 106 PID 4084 wrote to memory of 2544 4084 RdrCEF.exe 106 PID 4084 wrote to memory of 2544 4084 RdrCEF.exe 106 PID 4084 wrote to memory of 2544 4084 RdrCEF.exe 106 PID 4084 wrote to memory of 2544 4084 RdrCEF.exe 106 PID 4084 wrote to memory of 2544 4084 RdrCEF.exe 106 PID 4084 wrote to memory of 2544 4084 RdrCEF.exe 106 PID 4084 wrote to memory of 2544 4084 RdrCEF.exe 106 PID 4084 wrote to memory of 2544 4084 RdrCEF.exe 106 PID 4084 wrote to memory of 2544 4084 RdrCEF.exe 106 PID 4084 wrote to memory of 2544 4084 RdrCEF.exe 106 PID 4084 wrote to memory of 2544 4084 RdrCEF.exe 106 PID 4084 wrote to memory of 2544 4084 RdrCEF.exe 106 PID 4084 wrote to memory of 2544 4084 RdrCEF.exe 106 PID 4084 wrote to memory of 2544 4084 RdrCEF.exe 106 PID 4084 wrote to memory of 2544 4084 RdrCEF.exe 106 PID 4084 wrote to memory of 2544 4084 RdrCEF.exe 106 PID 4084 wrote to memory of 2544 4084 RdrCEF.exe 106 PID 4084 wrote to memory of 2544 4084 RdrCEF.exe 106 PID 4084 wrote to memory of 2544 4084 RdrCEF.exe 106 PID 4084 wrote to memory of 2544 4084 RdrCEF.exe 106 PID 4084 wrote to memory of 2544 4084 RdrCEF.exe 106 PID 4084 wrote to memory of 2544 4084 RdrCEF.exe 106 PID 4084 wrote to memory of 2544 4084 RdrCEF.exe 106 PID 4084 wrote to memory of 2544 4084 RdrCEF.exe 106 PID 4084 wrote to memory of 2544 4084 RdrCEF.exe 106 PID 4084 wrote to memory of 2544 4084 RdrCEF.exe 106 PID 4084 wrote to memory of 3496 4084 RdrCEF.exe 107 PID 4084 wrote to memory of 3496 4084 RdrCEF.exe 107 PID 4084 wrote to memory of 3496 4084 RdrCEF.exe 107 PID 4084 wrote to memory of 3496 4084 RdrCEF.exe 107 PID 4084 wrote to memory of 3496 4084 RdrCEF.exe 107 PID 4084 wrote to memory of 3496 4084 RdrCEF.exe 107 PID 4084 wrote to memory of 3496 4084 RdrCEF.exe 107 PID 4084 wrote to memory of 3496 4084 RdrCEF.exe 107 PID 4084 wrote to memory of 3496 4084 RdrCEF.exe 107 PID 4084 wrote to memory of 3496 4084 RdrCEF.exe 107 PID 4084 wrote to memory of 3496 4084 RdrCEF.exe 107 PID 4084 wrote to memory of 3496 4084 RdrCEF.exe 107 PID 4084 wrote to memory of 3496 4084 RdrCEF.exe 107 PID 4084 wrote to memory of 3496 4084 RdrCEF.exe 107 PID 4084 wrote to memory of 3496 4084 RdrCEF.exe 107 PID 4084 wrote to memory of 3496 4084 RdrCEF.exe 107 PID 4084 wrote to memory of 3496 4084 RdrCEF.exe 107
Processes
-
C:\Windows\system32\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\lightcord perm.py"1⤵
- Modifies registry class
PID:3152
-
C:\Windows\system32\OpenWith.exeC:\Windows\system32\OpenWith.exe -Embedding1⤵
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:852 -
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\lightcord perm.py"2⤵
- System Location Discovery: System Language Discovery
- Checks processor information in registry
- Modifies Internet Explorer settings
- Suspicious use of WriteProcessMemory
PID:1924 -
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --backgroundcolor=165140433⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4084 -
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=7A78B764C7BEAE54993195D2D77C6043 --mojo-platform-channel-handle=1760 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:24⤵
- System Location Discovery: System Language Discovery
PID:2544
-
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=ABCD3FF783CF42A32D54D1DBD4230252 --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=ABCD3FF783CF42A32D54D1DBD4230252 --renderer-client-id=2 --mojo-platform-channel-handle=1768 --allow-no-sandbox-job /prefetch:14⤵
- System Location Discovery: System Language Discovery
PID:3496
-
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=983F6AF1D4F432B51B32A19796DC6D6B --mojo-platform-channel-handle=2332 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:24⤵
- System Location Discovery: System Language Discovery
PID:2036
-
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=23A8E223EA43A203C3C1EAFA365A59E0 --mojo-platform-channel-handle=1796 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:24⤵
- System Location Discovery: System Language Discovery
PID:3692
-
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=409B4DBC2B23F0E679B713E715D57FAC --mojo-platform-channel-handle=2408 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:24⤵
- System Location Discovery: System Language Discovery
PID:2892
-
-
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:4904