Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    150s
  • max time network
    139s
  • platform
    windows10-1703_x64
  • resource
    win10-20220812-en
  • resource tags

    arch:x64arch:x86image:win10-20220812-enlocale:en-usos:windows10-1703-x64system
  • submitted
    13/09/2022, 20:58

General

  • Target

    94d302551641932538799ac5623bcdcf82fced9e1299722e8ca2a597ab866115.exe

  • Size

    717KB

  • MD5

    486cacff0b62fdab36928cd5f640f2ec

  • SHA1

    8fac5cdc97ba17aed38d5a8d3c0843b04bb7a996

  • SHA256

    94d302551641932538799ac5623bcdcf82fced9e1299722e8ca2a597ab866115

  • SHA512

    917c5a3c2b139fa8891024b9c04106b73ed2fddc9f6979216d2142154a342098ab86dd361c996c352434acd67c469cfeb72a162583acccd47acdcd042f2b910d

  • SSDEEP

    768:rZmchlXKGREW6VA6joSRhFH+C9Pe2auEqainmngYWxuv8Gwmwoe9R4ZstojtfcWv:schl6M+lpDCUoHid0bIrlyR

Score
8/10

Malware Config

Signatures

  • Downloads MZ/PE file
  • Executes dropped EXE 1 IoCs
  • Adds Run key to start application 2 TTPs 9 IoCs
  • Legitimate hosting services abused for malware hosting/C2 1 TTPs
  • Creates scheduled task(s) 1 TTPs 5 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 4 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\94d302551641932538799ac5623bcdcf82fced9e1299722e8ca2a597ab866115.exe
    "C:\Users\Admin\AppData\Local\Temp\94d302551641932538799ac5623bcdcf82fced9e1299722e8ca2a597ab866115.exe"
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:2100
    • C:\Windows\SysWOW64\cmd.exe
      "cmd.exe" /C chcp 1251 & powershell -Command Add-MpPreference -ExclusionPath "$ENV:USERPROFILE\Desktop" & powershell -Command Add-MpPreference -ExclusionPath "C:\ProgramData\Dllhost" & powershell -Command Add-MpPreference -ExclusionPath "C:\ProgramData\HostData"
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:4848
      • C:\Windows\SysWOW64\chcp.com
        chcp 1251
        3⤵
          PID:1388
        • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
          powershell -Command Add-MpPreference -ExclusionPath "$ENV:USERPROFILE\Desktop"
          3⤵
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:4080
        • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
          powershell -Command Add-MpPreference -ExclusionPath "C:\ProgramData\Dllhost"
          3⤵
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:1832
      • C:\ProgramData\Dllhost\dllhost.exe
        "C:\ProgramData\Dllhost\dllhost.exe"
        2⤵
        • Executes dropped EXE
        • Adds Run key to start application
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:5084
        • C:\Windows\SysWOW64\cmd.exe
          "cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "SecurityHealthSystray" /TR "C:\ProgramData\Dllhost\dllhost.exe"
          3⤵
          • Suspicious use of WriteProcessMemory
          PID:4636
          • C:\Windows\SysWOW64\schtasks.exe
            SCHTASKS /CREATE /SC HOURLY /TN "SecurityHealthSystray" /TR "C:\ProgramData\Dllhost\dllhost.exe"
            4⤵
            • Creates scheduled task(s)
            PID:2216
        • C:\Windows\SysWOW64\cmd.exe
          "cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "WindowsDefender" /TR "C:\ProgramData\Dllhost\dllhost.exe"
          3⤵
          • Suspicious use of WriteProcessMemory
          PID:3452
          • C:\Windows\SysWOW64\schtasks.exe
            SCHTASKS /CREATE /SC HOURLY /TN "WindowsDefender" /TR "C:\ProgramData\Dllhost\dllhost.exe"
            4⤵
            • Creates scheduled task(s)
            PID:4500
        • C:\Windows\SysWOW64\cmd.exe
          "cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "WmiPrvSE" /TR "C:\ProgramData\Dllhost\dllhost.exe"
          3⤵
            PID:4292
          • C:\Windows\SysWOW64\cmd.exe
            "cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "AntiMalwareServiceExecutable" /TR "C:\ProgramData\Dllhost\dllhost.exe"
            3⤵
            • Suspicious use of WriteProcessMemory
            PID:4300
            • C:\Windows\SysWOW64\schtasks.exe
              SCHTASKS /CREATE /SC HOURLY /TN "AntiMalwareServiceExecutable" /TR "C:\ProgramData\Dllhost\dllhost.exe"
              4⤵
              • Creates scheduled task(s)
              PID:4368
          • C:\Windows\SysWOW64\cmd.exe
            "cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "dllhost" /TR "C:\ProgramData\Dllhost\dllhost.exe"
            3⤵
              PID:5076
            • C:\Windows\SysWOW64\cmd.exe
              "cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "MicrosoftEdgeUpd" /TR "C:\ProgramData\Dllhost\dllhost.exe"
              3⤵
              • Suspicious use of WriteProcessMemory
              PID:3196
              • C:\Windows\SysWOW64\schtasks.exe
                SCHTASKS /CREATE /SC HOURLY /TN "MicrosoftEdgeUpd" /TR "C:\ProgramData\Dllhost\dllhost.exe"
                4⤵
                • Creates scheduled task(s)
                PID:2276
            • C:\Windows\SysWOW64\cmd.exe
              "cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "OneDriveService" /TR "C:\ProgramData\Dllhost\dllhost.exe"
              3⤵
                PID:4488
              • C:\Windows\SysWOW64\cmd.exe
                "cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "MicrosoftUpdateServices\MicrosoftUpdateServicesService_bk5266" /TR "C:\ProgramData\Dllhost\dllhost.exe"
                3⤵
                  PID:2124
                • C:\Windows\SysWOW64\cmd.exe
                  "cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "AntiMalwareSericeExecutable\AntiMalwareSericeExecutableService_bk990" /TR "C:\ProgramData\Dllhost\dllhost.exe"
                  3⤵
                  • Suspicious use of WriteProcessMemory
                  PID:3948
                  • C:\Windows\SysWOW64\schtasks.exe
                    SCHTASKS /CREATE /SC HOURLY /TN "AntiMalwareSericeExecutable\AntiMalwareSericeExecutableService_bk990" /TR "C:\ProgramData\Dllhost\dllhost.exe"
                    4⤵
                    • Creates scheduled task(s)
                    PID:1488
                • C:\Windows\SysWOW64\cmd.exe
                  "cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "WindowsDefenderServices\WindowsDefenderServicesService_bk1379" /TR "C:\ProgramData\Dllhost\dllhost.exe"
                  3⤵
                    PID:4912
                  • C:\Windows\SysWOW64\cmd.exe
                    "cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "NvStray" /TR "C:\ProgramData\Dllhost\dllhost.exe"
                    3⤵
                      PID:5096
                    • C:\Windows\SysWOW64\cmd.exe
                      "cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "SettingSysHost\SettingSysHostService_bk7076" /TR "C:\ProgramData\Dllhost\dllhost.exe"
                      3⤵
                        PID:4684
                      • C:\Windows\SysWOW64\cmd.exe
                        "cmd.exe" /c chcp 1251 & C:\ProgramData\Dllhost\winlogson.exe --config msi.bin --log off
                        3⤵
                          PID:3876
                          • C:\Windows\SysWOW64\chcp.com
                            chcp 1251
                            4⤵
                              PID:2316
                          • C:\Windows\SysWOW64\cmd.exe
                            "cmd.exe" /c chcp 1251 & C:\ProgramData\Dllhost\winlogson.exe --config msi.bin --log off
                            3⤵
                              PID:3952
                              • C:\Windows\SysWOW64\chcp.com
                                chcp 1251
                                4⤵
                                  PID:356

                          Network

                          MITRE ATT&CK Enterprise v6

                          Replay Monitor

                          Loading Replay Monitor...

                          Downloads

                          • C:\ProgramData\Dllhost\dllhost.exe

                            Filesize

                            894KB

                            MD5

                            0440b14b8b65d8108a010e67d2c15ccb

                            SHA1

                            169d9e1869acf2f3eed3ff3008eb9a08ed698418

                            SHA256

                            55fcb226dfd05bd377ceab7476e9f605db568687c594e24af212a4290c0e557b

                            SHA512

                            321a0b59826b08e4749b6cfc1edf17bd050d295d88ca72d66e69d414cd63bd620b17baabeca631ccfa0eeac69bf87a3b0f59e3303d4bd72fab1ecee279621771

                          • C:\ProgramData\Dllhost\dllhost.exe

                            Filesize

                            894KB

                            MD5

                            0440b14b8b65d8108a010e67d2c15ccb

                            SHA1

                            169d9e1869acf2f3eed3ff3008eb9a08ed698418

                            SHA256

                            55fcb226dfd05bd377ceab7476e9f605db568687c594e24af212a4290c0e557b

                            SHA512

                            321a0b59826b08e4749b6cfc1edf17bd050d295d88ca72d66e69d414cd63bd620b17baabeca631ccfa0eeac69bf87a3b0f59e3303d4bd72fab1ecee279621771

                          • C:\ProgramData\HostData\logs.uce

                            Filesize

                            497B

                            MD5

                            13fda2ab01b83a5130842a5bab3892d3

                            SHA1

                            6e18e4b467cde054a63a95d4dfc030f156ecd215

                            SHA256

                            76973d42c8fceceab7ec85b3d01b218db92564993e93a9bea31c52aa73aeee9e

                            SHA512

                            c51f9fd6e452fbeeedd4dfaba3c7c887e337f01e68abdd27d4032f8be85def7ef3cf0c77bf60e425b085b76c0539464c6b6e5e805a69397c5519e8ccf9fffccc

                          • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log

                            Filesize

                            2KB

                            MD5

                            db01a2c1c7e70b2b038edf8ad5ad9826

                            SHA1

                            540217c647a73bad8d8a79e3a0f3998b5abd199b

                            SHA256

                            413da361d77055dae7007f82b58b366c8783aa72e0b8fbe41519b940c253b38d

                            SHA512

                            c76ff57fcee5cdf9fdf3116d4e1dc0cf106867bf19ab474b763e242acf5dca9a7509cb837c35e130c3e056636b4e8a4e135512a978bcd3dd641e20f5bf76c3d6

                          • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                            Filesize

                            18KB

                            MD5

                            03eb18a7e1e2c80195de3dbd5569f312

                            SHA1

                            bcfefd6af3822815c439ea967539e222b69ecddc

                            SHA256

                            e9d24ee3a1239bb1c67d840235181742890561b885e98f04ac3f9de615f6a4fe

                            SHA512

                            3722d9a2dac4967cf923220fc513cd86148803053a16ccaf4990bc7940fba7bdd530da4fa1a4e5ad45da925f162379e2b8715ddb90fe599713355d7bd48dd648

                          • memory/1388-187-0x00000000776D0000-0x000000007785E000-memory.dmp

                            Filesize

                            1.6MB

                          • memory/1388-188-0x00000000776D0000-0x000000007785E000-memory.dmp

                            Filesize

                            1.6MB

                          • memory/1388-189-0x00000000776D0000-0x000000007785E000-memory.dmp

                            Filesize

                            1.6MB

                          • memory/1388-186-0x00000000776D0000-0x000000007785E000-memory.dmp

                            Filesize

                            1.6MB

                          • memory/1388-185-0x00000000776D0000-0x000000007785E000-memory.dmp

                            Filesize

                            1.6MB

                          • memory/1388-184-0x00000000776D0000-0x000000007785E000-memory.dmp

                            Filesize

                            1.6MB

                          • memory/1388-183-0x00000000776D0000-0x000000007785E000-memory.dmp

                            Filesize

                            1.6MB

                          • memory/2100-140-0x00000000776D0000-0x000000007785E000-memory.dmp

                            Filesize

                            1.6MB

                          • memory/2100-169-0x00000000776D0000-0x000000007785E000-memory.dmp

                            Filesize

                            1.6MB

                          • memory/2100-137-0x00000000776D0000-0x000000007785E000-memory.dmp

                            Filesize

                            1.6MB

                          • memory/2100-139-0x00000000776D0000-0x000000007785E000-memory.dmp

                            Filesize

                            1.6MB

                          • memory/2100-120-0x00000000776D0000-0x000000007785E000-memory.dmp

                            Filesize

                            1.6MB

                          • memory/2100-141-0x00000000776D0000-0x000000007785E000-memory.dmp

                            Filesize

                            1.6MB

                          • memory/2100-142-0x00000000776D0000-0x000000007785E000-memory.dmp

                            Filesize

                            1.6MB

                          • memory/2100-143-0x00000000776D0000-0x000000007785E000-memory.dmp

                            Filesize

                            1.6MB

                          • memory/2100-144-0x00000000776D0000-0x000000007785E000-memory.dmp

                            Filesize

                            1.6MB

                          • memory/2100-145-0x00000000776D0000-0x000000007785E000-memory.dmp

                            Filesize

                            1.6MB

                          • memory/2100-146-0x00000000776D0000-0x000000007785E000-memory.dmp

                            Filesize

                            1.6MB

                          • memory/2100-147-0x00000000776D0000-0x000000007785E000-memory.dmp

                            Filesize

                            1.6MB

                          • memory/2100-148-0x00000000776D0000-0x000000007785E000-memory.dmp

                            Filesize

                            1.6MB

                          • memory/2100-149-0x00000000776D0000-0x000000007785E000-memory.dmp

                            Filesize

                            1.6MB

                          • memory/2100-150-0x00000000776D0000-0x000000007785E000-memory.dmp

                            Filesize

                            1.6MB

                          • memory/2100-151-0x00000000776D0000-0x000000007785E000-memory.dmp

                            Filesize

                            1.6MB

                          • memory/2100-152-0x00000000776D0000-0x000000007785E000-memory.dmp

                            Filesize

                            1.6MB

                          • memory/2100-153-0x00000000007F0000-0x0000000000898000-memory.dmp

                            Filesize

                            672KB

                          • memory/2100-154-0x00000000776D0000-0x000000007785E000-memory.dmp

                            Filesize

                            1.6MB

                          • memory/2100-155-0x00000000776D0000-0x000000007785E000-memory.dmp

                            Filesize

                            1.6MB

                          • memory/2100-156-0x00000000776D0000-0x000000007785E000-memory.dmp

                            Filesize

                            1.6MB

                          • memory/2100-157-0x0000000005780000-0x0000000005C7E000-memory.dmp

                            Filesize

                            5.0MB

                          • memory/2100-158-0x0000000005160000-0x00000000051F2000-memory.dmp

                            Filesize

                            584KB

                          • memory/2100-159-0x00000000776D0000-0x000000007785E000-memory.dmp

                            Filesize

                            1.6MB

                          • memory/2100-160-0x00000000776D0000-0x000000007785E000-memory.dmp

                            Filesize

                            1.6MB

                          • memory/2100-161-0x00000000776D0000-0x000000007785E000-memory.dmp

                            Filesize

                            1.6MB

                          • memory/2100-162-0x00000000776D0000-0x000000007785E000-memory.dmp

                            Filesize

                            1.6MB

                          • memory/2100-163-0x00000000776D0000-0x000000007785E000-memory.dmp

                            Filesize

                            1.6MB

                          • memory/2100-164-0x00000000776D0000-0x000000007785E000-memory.dmp

                            Filesize

                            1.6MB

                          • memory/2100-165-0x00000000776D0000-0x000000007785E000-memory.dmp

                            Filesize

                            1.6MB

                          • memory/2100-166-0x00000000776D0000-0x000000007785E000-memory.dmp

                            Filesize

                            1.6MB

                          • memory/2100-167-0x00000000776D0000-0x000000007785E000-memory.dmp

                            Filesize

                            1.6MB

                          • memory/2100-168-0x00000000776D0000-0x000000007785E000-memory.dmp

                            Filesize

                            1.6MB

                          • memory/2100-138-0x00000000776D0000-0x000000007785E000-memory.dmp

                            Filesize

                            1.6MB

                          • memory/2100-170-0x00000000776D0000-0x000000007785E000-memory.dmp

                            Filesize

                            1.6MB

                          • memory/2100-171-0x00000000776D0000-0x000000007785E000-memory.dmp

                            Filesize

                            1.6MB

                          • memory/2100-172-0x00000000776D0000-0x000000007785E000-memory.dmp

                            Filesize

                            1.6MB

                          • memory/2100-173-0x00000000776D0000-0x000000007785E000-memory.dmp

                            Filesize

                            1.6MB

                          • memory/2100-174-0x00000000050D0000-0x00000000050DA000-memory.dmp

                            Filesize

                            40KB

                          • memory/2100-175-0x0000000005200000-0x0000000005266000-memory.dmp

                            Filesize

                            408KB

                          • memory/2100-136-0x00000000776D0000-0x000000007785E000-memory.dmp

                            Filesize

                            1.6MB

                          • memory/2100-121-0x00000000776D0000-0x000000007785E000-memory.dmp

                            Filesize

                            1.6MB

                          • memory/2100-122-0x00000000776D0000-0x000000007785E000-memory.dmp

                            Filesize

                            1.6MB

                          • memory/2100-123-0x00000000776D0000-0x000000007785E000-memory.dmp

                            Filesize

                            1.6MB

                          • memory/2100-135-0x00000000776D0000-0x000000007785E000-memory.dmp

                            Filesize

                            1.6MB

                          • memory/2100-134-0x00000000776D0000-0x000000007785E000-memory.dmp

                            Filesize

                            1.6MB

                          • memory/2100-133-0x00000000776D0000-0x000000007785E000-memory.dmp

                            Filesize

                            1.6MB

                          • memory/2100-132-0x00000000776D0000-0x000000007785E000-memory.dmp

                            Filesize

                            1.6MB

                          • memory/2100-131-0x00000000776D0000-0x000000007785E000-memory.dmp

                            Filesize

                            1.6MB

                          • memory/2100-130-0x00000000776D0000-0x000000007785E000-memory.dmp

                            Filesize

                            1.6MB

                          • memory/2100-129-0x00000000776D0000-0x000000007785E000-memory.dmp

                            Filesize

                            1.6MB

                          • memory/2100-128-0x00000000776D0000-0x000000007785E000-memory.dmp

                            Filesize

                            1.6MB

                          • memory/2100-127-0x00000000776D0000-0x000000007785E000-memory.dmp

                            Filesize

                            1.6MB

                          • memory/2100-126-0x00000000776D0000-0x000000007785E000-memory.dmp

                            Filesize

                            1.6MB

                          • memory/2100-124-0x00000000776D0000-0x000000007785E000-memory.dmp

                            Filesize

                            1.6MB

                          • memory/2100-125-0x00000000776D0000-0x000000007785E000-memory.dmp

                            Filesize

                            1.6MB

                          • memory/4080-505-0x0000000006E50000-0x0000000006E6A000-memory.dmp

                            Filesize

                            104KB

                          • memory/4080-261-0x0000000007850000-0x0000000007872000-memory.dmp

                            Filesize

                            136KB

                          • memory/4080-302-0x00000000096F0000-0x0000000009784000-memory.dmp

                            Filesize

                            592KB

                          • memory/4080-289-0x0000000009360000-0x000000000937E000-memory.dmp

                            Filesize

                            120KB

                          • memory/4080-510-0x0000000006E40000-0x0000000006E48000-memory.dmp

                            Filesize

                            32KB

                          • memory/4080-288-0x00000000093A0000-0x00000000093D3000-memory.dmp

                            Filesize

                            204KB

                          • memory/4080-275-0x0000000008380000-0x00000000083F6000-memory.dmp

                            Filesize

                            472KB

                          • memory/4080-271-0x0000000007FE0000-0x000000000802B000-memory.dmp

                            Filesize

                            300KB

                          • memory/4080-270-0x0000000007FC0000-0x0000000007FDC000-memory.dmp

                            Filesize

                            112KB

                          • memory/4080-267-0x0000000007BB0000-0x0000000007F00000-memory.dmp

                            Filesize

                            3.3MB

                          • memory/4080-191-0x00000000776D0000-0x000000007785E000-memory.dmp

                            Filesize

                            1.6MB

                          • memory/4080-263-0x0000000007900000-0x0000000007966000-memory.dmp

                            Filesize

                            408KB

                          • memory/4080-226-0x0000000006B60000-0x0000000006B96000-memory.dmp

                            Filesize

                            216KB

                          • memory/4080-231-0x0000000007220000-0x0000000007848000-memory.dmp

                            Filesize

                            6.2MB

                          • memory/4080-298-0x00000000093E0000-0x0000000009485000-memory.dmp

                            Filesize

                            660KB

                          • memory/4848-181-0x00000000776D0000-0x000000007785E000-memory.dmp

                            Filesize

                            1.6MB

                          • memory/4848-180-0x00000000776D0000-0x000000007785E000-memory.dmp

                            Filesize

                            1.6MB

                          • memory/4848-179-0x00000000776D0000-0x000000007785E000-memory.dmp

                            Filesize

                            1.6MB

                          • memory/4848-178-0x00000000776D0000-0x000000007785E000-memory.dmp

                            Filesize

                            1.6MB

                          • memory/4848-177-0x00000000776D0000-0x000000007785E000-memory.dmp

                            Filesize

                            1.6MB

                          • memory/5084-641-0x00000000009D0000-0x0000000000A80000-memory.dmp

                            Filesize

                            704KB