Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    150s
  • max time network
    145s
  • platform
    windows10-1703_x64
  • resource
    win10-20220812-en
  • resource tags

    arch:x64arch:x86image:win10-20220812-enlocale:en-usos:windows10-1703-x64system
  • submitted
    22/09/2022, 10:43

General

  • Target

    42738b25ab8ec34a94366e52fcb5ef8ffcc1cb3db9fef55ae3ce54276ed32081.exe

  • Size

    723KB

  • MD5

    aa3c79bcf7df40db8c880600624583ed

  • SHA1

    1e62159655afa8918e12f9af8a160419543c996e

  • SHA256

    42738b25ab8ec34a94366e52fcb5ef8ffcc1cb3db9fef55ae3ce54276ed32081

  • SHA512

    dfb2e625ee3faca02a0d3a82f810183439dc45c165824949a865778975053ede7553a10f42ac9edea979a38b594e9ba90c8e4580b9a362cd386efea2adeecc40

  • SSDEEP

    768:rZmchlXKGREW6VA6joSRhFH+C9Pe2auEqainmngYWxuv8Gwmwoe9R4ZstojtfcWv:schl6M+lpDCUoHid0bIrlyR

Score
8/10

Malware Config

Signatures

  • Downloads MZ/PE file
  • Executes dropped EXE 1 IoCs
  • Adds Run key to start application 2 TTPs 9 IoCs
  • Legitimate hosting services abused for malware hosting/C2 1 TTPs
  • Creates scheduled task(s) 1 TTPs 4 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 4 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\42738b25ab8ec34a94366e52fcb5ef8ffcc1cb3db9fef55ae3ce54276ed32081.exe
    "C:\Users\Admin\AppData\Local\Temp\42738b25ab8ec34a94366e52fcb5ef8ffcc1cb3db9fef55ae3ce54276ed32081.exe"
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:1748
    • C:\Windows\SysWOW64\cmd.exe
      "cmd.exe" /C chcp 1251 & powershell -Command Add-MpPreference -ExclusionPath "$ENV:USERPROFILE\Desktop" & powershell -Command Add-MpPreference -ExclusionPath "C:\ProgramData\Dllhost" & powershell -Command Add-MpPreference -ExclusionPath "C:\ProgramData\HostData"
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:3412
      • C:\Windows\SysWOW64\chcp.com
        chcp 1251
        3⤵
          PID:4528
        • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
          powershell -Command Add-MpPreference -ExclusionPath "$ENV:USERPROFILE\Desktop"
          3⤵
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:5012
        • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
          powershell -Command Add-MpPreference -ExclusionPath "C:\ProgramData\Dllhost"
          3⤵
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:1544
      • C:\ProgramData\Dllhost\dllhost.exe
        "C:\ProgramData\Dllhost\dllhost.exe"
        2⤵
        • Executes dropped EXE
        • Adds Run key to start application
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:4752
        • C:\Windows\SysWOW64\cmd.exe
          "cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "SecurityHealthSystray" /TR "C:\ProgramData\Dllhost\dllhost.exe"
          3⤵
          • Suspicious use of WriteProcessMemory
          PID:3540
          • C:\Windows\SysWOW64\schtasks.exe
            SCHTASKS /CREATE /SC HOURLY /TN "SecurityHealthSystray" /TR "C:\ProgramData\Dllhost\dllhost.exe"
            4⤵
            • Creates scheduled task(s)
            PID:1984
        • C:\Windows\SysWOW64\cmd.exe
          "cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "WindowsDefender" /TR "C:\ProgramData\Dllhost\dllhost.exe"
          3⤵
            PID:4244
          • C:\Windows\SysWOW64\cmd.exe
            "cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "AntiMalwareServiceExecutable" /TR "C:\ProgramData\Dllhost\dllhost.exe"
            3⤵
              PID:4824
            • C:\Windows\SysWOW64\cmd.exe
              "cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "WmiPrvSE" /TR "C:\ProgramData\Dllhost\dllhost.exe"
              3⤵
                PID:3444
              • C:\Windows\SysWOW64\cmd.exe
                "cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "NvStray" /TR "C:\ProgramData\Dllhost\dllhost.exe"
                3⤵
                  PID:4988
                • C:\Windows\SysWOW64\cmd.exe
                  "cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "OneDriveService" /TR "C:\ProgramData\Dllhost\dllhost.exe"
                  3⤵
                    PID:3896
                  • C:\Windows\SysWOW64\cmd.exe
                    "cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "MicrosoftEdgeUpd" /TR "C:\ProgramData\Dllhost\dllhost.exe"
                    3⤵
                    • Suspicious use of WriteProcessMemory
                    PID:3104
                    • C:\Windows\SysWOW64\schtasks.exe
                      SCHTASKS /CREATE /SC HOURLY /TN "MicrosoftEdgeUpd" /TR "C:\ProgramData\Dllhost\dllhost.exe"
                      4⤵
                      • Creates scheduled task(s)
                      PID:3216
                  • C:\Windows\SysWOW64\cmd.exe
                    "cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "dllhost" /TR "C:\ProgramData\Dllhost\dllhost.exe"
                    3⤵
                    • Suspicious use of WriteProcessMemory
                    PID:4948
                    • C:\Windows\SysWOW64\schtasks.exe
                      SCHTASKS /CREATE /SC HOURLY /TN "dllhost" /TR "C:\ProgramData\Dllhost\dllhost.exe"
                      4⤵
                      • Creates scheduled task(s)
                      PID:220
                  • C:\Windows\SysWOW64\cmd.exe
                    "cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "WindowsDefenderServices\WindowsDefenderServicesService_bk2567" /TR "C:\ProgramData\Dllhost\dllhost.exe"
                    3⤵
                      PID:5004
                    • C:\Windows\SysWOW64\cmd.exe
                      "cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "MicrosoftUpdateServices\MicrosoftUpdateServicesService_bk2254" /TR "C:\ProgramData\Dllhost\dllhost.exe"
                      3⤵
                        PID:4460
                      • C:\Windows\SysWOW64\cmd.exe
                        "cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "SettingSysHost\SettingSysHostService_bk644" /TR "C:\ProgramData\Dllhost\dllhost.exe"
                        3⤵
                          PID:3880
                        • C:\Windows\SysWOW64\cmd.exe
                          "cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "AntiMalwareSericeExecutable\AntiMalwareSericeExecutableService_bk3869" /TR "C:\ProgramData\Dllhost\dllhost.exe"
                          3⤵
                          • Suspicious use of WriteProcessMemory
                          PID:4148
                          • C:\Windows\SysWOW64\schtasks.exe
                            SCHTASKS /CREATE /SC HOURLY /TN "AntiMalwareSericeExecutable\AntiMalwareSericeExecutableService_bk3869" /TR "C:\ProgramData\Dllhost\dllhost.exe"
                            4⤵
                            • Creates scheduled task(s)
                            PID:3876
                        • C:\Windows\SysWOW64\cmd.exe
                          "cmd.exe" /c chcp 1251 & C:\ProgramData\Dllhost\winlogson.exe --config msi.bin --log off
                          3⤵
                            PID:4604
                            • C:\Windows\SysWOW64\chcp.com
                              chcp 1251
                              4⤵
                                PID:4344
                            • C:\Windows\SysWOW64\cmd.exe
                              "cmd.exe" /c chcp 1251 & C:\ProgramData\Dllhost\winlogson.exe --config msi.bin --log off
                              3⤵
                                PID:4524
                                • C:\Windows\SysWOW64\chcp.com
                                  chcp 1251
                                  4⤵
                                    PID:588

                            Network

                            MITRE ATT&CK Enterprise v6

                            Replay Monitor

                            Loading Replay Monitor...

                            Downloads

                            • C:\ProgramData\Dllhost\dllhost.exe

                              Filesize

                              915KB

                              MD5

                              21fb723594386c2fd180395455f7d61c

                              SHA1

                              bbbe7845deeaf3cb7f6471e59931b98469023321

                              SHA256

                              8a1e66d8c23a8a7c15a6e1bc1cdcbcbafcf5703a6f75d9cfcb8fc9741dc53f4e

                              SHA512

                              270c57f51ac2ec76f44a32623466d0bc1cba514b30f940bc1f758f3e90580dc379c790157502d0b896c39f8a1c56a5e024e1076663a52289a70a3c58f8e0765e

                            • C:\ProgramData\Dllhost\dllhost.exe

                              Filesize

                              915KB

                              MD5

                              21fb723594386c2fd180395455f7d61c

                              SHA1

                              bbbe7845deeaf3cb7f6471e59931b98469023321

                              SHA256

                              8a1e66d8c23a8a7c15a6e1bc1cdcbcbafcf5703a6f75d9cfcb8fc9741dc53f4e

                              SHA512

                              270c57f51ac2ec76f44a32623466d0bc1cba514b30f940bc1f758f3e90580dc379c790157502d0b896c39f8a1c56a5e024e1076663a52289a70a3c58f8e0765e

                            • C:\ProgramData\HostData\logs.uce

                              Filesize

                              497B

                              MD5

                              13fda2ab01b83a5130842a5bab3892d3

                              SHA1

                              6e18e4b467cde054a63a95d4dfc030f156ecd215

                              SHA256

                              76973d42c8fceceab7ec85b3d01b218db92564993e93a9bea31c52aa73aeee9e

                              SHA512

                              c51f9fd6e452fbeeedd4dfaba3c7c887e337f01e68abdd27d4032f8be85def7ef3cf0c77bf60e425b085b76c0539464c6b6e5e805a69397c5519e8ccf9fffccc

                            • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log

                              Filesize

                              2KB

                              MD5

                              1c19c16e21c97ed42d5beabc93391fc5

                              SHA1

                              8ad83f8e0b3acf8dfbbf87931e41f0d664c4df68

                              SHA256

                              1bcd97396c83babfe6c5068ba590d7a3f8b70e72955a9d1e4070648e404cbf05

                              SHA512

                              7d18776d8f649b3d29c182ff03efc6cea8b527542ee55304980f24577aae8b64e37044407776e220984346c3998ace5f8853afa58c8b38407482a728e9495e0c

                            • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                              Filesize

                              18KB

                              MD5

                              ee45c633f05e7eb6ebfa901756a041e0

                              SHA1

                              a4f9493d9af9bcb6fd57b164ec1657b1a882202b

                              SHA256

                              b37ab198f2943d943a3d17951533bd0f808f47c05e2ee4faa54b43838eeb39e3

                              SHA512

                              776dbb28abd687a62c16d076fefe9a24203772f35a734a4518ff214b00394deb06693a0c9f18715c15e88689eaebbddf294844e3fe1522e50b92608905549aac

                            • memory/1748-172-0x0000000077710000-0x000000007789E000-memory.dmp

                              Filesize

                              1.6MB

                            • memory/1748-154-0x0000000077710000-0x000000007789E000-memory.dmp

                              Filesize

                              1.6MB

                            • memory/1748-120-0x0000000077710000-0x000000007789E000-memory.dmp

                              Filesize

                              1.6MB

                            • memory/1748-127-0x0000000077710000-0x000000007789E000-memory.dmp

                              Filesize

                              1.6MB

                            • memory/1748-128-0x0000000077710000-0x000000007789E000-memory.dmp

                              Filesize

                              1.6MB

                            • memory/1748-129-0x0000000077710000-0x000000007789E000-memory.dmp

                              Filesize

                              1.6MB

                            • memory/1748-130-0x0000000077710000-0x000000007789E000-memory.dmp

                              Filesize

                              1.6MB

                            • memory/1748-131-0x0000000077710000-0x000000007789E000-memory.dmp

                              Filesize

                              1.6MB

                            • memory/1748-132-0x0000000077710000-0x000000007789E000-memory.dmp

                              Filesize

                              1.6MB

                            • memory/1748-133-0x0000000077710000-0x000000007789E000-memory.dmp

                              Filesize

                              1.6MB

                            • memory/1748-134-0x0000000077710000-0x000000007789E000-memory.dmp

                              Filesize

                              1.6MB

                            • memory/1748-135-0x0000000077710000-0x000000007789E000-memory.dmp

                              Filesize

                              1.6MB

                            • memory/1748-136-0x0000000077710000-0x000000007789E000-memory.dmp

                              Filesize

                              1.6MB

                            • memory/1748-138-0x0000000077710000-0x000000007789E000-memory.dmp

                              Filesize

                              1.6MB

                            • memory/1748-137-0x0000000077710000-0x000000007789E000-memory.dmp

                              Filesize

                              1.6MB

                            • memory/1748-139-0x0000000077710000-0x000000007789E000-memory.dmp

                              Filesize

                              1.6MB

                            • memory/1748-140-0x0000000077710000-0x000000007789E000-memory.dmp

                              Filesize

                              1.6MB

                            • memory/1748-141-0x0000000077710000-0x000000007789E000-memory.dmp

                              Filesize

                              1.6MB

                            • memory/1748-142-0x0000000077710000-0x000000007789E000-memory.dmp

                              Filesize

                              1.6MB

                            • memory/1748-143-0x0000000077710000-0x000000007789E000-memory.dmp

                              Filesize

                              1.6MB

                            • memory/1748-144-0x0000000077710000-0x000000007789E000-memory.dmp

                              Filesize

                              1.6MB

                            • memory/1748-145-0x0000000077710000-0x000000007789E000-memory.dmp

                              Filesize

                              1.6MB

                            • memory/1748-146-0x0000000077710000-0x000000007789E000-memory.dmp

                              Filesize

                              1.6MB

                            • memory/1748-147-0x0000000077710000-0x000000007789E000-memory.dmp

                              Filesize

                              1.6MB

                            • memory/1748-148-0x0000000077710000-0x000000007789E000-memory.dmp

                              Filesize

                              1.6MB

                            • memory/1748-149-0x0000000077710000-0x000000007789E000-memory.dmp

                              Filesize

                              1.6MB

                            • memory/1748-150-0x0000000077710000-0x000000007789E000-memory.dmp

                              Filesize

                              1.6MB

                            • memory/1748-151-0x0000000077710000-0x000000007789E000-memory.dmp

                              Filesize

                              1.6MB

                            • memory/1748-152-0x0000000077710000-0x000000007789E000-memory.dmp

                              Filesize

                              1.6MB

                            • memory/1748-153-0x0000000000A00000-0x0000000000AA8000-memory.dmp

                              Filesize

                              672KB

                            • memory/1748-121-0x0000000077710000-0x000000007789E000-memory.dmp

                              Filesize

                              1.6MB

                            • memory/1748-155-0x0000000077710000-0x000000007789E000-memory.dmp

                              Filesize

                              1.6MB

                            • memory/1748-156-0x0000000077710000-0x000000007789E000-memory.dmp

                              Filesize

                              1.6MB

                            • memory/1748-157-0x00000000058D0000-0x0000000005DCE000-memory.dmp

                              Filesize

                              5.0MB

                            • memory/1748-158-0x00000000053D0000-0x0000000005462000-memory.dmp

                              Filesize

                              584KB

                            • memory/1748-159-0x0000000077710000-0x000000007789E000-memory.dmp

                              Filesize

                              1.6MB

                            • memory/1748-160-0x0000000077710000-0x000000007789E000-memory.dmp

                              Filesize

                              1.6MB

                            • memory/1748-161-0x0000000077710000-0x000000007789E000-memory.dmp

                              Filesize

                              1.6MB

                            • memory/1748-162-0x0000000077710000-0x000000007789E000-memory.dmp

                              Filesize

                              1.6MB

                            • memory/1748-163-0x0000000077710000-0x000000007789E000-memory.dmp

                              Filesize

                              1.6MB

                            • memory/1748-164-0x0000000077710000-0x000000007789E000-memory.dmp

                              Filesize

                              1.6MB

                            • memory/1748-165-0x0000000077710000-0x000000007789E000-memory.dmp

                              Filesize

                              1.6MB

                            • memory/1748-122-0x0000000077710000-0x000000007789E000-memory.dmp

                              Filesize

                              1.6MB

                            • memory/1748-167-0x0000000077710000-0x000000007789E000-memory.dmp

                              Filesize

                              1.6MB

                            • memory/1748-168-0x0000000077710000-0x000000007789E000-memory.dmp

                              Filesize

                              1.6MB

                            • memory/1748-169-0x0000000077710000-0x000000007789E000-memory.dmp

                              Filesize

                              1.6MB

                            • memory/1748-170-0x0000000077710000-0x000000007789E000-memory.dmp

                              Filesize

                              1.6MB

                            • memory/1748-171-0x0000000077710000-0x000000007789E000-memory.dmp

                              Filesize

                              1.6MB

                            • memory/1748-124-0x0000000077710000-0x000000007789E000-memory.dmp

                              Filesize

                              1.6MB

                            • memory/1748-173-0x0000000077710000-0x000000007789E000-memory.dmp

                              Filesize

                              1.6MB

                            • memory/1748-174-0x0000000001650000-0x000000000165A000-memory.dmp

                              Filesize

                              40KB

                            • memory/1748-175-0x00000000055A0000-0x0000000005606000-memory.dmp

                              Filesize

                              408KB

                            • memory/1748-166-0x0000000077710000-0x000000007789E000-memory.dmp

                              Filesize

                              1.6MB

                            • memory/1748-125-0x0000000077710000-0x000000007789E000-memory.dmp

                              Filesize

                              1.6MB

                            • memory/1748-126-0x0000000077710000-0x000000007789E000-memory.dmp

                              Filesize

                              1.6MB

                            • memory/1748-123-0x0000000077710000-0x000000007789E000-memory.dmp

                              Filesize

                              1.6MB

                            • memory/3412-179-0x0000000077710000-0x000000007789E000-memory.dmp

                              Filesize

                              1.6MB

                            • memory/3412-177-0x0000000077710000-0x000000007789E000-memory.dmp

                              Filesize

                              1.6MB

                            • memory/3412-178-0x0000000077710000-0x000000007789E000-memory.dmp

                              Filesize

                              1.6MB

                            • memory/3412-180-0x0000000077710000-0x000000007789E000-memory.dmp

                              Filesize

                              1.6MB

                            • memory/3412-181-0x0000000077710000-0x000000007789E000-memory.dmp

                              Filesize

                              1.6MB

                            • memory/4528-186-0x0000000077710000-0x000000007789E000-memory.dmp

                              Filesize

                              1.6MB

                            • memory/4528-185-0x0000000077710000-0x000000007789E000-memory.dmp

                              Filesize

                              1.6MB

                            • memory/4528-183-0x0000000077710000-0x000000007789E000-memory.dmp

                              Filesize

                              1.6MB

                            • memory/4528-184-0x0000000077710000-0x000000007789E000-memory.dmp

                              Filesize

                              1.6MB

                            • memory/4528-189-0x0000000077710000-0x000000007789E000-memory.dmp

                              Filesize

                              1.6MB

                            • memory/4528-188-0x0000000077710000-0x000000007789E000-memory.dmp

                              Filesize

                              1.6MB

                            • memory/4528-187-0x0000000077710000-0x000000007789E000-memory.dmp

                              Filesize

                              1.6MB

                            • memory/4752-652-0x0000000000080000-0x0000000000130000-memory.dmp

                              Filesize

                              704KB

                            • memory/5012-254-0x00000000080A0000-0x0000000008106000-memory.dmp

                              Filesize

                              408KB

                            • memory/5012-260-0x0000000008360000-0x00000000086B0000-memory.dmp

                              Filesize

                              3.3MB

                            • memory/5012-191-0x0000000077710000-0x000000007789E000-memory.dmp

                              Filesize

                              1.6MB

                            • memory/5012-226-0x0000000004F30000-0x0000000004F66000-memory.dmp

                              Filesize

                              216KB

                            • memory/5012-231-0x00000000079D0000-0x0000000007FF8000-memory.dmp

                              Filesize

                              6.2MB

                            • memory/5012-252-0x0000000008000000-0x0000000008022000-memory.dmp

                              Filesize

                              136KB

                            • memory/5012-271-0x0000000008AB0000-0x0000000008AFB000-memory.dmp

                              Filesize

                              300KB

                            • memory/5012-270-0x0000000008730000-0x000000000874C000-memory.dmp

                              Filesize

                              112KB

                            • memory/5012-288-0x0000000009930000-0x0000000009963000-memory.dmp

                              Filesize

                              204KB

                            • memory/5012-275-0x0000000008B00000-0x0000000008B76000-memory.dmp

                              Filesize

                              472KB

                            • memory/5012-289-0x0000000009910000-0x000000000992E000-memory.dmp

                              Filesize

                              120KB

                            • memory/5012-298-0x0000000009970000-0x0000000009A15000-memory.dmp

                              Filesize

                              660KB

                            • memory/5012-302-0x0000000009E60000-0x0000000009EF4000-memory.dmp

                              Filesize

                              592KB

                            • memory/5012-505-0x0000000009DE0000-0x0000000009DFA000-memory.dmp

                              Filesize

                              104KB

                            • memory/5012-510-0x0000000009DD0000-0x0000000009DD8000-memory.dmp

                              Filesize

                              32KB