Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
44s -
max time network
147s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
27/09/2022, 01:37
Static task
static1
Behavioral task
behavioral1
Sample
2623a6e8b5f94511e9e12aead13543b219fac8879e292988919a42519571c87e.exe
Resource
win10v2004-20220812-en
General
-
Target
2623a6e8b5f94511e9e12aead13543b219fac8879e292988919a42519571c87e.exe
-
Size
726KB
-
MD5
f406f57b64abe345b8f970fe0ce01ab7
-
SHA1
c9417d6bc8485b9658b04294d2346b48d4c7bddc
-
SHA256
2623a6e8b5f94511e9e12aead13543b219fac8879e292988919a42519571c87e
-
SHA512
74198959c8d113437b1baaba739f1bb8c2a7476ec44d2b39ac927b8b7a8d308242b2b5f9b7c6b93f64b4a5ce8ba06b29140c0611c3868623264c29ad800c6242
-
SSDEEP
768:rZmchlXKGREW6VA6joSRhFH+C9Pe2auEqainmngYWxuv8Gwmwoe9R4ZstojtfcWv:schl6M+lpDCUoHid0bIrlyR
Malware Config
Signatures
-
Downloads MZ/PE file
-
Executes dropped EXE 1 IoCs
pid Process 3592 dllhost.exe -
Adds Run key to start application 2 TTPs 9 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\MicrosoftEdgeUpd = "C:\\Program Files\\WindowsApps\\Microsoft.x64__8wekyb3gfdfdgd8bbwe/file.exe" dllhost.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\OneDriveService = "C:\\Program Files\\WindowsApps\\Microsoft.x64__8wekyb3gfdfdgd8bbwe/file.exe" dllhost.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\dllhost = "C:\\ProgramData\\Dllhost\\dllhost.exe" dllhost.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\SecurityHealthSystray = "C:\\Windows\\System32\\SecurityHealthSystray.exe" dllhost.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WindowsDefender = "C:\\Program Files\\Windows Defender\\MpCmdRun.exe" dllhost.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Cortana = "C:\\Program Files\\WindowsApps\\Microsoft.x64__8wekyb3gfdfdgd8bbwe\\Cortana.exe" dllhost.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WmiPrvSE = "C:\\Windows\\System32\\wbem\\WmiPrvSE.exe" dllhost.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\AntiMalwareServiceExecutable = "C:\\ProgramData\\Microsoft\\Windows Defender\\Platform\\4.18.2111.5-0\\MsMpEng.exe" dllhost.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\NvStray = "C:\\Program Files\\WindowsApps\\Microsoft.x64__8wekyb3gfdfdgd8bbwe/file.exe" dllhost.exe -
Legitimate hosting services abused for malware hosting/C2 1 TTPs
-
Program crash 1 IoCs
pid pid_target Process procid_target 2752 3344 WerFault.exe 57 -
Creates scheduled task(s) 1 TTPs 11 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 3740 schtasks.exe 388 schtasks.exe 4304 schtasks.exe 3184 schtasks.exe 2604 schtasks.exe 3680 schtasks.exe 1784 schtasks.exe 5068 schtasks.exe 3264 schtasks.exe 3816 schtasks.exe 2304 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4384 powershell.exe 4384 powershell.exe 4828 powershell.exe 4828 powershell.exe 4548 powershell.exe 4548 powershell.exe 3592 dllhost.exe 3592 dllhost.exe 3592 dllhost.exe 3592 dllhost.exe 3592 dllhost.exe 3592 dllhost.exe 3592 dllhost.exe 3592 dllhost.exe 3592 dllhost.exe 3592 dllhost.exe 3592 dllhost.exe 3592 dllhost.exe 3592 dllhost.exe 3592 dllhost.exe 3592 dllhost.exe 3592 dllhost.exe 3592 dllhost.exe 3592 dllhost.exe 3592 dllhost.exe 3592 dllhost.exe 3592 dllhost.exe 3592 dllhost.exe 3592 dllhost.exe 3592 dllhost.exe 3592 dllhost.exe 3592 dllhost.exe 3592 dllhost.exe 3592 dllhost.exe 3592 dllhost.exe 3592 dllhost.exe 3592 dllhost.exe 3592 dllhost.exe 3592 dllhost.exe 3592 dllhost.exe 3592 dllhost.exe 3592 dllhost.exe 3592 dllhost.exe 3592 dllhost.exe 3592 dllhost.exe 3592 dllhost.exe 3592 dllhost.exe 3592 dllhost.exe 3592 dllhost.exe 3592 dllhost.exe 3592 dllhost.exe 3592 dllhost.exe 3592 dllhost.exe 3592 dllhost.exe 3592 dllhost.exe 3592 dllhost.exe 3592 dllhost.exe 3592 dllhost.exe 3592 dllhost.exe 3592 dllhost.exe 3592 dllhost.exe 3592 dllhost.exe 3592 dllhost.exe 3592 dllhost.exe -
Suspicious use of AdjustPrivilegeToken 5 IoCs
description pid Process Token: SeDebugPrivilege 4384 powershell.exe Token: SeDebugPrivilege 2840 2623a6e8b5f94511e9e12aead13543b219fac8879e292988919a42519571c87e.exe Token: SeDebugPrivilege 4828 powershell.exe Token: SeDebugPrivilege 4548 powershell.exe Token: SeDebugPrivilege 3592 dllhost.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2840 wrote to memory of 1180 2840 2623a6e8b5f94511e9e12aead13543b219fac8879e292988919a42519571c87e.exe 79 PID 2840 wrote to memory of 1180 2840 2623a6e8b5f94511e9e12aead13543b219fac8879e292988919a42519571c87e.exe 79 PID 2840 wrote to memory of 1180 2840 2623a6e8b5f94511e9e12aead13543b219fac8879e292988919a42519571c87e.exe 79 PID 1180 wrote to memory of 4808 1180 cmd.exe 81 PID 1180 wrote to memory of 4808 1180 cmd.exe 81 PID 1180 wrote to memory of 4808 1180 cmd.exe 81 PID 1180 wrote to memory of 4384 1180 cmd.exe 82 PID 1180 wrote to memory of 4384 1180 cmd.exe 82 PID 1180 wrote to memory of 4384 1180 cmd.exe 82 PID 1180 wrote to memory of 4828 1180 cmd.exe 87 PID 1180 wrote to memory of 4828 1180 cmd.exe 87 PID 1180 wrote to memory of 4828 1180 cmd.exe 87 PID 1180 wrote to memory of 4548 1180 cmd.exe 90 PID 1180 wrote to memory of 4548 1180 cmd.exe 90 PID 1180 wrote to memory of 4548 1180 cmd.exe 90 PID 2840 wrote to memory of 3592 2840 2623a6e8b5f94511e9e12aead13543b219fac8879e292988919a42519571c87e.exe 91 PID 2840 wrote to memory of 3592 2840 2623a6e8b5f94511e9e12aead13543b219fac8879e292988919a42519571c87e.exe 91 PID 2840 wrote to memory of 3592 2840 2623a6e8b5f94511e9e12aead13543b219fac8879e292988919a42519571c87e.exe 91 PID 3592 wrote to memory of 3916 3592 dllhost.exe 92 PID 3592 wrote to memory of 3916 3592 dllhost.exe 92 PID 3592 wrote to memory of 3916 3592 dllhost.exe 92 PID 3592 wrote to memory of 3944 3592 dllhost.exe 93 PID 3592 wrote to memory of 3944 3592 dllhost.exe 93 PID 3592 wrote to memory of 3944 3592 dllhost.exe 93 PID 3592 wrote to memory of 3500 3592 dllhost.exe 97 PID 3592 wrote to memory of 3500 3592 dllhost.exe 97 PID 3592 wrote to memory of 3500 3592 dllhost.exe 97 PID 3592 wrote to memory of 4492 3592 dllhost.exe 96 PID 3592 wrote to memory of 4492 3592 dllhost.exe 96 PID 3592 wrote to memory of 4492 3592 dllhost.exe 96 PID 3592 wrote to memory of 4320 3592 dllhost.exe 100 PID 3592 wrote to memory of 4320 3592 dllhost.exe 100 PID 3592 wrote to memory of 4320 3592 dllhost.exe 100 PID 3592 wrote to memory of 1428 3592 dllhost.exe 101 PID 3592 wrote to memory of 1428 3592 dllhost.exe 101 PID 3592 wrote to memory of 1428 3592 dllhost.exe 101 PID 3592 wrote to memory of 1012 3592 dllhost.exe 102 PID 3592 wrote to memory of 1012 3592 dllhost.exe 102 PID 3592 wrote to memory of 1012 3592 dllhost.exe 102 PID 3592 wrote to memory of 1080 3592 dllhost.exe 104 PID 3592 wrote to memory of 1080 3592 dllhost.exe 104 PID 3592 wrote to memory of 1080 3592 dllhost.exe 104 PID 3592 wrote to memory of 1840 3592 dllhost.exe 105 PID 3592 wrote to memory of 1840 3592 dllhost.exe 105 PID 3592 wrote to memory of 1840 3592 dllhost.exe 105 PID 3592 wrote to memory of 3932 3592 dllhost.exe 108 PID 3592 wrote to memory of 3932 3592 dllhost.exe 108 PID 3592 wrote to memory of 3932 3592 dllhost.exe 108 PID 3592 wrote to memory of 1484 3592 dllhost.exe 109 PID 3592 wrote to memory of 1484 3592 dllhost.exe 109 PID 3592 wrote to memory of 1484 3592 dllhost.exe 109 PID 3592 wrote to memory of 2636 3592 dllhost.exe 110 PID 3592 wrote to memory of 2636 3592 dllhost.exe 110 PID 3592 wrote to memory of 2636 3592 dllhost.exe 110 PID 4492 wrote to memory of 5068 4492 cmd.exe 116 PID 4492 wrote to memory of 5068 4492 cmd.exe 116 PID 4492 wrote to memory of 5068 4492 cmd.exe 116 PID 3916 wrote to memory of 3740 3916 cmd.exe 117 PID 3916 wrote to memory of 3740 3916 cmd.exe 117 PID 3916 wrote to memory of 3740 3916 cmd.exe 117 PID 3500 wrote to memory of 388 3500 cmd.exe 118 PID 3500 wrote to memory of 388 3500 cmd.exe 118 PID 3500 wrote to memory of 388 3500 cmd.exe 118 PID 1428 wrote to memory of 2604 1428 cmd.exe 123
Processes
-
C:\Users\Admin\AppData\Local\Temp\2623a6e8b5f94511e9e12aead13543b219fac8879e292988919a42519571c87e.exe"C:\Users\Admin\AppData\Local\Temp\2623a6e8b5f94511e9e12aead13543b219fac8879e292988919a42519571c87e.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2840 -
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /C chcp 1251 & powershell -Command Add-MpPreference -ExclusionPath "$ENV:USERPROFILE\Desktop" & powershell -Command Add-MpPreference -ExclusionPath "C:\ProgramData\Dllhost" & powershell -Command Add-MpPreference -ExclusionPath "C:\ProgramData\HostData"2⤵
- Suspicious use of WriteProcessMemory
PID:1180 -
C:\Windows\SysWOW64\chcp.comchcp 12513⤵PID:4808
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -Command Add-MpPreference -ExclusionPath "$ENV:USERPROFILE\Desktop"3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4384
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -Command Add-MpPreference -ExclusionPath "C:\ProgramData\Dllhost"3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4828
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -Command Add-MpPreference -ExclusionPath "C:\ProgramData\HostData"3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4548
-
-
-
C:\ProgramData\Dllhost\dllhost.exe"C:\ProgramData\Dllhost\dllhost.exe"2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3592 -
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "SecurityHealthSystray" /TR "C:\ProgramData\Dllhost\dllhost.exe"3⤵
- Suspicious use of WriteProcessMemory
PID:3916 -
C:\Windows\SysWOW64\schtasks.exeSCHTASKS /CREATE /SC HOURLY /TN "SecurityHealthSystray" /TR "C:\ProgramData\Dllhost\dllhost.exe"4⤵
- Creates scheduled task(s)
PID:3740
-
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "WindowsDefender" /TR "C:\ProgramData\Dllhost\dllhost.exe"3⤵PID:3944
-
C:\Windows\SysWOW64\schtasks.exeSCHTASKS /CREATE /SC HOURLY /TN "WindowsDefender" /TR "C:\ProgramData\Dllhost\dllhost.exe"4⤵
- Creates scheduled task(s)
PID:3816
-
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "AntiMalwareServiceExecutable" /TR "C:\ProgramData\Dllhost\dllhost.exe"3⤵
- Suspicious use of WriteProcessMemory
PID:4492 -
C:\Windows\SysWOW64\schtasks.exeSCHTASKS /CREATE /SC HOURLY /TN "AntiMalwareServiceExecutable" /TR "C:\ProgramData\Dllhost\dllhost.exe"4⤵
- Creates scheduled task(s)
PID:5068
-
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "WmiPrvSE" /TR "C:\ProgramData\Dllhost\dllhost.exe"3⤵
- Suspicious use of WriteProcessMemory
PID:3500 -
C:\Windows\SysWOW64\schtasks.exeSCHTASKS /CREATE /SC HOURLY /TN "WmiPrvSE" /TR "C:\ProgramData\Dllhost\dllhost.exe"4⤵
- Creates scheduled task(s)
PID:388
-
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "dllhost" /TR "C:\ProgramData\Dllhost\dllhost.exe"3⤵PID:4320
-
C:\Windows\SysWOW64\schtasks.exeSCHTASKS /CREATE /SC HOURLY /TN "dllhost" /TR "C:\ProgramData\Dllhost\dllhost.exe"4⤵
- Creates scheduled task(s)
PID:3264
-
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "MicrosoftEdgeUpd" /TR "C:\ProgramData\Dllhost\dllhost.exe"3⤵
- Suspicious use of WriteProcessMemory
PID:1428 -
C:\Windows\SysWOW64\schtasks.exeSCHTASKS /CREATE /SC HOURLY /TN "MicrosoftEdgeUpd" /TR "C:\ProgramData\Dllhost\dllhost.exe"4⤵
- Creates scheduled task(s)
PID:2604
-
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "OneDriveService" /TR "C:\ProgramData\Dllhost\dllhost.exe"3⤵PID:1012
-
C:\Windows\SysWOW64\schtasks.exeSCHTASKS /CREATE /SC HOURLY /TN "OneDriveService" /TR "C:\ProgramData\Dllhost\dllhost.exe"4⤵
- Creates scheduled task(s)
PID:4304
-
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "NvStray" /TR "C:\ProgramData\Dllhost\dllhost.exe"3⤵PID:1080
-
C:\Windows\SysWOW64\schtasks.exeSCHTASKS /CREATE /SC HOURLY /TN "NvStray" /TR "C:\ProgramData\Dllhost\dllhost.exe"4⤵
- Creates scheduled task(s)
PID:2304
-
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "WindowsDefenderServices\WindowsDefenderServicesService_bk3871" /TR "C:\ProgramData\Dllhost\dllhost.exe"3⤵PID:1840
-
C:\Windows\SysWOW64\schtasks.exeSCHTASKS /CREATE /SC HOURLY /TN "WindowsDefenderServices\WindowsDefenderServicesService_bk3871" /TR "C:\ProgramData\Dllhost\dllhost.exe"4⤵
- Creates scheduled task(s)
PID:3680
-
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "AntiMalwareSericeExecutable\AntiMalwareSericeExecutableService_bk4502" /TR "C:\ProgramData\Dllhost\dllhost.exe"3⤵PID:3932
-
C:\Windows\SysWOW64\schtasks.exeSCHTASKS /CREATE /SC HOURLY /TN "AntiMalwareSericeExecutable\AntiMalwareSericeExecutableService_bk4502" /TR "C:\ProgramData\Dllhost\dllhost.exe"4⤵
- Creates scheduled task(s)
PID:3184
-
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "MicrosoftUpdateServices\MicrosoftUpdateServicesService_bk613" /TR "C:\ProgramData\Dllhost\dllhost.exe"3⤵PID:1484
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "SettingSysHost\SettingSysHostService_bk6202" /TR "C:\ProgramData\Dllhost\dllhost.exe"3⤵PID:2636
-
C:\Windows\SysWOW64\schtasks.exeSCHTASKS /CREATE /SC HOURLY /TN "SettingSysHost\SettingSysHostService_bk6202" /TR "C:\ProgramData\Dllhost\dllhost.exe"4⤵
- Creates scheduled task(s)
PID:1784
-
-
-
-
C:\Windows\system32\dwm.exe"dwm.exe"1⤵PID:4912
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 3344 -s 15721⤵
- Program crash
PID:2752
-
C:\Windows\system32\dwm.exe"dwm.exe"1⤵PID:4112
-
C:\Windows\system32\dwm.exe"dwm.exe"1⤵PID:2304
-
C:\Windows\system32\dwm.exe"dwm.exe"1⤵PID:3740
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
929KB
MD5094e383b6c9768692b55ffb62d0ff3f5
SHA1768536a17ddcdf194431aa5e0b7969fa81d78b8a
SHA2564e7cedff1c19e2a657b1b2609eecba31a494b0b96b60be69c7ae0e3bf48e76c6
SHA5122bcb4bfdee4d95b017dc1255fc7e04a8a59301df257b61b6768fc8e511f0b9f2ea34da4d017c28cf24555fc15f174d69644dd32e530e29f8c6ec4726a39172ba
-
Filesize
929KB
MD5094e383b6c9768692b55ffb62d0ff3f5
SHA1768536a17ddcdf194431aa5e0b7969fa81d78b8a
SHA2564e7cedff1c19e2a657b1b2609eecba31a494b0b96b60be69c7ae0e3bf48e76c6
SHA5122bcb4bfdee4d95b017dc1255fc7e04a8a59301df257b61b6768fc8e511f0b9f2ea34da4d017c28cf24555fc15f174d69644dd32e530e29f8c6ec4726a39172ba
-
Filesize
497B
MD513fda2ab01b83a5130842a5bab3892d3
SHA16e18e4b467cde054a63a95d4dfc030f156ecd215
SHA25676973d42c8fceceab7ec85b3d01b218db92564993e93a9bea31c52aa73aeee9e
SHA512c51f9fd6e452fbeeedd4dfaba3c7c887e337f01e68abdd27d4032f8be85def7ef3cf0c77bf60e425b085b76c0539464c6b6e5e805a69397c5519e8ccf9fffccc
-
Filesize
2KB
MD5968cb9309758126772781b83adb8a28f
SHA18da30e71accf186b2ba11da1797cf67f8f78b47c
SHA25692099c10776bb7e3f2a8d1b82d4d40d0c4627e4f1bf754a6e58dfd2c2e97042a
SHA5124bd50732f8af4d688d95999bddfd296115d7033ddc38f86c9fb1f47fde202bffa27e9088bebcaa3064ca946af2f5c1ca6cbde49d0907f0005c7ab42874515dd3
-
Filesize
18KB
MD58631e77c97edfa0e172db6fc687674ff
SHA1b9e608d3acf0c9031b4441917d20c002471de9e0
SHA2563f3c744ae6ff7be30f1f0d9793905a068f97e6187297be4d7c3da03830c56b4a
SHA512e8ff77c7e59bd318aff161d62057076b848e4bbc4bd0d830bb79bbe56397b99b988cfe0cbf301db9b47f32b9182a9e7d4145b58d5468ef4c518349a7a73aa2ec
-
Filesize
18KB
MD5a219a29849d975c02639a133f4b69e80
SHA1cd46ab7a957ea128869fdcc526e8d3f7fbcbf82f
SHA256b7e6ddec5df9b1b4f18a9619297fed03c5122e5fc1cf2b7446195f5771023092
SHA5124f05084bf127294e065f8725107ede805506ad9f2371b03c39ccdf703da7e57a3042c642ec3cf64e4370e90fb64796576656b78777a03fc24b8355717ca1fa24