Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    150s
  • max time network
    152s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220901-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
  • submitted
    27/09/2022, 12:30

General

  • Target

    2fc18ac1f71c88d3d83819c9fa6910690e93b6351d01c0a5727731ccba8c06dc.exe

  • Size

    727KB

  • MD5

    e1653bab4c5f23c59db82331042fa221

  • SHA1

    f4393e5f07da72c99cf601f1faa92f6b8dcf5192

  • SHA256

    2fc18ac1f71c88d3d83819c9fa6910690e93b6351d01c0a5727731ccba8c06dc

  • SHA512

    af382868707144625aa3ff9c629e151bdaab3fe341e89f73689bd4065522ccc9a61959898b63265c39139dda13091e2c25c2b4ebde65425a2a62ce1ff1a2e726

  • SSDEEP

    768:rZmchlXKGREW6VA6joSRhFH+C9Pe2auEqainmngYWxuv8Gwmwoe9R4ZstojtfcWv:schl6M+lpDCUoHid0bIrlyR

Score
8/10

Malware Config

Signatures

  • Downloads MZ/PE file
  • Executes dropped EXE 1 IoCs
  • Adds Run key to start application 2 TTPs 9 IoCs
  • Legitimate hosting services abused for malware hosting/C2 1 TTPs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Creates scheduled task(s) 1 TTPs 11 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 5 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2fc18ac1f71c88d3d83819c9fa6910690e93b6351d01c0a5727731ccba8c06dc.exe
    "C:\Users\Admin\AppData\Local\Temp\2fc18ac1f71c88d3d83819c9fa6910690e93b6351d01c0a5727731ccba8c06dc.exe"
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:3096
    • C:\Windows\SysWOW64\cmd.exe
      "cmd.exe" /C chcp 1251 & powershell -Command Add-MpPreference -ExclusionPath "$ENV:USERPROFILE\Desktop" & powershell -Command Add-MpPreference -ExclusionPath "C:\ProgramData\Dllhost" & powershell -Command Add-MpPreference -ExclusionPath "C:\ProgramData\HostData"
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:624
      • C:\Windows\SysWOW64\chcp.com
        chcp 1251
        3⤵
          PID:1428
        • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
          powershell -Command Add-MpPreference -ExclusionPath "$ENV:USERPROFILE\Desktop"
          3⤵
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:4380
        • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
          powershell -Command Add-MpPreference -ExclusionPath "C:\ProgramData\Dllhost"
          3⤵
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:3904
        • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
          powershell -Command Add-MpPreference -ExclusionPath "C:\ProgramData\HostData"
          3⤵
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:2368
      • C:\ProgramData\Dllhost\dllhost.exe
        "C:\ProgramData\Dllhost\dllhost.exe"
        2⤵
        • Executes dropped EXE
        • Adds Run key to start application
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:5100
        • C:\Windows\SysWOW64\cmd.exe
          "cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "SecurityHealthSystray" /TR "C:\ProgramData\Dllhost\dllhost.exe"
          3⤵
          • Suspicious use of WriteProcessMemory
          PID:3744
          • C:\Windows\SysWOW64\schtasks.exe
            SCHTASKS /CREATE /SC HOURLY /TN "SecurityHealthSystray" /TR "C:\ProgramData\Dllhost\dllhost.exe"
            4⤵
            • Creates scheduled task(s)
            PID:3808
        • C:\Windows\SysWOW64\cmd.exe
          "cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "WindowsDefender" /TR "C:\ProgramData\Dllhost\dllhost.exe"
          3⤵
          • Suspicious use of WriteProcessMemory
          PID:4256
          • C:\Windows\SysWOW64\schtasks.exe
            SCHTASKS /CREATE /SC HOURLY /TN "WindowsDefender" /TR "C:\ProgramData\Dllhost\dllhost.exe"
            4⤵
            • Creates scheduled task(s)
            PID:4968
        • C:\Windows\SysWOW64\cmd.exe
          "cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "WmiPrvSE" /TR "C:\ProgramData\Dllhost\dllhost.exe"
          3⤵
            PID:4276
            • C:\Windows\SysWOW64\schtasks.exe
              SCHTASKS /CREATE /SC HOURLY /TN "WmiPrvSE" /TR "C:\ProgramData\Dllhost\dllhost.exe"
              4⤵
              • Creates scheduled task(s)
              PID:4824
          • C:\Windows\SysWOW64\cmd.exe
            "cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "AntiMalwareServiceExecutable" /TR "C:\ProgramData\Dllhost\dllhost.exe"
            3⤵
              PID:4536
              • C:\Windows\SysWOW64\schtasks.exe
                SCHTASKS /CREATE /SC HOURLY /TN "AntiMalwareServiceExecutable" /TR "C:\ProgramData\Dllhost\dllhost.exe"
                4⤵
                • Creates scheduled task(s)
                PID:3220
            • C:\Windows\SysWOW64\cmd.exe
              "cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "MicrosoftEdgeUpd" /TR "C:\ProgramData\Dllhost\dllhost.exe"
              3⤵
              • Suspicious use of WriteProcessMemory
              PID:896
              • C:\Windows\SysWOW64\schtasks.exe
                SCHTASKS /CREATE /SC HOURLY /TN "MicrosoftEdgeUpd" /TR "C:\ProgramData\Dllhost\dllhost.exe"
                4⤵
                • Creates scheduled task(s)
                PID:3324
            • C:\Windows\SysWOW64\cmd.exe
              "cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "OneDriveService" /TR "C:\ProgramData\Dllhost\dllhost.exe"
              3⤵
                PID:704
                • C:\Windows\SysWOW64\schtasks.exe
                  SCHTASKS /CREATE /SC HOURLY /TN "OneDriveService" /TR "C:\ProgramData\Dllhost\dllhost.exe"
                  4⤵
                  • Creates scheduled task(s)
                  PID:3432
              • C:\Windows\SysWOW64\cmd.exe
                "cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "NvStray" /TR "C:\ProgramData\Dllhost\dllhost.exe"
                3⤵
                  PID:384
                • C:\Windows\SysWOW64\cmd.exe
                  "cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "WindowsDefenderServices\WindowsDefenderServicesService_bk2752" /TR "C:\ProgramData\Dllhost\dllhost.exe"
                  3⤵
                    PID:3160
                    • C:\Windows\SysWOW64\schtasks.exe
                      SCHTASKS /CREATE /SC HOURLY /TN "WindowsDefenderServices\WindowsDefenderServicesService_bk2752" /TR "C:\ProgramData\Dllhost\dllhost.exe"
                      4⤵
                      • Creates scheduled task(s)
                      PID:4556
                  • C:\Windows\SysWOW64\cmd.exe
                    "cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "AntiMalwareSericeExecutable\AntiMalwareSericeExecutableService_bk3808" /TR "C:\ProgramData\Dllhost\dllhost.exe"
                    3⤵
                      PID:1444
                      • C:\Windows\SysWOW64\schtasks.exe
                        SCHTASKS /CREATE /SC HOURLY /TN "AntiMalwareSericeExecutable\AntiMalwareSericeExecutableService_bk3808" /TR "C:\ProgramData\Dllhost\dllhost.exe"
                        4⤵
                        • Creates scheduled task(s)
                        PID:4936
                    • C:\Windows\SysWOW64\cmd.exe
                      "cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "dllhost" /TR "C:\ProgramData\Dllhost\dllhost.exe"
                      3⤵
                      • Suspicious use of WriteProcessMemory
                      PID:4652
                      • C:\Windows\SysWOW64\schtasks.exe
                        SCHTASKS /CREATE /SC HOURLY /TN "dllhost" /TR "C:\ProgramData\Dllhost\dllhost.exe"
                        4⤵
                        • Creates scheduled task(s)
                        PID:3284
                    • C:\Windows\SysWOW64\cmd.exe
                      "cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "MicrosoftUpdateServices\MicrosoftUpdateServicesService_bk5655" /TR "C:\ProgramData\Dllhost\dllhost.exe"
                      3⤵
                        PID:2308
                        • C:\Windows\SysWOW64\schtasks.exe
                          SCHTASKS /CREATE /SC HOURLY /TN "MicrosoftUpdateServices\MicrosoftUpdateServicesService_bk5655" /TR "C:\ProgramData\Dllhost\dllhost.exe"
                          4⤵
                          • Creates scheduled task(s)
                          PID:628
                      • C:\Windows\SysWOW64\cmd.exe
                        "cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "SettingSysHost\SettingSysHostService_bk4970" /TR "C:\ProgramData\Dllhost\dllhost.exe"
                        3⤵
                          PID:4284
                          • C:\Windows\SysWOW64\schtasks.exe
                            SCHTASKS /CREATE /SC HOURLY /TN "SettingSysHost\SettingSysHostService_bk4970" /TR "C:\ProgramData\Dllhost\dllhost.exe"
                            4⤵
                            • Creates scheduled task(s)
                            PID:1160
                        • C:\Windows\SysWOW64\cmd.exe
                          "cmd.exe" /c chcp 1251 & C:\ProgramData\Dllhost\winlogson.exe --config msi.bin --log off
                          3⤵
                            PID:1524
                            • C:\Windows\SysWOW64\chcp.com
                              chcp 1251
                              4⤵
                                PID:3572
                            • C:\Windows\SysWOW64\cmd.exe
                              "cmd.exe" /c chcp 1251 & C:\ProgramData\Dllhost\winlogson.exe --config msi.bin --log off
                              3⤵
                                PID:2780
                                • C:\Windows\SysWOW64\chcp.com
                                  chcp 1251
                                  4⤵
                                    PID:4248
                                • C:\Windows\SysWOW64\cmd.exe
                                  "cmd.exe" /c chcp 1251 & C:\ProgramData\Dllhost\winlogson.exe --config msi.bin --log off
                                  3⤵
                                    PID:4156
                                    • C:\Windows\SysWOW64\chcp.com
                                      chcp 1251
                                      4⤵
                                        PID:256

                                Network

                                MITRE ATT&CK Enterprise v6

                                Replay Monitor

                                Loading Replay Monitor...

                                Downloads

                                • C:\ProgramData\Dllhost\dllhost.exe

                                  Filesize

                                  930KB

                                  MD5

                                  f45ae21e6655436407f15696442d1934

                                  SHA1

                                  4469d31dbc669bc24a3c3f100ffdadfb2b76c0ed

                                  SHA256

                                  12405ee617062da53dc55194dc1652d3541b6fbb6eb65d10b8831e6f15abff43

                                  SHA512

                                  dffdeabd11158f4881d4a9b7b3f51336fe93a1c2d0b3211122f05705132504eb1f1d6f68027591505a39dc7bda7998a08be62dbcafcf19b08785330ddeda289d

                                • C:\ProgramData\Dllhost\dllhost.exe

                                  Filesize

                                  930KB

                                  MD5

                                  f45ae21e6655436407f15696442d1934

                                  SHA1

                                  4469d31dbc669bc24a3c3f100ffdadfb2b76c0ed

                                  SHA256

                                  12405ee617062da53dc55194dc1652d3541b6fbb6eb65d10b8831e6f15abff43

                                  SHA512

                                  dffdeabd11158f4881d4a9b7b3f51336fe93a1c2d0b3211122f05705132504eb1f1d6f68027591505a39dc7bda7998a08be62dbcafcf19b08785330ddeda289d

                                • C:\ProgramData\HostData\logs.uce

                                  Filesize

                                  497B

                                  MD5

                                  13fda2ab01b83a5130842a5bab3892d3

                                  SHA1

                                  6e18e4b467cde054a63a95d4dfc030f156ecd215

                                  SHA256

                                  76973d42c8fceceab7ec85b3d01b218db92564993e93a9bea31c52aa73aeee9e

                                  SHA512

                                  c51f9fd6e452fbeeedd4dfaba3c7c887e337f01e68abdd27d4032f8be85def7ef3cf0c77bf60e425b085b76c0539464c6b6e5e805a69397c5519e8ccf9fffccc

                                • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log

                                  Filesize

                                  2KB

                                  MD5

                                  968cb9309758126772781b83adb8a28f

                                  SHA1

                                  8da30e71accf186b2ba11da1797cf67f8f78b47c

                                  SHA256

                                  92099c10776bb7e3f2a8d1b82d4d40d0c4627e4f1bf754a6e58dfd2c2e97042a

                                  SHA512

                                  4bd50732f8af4d688d95999bddfd296115d7033ddc38f86c9fb1f47fde202bffa27e9088bebcaa3064ca946af2f5c1ca6cbde49d0907f0005c7ab42874515dd3

                                • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                  Filesize

                                  18KB

                                  MD5

                                  59a57cd814bf471ec4be0ea19bf71aa2

                                  SHA1

                                  e40fc442ee03ad1f437fcf5d4aa6c401066595ec

                                  SHA256

                                  d7737c62c55f5e59dd10c84cfa16cff90ec763fd1d9be6e82ebb4b9c21101434

                                  SHA512

                                  3307d7f465a77604b2754950df557be6bdf46a43cafffcf6d18951c4c68e184f3cc870dba479aea006b89dba8341167305bb878fc4f7eab3f5663a774f30302e

                                • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                  Filesize

                                  18KB

                                  MD5

                                  c3ed78211abed7eebf5f775693e30f43

                                  SHA1

                                  76e7a7ee81844489c2654626605a596e788e2462

                                  SHA256

                                  acc5f739883a788909d6b5b2fe801a04ceef3b4b828ec8d8a7d587d3876b2e0a

                                  SHA512

                                  2dd7eed75cd629677dda6b7ed4a2ddae7510fdd45b628c67d905a2b0890a45cc059c5b629c549a8f89491b9758bcc3db90b4ce45b6f8c7cd54ee8390e87960ad

                                • memory/2368-161-0x0000000070FA0000-0x0000000070FEC000-memory.dmp

                                  Filesize

                                  304KB

                                • memory/3096-135-0x0000000004ED0000-0x0000000004EDA000-memory.dmp

                                  Filesize

                                  40KB

                                • memory/3096-136-0x0000000005130000-0x0000000005196000-memory.dmp

                                  Filesize

                                  408KB

                                • memory/3096-132-0x0000000000460000-0x0000000000508000-memory.dmp

                                  Filesize

                                  672KB

                                • memory/3096-134-0x0000000004F70000-0x0000000005002000-memory.dmp

                                  Filesize

                                  584KB

                                • memory/3096-133-0x0000000005480000-0x0000000005A24000-memory.dmp

                                  Filesize

                                  5.6MB

                                • memory/3904-158-0x0000000070FA0000-0x0000000070FEC000-memory.dmp

                                  Filesize

                                  304KB

                                • memory/4380-141-0x0000000005950000-0x0000000005F78000-memory.dmp

                                  Filesize

                                  6.2MB

                                • memory/4380-144-0x0000000006710000-0x000000000672E000-memory.dmp

                                  Filesize

                                  120KB

                                • memory/4380-150-0x0000000007A90000-0x0000000007A9A000-memory.dmp

                                  Filesize

                                  40KB

                                • memory/4380-149-0x0000000007A40000-0x0000000007A5A000-memory.dmp

                                  Filesize

                                  104KB

                                • memory/4380-148-0x00000000080A0000-0x000000000871A000-memory.dmp

                                  Filesize

                                  6.5MB

                                • memory/4380-153-0x0000000007D60000-0x0000000007D7A000-memory.dmp

                                  Filesize

                                  104KB

                                • memory/4380-145-0x00000000076F0000-0x0000000007722000-memory.dmp

                                  Filesize

                                  200KB

                                • memory/4380-147-0x0000000006CA0000-0x0000000006CBE000-memory.dmp

                                  Filesize

                                  120KB

                                • memory/4380-146-0x0000000070FA0000-0x0000000070FEC000-memory.dmp

                                  Filesize

                                  304KB

                                • memory/4380-151-0x0000000007CC0000-0x0000000007D56000-memory.dmp

                                  Filesize

                                  600KB

                                • memory/4380-154-0x0000000007CA0000-0x0000000007CA8000-memory.dmp

                                  Filesize

                                  32KB

                                • memory/4380-143-0x0000000005FF0000-0x0000000006056000-memory.dmp

                                  Filesize

                                  408KB

                                • memory/4380-140-0x0000000005170000-0x00000000051A6000-memory.dmp

                                  Filesize

                                  216KB

                                • memory/4380-152-0x0000000007C60000-0x0000000007C6E000-memory.dmp

                                  Filesize

                                  56KB

                                • memory/4380-142-0x0000000005840000-0x0000000005862000-memory.dmp

                                  Filesize

                                  136KB

                                • memory/5100-165-0x0000000000CB0000-0x0000000000D60000-memory.dmp

                                  Filesize

                                  704KB