Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    150s
  • max time network
    139s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220812-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
  • submitted
    28/09/2022, 22:47

General

  • Target

    fda929f4a069dace72aed5c30013a7bb13c4fea2aa065750f155db5e43a030e1.exe

  • Size

    728KB

  • MD5

    8f45b0b328a2c962203fbb6470cd90df

  • SHA1

    89e863afd79ed67e28ffc58a2f9777b08cd1473e

  • SHA256

    fda929f4a069dace72aed5c30013a7bb13c4fea2aa065750f155db5e43a030e1

  • SHA512

    7f8c7534903ca800a3faead6b5ea701e2814b9a110c3a45cfc532ea5f56ebda01e9524dc37fe6a1aed50ebc2c79838afbac17cf85dc9b6c1b7cf47fe64978fd3

  • SSDEEP

    768:rZmchlXKGREW6VA6joSRhFH+C9Pe2auEqainmngYWxuv8Gwmwoe9R4ZstojtfcWv:schl6M+lpDCUoHid0bIrlyR

Score
8/10

Malware Config

Signatures

  • Downloads MZ/PE file
  • Executes dropped EXE 1 IoCs
  • Adds Run key to start application 2 TTPs 9 IoCs
  • Legitimate hosting services abused for malware hosting/C2 1 TTPs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Creates scheduled task(s) 1 TTPs 12 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 5 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\fda929f4a069dace72aed5c30013a7bb13c4fea2aa065750f155db5e43a030e1.exe
    "C:\Users\Admin\AppData\Local\Temp\fda929f4a069dace72aed5c30013a7bb13c4fea2aa065750f155db5e43a030e1.exe"
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:2412
    • C:\Windows\SysWOW64\cmd.exe
      "cmd.exe" /C chcp 1251 & powershell -Command Add-MpPreference -ExclusionPath "$ENV:USERPROFILE\Desktop" & powershell -Command Add-MpPreference -ExclusionPath "C:\ProgramData\Dllhost" & powershell -Command Add-MpPreference -ExclusionPath "C:\ProgramData\HostData"
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:2980
      • C:\Windows\SysWOW64\chcp.com
        chcp 1251
        3⤵
          PID:4236
        • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
          powershell -Command Add-MpPreference -ExclusionPath "$ENV:USERPROFILE\Desktop"
          3⤵
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:1112
        • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
          powershell -Command Add-MpPreference -ExclusionPath "C:\ProgramData\Dllhost"
          3⤵
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:2660
        • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
          powershell -Command Add-MpPreference -ExclusionPath "C:\ProgramData\HostData"
          3⤵
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:3512
      • C:\ProgramData\Dllhost\dllhost.exe
        "C:\ProgramData\Dllhost\dllhost.exe"
        2⤵
        • Executes dropped EXE
        • Adds Run key to start application
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:4204
        • C:\Windows\SysWOW64\cmd.exe
          "cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "SecurityHealthSystray" /TR "C:\ProgramData\Dllhost\dllhost.exe"
          3⤵
          • Suspicious use of WriteProcessMemory
          PID:1364
          • C:\Windows\SysWOW64\schtasks.exe
            SCHTASKS /CREATE /SC HOURLY /TN "SecurityHealthSystray" /TR "C:\ProgramData\Dllhost\dllhost.exe"
            4⤵
            • Creates scheduled task(s)
            PID:1448
        • C:\Windows\SysWOW64\cmd.exe
          "cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "WindowsDefender" /TR "C:\ProgramData\Dllhost\dllhost.exe"
          3⤵
          • Suspicious use of WriteProcessMemory
          PID:3392
          • C:\Windows\SysWOW64\schtasks.exe
            SCHTASKS /CREATE /SC HOURLY /TN "WindowsDefender" /TR "C:\ProgramData\Dllhost\dllhost.exe"
            4⤵
            • Creates scheduled task(s)
            PID:3312
        • C:\Windows\SysWOW64\cmd.exe
          "cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "WmiPrvSE" /TR "C:\ProgramData\Dllhost\dllhost.exe"
          3⤵
          • Suspicious use of WriteProcessMemory
          PID:4872
          • C:\Windows\SysWOW64\schtasks.exe
            SCHTASKS /CREATE /SC HOURLY /TN "WmiPrvSE" /TR "C:\ProgramData\Dllhost\dllhost.exe"
            4⤵
            • Creates scheduled task(s)
            PID:1936
        • C:\Windows\SysWOW64\cmd.exe
          "cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "AntiMalwareServiceExecutable" /TR "C:\ProgramData\Dllhost\dllhost.exe"
          3⤵
          • Suspicious use of WriteProcessMemory
          PID:2936
          • C:\Windows\SysWOW64\schtasks.exe
            SCHTASKS /CREATE /SC HOURLY /TN "AntiMalwareServiceExecutable" /TR "C:\ProgramData\Dllhost\dllhost.exe"
            4⤵
            • Creates scheduled task(s)
            PID:5004
        • C:\Windows\SysWOW64\cmd.exe
          "cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "dllhost" /TR "C:\ProgramData\Dllhost\dllhost.exe"
          3⤵
            PID:2272
            • C:\Windows\SysWOW64\schtasks.exe
              SCHTASKS /CREATE /SC HOURLY /TN "dllhost" /TR "C:\ProgramData\Dllhost\dllhost.exe"
              4⤵
              • Creates scheduled task(s)
              PID:3948
          • C:\Windows\SysWOW64\cmd.exe
            "cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "MicrosoftEdgeUpd" /TR "C:\ProgramData\Dllhost\dllhost.exe"
            3⤵
              PID:1120
              • C:\Windows\SysWOW64\schtasks.exe
                SCHTASKS /CREATE /SC HOURLY /TN "MicrosoftEdgeUpd" /TR "C:\ProgramData\Dllhost\dllhost.exe"
                4⤵
                • Creates scheduled task(s)
                PID:3240
            • C:\Windows\SysWOW64\cmd.exe
              "cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "NvStray" /TR "C:\ProgramData\Dllhost\dllhost.exe"
              3⤵
                PID:4648
                • C:\Windows\SysWOW64\schtasks.exe
                  SCHTASKS /CREATE /SC HOURLY /TN "NvStray" /TR "C:\ProgramData\Dllhost\dllhost.exe"
                  4⤵
                  • Creates scheduled task(s)
                  PID:1780
              • C:\Windows\SysWOW64\cmd.exe
                "cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "WindowsDefenderServices\WindowsDefenderServicesService_bk7165" /TR "C:\ProgramData\Dllhost\dllhost.exe"
                3⤵
                  PID:4844
                  • C:\Windows\SysWOW64\schtasks.exe
                    SCHTASKS /CREATE /SC HOURLY /TN "WindowsDefenderServices\WindowsDefenderServicesService_bk7165" /TR "C:\ProgramData\Dllhost\dllhost.exe"
                    4⤵
                    • Creates scheduled task(s)
                    PID:4336
                • C:\Windows\SysWOW64\cmd.exe
                  "cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "AntiMalwareSericeExecutable\AntiMalwareSericeExecutableService_bk1684" /TR "C:\ProgramData\Dllhost\dllhost.exe"
                  3⤵
                    PID:412
                    • C:\Windows\SysWOW64\schtasks.exe
                      SCHTASKS /CREATE /SC HOURLY /TN "AntiMalwareSericeExecutable\AntiMalwareSericeExecutableService_bk1684" /TR "C:\ProgramData\Dllhost\dllhost.exe"
                      4⤵
                      • Creates scheduled task(s)
                      PID:3016
                  • C:\Windows\SysWOW64\cmd.exe
                    "cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "OneDriveService" /TR "C:\ProgramData\Dllhost\dllhost.exe"
                    3⤵
                      PID:3128
                      • C:\Windows\SysWOW64\schtasks.exe
                        SCHTASKS /CREATE /SC HOURLY /TN "OneDriveService" /TR "C:\ProgramData\Dllhost\dllhost.exe"
                        4⤵
                        • Creates scheduled task(s)
                        PID:1504
                    • C:\Windows\SysWOW64\cmd.exe
                      "cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "MicrosoftUpdateServices\MicrosoftUpdateServicesService_bk3296" /TR "C:\ProgramData\Dllhost\dllhost.exe"
                      3⤵
                        PID:3216
                        • C:\Windows\SysWOW64\schtasks.exe
                          SCHTASKS /CREATE /SC HOURLY /TN "MicrosoftUpdateServices\MicrosoftUpdateServicesService_bk3296" /TR "C:\ProgramData\Dllhost\dllhost.exe"
                          4⤵
                          • Creates scheduled task(s)
                          PID:2852
                      • C:\Windows\SysWOW64\cmd.exe
                        "cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "SettingSysHost\SettingSysHostService_bk3242" /TR "C:\ProgramData\Dllhost\dllhost.exe"
                        3⤵
                          PID:4444
                          • C:\Windows\SysWOW64\schtasks.exe
                            SCHTASKS /CREATE /SC HOURLY /TN "SettingSysHost\SettingSysHostService_bk3242" /TR "C:\ProgramData\Dllhost\dllhost.exe"
                            4⤵
                            • Creates scheduled task(s)
                            PID:3384
                        • C:\Windows\SysWOW64\cmd.exe
                          "cmd.exe" /c chcp 1251 & C:\ProgramData\Dllhost\winlogson.exe --config msi.bin --log off
                          3⤵
                            PID:3984
                            • C:\Windows\SysWOW64\chcp.com
                              chcp 1251
                              4⤵
                                PID:2060
                            • C:\Windows\SysWOW64\cmd.exe
                              "cmd.exe" /c chcp 1251 & C:\ProgramData\Dllhost\winlogson.exe --config msi.bin --log off
                              3⤵
                                PID:4988
                                • C:\Windows\SysWOW64\chcp.com
                                  chcp 1251
                                  4⤵
                                    PID:1076
                                • C:\Windows\SysWOW64\cmd.exe
                                  "cmd.exe" /c chcp 1251 & C:\ProgramData\Dllhost\winlogson.exe --config msi.bin --log off
                                  3⤵
                                    PID:2296
                                    • C:\Windows\SysWOW64\chcp.com
                                      chcp 1251
                                      4⤵
                                        PID:4432

                                Network

                                MITRE ATT&CK Enterprise v6

                                Replay Monitor

                                Loading Replay Monitor...

                                Downloads

                                • C:\ProgramData\Dllhost\dllhost.exe

                                  Filesize

                                  934KB

                                  MD5

                                  852fe9afebd1212b0c828b2d9ccc25b7

                                  SHA1

                                  95fa3ee134f1484a2cc8c888c9de5704e20b6c80

                                  SHA256

                                  27521bf3cdc0ce0f2c512ce6b1bc34cbb25f227e8cfac1becfc6add7c776160f

                                  SHA512

                                  049a3cdc75da1b683434f71de8545e64a221960fdc2cb29931bc003f2886c1ddcb524a86007306190c05becc3ab5c9766588ae25c253599c7e38db104b3124ec

                                • C:\ProgramData\Dllhost\dllhost.exe

                                  Filesize

                                  934KB

                                  MD5

                                  852fe9afebd1212b0c828b2d9ccc25b7

                                  SHA1

                                  95fa3ee134f1484a2cc8c888c9de5704e20b6c80

                                  SHA256

                                  27521bf3cdc0ce0f2c512ce6b1bc34cbb25f227e8cfac1becfc6add7c776160f

                                  SHA512

                                  049a3cdc75da1b683434f71de8545e64a221960fdc2cb29931bc003f2886c1ddcb524a86007306190c05becc3ab5c9766588ae25c253599c7e38db104b3124ec

                                • C:\ProgramData\HostData\logs.uce

                                  Filesize

                                  497B

                                  MD5

                                  13fda2ab01b83a5130842a5bab3892d3

                                  SHA1

                                  6e18e4b467cde054a63a95d4dfc030f156ecd215

                                  SHA256

                                  76973d42c8fceceab7ec85b3d01b218db92564993e93a9bea31c52aa73aeee9e

                                  SHA512

                                  c51f9fd6e452fbeeedd4dfaba3c7c887e337f01e68abdd27d4032f8be85def7ef3cf0c77bf60e425b085b76c0539464c6b6e5e805a69397c5519e8ccf9fffccc

                                • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log

                                  Filesize

                                  2KB

                                  MD5

                                  968cb9309758126772781b83adb8a28f

                                  SHA1

                                  8da30e71accf186b2ba11da1797cf67f8f78b47c

                                  SHA256

                                  92099c10776bb7e3f2a8d1b82d4d40d0c4627e4f1bf754a6e58dfd2c2e97042a

                                  SHA512

                                  4bd50732f8af4d688d95999bddfd296115d7033ddc38f86c9fb1f47fde202bffa27e9088bebcaa3064ca946af2f5c1ca6cbde49d0907f0005c7ab42874515dd3

                                • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                  Filesize

                                  18KB

                                  MD5

                                  f11b8e8a1c3a4b1c531f98ee5116fbb0

                                  SHA1

                                  73a220942c06969999d79991d8e38e06b073b36f

                                  SHA256

                                  3e4ff341b30ac6292395c534413e18b5de075170c64210f6cb915e0b288f7c24

                                  SHA512

                                  5153524d38f885d052958cb9d92699fe98d86f3d7948c89c929ebb3fb2608d5ea0690719fe135d76a36a01b408656fa7d766e45c0ae96f91626f21331b6059be

                                • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                  Filesize

                                  18KB

                                  MD5

                                  06e34868a947c54aa83bf38b024ed31e

                                  SHA1

                                  b41df511df689cd545b44c0b59aa904594663546

                                  SHA256

                                  e927eee0cb5c539fa7d212b8060128ccd9e85b16380e93250eb421e93c52aaf8

                                  SHA512

                                  f9c7eafeb6c0ebaee7364dfaaa991bec01e8cce0a75940649d4733a9204662510cc2dff7e43a4cbe3fbc82d7b7d387fda09022ab16871aaad371d2ceabf51f20

                                • memory/1112-148-0x0000000008170000-0x00000000087EA000-memory.dmp

                                  Filesize

                                  6.5MB

                                • memory/1112-142-0x0000000005920000-0x0000000005942000-memory.dmp

                                  Filesize

                                  136KB

                                • memory/1112-143-0x00000000059C0000-0x0000000005A26000-memory.dmp

                                  Filesize

                                  408KB

                                • memory/1112-144-0x00000000067D0000-0x00000000067EE000-memory.dmp

                                  Filesize

                                  120KB

                                • memory/1112-145-0x00000000077A0000-0x00000000077D2000-memory.dmp

                                  Filesize

                                  200KB

                                • memory/1112-146-0x0000000071090000-0x00000000710DC000-memory.dmp

                                  Filesize

                                  304KB

                                • memory/1112-147-0x0000000006D90000-0x0000000006DAE000-memory.dmp

                                  Filesize

                                  120KB

                                • memory/1112-141-0x0000000005C30000-0x0000000006258000-memory.dmp

                                  Filesize

                                  6.2MB

                                • memory/1112-149-0x0000000007B10000-0x0000000007B2A000-memory.dmp

                                  Filesize

                                  104KB

                                • memory/1112-150-0x0000000007B60000-0x0000000007B6A000-memory.dmp

                                  Filesize

                                  40KB

                                • memory/1112-151-0x0000000007D90000-0x0000000007E26000-memory.dmp

                                  Filesize

                                  600KB

                                • memory/1112-152-0x0000000007D30000-0x0000000007D3E000-memory.dmp

                                  Filesize

                                  56KB

                                • memory/1112-153-0x0000000007E30000-0x0000000007E4A000-memory.dmp

                                  Filesize

                                  104KB

                                • memory/1112-154-0x0000000007D70000-0x0000000007D78000-memory.dmp

                                  Filesize

                                  32KB

                                • memory/1112-140-0x0000000003210000-0x0000000003246000-memory.dmp

                                  Filesize

                                  216KB

                                • memory/2412-136-0x0000000005660000-0x00000000056C6000-memory.dmp

                                  Filesize

                                  408KB

                                • memory/2412-134-0x0000000005460000-0x00000000054F2000-memory.dmp

                                  Filesize

                                  584KB

                                • memory/2412-133-0x0000000005970000-0x0000000005F14000-memory.dmp

                                  Filesize

                                  5.6MB

                                • memory/2412-132-0x0000000000B10000-0x0000000000BB8000-memory.dmp

                                  Filesize

                                  672KB

                                • memory/2412-135-0x0000000005430000-0x000000000543A000-memory.dmp

                                  Filesize

                                  40KB

                                • memory/2660-158-0x0000000071090000-0x00000000710DC000-memory.dmp

                                  Filesize

                                  304KB

                                • memory/3512-161-0x0000000071090000-0x00000000710DC000-memory.dmp

                                  Filesize

                                  304KB

                                • memory/4204-165-0x0000000000960000-0x0000000000A10000-memory.dmp

                                  Filesize

                                  704KB