Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    150s
  • max time network
    137s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220901-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
  • submitted
    30/09/2022, 16:30

General

  • Target

    761510b374d517f51ad9cf29acca741cb4ba63e733bf3607ab89b2cd0bbafbca.exe

  • Size

    729KB

  • MD5

    f24d7a5193b4227f8175f6188ab90f6b

  • SHA1

    0c36609dc91da8dc79d09e2b8304912dd2c5ba42

  • SHA256

    761510b374d517f51ad9cf29acca741cb4ba63e733bf3607ab89b2cd0bbafbca

  • SHA512

    f39d8be79325d688537a0db8155543f6f65ecf046c39ebd0480b51499ff3b00b9d7daa5db0189fff29b17c054d545d742b9670d6d25c216c54c2ca712b6de55c

  • SSDEEP

    768:rZmchlXKGREW6VA6joSRhFH+C9Pe2auEqainmngYWxuv8Gwmwoe9R4ZstojtfcWv:schl6M+lpDCUoHid0bIrlyR

Score
8/10

Malware Config

Signatures

  • Downloads MZ/PE file
  • Executes dropped EXE 1 IoCs
  • Adds Run key to start application 2 TTPs 9 IoCs
  • Legitimate hosting services abused for malware hosting/C2 1 TTPs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Creates scheduled task(s) 1 TTPs 11 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 5 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\761510b374d517f51ad9cf29acca741cb4ba63e733bf3607ab89b2cd0bbafbca.exe
    "C:\Users\Admin\AppData\Local\Temp\761510b374d517f51ad9cf29acca741cb4ba63e733bf3607ab89b2cd0bbafbca.exe"
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:1204
    • C:\Windows\SysWOW64\cmd.exe
      "cmd.exe" /C chcp 1251 & powershell -Command Add-MpPreference -ExclusionPath "$ENV:USERPROFILE\Desktop" & powershell -Command Add-MpPreference -ExclusionPath "C:\ProgramData\Dllhost" & powershell -Command Add-MpPreference -ExclusionPath "C:\ProgramData\HostData"
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:4144
      • C:\Windows\SysWOW64\chcp.com
        chcp 1251
        3⤵
          PID:4776
        • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
          powershell -Command Add-MpPreference -ExclusionPath "$ENV:USERPROFILE\Desktop"
          3⤵
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:1924
        • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
          powershell -Command Add-MpPreference -ExclusionPath "C:\ProgramData\Dllhost"
          3⤵
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:4228
        • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
          powershell -Command Add-MpPreference -ExclusionPath "C:\ProgramData\HostData"
          3⤵
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:5104
      • C:\ProgramData\Dllhost\dllhost.exe
        "C:\ProgramData\Dllhost\dllhost.exe"
        2⤵
        • Executes dropped EXE
        • Adds Run key to start application
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:2540
        • C:\Windows\SysWOW64\cmd.exe
          "cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "SecurityHealthSystray" /TR "C:\ProgramData\Dllhost\dllhost.exe"
          3⤵
          • Suspicious use of WriteProcessMemory
          PID:4804
          • C:\Windows\SysWOW64\schtasks.exe
            SCHTASKS /CREATE /SC HOURLY /TN "SecurityHealthSystray" /TR "C:\ProgramData\Dllhost\dllhost.exe"
            4⤵
            • Creates scheduled task(s)
            PID:4288
        • C:\Windows\SysWOW64\cmd.exe
          "cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "WindowsDefender" /TR "C:\ProgramData\Dllhost\dllhost.exe"
          3⤵
          • Suspicious use of WriteProcessMemory
          PID:3492
          • C:\Windows\SysWOW64\schtasks.exe
            SCHTASKS /CREATE /SC HOURLY /TN "WindowsDefender" /TR "C:\ProgramData\Dllhost\dllhost.exe"
            4⤵
            • Creates scheduled task(s)
            PID:3820
        • C:\Windows\SysWOW64\cmd.exe
          "cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "AntiMalwareServiceExecutable" /TR "C:\ProgramData\Dllhost\dllhost.exe"
          3⤵
            PID:3644
            • C:\Windows\SysWOW64\schtasks.exe
              SCHTASKS /CREATE /SC HOURLY /TN "AntiMalwareServiceExecutable" /TR "C:\ProgramData\Dllhost\dllhost.exe"
              4⤵
              • Creates scheduled task(s)
              PID:4360
          • C:\Windows\SysWOW64\cmd.exe
            "cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "dllhost" /TR "C:\ProgramData\Dllhost\dllhost.exe"
            3⤵
            • Suspicious use of WriteProcessMemory
            PID:4488
            • C:\Windows\SysWOW64\schtasks.exe
              SCHTASKS /CREATE /SC HOURLY /TN "dllhost" /TR "C:\ProgramData\Dllhost\dllhost.exe"
              4⤵
              • Creates scheduled task(s)
              PID:4772
          • C:\Windows\SysWOW64\cmd.exe
            "cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "WmiPrvSE" /TR "C:\ProgramData\Dllhost\dllhost.exe"
            3⤵
              PID:3624
              • C:\Windows\SysWOW64\schtasks.exe
                SCHTASKS /CREATE /SC HOURLY /TN "WmiPrvSE" /TR "C:\ProgramData\Dllhost\dllhost.exe"
                4⤵
                • Creates scheduled task(s)
                PID:4624
            • C:\Windows\SysWOW64\cmd.exe
              "cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "MicrosoftEdgeUpd" /TR "C:\ProgramData\Dllhost\dllhost.exe"
              3⤵
                PID:480
                • C:\Windows\SysWOW64\schtasks.exe
                  SCHTASKS /CREATE /SC HOURLY /TN "MicrosoftEdgeUpd" /TR "C:\ProgramData\Dllhost\dllhost.exe"
                  4⤵
                  • Creates scheduled task(s)
                  PID:3712
              • C:\Windows\SysWOW64\cmd.exe
                "cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "OneDriveService" /TR "C:\ProgramData\Dllhost\dllhost.exe"
                3⤵
                  PID:4168
                  • C:\Windows\SysWOW64\schtasks.exe
                    SCHTASKS /CREATE /SC HOURLY /TN "OneDriveService" /TR "C:\ProgramData\Dllhost\dllhost.exe"
                    4⤵
                    • Creates scheduled task(s)
                    PID:3604
                • C:\Windows\SysWOW64\cmd.exe
                  "cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "NvStray" /TR "C:\ProgramData\Dllhost\dllhost.exe"
                  3⤵
                    PID:4832
                    • C:\Windows\SysWOW64\schtasks.exe
                      SCHTASKS /CREATE /SC HOURLY /TN "NvStray" /TR "C:\ProgramData\Dllhost\dllhost.exe"
                      4⤵
                      • Creates scheduled task(s)
                      PID:1256
                  • C:\Windows\SysWOW64\cmd.exe
                    "cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "WindowsDefenderServices\WindowsDefenderServicesService_bk7886" /TR "C:\ProgramData\Dllhost\dllhost.exe"
                    3⤵
                      PID:2008
                    • C:\Windows\SysWOW64\cmd.exe
                      "cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "AntiMalwareSericeExecutable\AntiMalwareSericeExecutableService_bk4186" /TR "C:\ProgramData\Dllhost\dllhost.exe"
                      3⤵
                        PID:4484
                        • C:\Windows\SysWOW64\schtasks.exe
                          SCHTASKS /CREATE /SC HOURLY /TN "AntiMalwareSericeExecutable\AntiMalwareSericeExecutableService_bk4186" /TR "C:\ProgramData\Dllhost\dllhost.exe"
                          4⤵
                          • Creates scheduled task(s)
                          PID:4580
                      • C:\Windows\SysWOW64\cmd.exe
                        "cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "MicrosoftUpdateServices\MicrosoftUpdateServicesService_bk4505" /TR "C:\ProgramData\Dllhost\dllhost.exe"
                        3⤵
                          PID:1788
                          • C:\Windows\SysWOW64\schtasks.exe
                            SCHTASKS /CREATE /SC HOURLY /TN "MicrosoftUpdateServices\MicrosoftUpdateServicesService_bk4505" /TR "C:\ProgramData\Dllhost\dllhost.exe"
                            4⤵
                            • Creates scheduled task(s)
                            PID:1056
                        • C:\Windows\SysWOW64\cmd.exe
                          "cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "SettingSysHost\SettingSysHostService_bk8357" /TR "C:\ProgramData\Dllhost\dllhost.exe"
                          3⤵
                          • Suspicious use of WriteProcessMemory
                          PID:4280
                          • C:\Windows\SysWOW64\schtasks.exe
                            SCHTASKS /CREATE /SC HOURLY /TN "SettingSysHost\SettingSysHostService_bk8357" /TR "C:\ProgramData\Dllhost\dllhost.exe"
                            4⤵
                            • Creates scheduled task(s)
                            PID:4560
                        • C:\Windows\SysWOW64\cmd.exe
                          "cmd.exe" /c chcp 1251 & C:\ProgramData\Dllhost\winlogson.exe --config msi.bin --log off
                          3⤵
                            PID:3512
                            • C:\Windows\SysWOW64\chcp.com
                              chcp 1251
                              4⤵
                                PID:3976
                            • C:\Windows\SysWOW64\cmd.exe
                              "cmd.exe" /c chcp 1251 & C:\ProgramData\Dllhost\winlogson.exe --config msi.bin --log off
                              3⤵
                                PID:2804
                                • C:\Windows\SysWOW64\chcp.com
                                  chcp 1251
                                  4⤵
                                    PID:1804
                                • C:\Windows\SysWOW64\cmd.exe
                                  "cmd.exe" /c chcp 1251 & C:\ProgramData\Dllhost\winlogson.exe --config msi.bin --log off
                                  3⤵
                                    PID:4224
                                    • C:\Windows\SysWOW64\chcp.com
                                      chcp 1251
                                      4⤵
                                        PID:4884

                                Network

                                MITRE ATT&CK Enterprise v6

                                Replay Monitor

                                Loading Replay Monitor...

                                Downloads

                                • C:\ProgramData\Dllhost\dllhost.exe

                                  Filesize

                                  939KB

                                  MD5

                                  b262a4fdfbb70b364d5d0e0479dd8250

                                  SHA1

                                  1000924cc24554a21bae8265973d129add92f01a

                                  SHA256

                                  388788d96784b9fb5e9974a9269c236024fe3d43062330f9099947d8b82c0ebb

                                  SHA512

                                  6dcad68d0ecafb1c9f5a3d8f0fe872546694011bdb6607c2c5c2f1dd3935fe2082f0f766905bdc3f920bfdecf88a338e19989d3c74c4720e9ee240dd343ffa48

                                • C:\ProgramData\Dllhost\dllhost.exe

                                  Filesize

                                  939KB

                                  MD5

                                  b262a4fdfbb70b364d5d0e0479dd8250

                                  SHA1

                                  1000924cc24554a21bae8265973d129add92f01a

                                  SHA256

                                  388788d96784b9fb5e9974a9269c236024fe3d43062330f9099947d8b82c0ebb

                                  SHA512

                                  6dcad68d0ecafb1c9f5a3d8f0fe872546694011bdb6607c2c5c2f1dd3935fe2082f0f766905bdc3f920bfdecf88a338e19989d3c74c4720e9ee240dd343ffa48

                                • C:\ProgramData\HostData\logs.uce

                                  Filesize

                                  497B

                                  MD5

                                  13fda2ab01b83a5130842a5bab3892d3

                                  SHA1

                                  6e18e4b467cde054a63a95d4dfc030f156ecd215

                                  SHA256

                                  76973d42c8fceceab7ec85b3d01b218db92564993e93a9bea31c52aa73aeee9e

                                  SHA512

                                  c51f9fd6e452fbeeedd4dfaba3c7c887e337f01e68abdd27d4032f8be85def7ef3cf0c77bf60e425b085b76c0539464c6b6e5e805a69397c5519e8ccf9fffccc

                                • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log

                                  Filesize

                                  2KB

                                  MD5

                                  968cb9309758126772781b83adb8a28f

                                  SHA1

                                  8da30e71accf186b2ba11da1797cf67f8f78b47c

                                  SHA256

                                  92099c10776bb7e3f2a8d1b82d4d40d0c4627e4f1bf754a6e58dfd2c2e97042a

                                  SHA512

                                  4bd50732f8af4d688d95999bddfd296115d7033ddc38f86c9fb1f47fde202bffa27e9088bebcaa3064ca946af2f5c1ca6cbde49d0907f0005c7ab42874515dd3

                                • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                  Filesize

                                  18KB

                                  MD5

                                  550ed6f9c9d78f54cdc94a866f6a28c7

                                  SHA1

                                  17c578f5ba041d36f39089d58dd3de869e1dfea9

                                  SHA256

                                  48000805232c29c556c389b22dbc15d5bbc37a4d993e3fff6afe267941b114af

                                  SHA512

                                  a0884634c3d04ef0fe0092b59a6c1254a203f9a317a425d53c100e7c27d3fe7cdc89facd054f647a6bda12c391fa918a03010b5dfb9c0ac9d8f2f62a366664cf

                                • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                  Filesize

                                  18KB

                                  MD5

                                  0404751aca5af9682ec18c11be3bda8f

                                  SHA1

                                  f8fcb99aaa989b3e03280abc8d83dd98bf6a2202

                                  SHA256

                                  20a4f499dde44a23bf3c2951bc46638d1bd5674aa7ee75c9e86020ec36cd5be9

                                  SHA512

                                  e52d59f93c31973d3791d446d52c9f6c931b4bfce2ab3ccfd80df667db44f88716f816d9f9588dde0b921948799a906da6eb181f04d5cd15fc0c6fa616a1d399

                                • memory/1204-136-0x0000000005330000-0x0000000005396000-memory.dmp

                                  Filesize

                                  408KB

                                • memory/1204-132-0x0000000000630000-0x00000000006D8000-memory.dmp

                                  Filesize

                                  672KB

                                • memory/1204-135-0x00000000050A0000-0x00000000050AA000-memory.dmp

                                  Filesize

                                  40KB

                                • memory/1204-134-0x00000000050D0000-0x0000000005162000-memory.dmp

                                  Filesize

                                  584KB

                                • memory/1204-133-0x0000000005780000-0x0000000005D24000-memory.dmp

                                  Filesize

                                  5.6MB

                                • memory/1924-148-0x00000000082D0000-0x000000000894A000-memory.dmp

                                  Filesize

                                  6.5MB

                                • memory/1924-146-0x0000000070940000-0x000000007098C000-memory.dmp

                                  Filesize

                                  304KB

                                • memory/1924-150-0x0000000007CB0000-0x0000000007CBA000-memory.dmp

                                  Filesize

                                  40KB

                                • memory/1924-151-0x0000000007EE0000-0x0000000007F76000-memory.dmp

                                  Filesize

                                  600KB

                                • memory/1924-152-0x0000000007E80000-0x0000000007E8E000-memory.dmp

                                  Filesize

                                  56KB

                                • memory/1924-153-0x0000000007F80000-0x0000000007F9A000-memory.dmp

                                  Filesize

                                  104KB

                                • memory/1924-154-0x0000000007EC0000-0x0000000007EC8000-memory.dmp

                                  Filesize

                                  32KB

                                • memory/1924-140-0x0000000005390000-0x00000000053C6000-memory.dmp

                                  Filesize

                                  216KB

                                • memory/1924-147-0x0000000006ED0000-0x0000000006EEE000-memory.dmp

                                  Filesize

                                  120KB

                                • memory/1924-149-0x0000000007C70000-0x0000000007C8A000-memory.dmp

                                  Filesize

                                  104KB

                                • memory/1924-141-0x0000000005A00000-0x0000000006028000-memory.dmp

                                  Filesize

                                  6.2MB

                                • memory/1924-145-0x0000000006EF0000-0x0000000006F22000-memory.dmp

                                  Filesize

                                  200KB

                                • memory/1924-143-0x00000000062E0000-0x0000000006346000-memory.dmp

                                  Filesize

                                  408KB

                                • memory/1924-142-0x0000000005960000-0x0000000005982000-memory.dmp

                                  Filesize

                                  136KB

                                • memory/1924-144-0x00000000069B0000-0x00000000069CE000-memory.dmp

                                  Filesize

                                  120KB

                                • memory/2540-165-0x0000000000B20000-0x0000000000BD0000-memory.dmp

                                  Filesize

                                  704KB

                                • memory/4228-158-0x0000000070940000-0x000000007098C000-memory.dmp

                                  Filesize

                                  304KB

                                • memory/5104-161-0x0000000070940000-0x000000007098C000-memory.dmp

                                  Filesize

                                  304KB