Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    71s
  • max time network
    49s
  • platform
    windows7_x64
  • resource
    win7-20220901-en
  • resource tags

    arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
  • submitted
    04/10/2022, 05:01

General

  • Target

    1219bd9f2ca223f02c97722217c6194ad8d1a5529bff775d8a203491caedb49f.exe

  • Size

    120KB

  • MD5

    0717e485a2f70f71e2839b397ccdc79e

  • SHA1

    804a46fd2ee856fbca607cc6aa854832d793422a

  • SHA256

    1219bd9f2ca223f02c97722217c6194ad8d1a5529bff775d8a203491caedb49f

  • SHA512

    27015c3efdf919dbe66a3a36e665c9a9d0daaa48f587ab06d6011f9093043a85a6e6403a1ab029a9442560dbb1f4f4ba6d214a30fe086a934121c71f3b85a76e

  • SSDEEP

    1536:Dm1Bk6KOenzQoHnnk56Mti9xzrSoVjc3sS4pN9WmCNWD97Ja7RungOzp+edWTgLP:Dm1iLQoHnY5Uzhc3snsNWJ7eUngwUY

Malware Config

Signatures

  • ASPack v2.12-2.42 26 IoCs

    Detects executables packed with ASPack v2.12-2.42

  • Executes dropped EXE 1 IoCs
  • Sets DLL path for service in the registry 2 TTPs 14 IoCs
  • UPX packed file 2 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Loads dropped DLL 12 IoCs
  • Drops file in System32 directory 14 IoCs
  • Suspicious behavior: EnumeratesProcesses 1 IoCs
  • Suspicious use of WriteProcessMemory 7 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\1219bd9f2ca223f02c97722217c6194ad8d1a5529bff775d8a203491caedb49f.exe
    "C:\Users\Admin\AppData\Local\Temp\1219bd9f2ca223f02c97722217c6194ad8d1a5529bff775d8a203491caedb49f.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:2028
    • C:\03d35205.exe
      C:\03d35205.exe
      2⤵
      • Executes dropped EXE
      • Sets DLL path for service in the registry
      • Drops file in System32 directory
      • Suspicious behavior: EnumeratesProcesses
      PID:1388
  • C:\Windows\SysWOW64\svchost.exe
    C:\Windows\SysWOW64\svchost.exe -k netsvcs
    1⤵
    • Loads dropped DLL
    PID:2008
  • C:\Windows\SysWOW64\svchost.exe
    C:\Windows\SysWOW64\svchost.exe -k netsvcs
    1⤵
    • Loads dropped DLL
    PID:2020
  • C:\Windows\SysWOW64\svchost.exe
    C:\Windows\SysWOW64\svchost.exe -k netsvcs
    1⤵
    • Loads dropped DLL
    PID:1060
  • C:\Windows\SysWOW64\svchost.exe
    C:\Windows\SysWOW64\svchost.exe -k netsvcs
    1⤵
    • Loads dropped DLL
    PID:1444
  • C:\Windows\SysWOW64\svchost.exe
    C:\Windows\SysWOW64\svchost.exe -k netsvcs
    1⤵
    • Loads dropped DLL
    PID:1960
  • C:\Windows\SysWOW64\svchost.exe
    C:\Windows\SysWOW64\svchost.exe -k netsvcs
    1⤵
    • Loads dropped DLL
    PID:2004
  • C:\Windows\SysWOW64\svchost.exe
    C:\Windows\SysWOW64\svchost.exe -k netsvcs
    1⤵
    • Loads dropped DLL
    PID:1172
  • C:\Windows\SysWOW64\svchost.exe
    C:\Windows\SysWOW64\svchost.exe -k netsvcs
    1⤵
      PID:1996
    • C:\Windows\SysWOW64\svchost.exe
      C:\Windows\SysWOW64\svchost.exe -k netsvcs
      1⤵
      • Loads dropped DLL
      PID:1952
    • C:\Windows\SysWOW64\svchost.exe
      C:\Windows\SysWOW64\svchost.exe -k netsvcs
      1⤵
      • Loads dropped DLL
      PID:1208
    • C:\Windows\SysWOW64\svchost.exe
      C:\Windows\SysWOW64\svchost.exe -k netsvcs
      1⤵
      • Loads dropped DLL
      PID:2008
    • C:\Windows\SysWOW64\svchost.exe
      C:\Windows\SysWOW64\svchost.exe -k netsvcs
      1⤵
      • Loads dropped DLL
      PID:1368
    • C:\Windows\SysWOW64\svchost.exe
      C:\Windows\SysWOW64\svchost.exe -k netsvcs
      1⤵
      • Loads dropped DLL
      PID:1684

    Network

    MITRE ATT&CK Enterprise v6

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\03d35205.exe

      Filesize

      56KB

      MD5

      a13d8dd9e5bffbd7e5f4e579bac4f8da

      SHA1

      629ebdbe9eb7cf5788163a554cf6c4342860a8f8

      SHA256

      65a16bc0c36468851a352cdbc37d747bd09ce67dae14fc065b27266362c1d6e4

      SHA512

      aab40a4ea4a7c7ca8062be0b1ba98d3314ef7e7874bc7bff48a645454777f0829a84db9798b9c31eae211cd837127c25d8807222c9819d0bb1a37b1ddf72e093

    • C:\03d35205.exe

      Filesize

      56KB

      MD5

      a13d8dd9e5bffbd7e5f4e579bac4f8da

      SHA1

      629ebdbe9eb7cf5788163a554cf6c4342860a8f8

      SHA256

      65a16bc0c36468851a352cdbc37d747bd09ce67dae14fc065b27266362c1d6e4

      SHA512

      aab40a4ea4a7c7ca8062be0b1ba98d3314ef7e7874bc7bff48a645454777f0829a84db9798b9c31eae211cd837127c25d8807222c9819d0bb1a37b1ddf72e093

    • \??\c:\windows\SysWOW64\fastuserswitchingcompatibility.dll

      Filesize

      56KB

      MD5

      21639ce79aa2ce2b87b873ca20b7a236

      SHA1

      cf1eb5b74aa902f52cb706756c4aa84253c6d19f

      SHA256

      107509f86a30b75e5ed73ba2cb1ccad8f0a1eea694ac5e69e919db8912c86c1b

      SHA512

      1a11acdb7292a4c154d305ae4e2d62be8e8777ca84a742a29fe18d3cca0384fbb099241d382ece8225f4cdd8098f05bef6484e9e9a89fa911d7880b964df4ce8

    • \??\c:\windows\SysWOW64\helpsvc.dll

      Filesize

      56KB

      MD5

      21639ce79aa2ce2b87b873ca20b7a236

      SHA1

      cf1eb5b74aa902f52cb706756c4aa84253c6d19f

      SHA256

      107509f86a30b75e5ed73ba2cb1ccad8f0a1eea694ac5e69e919db8912c86c1b

      SHA512

      1a11acdb7292a4c154d305ae4e2d62be8e8777ca84a742a29fe18d3cca0384fbb099241d382ece8225f4cdd8098f05bef6484e9e9a89fa911d7880b964df4ce8

    • \??\c:\windows\SysWOW64\irmon.dll

      Filesize

      56KB

      MD5

      21639ce79aa2ce2b87b873ca20b7a236

      SHA1

      cf1eb5b74aa902f52cb706756c4aa84253c6d19f

      SHA256

      107509f86a30b75e5ed73ba2cb1ccad8f0a1eea694ac5e69e919db8912c86c1b

      SHA512

      1a11acdb7292a4c154d305ae4e2d62be8e8777ca84a742a29fe18d3cca0384fbb099241d382ece8225f4cdd8098f05bef6484e9e9a89fa911d7880b964df4ce8

    • \??\c:\windows\SysWOW64\logonhours.dll

      Filesize

      56KB

      MD5

      21639ce79aa2ce2b87b873ca20b7a236

      SHA1

      cf1eb5b74aa902f52cb706756c4aa84253c6d19f

      SHA256

      107509f86a30b75e5ed73ba2cb1ccad8f0a1eea694ac5e69e919db8912c86c1b

      SHA512

      1a11acdb7292a4c154d305ae4e2d62be8e8777ca84a742a29fe18d3cca0384fbb099241d382ece8225f4cdd8098f05bef6484e9e9a89fa911d7880b964df4ce8

    • \??\c:\windows\SysWOW64\nla.dll

      Filesize

      56KB

      MD5

      21639ce79aa2ce2b87b873ca20b7a236

      SHA1

      cf1eb5b74aa902f52cb706756c4aa84253c6d19f

      SHA256

      107509f86a30b75e5ed73ba2cb1ccad8f0a1eea694ac5e69e919db8912c86c1b

      SHA512

      1a11acdb7292a4c154d305ae4e2d62be8e8777ca84a742a29fe18d3cca0384fbb099241d382ece8225f4cdd8098f05bef6484e9e9a89fa911d7880b964df4ce8

    • \??\c:\windows\SysWOW64\ntmssvc.dll

      Filesize

      56KB

      MD5

      21639ce79aa2ce2b87b873ca20b7a236

      SHA1

      cf1eb5b74aa902f52cb706756c4aa84253c6d19f

      SHA256

      107509f86a30b75e5ed73ba2cb1ccad8f0a1eea694ac5e69e919db8912c86c1b

      SHA512

      1a11acdb7292a4c154d305ae4e2d62be8e8777ca84a742a29fe18d3cca0384fbb099241d382ece8225f4cdd8098f05bef6484e9e9a89fa911d7880b964df4ce8

    • \??\c:\windows\SysWOW64\nwcworkstation.dll

      Filesize

      56KB

      MD5

      21639ce79aa2ce2b87b873ca20b7a236

      SHA1

      cf1eb5b74aa902f52cb706756c4aa84253c6d19f

      SHA256

      107509f86a30b75e5ed73ba2cb1ccad8f0a1eea694ac5e69e919db8912c86c1b

      SHA512

      1a11acdb7292a4c154d305ae4e2d62be8e8777ca84a742a29fe18d3cca0384fbb099241d382ece8225f4cdd8098f05bef6484e9e9a89fa911d7880b964df4ce8

    • \??\c:\windows\SysWOW64\nwsapagent.dll

      Filesize

      56KB

      MD5

      21639ce79aa2ce2b87b873ca20b7a236

      SHA1

      cf1eb5b74aa902f52cb706756c4aa84253c6d19f

      SHA256

      107509f86a30b75e5ed73ba2cb1ccad8f0a1eea694ac5e69e919db8912c86c1b

      SHA512

      1a11acdb7292a4c154d305ae4e2d62be8e8777ca84a742a29fe18d3cca0384fbb099241d382ece8225f4cdd8098f05bef6484e9e9a89fa911d7880b964df4ce8

    • \??\c:\windows\SysWOW64\pcaudit.dll

      Filesize

      56KB

      MD5

      21639ce79aa2ce2b87b873ca20b7a236

      SHA1

      cf1eb5b74aa902f52cb706756c4aa84253c6d19f

      SHA256

      107509f86a30b75e5ed73ba2cb1ccad8f0a1eea694ac5e69e919db8912c86c1b

      SHA512

      1a11acdb7292a4c154d305ae4e2d62be8e8777ca84a742a29fe18d3cca0384fbb099241d382ece8225f4cdd8098f05bef6484e9e9a89fa911d7880b964df4ce8

    • \??\c:\windows\SysWOW64\srservice.dll

      Filesize

      56KB

      MD5

      21639ce79aa2ce2b87b873ca20b7a236

      SHA1

      cf1eb5b74aa902f52cb706756c4aa84253c6d19f

      SHA256

      107509f86a30b75e5ed73ba2cb1ccad8f0a1eea694ac5e69e919db8912c86c1b

      SHA512

      1a11acdb7292a4c154d305ae4e2d62be8e8777ca84a742a29fe18d3cca0384fbb099241d382ece8225f4cdd8098f05bef6484e9e9a89fa911d7880b964df4ce8

    • \??\c:\windows\SysWOW64\uploadmgr.dll

      Filesize

      56KB

      MD5

      21639ce79aa2ce2b87b873ca20b7a236

      SHA1

      cf1eb5b74aa902f52cb706756c4aa84253c6d19f

      SHA256

      107509f86a30b75e5ed73ba2cb1ccad8f0a1eea694ac5e69e919db8912c86c1b

      SHA512

      1a11acdb7292a4c154d305ae4e2d62be8e8777ca84a742a29fe18d3cca0384fbb099241d382ece8225f4cdd8098f05bef6484e9e9a89fa911d7880b964df4ce8

    • \??\c:\windows\SysWOW64\wmdmpmsp.dll

      Filesize

      56KB

      MD5

      21639ce79aa2ce2b87b873ca20b7a236

      SHA1

      cf1eb5b74aa902f52cb706756c4aa84253c6d19f

      SHA256

      107509f86a30b75e5ed73ba2cb1ccad8f0a1eea694ac5e69e919db8912c86c1b

      SHA512

      1a11acdb7292a4c154d305ae4e2d62be8e8777ca84a742a29fe18d3cca0384fbb099241d382ece8225f4cdd8098f05bef6484e9e9a89fa911d7880b964df4ce8

    • \Windows\SysWOW64\FastUserSwitchingCompatibility.dll

      Filesize

      56KB

      MD5

      21639ce79aa2ce2b87b873ca20b7a236

      SHA1

      cf1eb5b74aa902f52cb706756c4aa84253c6d19f

      SHA256

      107509f86a30b75e5ed73ba2cb1ccad8f0a1eea694ac5e69e919db8912c86c1b

      SHA512

      1a11acdb7292a4c154d305ae4e2d62be8e8777ca84a742a29fe18d3cca0384fbb099241d382ece8225f4cdd8098f05bef6484e9e9a89fa911d7880b964df4ce8

    • \Windows\SysWOW64\Irmon.dll

      Filesize

      56KB

      MD5

      21639ce79aa2ce2b87b873ca20b7a236

      SHA1

      cf1eb5b74aa902f52cb706756c4aa84253c6d19f

      SHA256

      107509f86a30b75e5ed73ba2cb1ccad8f0a1eea694ac5e69e919db8912c86c1b

      SHA512

      1a11acdb7292a4c154d305ae4e2d62be8e8777ca84a742a29fe18d3cca0384fbb099241d382ece8225f4cdd8098f05bef6484e9e9a89fa911d7880b964df4ce8

    • \Windows\SysWOW64\LogonHours.dll

      Filesize

      56KB

      MD5

      21639ce79aa2ce2b87b873ca20b7a236

      SHA1

      cf1eb5b74aa902f52cb706756c4aa84253c6d19f

      SHA256

      107509f86a30b75e5ed73ba2cb1ccad8f0a1eea694ac5e69e919db8912c86c1b

      SHA512

      1a11acdb7292a4c154d305ae4e2d62be8e8777ca84a742a29fe18d3cca0384fbb099241d382ece8225f4cdd8098f05bef6484e9e9a89fa911d7880b964df4ce8

    • \Windows\SysWOW64\NWCWorkstation.dll

      Filesize

      56KB

      MD5

      21639ce79aa2ce2b87b873ca20b7a236

      SHA1

      cf1eb5b74aa902f52cb706756c4aa84253c6d19f

      SHA256

      107509f86a30b75e5ed73ba2cb1ccad8f0a1eea694ac5e69e919db8912c86c1b

      SHA512

      1a11acdb7292a4c154d305ae4e2d62be8e8777ca84a742a29fe18d3cca0384fbb099241d382ece8225f4cdd8098f05bef6484e9e9a89fa911d7880b964df4ce8

    • \Windows\SysWOW64\Nla.dll

      Filesize

      56KB

      MD5

      21639ce79aa2ce2b87b873ca20b7a236

      SHA1

      cf1eb5b74aa902f52cb706756c4aa84253c6d19f

      SHA256

      107509f86a30b75e5ed73ba2cb1ccad8f0a1eea694ac5e69e919db8912c86c1b

      SHA512

      1a11acdb7292a4c154d305ae4e2d62be8e8777ca84a742a29fe18d3cca0384fbb099241d382ece8225f4cdd8098f05bef6484e9e9a89fa911d7880b964df4ce8

    • \Windows\SysWOW64\Ntmssvc.dll

      Filesize

      56KB

      MD5

      21639ce79aa2ce2b87b873ca20b7a236

      SHA1

      cf1eb5b74aa902f52cb706756c4aa84253c6d19f

      SHA256

      107509f86a30b75e5ed73ba2cb1ccad8f0a1eea694ac5e69e919db8912c86c1b

      SHA512

      1a11acdb7292a4c154d305ae4e2d62be8e8777ca84a742a29fe18d3cca0384fbb099241d382ece8225f4cdd8098f05bef6484e9e9a89fa911d7880b964df4ce8

    • \Windows\SysWOW64\Nwsapagent.dll

      Filesize

      56KB

      MD5

      21639ce79aa2ce2b87b873ca20b7a236

      SHA1

      cf1eb5b74aa902f52cb706756c4aa84253c6d19f

      SHA256

      107509f86a30b75e5ed73ba2cb1ccad8f0a1eea694ac5e69e919db8912c86c1b

      SHA512

      1a11acdb7292a4c154d305ae4e2d62be8e8777ca84a742a29fe18d3cca0384fbb099241d382ece8225f4cdd8098f05bef6484e9e9a89fa911d7880b964df4ce8

    • \Windows\SysWOW64\PCAudit.dll

      Filesize

      56KB

      MD5

      21639ce79aa2ce2b87b873ca20b7a236

      SHA1

      cf1eb5b74aa902f52cb706756c4aa84253c6d19f

      SHA256

      107509f86a30b75e5ed73ba2cb1ccad8f0a1eea694ac5e69e919db8912c86c1b

      SHA512

      1a11acdb7292a4c154d305ae4e2d62be8e8777ca84a742a29fe18d3cca0384fbb099241d382ece8225f4cdd8098f05bef6484e9e9a89fa911d7880b964df4ce8

    • \Windows\SysWOW64\SRService.dll

      Filesize

      56KB

      MD5

      21639ce79aa2ce2b87b873ca20b7a236

      SHA1

      cf1eb5b74aa902f52cb706756c4aa84253c6d19f

      SHA256

      107509f86a30b75e5ed73ba2cb1ccad8f0a1eea694ac5e69e919db8912c86c1b

      SHA512

      1a11acdb7292a4c154d305ae4e2d62be8e8777ca84a742a29fe18d3cca0384fbb099241d382ece8225f4cdd8098f05bef6484e9e9a89fa911d7880b964df4ce8

    • \Windows\SysWOW64\WmdmPmSp.dll

      Filesize

      56KB

      MD5

      21639ce79aa2ce2b87b873ca20b7a236

      SHA1

      cf1eb5b74aa902f52cb706756c4aa84253c6d19f

      SHA256

      107509f86a30b75e5ed73ba2cb1ccad8f0a1eea694ac5e69e919db8912c86c1b

      SHA512

      1a11acdb7292a4c154d305ae4e2d62be8e8777ca84a742a29fe18d3cca0384fbb099241d382ece8225f4cdd8098f05bef6484e9e9a89fa911d7880b964df4ce8

    • \Windows\SysWOW64\helpsvc.dll

      Filesize

      56KB

      MD5

      21639ce79aa2ce2b87b873ca20b7a236

      SHA1

      cf1eb5b74aa902f52cb706756c4aa84253c6d19f

      SHA256

      107509f86a30b75e5ed73ba2cb1ccad8f0a1eea694ac5e69e919db8912c86c1b

      SHA512

      1a11acdb7292a4c154d305ae4e2d62be8e8777ca84a742a29fe18d3cca0384fbb099241d382ece8225f4cdd8098f05bef6484e9e9a89fa911d7880b964df4ce8

    • \Windows\SysWOW64\uploadmgr.dll

      Filesize

      56KB

      MD5

      21639ce79aa2ce2b87b873ca20b7a236

      SHA1

      cf1eb5b74aa902f52cb706756c4aa84253c6d19f

      SHA256

      107509f86a30b75e5ed73ba2cb1ccad8f0a1eea694ac5e69e919db8912c86c1b

      SHA512

      1a11acdb7292a4c154d305ae4e2d62be8e8777ca84a742a29fe18d3cca0384fbb099241d382ece8225f4cdd8098f05bef6484e9e9a89fa911d7880b964df4ce8

    • memory/1060-77-0x0000000074C40000-0x0000000074C5C000-memory.dmp

      Filesize

      112KB

    • memory/1060-76-0x0000000074C40000-0x0000000074C5C000-memory.dmp

      Filesize

      112KB

    • memory/1172-99-0x0000000074C40000-0x0000000074C5C000-memory.dmp

      Filesize

      112KB

    • memory/1172-98-0x0000000074C40000-0x0000000074C5C000-memory.dmp

      Filesize

      112KB

    • memory/1368-117-0x0000000074C40000-0x0000000074C5C000-memory.dmp

      Filesize

      112KB

    • memory/1368-118-0x0000000074C40000-0x0000000074C5C000-memory.dmp

      Filesize

      112KB

    • memory/1388-78-0x0000000002710000-0x0000000006710000-memory.dmp

      Filesize

      64.0MB

    • memory/1388-67-0x0000000002710000-0x0000000006710000-memory.dmp

      Filesize

      64.0MB

    • memory/1388-66-0x00000000012F0000-0x000000000130C000-memory.dmp

      Filesize

      112KB

    • memory/1388-56-0x00000000759F1000-0x00000000759F3000-memory.dmp

      Filesize

      8KB

    • memory/1388-58-0x00000000012F0000-0x000000000130C000-memory.dmp

      Filesize

      112KB

    • memory/1444-83-0x0000000074C40000-0x0000000074C5C000-memory.dmp

      Filesize

      112KB

    • memory/1444-82-0x0000000074C40000-0x0000000074C5C000-memory.dmp

      Filesize

      112KB

    • memory/1684-123-0x0000000074C40000-0x0000000074C5C000-memory.dmp

      Filesize

      112KB

    • memory/1684-122-0x0000000074C40000-0x0000000074C5C000-memory.dmp

      Filesize

      112KB

    • memory/1952-103-0x0000000074C40000-0x0000000074C5C000-memory.dmp

      Filesize

      112KB

    • memory/1952-104-0x0000000074C40000-0x0000000074C5C000-memory.dmp

      Filesize

      112KB

    • memory/1960-87-0x0000000074C40000-0x0000000074C5C000-memory.dmp

      Filesize

      112KB

    • memory/1960-88-0x0000000074C40000-0x0000000074C5C000-memory.dmp

      Filesize

      112KB

    • memory/2004-93-0x0000000074C40000-0x0000000074C5C000-memory.dmp

      Filesize

      112KB

    • memory/2004-92-0x0000000074C40000-0x0000000074C5C000-memory.dmp

      Filesize

      112KB

    • memory/2008-112-0x0000000074C40000-0x0000000074C5C000-memory.dmp

      Filesize

      112KB

    • memory/2008-113-0x0000000074C40000-0x0000000074C5C000-memory.dmp

      Filesize

      112KB

    • memory/2008-63-0x0000000074C40000-0x0000000074C5C000-memory.dmp

      Filesize

      112KB

    • memory/2008-62-0x0000000074C40000-0x0000000074C5C000-memory.dmp

      Filesize

      112KB

    • memory/2020-72-0x00000000746F0000-0x000000007470C000-memory.dmp

      Filesize

      112KB

    • memory/2020-71-0x00000000746F0000-0x000000007470C000-memory.dmp

      Filesize

      112KB

    • memory/2028-94-0x0000000000400000-0x000000000041E000-memory.dmp

      Filesize

      120KB

    • memory/2028-64-0x0000000000400000-0x000000000041E000-memory.dmp

      Filesize

      120KB

    • memory/2028-65-0x0000000000220000-0x000000000023C000-memory.dmp

      Filesize

      112KB