Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    121s
  • max time network
    166s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220812-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
  • submitted
    04/10/2022, 05:01

General

  • Target

    1219bd9f2ca223f02c97722217c6194ad8d1a5529bff775d8a203491caedb49f.exe

  • Size

    120KB

  • MD5

    0717e485a2f70f71e2839b397ccdc79e

  • SHA1

    804a46fd2ee856fbca607cc6aa854832d793422a

  • SHA256

    1219bd9f2ca223f02c97722217c6194ad8d1a5529bff775d8a203491caedb49f

  • SHA512

    27015c3efdf919dbe66a3a36e665c9a9d0daaa48f587ab06d6011f9093043a85a6e6403a1ab029a9442560dbb1f4f4ba6d214a30fe086a934121c71f3b85a76e

  • SSDEEP

    1536:Dm1Bk6KOenzQoHnnk56Mti9xzrSoVjc3sS4pN9WmCNWD97Ja7RungOzp+edWTgLP:Dm1iLQoHnY5Uzhc3snsNWJ7eUngwUY

Malware Config

Signatures

  • ASPack v2.12-2.42 26 IoCs

    Detects executables packed with ASPack v2.12-2.42

  • Executes dropped EXE 1 IoCs
  • Sets DLL path for service in the registry 2 TTPs 14 IoCs
  • UPX packed file 2 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Loads dropped DLL 12 IoCs
  • Drops file in System32 directory 14 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\1219bd9f2ca223f02c97722217c6194ad8d1a5529bff775d8a203491caedb49f.exe
    "C:\Users\Admin\AppData\Local\Temp\1219bd9f2ca223f02c97722217c6194ad8d1a5529bff775d8a203491caedb49f.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:5104
    • C:\03d35205.exe
      C:\03d35205.exe
      2⤵
      • Executes dropped EXE
      • Sets DLL path for service in the registry
      • Drops file in System32 directory
      • Suspicious behavior: EnumeratesProcesses
      PID:2408
  • C:\Windows\SysWOW64\svchost.exe
    C:\Windows\SysWOW64\svchost.exe -k netsvcs -s FastUserSwitchingCompatibility
    1⤵
    • Loads dropped DLL
    PID:2224
  • C:\Windows\SysWOW64\svchost.exe
    C:\Windows\SysWOW64\svchost.exe -k netsvcs -s Irmon
    1⤵
    • Loads dropped DLL
    PID:2192
  • C:\Windows\SysWOW64\svchost.exe
    C:\Windows\SysWOW64\svchost.exe -k netsvcs -s Nla
    1⤵
    • Loads dropped DLL
    PID:4756
  • C:\Windows\SysWOW64\svchost.exe
    C:\Windows\SysWOW64\svchost.exe -k netsvcs -s Ntmssvc
    1⤵
    • Loads dropped DLL
    PID:3768
  • C:\Windows\SysWOW64\svchost.exe
    C:\Windows\SysWOW64\svchost.exe -k netsvcs -s NWCWorkstation
    1⤵
    • Loads dropped DLL
    PID:3680
  • C:\Windows\SysWOW64\svchost.exe
    C:\Windows\SysWOW64\svchost.exe -k netsvcs -s Nwsapagent
    1⤵
    • Loads dropped DLL
    PID:3484
  • C:\Windows\SysWOW64\svchost.exe
    C:\Windows\SysWOW64\svchost.exe -k netsvcs -s SRService
    1⤵
    • Loads dropped DLL
    PID:1988
  • C:\Windows\SysWOW64\svchost.exe
    C:\Windows\SysWOW64\svchost.exe -k netsvcs -s WmdmPmSp
    1⤵
    • Loads dropped DLL
    PID:2052
  • C:\Windows\SysWOW64\svchost.exe
    C:\Windows\SysWOW64\svchost.exe -k netsvcs -s LogonHours
    1⤵
    • Loads dropped DLL
    PID:2864
  • C:\Windows\SysWOW64\svchost.exe
    C:\Windows\SysWOW64\svchost.exe -k netsvcs -s PCAudit
    1⤵
    • Loads dropped DLL
    PID:4100
  • C:\Windows\SysWOW64\svchost.exe
    C:\Windows\SysWOW64\svchost.exe -k netsvcs -s helpsvc
    1⤵
    • Loads dropped DLL
    PID:4272
  • C:\Windows\SysWOW64\svchost.exe
    C:\Windows\SysWOW64\svchost.exe -k netsvcs -s uploadmgr
    1⤵
    • Loads dropped DLL
    PID:2608

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\03d35205.exe

    Filesize

    56KB

    MD5

    a13d8dd9e5bffbd7e5f4e579bac4f8da

    SHA1

    629ebdbe9eb7cf5788163a554cf6c4342860a8f8

    SHA256

    65a16bc0c36468851a352cdbc37d747bd09ce67dae14fc065b27266362c1d6e4

    SHA512

    aab40a4ea4a7c7ca8062be0b1ba98d3314ef7e7874bc7bff48a645454777f0829a84db9798b9c31eae211cd837127c25d8807222c9819d0bb1a37b1ddf72e093

  • C:\03d35205.exe

    Filesize

    56KB

    MD5

    a13d8dd9e5bffbd7e5f4e579bac4f8da

    SHA1

    629ebdbe9eb7cf5788163a554cf6c4342860a8f8

    SHA256

    65a16bc0c36468851a352cdbc37d747bd09ce67dae14fc065b27266362c1d6e4

    SHA512

    aab40a4ea4a7c7ca8062be0b1ba98d3314ef7e7874bc7bff48a645454777f0829a84db9798b9c31eae211cd837127c25d8807222c9819d0bb1a37b1ddf72e093

  • C:\Windows\SysWOW64\FastUserSwitchingCompatibility.dll

    Filesize

    56KB

    MD5

    21639ce79aa2ce2b87b873ca20b7a236

    SHA1

    cf1eb5b74aa902f52cb706756c4aa84253c6d19f

    SHA256

    107509f86a30b75e5ed73ba2cb1ccad8f0a1eea694ac5e69e919db8912c86c1b

    SHA512

    1a11acdb7292a4c154d305ae4e2d62be8e8777ca84a742a29fe18d3cca0384fbb099241d382ece8225f4cdd8098f05bef6484e9e9a89fa911d7880b964df4ce8

  • C:\Windows\SysWOW64\Irmon.dll

    Filesize

    56KB

    MD5

    21639ce79aa2ce2b87b873ca20b7a236

    SHA1

    cf1eb5b74aa902f52cb706756c4aa84253c6d19f

    SHA256

    107509f86a30b75e5ed73ba2cb1ccad8f0a1eea694ac5e69e919db8912c86c1b

    SHA512

    1a11acdb7292a4c154d305ae4e2d62be8e8777ca84a742a29fe18d3cca0384fbb099241d382ece8225f4cdd8098f05bef6484e9e9a89fa911d7880b964df4ce8

  • C:\Windows\SysWOW64\LogonHours.dll

    Filesize

    56KB

    MD5

    21639ce79aa2ce2b87b873ca20b7a236

    SHA1

    cf1eb5b74aa902f52cb706756c4aa84253c6d19f

    SHA256

    107509f86a30b75e5ed73ba2cb1ccad8f0a1eea694ac5e69e919db8912c86c1b

    SHA512

    1a11acdb7292a4c154d305ae4e2d62be8e8777ca84a742a29fe18d3cca0384fbb099241d382ece8225f4cdd8098f05bef6484e9e9a89fa911d7880b964df4ce8

  • C:\Windows\SysWOW64\NWCWorkstation.dll

    Filesize

    56KB

    MD5

    21639ce79aa2ce2b87b873ca20b7a236

    SHA1

    cf1eb5b74aa902f52cb706756c4aa84253c6d19f

    SHA256

    107509f86a30b75e5ed73ba2cb1ccad8f0a1eea694ac5e69e919db8912c86c1b

    SHA512

    1a11acdb7292a4c154d305ae4e2d62be8e8777ca84a742a29fe18d3cca0384fbb099241d382ece8225f4cdd8098f05bef6484e9e9a89fa911d7880b964df4ce8

  • C:\Windows\SysWOW64\Nla.dll

    Filesize

    56KB

    MD5

    21639ce79aa2ce2b87b873ca20b7a236

    SHA1

    cf1eb5b74aa902f52cb706756c4aa84253c6d19f

    SHA256

    107509f86a30b75e5ed73ba2cb1ccad8f0a1eea694ac5e69e919db8912c86c1b

    SHA512

    1a11acdb7292a4c154d305ae4e2d62be8e8777ca84a742a29fe18d3cca0384fbb099241d382ece8225f4cdd8098f05bef6484e9e9a89fa911d7880b964df4ce8

  • C:\Windows\SysWOW64\Ntmssvc.dll

    Filesize

    56KB

    MD5

    21639ce79aa2ce2b87b873ca20b7a236

    SHA1

    cf1eb5b74aa902f52cb706756c4aa84253c6d19f

    SHA256

    107509f86a30b75e5ed73ba2cb1ccad8f0a1eea694ac5e69e919db8912c86c1b

    SHA512

    1a11acdb7292a4c154d305ae4e2d62be8e8777ca84a742a29fe18d3cca0384fbb099241d382ece8225f4cdd8098f05bef6484e9e9a89fa911d7880b964df4ce8

  • C:\Windows\SysWOW64\Nwsapagent.dll

    Filesize

    56KB

    MD5

    21639ce79aa2ce2b87b873ca20b7a236

    SHA1

    cf1eb5b74aa902f52cb706756c4aa84253c6d19f

    SHA256

    107509f86a30b75e5ed73ba2cb1ccad8f0a1eea694ac5e69e919db8912c86c1b

    SHA512

    1a11acdb7292a4c154d305ae4e2d62be8e8777ca84a742a29fe18d3cca0384fbb099241d382ece8225f4cdd8098f05bef6484e9e9a89fa911d7880b964df4ce8

  • C:\Windows\SysWOW64\PCAudit.dll

    Filesize

    56KB

    MD5

    21639ce79aa2ce2b87b873ca20b7a236

    SHA1

    cf1eb5b74aa902f52cb706756c4aa84253c6d19f

    SHA256

    107509f86a30b75e5ed73ba2cb1ccad8f0a1eea694ac5e69e919db8912c86c1b

    SHA512

    1a11acdb7292a4c154d305ae4e2d62be8e8777ca84a742a29fe18d3cca0384fbb099241d382ece8225f4cdd8098f05bef6484e9e9a89fa911d7880b964df4ce8

  • C:\Windows\SysWOW64\SRService.dll

    Filesize

    56KB

    MD5

    21639ce79aa2ce2b87b873ca20b7a236

    SHA1

    cf1eb5b74aa902f52cb706756c4aa84253c6d19f

    SHA256

    107509f86a30b75e5ed73ba2cb1ccad8f0a1eea694ac5e69e919db8912c86c1b

    SHA512

    1a11acdb7292a4c154d305ae4e2d62be8e8777ca84a742a29fe18d3cca0384fbb099241d382ece8225f4cdd8098f05bef6484e9e9a89fa911d7880b964df4ce8

  • C:\Windows\SysWOW64\WmdmPmSp.dll

    Filesize

    56KB

    MD5

    21639ce79aa2ce2b87b873ca20b7a236

    SHA1

    cf1eb5b74aa902f52cb706756c4aa84253c6d19f

    SHA256

    107509f86a30b75e5ed73ba2cb1ccad8f0a1eea694ac5e69e919db8912c86c1b

    SHA512

    1a11acdb7292a4c154d305ae4e2d62be8e8777ca84a742a29fe18d3cca0384fbb099241d382ece8225f4cdd8098f05bef6484e9e9a89fa911d7880b964df4ce8

  • C:\Windows\SysWOW64\helpsvc.dll

    Filesize

    56KB

    MD5

    21639ce79aa2ce2b87b873ca20b7a236

    SHA1

    cf1eb5b74aa902f52cb706756c4aa84253c6d19f

    SHA256

    107509f86a30b75e5ed73ba2cb1ccad8f0a1eea694ac5e69e919db8912c86c1b

    SHA512

    1a11acdb7292a4c154d305ae4e2d62be8e8777ca84a742a29fe18d3cca0384fbb099241d382ece8225f4cdd8098f05bef6484e9e9a89fa911d7880b964df4ce8

  • C:\Windows\SysWOW64\uploadmgr.dll

    Filesize

    56KB

    MD5

    21639ce79aa2ce2b87b873ca20b7a236

    SHA1

    cf1eb5b74aa902f52cb706756c4aa84253c6d19f

    SHA256

    107509f86a30b75e5ed73ba2cb1ccad8f0a1eea694ac5e69e919db8912c86c1b

    SHA512

    1a11acdb7292a4c154d305ae4e2d62be8e8777ca84a742a29fe18d3cca0384fbb099241d382ece8225f4cdd8098f05bef6484e9e9a89fa911d7880b964df4ce8

  • \??\c:\windows\SysWOW64\fastuserswitchingcompatibility.dll

    Filesize

    56KB

    MD5

    21639ce79aa2ce2b87b873ca20b7a236

    SHA1

    cf1eb5b74aa902f52cb706756c4aa84253c6d19f

    SHA256

    107509f86a30b75e5ed73ba2cb1ccad8f0a1eea694ac5e69e919db8912c86c1b

    SHA512

    1a11acdb7292a4c154d305ae4e2d62be8e8777ca84a742a29fe18d3cca0384fbb099241d382ece8225f4cdd8098f05bef6484e9e9a89fa911d7880b964df4ce8

  • \??\c:\windows\SysWOW64\helpsvc.dll

    Filesize

    56KB

    MD5

    21639ce79aa2ce2b87b873ca20b7a236

    SHA1

    cf1eb5b74aa902f52cb706756c4aa84253c6d19f

    SHA256

    107509f86a30b75e5ed73ba2cb1ccad8f0a1eea694ac5e69e919db8912c86c1b

    SHA512

    1a11acdb7292a4c154d305ae4e2d62be8e8777ca84a742a29fe18d3cca0384fbb099241d382ece8225f4cdd8098f05bef6484e9e9a89fa911d7880b964df4ce8

  • \??\c:\windows\SysWOW64\irmon.dll

    Filesize

    56KB

    MD5

    21639ce79aa2ce2b87b873ca20b7a236

    SHA1

    cf1eb5b74aa902f52cb706756c4aa84253c6d19f

    SHA256

    107509f86a30b75e5ed73ba2cb1ccad8f0a1eea694ac5e69e919db8912c86c1b

    SHA512

    1a11acdb7292a4c154d305ae4e2d62be8e8777ca84a742a29fe18d3cca0384fbb099241d382ece8225f4cdd8098f05bef6484e9e9a89fa911d7880b964df4ce8

  • \??\c:\windows\SysWOW64\logonhours.dll

    Filesize

    56KB

    MD5

    21639ce79aa2ce2b87b873ca20b7a236

    SHA1

    cf1eb5b74aa902f52cb706756c4aa84253c6d19f

    SHA256

    107509f86a30b75e5ed73ba2cb1ccad8f0a1eea694ac5e69e919db8912c86c1b

    SHA512

    1a11acdb7292a4c154d305ae4e2d62be8e8777ca84a742a29fe18d3cca0384fbb099241d382ece8225f4cdd8098f05bef6484e9e9a89fa911d7880b964df4ce8

  • \??\c:\windows\SysWOW64\nla.dll

    Filesize

    56KB

    MD5

    21639ce79aa2ce2b87b873ca20b7a236

    SHA1

    cf1eb5b74aa902f52cb706756c4aa84253c6d19f

    SHA256

    107509f86a30b75e5ed73ba2cb1ccad8f0a1eea694ac5e69e919db8912c86c1b

    SHA512

    1a11acdb7292a4c154d305ae4e2d62be8e8777ca84a742a29fe18d3cca0384fbb099241d382ece8225f4cdd8098f05bef6484e9e9a89fa911d7880b964df4ce8

  • \??\c:\windows\SysWOW64\ntmssvc.dll

    Filesize

    56KB

    MD5

    21639ce79aa2ce2b87b873ca20b7a236

    SHA1

    cf1eb5b74aa902f52cb706756c4aa84253c6d19f

    SHA256

    107509f86a30b75e5ed73ba2cb1ccad8f0a1eea694ac5e69e919db8912c86c1b

    SHA512

    1a11acdb7292a4c154d305ae4e2d62be8e8777ca84a742a29fe18d3cca0384fbb099241d382ece8225f4cdd8098f05bef6484e9e9a89fa911d7880b964df4ce8

  • \??\c:\windows\SysWOW64\nwcworkstation.dll

    Filesize

    56KB

    MD5

    21639ce79aa2ce2b87b873ca20b7a236

    SHA1

    cf1eb5b74aa902f52cb706756c4aa84253c6d19f

    SHA256

    107509f86a30b75e5ed73ba2cb1ccad8f0a1eea694ac5e69e919db8912c86c1b

    SHA512

    1a11acdb7292a4c154d305ae4e2d62be8e8777ca84a742a29fe18d3cca0384fbb099241d382ece8225f4cdd8098f05bef6484e9e9a89fa911d7880b964df4ce8

  • \??\c:\windows\SysWOW64\nwsapagent.dll

    Filesize

    56KB

    MD5

    21639ce79aa2ce2b87b873ca20b7a236

    SHA1

    cf1eb5b74aa902f52cb706756c4aa84253c6d19f

    SHA256

    107509f86a30b75e5ed73ba2cb1ccad8f0a1eea694ac5e69e919db8912c86c1b

    SHA512

    1a11acdb7292a4c154d305ae4e2d62be8e8777ca84a742a29fe18d3cca0384fbb099241d382ece8225f4cdd8098f05bef6484e9e9a89fa911d7880b964df4ce8

  • \??\c:\windows\SysWOW64\pcaudit.dll

    Filesize

    56KB

    MD5

    21639ce79aa2ce2b87b873ca20b7a236

    SHA1

    cf1eb5b74aa902f52cb706756c4aa84253c6d19f

    SHA256

    107509f86a30b75e5ed73ba2cb1ccad8f0a1eea694ac5e69e919db8912c86c1b

    SHA512

    1a11acdb7292a4c154d305ae4e2d62be8e8777ca84a742a29fe18d3cca0384fbb099241d382ece8225f4cdd8098f05bef6484e9e9a89fa911d7880b964df4ce8

  • \??\c:\windows\SysWOW64\srservice.dll

    Filesize

    56KB

    MD5

    21639ce79aa2ce2b87b873ca20b7a236

    SHA1

    cf1eb5b74aa902f52cb706756c4aa84253c6d19f

    SHA256

    107509f86a30b75e5ed73ba2cb1ccad8f0a1eea694ac5e69e919db8912c86c1b

    SHA512

    1a11acdb7292a4c154d305ae4e2d62be8e8777ca84a742a29fe18d3cca0384fbb099241d382ece8225f4cdd8098f05bef6484e9e9a89fa911d7880b964df4ce8

  • \??\c:\windows\SysWOW64\uploadmgr.dll

    Filesize

    56KB

    MD5

    21639ce79aa2ce2b87b873ca20b7a236

    SHA1

    cf1eb5b74aa902f52cb706756c4aa84253c6d19f

    SHA256

    107509f86a30b75e5ed73ba2cb1ccad8f0a1eea694ac5e69e919db8912c86c1b

    SHA512

    1a11acdb7292a4c154d305ae4e2d62be8e8777ca84a742a29fe18d3cca0384fbb099241d382ece8225f4cdd8098f05bef6484e9e9a89fa911d7880b964df4ce8

  • \??\c:\windows\SysWOW64\wmdmpmsp.dll

    Filesize

    56KB

    MD5

    21639ce79aa2ce2b87b873ca20b7a236

    SHA1

    cf1eb5b74aa902f52cb706756c4aa84253c6d19f

    SHA256

    107509f86a30b75e5ed73ba2cb1ccad8f0a1eea694ac5e69e919db8912c86c1b

    SHA512

    1a11acdb7292a4c154d305ae4e2d62be8e8777ca84a742a29fe18d3cca0384fbb099241d382ece8225f4cdd8098f05bef6484e9e9a89fa911d7880b964df4ce8

  • memory/1988-168-0x0000000074D00000-0x0000000074D1C000-memory.dmp

    Filesize

    112KB

  • memory/1988-167-0x0000000074D00000-0x0000000074D1C000-memory.dmp

    Filesize

    112KB

  • memory/2052-172-0x0000000074D00000-0x0000000074D1C000-memory.dmp

    Filesize

    112KB

  • memory/2052-171-0x0000000074D00000-0x0000000074D1C000-memory.dmp

    Filesize

    112KB

  • memory/2192-145-0x0000000074D00000-0x0000000074D1C000-memory.dmp

    Filesize

    112KB

  • memory/2192-146-0x0000000074D00000-0x0000000074D1C000-memory.dmp

    Filesize

    112KB

  • memory/2224-141-0x0000000074D00000-0x0000000074D1C000-memory.dmp

    Filesize

    112KB

  • memory/2224-140-0x0000000074D00000-0x0000000074D1C000-memory.dmp

    Filesize

    112KB

  • memory/2408-151-0x0000000002720000-0x0000000006720000-memory.dmp

    Filesize

    64.0MB

  • memory/2408-137-0x0000000000F30000-0x0000000000F4C000-memory.dmp

    Filesize

    112KB

  • memory/2408-135-0x0000000000F30000-0x0000000000F4C000-memory.dmp

    Filesize

    112KB

  • memory/2408-142-0x0000000002720000-0x0000000006720000-memory.dmp

    Filesize

    64.0MB

  • memory/2408-188-0x0000000000F30000-0x0000000000F4C000-memory.dmp

    Filesize

    112KB

  • memory/2608-187-0x0000000074D00000-0x0000000074D1C000-memory.dmp

    Filesize

    112KB

  • memory/2608-186-0x0000000074D00000-0x0000000074D1C000-memory.dmp

    Filesize

    112KB

  • memory/3484-163-0x0000000074D00000-0x0000000074D1C000-memory.dmp

    Filesize

    112KB

  • memory/3484-164-0x0000000074D00000-0x0000000074D1C000-memory.dmp

    Filesize

    112KB

  • memory/3680-159-0x0000000074D00000-0x0000000074D1C000-memory.dmp

    Filesize

    112KB

  • memory/3680-158-0x0000000074D00000-0x0000000074D1C000-memory.dmp

    Filesize

    112KB

  • memory/3768-154-0x0000000074D00000-0x0000000074D1C000-memory.dmp

    Filesize

    112KB

  • memory/3768-155-0x0000000074D00000-0x0000000074D1C000-memory.dmp

    Filesize

    112KB

  • memory/4100-179-0x0000000074D00000-0x0000000074D1C000-memory.dmp

    Filesize

    112KB

  • memory/4100-178-0x0000000074D00000-0x0000000074D1C000-memory.dmp

    Filesize

    112KB

  • memory/4272-183-0x0000000074D00000-0x0000000074D1C000-memory.dmp

    Filesize

    112KB

  • memory/4272-182-0x0000000074D00000-0x0000000074D1C000-memory.dmp

    Filesize

    112KB

  • memory/4756-149-0x0000000074D00000-0x0000000074D1C000-memory.dmp

    Filesize

    112KB

  • memory/4756-150-0x0000000074D00000-0x0000000074D1C000-memory.dmp

    Filesize

    112KB

  • memory/5104-136-0x0000000000400000-0x000000000041E000-memory.dmp

    Filesize

    120KB

  • memory/5104-161-0x0000000000400000-0x000000000041E000-memory.dmp

    Filesize

    120KB