Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
151s -
max time network
147s -
platform
windows10-1703_x64 -
resource
win10-20220812-en -
resource tags
arch:x64arch:x86image:win10-20220812-enlocale:en-usos:windows10-1703-x64system -
submitted
04/10/2022, 19:02
Static task
static1
Behavioral task
behavioral1
Sample
afcb8fef0c61a7fa825364e55b02455fb8e22bad9936b275e533d5ace5cf9ac2.exe
Resource
win10-20220812-en
General
-
Target
afcb8fef0c61a7fa825364e55b02455fb8e22bad9936b275e533d5ace5cf9ac2.exe
-
Size
731KB
-
MD5
93170f24f0dff996a6154f10b701ac6d
-
SHA1
09b81530a8dab3955aa3f4b528d99f54d7f73808
-
SHA256
afcb8fef0c61a7fa825364e55b02455fb8e22bad9936b275e533d5ace5cf9ac2
-
SHA512
0f7e3d2c02a1d4235c6decc11d2570189d26db86afeac67a4091af2867f0db9d1d0c3e8516f41fa648a0e19053fc192271356d14f5c11cc12586e524d785266d
-
SSDEEP
768:rZmchlXKGREW6VA6joSRhFH+C9Pe2auEqainmngYWxuv8Gwmwoe9R4ZstojtfcWv:schl6M+lpDCUoHid0bIrlyR
Malware Config
Signatures
-
Downloads MZ/PE file
-
Executes dropped EXE 1 IoCs
pid Process 4716 dllhost.exe -
Adds Run key to start application 2 TTPs 9 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2482096546-1136599444-1359412500-1000\Software\Microsoft\Windows\CurrentVersion\Run\dllhost = "C:\\ProgramData\\Dllhost\\dllhost.exe" dllhost.exe Set value (str) \REGISTRY\USER\S-1-5-21-2482096546-1136599444-1359412500-1000\Software\Microsoft\Windows\CurrentVersion\Run\Cortana = "C:\\Program Files\\WindowsApps\\Microsoft.x64__8wekyb3gfdfdgd8bbwe\\Cortana.exe" dllhost.exe Set value (str) \REGISTRY\USER\S-1-5-21-2482096546-1136599444-1359412500-1000\Software\Microsoft\Windows\CurrentVersion\Run\MicrosoftEdgeUpd = "C:\\Program Files\\WindowsApps\\Microsoft.x64__8wekyb3gfdfdgd8bbwe/file.exe" dllhost.exe Set value (str) \REGISTRY\USER\S-1-5-21-2482096546-1136599444-1359412500-1000\Software\Microsoft\Windows\CurrentVersion\Run\OneDriveService = "C:\\Program Files\\WindowsApps\\Microsoft.x64__8wekyb3gfdfdgd8bbwe/file.exe" dllhost.exe Set value (str) \REGISTRY\USER\S-1-5-21-2482096546-1136599444-1359412500-1000\Software\Microsoft\Windows\CurrentVersion\Run\SecurityHealthSystray = "C:\\Windows\\System32\\SecurityHealthSystray.exe" dllhost.exe Set value (str) \REGISTRY\USER\S-1-5-21-2482096546-1136599444-1359412500-1000\Software\Microsoft\Windows\CurrentVersion\Run\WindowsDefender = "C:\\Program Files\\Windows Defender\\MpCmdRun.exe" dllhost.exe Set value (str) \REGISTRY\USER\S-1-5-21-2482096546-1136599444-1359412500-1000\Software\Microsoft\Windows\CurrentVersion\Run\WmiPrvSE = "C:\\Windows\\System32\\wbem\\WmiPrvSE.exe" dllhost.exe Set value (str) \REGISTRY\USER\S-1-5-21-2482096546-1136599444-1359412500-1000\Software\Microsoft\Windows\CurrentVersion\Run\AntiMalwareServiceExecutable = "C:\\ProgramData\\Microsoft\\Windows Defender\\Platform\\4.18.2111.5-0\\MsMpEng.exe" dllhost.exe Set value (str) \REGISTRY\USER\S-1-5-21-2482096546-1136599444-1359412500-1000\Software\Microsoft\Windows\CurrentVersion\Run\NvStray = "C:\\Program Files\\WindowsApps\\Microsoft.x64__8wekyb3gfdfdgd8bbwe/file.exe" dllhost.exe -
Legitimate hosting services abused for malware hosting/C2 1 TTPs
-
Creates scheduled task(s) 1 TTPs 9 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 4784 schtasks.exe 4772 schtasks.exe 2092 schtasks.exe 4788 schtasks.exe 4588 schtasks.exe 4760 schtasks.exe 1912 schtasks.exe 4504 schtasks.exe 4488 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4868 powershell.exe 4868 powershell.exe 4868 powershell.exe 4716 dllhost.exe 4716 dllhost.exe 4716 dllhost.exe 4716 dllhost.exe 4716 dllhost.exe 4716 dllhost.exe 4716 dllhost.exe 4716 dllhost.exe 4716 dllhost.exe 4716 dllhost.exe 4716 dllhost.exe 4716 dllhost.exe 4716 dllhost.exe 4716 dllhost.exe 4716 dllhost.exe 4716 dllhost.exe 4716 dllhost.exe 4716 dllhost.exe 4716 dllhost.exe 4716 dllhost.exe 4716 dllhost.exe 4716 dllhost.exe 4716 dllhost.exe 4716 dllhost.exe 4716 dllhost.exe 4716 dllhost.exe 4716 dllhost.exe 4716 dllhost.exe 4716 dllhost.exe 4716 dllhost.exe 4716 dllhost.exe 4716 dllhost.exe 4716 dllhost.exe 4716 dllhost.exe 4716 dllhost.exe 4716 dllhost.exe 4716 dllhost.exe 4716 dllhost.exe 4716 dllhost.exe 4716 dllhost.exe 4716 dllhost.exe 4716 dllhost.exe 4716 dllhost.exe 4716 dllhost.exe 4716 dllhost.exe 4716 dllhost.exe 4716 dllhost.exe 4716 dllhost.exe 4716 dllhost.exe 4716 dllhost.exe 4716 dllhost.exe 4716 dllhost.exe 4716 dllhost.exe 4716 dllhost.exe 4716 dllhost.exe 4716 dllhost.exe 4716 dllhost.exe 4716 dllhost.exe 4716 dllhost.exe 4716 dllhost.exe 4716 dllhost.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
description pid Process Token: SeDebugPrivilege 2584 afcb8fef0c61a7fa825364e55b02455fb8e22bad9936b275e533d5ace5cf9ac2.exe Token: SeDebugPrivilege 4868 powershell.exe Token: SeDebugPrivilege 4716 dllhost.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2584 wrote to memory of 3788 2584 afcb8fef0c61a7fa825364e55b02455fb8e22bad9936b275e533d5ace5cf9ac2.exe 66 PID 2584 wrote to memory of 3788 2584 afcb8fef0c61a7fa825364e55b02455fb8e22bad9936b275e533d5ace5cf9ac2.exe 66 PID 2584 wrote to memory of 3788 2584 afcb8fef0c61a7fa825364e55b02455fb8e22bad9936b275e533d5ace5cf9ac2.exe 66 PID 3788 wrote to memory of 4836 3788 cmd.exe 68 PID 3788 wrote to memory of 4836 3788 cmd.exe 68 PID 3788 wrote to memory of 4836 3788 cmd.exe 68 PID 3788 wrote to memory of 4868 3788 cmd.exe 69 PID 3788 wrote to memory of 4868 3788 cmd.exe 69 PID 3788 wrote to memory of 4868 3788 cmd.exe 69 PID 2584 wrote to memory of 4716 2584 afcb8fef0c61a7fa825364e55b02455fb8e22bad9936b275e533d5ace5cf9ac2.exe 70 PID 2584 wrote to memory of 4716 2584 afcb8fef0c61a7fa825364e55b02455fb8e22bad9936b275e533d5ace5cf9ac2.exe 70 PID 2584 wrote to memory of 4716 2584 afcb8fef0c61a7fa825364e55b02455fb8e22bad9936b275e533d5ace5cf9ac2.exe 70 PID 4716 wrote to memory of 1308 4716 dllhost.exe 71 PID 4716 wrote to memory of 1308 4716 dllhost.exe 71 PID 4716 wrote to memory of 1308 4716 dllhost.exe 71 PID 4716 wrote to memory of 1260 4716 dllhost.exe 72 PID 4716 wrote to memory of 1260 4716 dllhost.exe 72 PID 4716 wrote to memory of 1260 4716 dllhost.exe 72 PID 4716 wrote to memory of 860 4716 dllhost.exe 73 PID 4716 wrote to memory of 860 4716 dllhost.exe 73 PID 4716 wrote to memory of 860 4716 dllhost.exe 73 PID 4716 wrote to memory of 824 4716 dllhost.exe 74 PID 4716 wrote to memory of 824 4716 dllhost.exe 74 PID 4716 wrote to memory of 824 4716 dllhost.exe 74 PID 4716 wrote to memory of 1064 4716 dllhost.exe 75 PID 4716 wrote to memory of 1064 4716 dllhost.exe 75 PID 4716 wrote to memory of 1064 4716 dllhost.exe 75 PID 4716 wrote to memory of 328 4716 dllhost.exe 76 PID 4716 wrote to memory of 328 4716 dllhost.exe 76 PID 4716 wrote to memory of 328 4716 dllhost.exe 76 PID 4716 wrote to memory of 216 4716 dllhost.exe 79 PID 4716 wrote to memory of 216 4716 dllhost.exe 79 PID 4716 wrote to memory of 216 4716 dllhost.exe 79 PID 4716 wrote to memory of 3844 4716 dllhost.exe 89 PID 4716 wrote to memory of 3844 4716 dllhost.exe 89 PID 4716 wrote to memory of 3844 4716 dllhost.exe 89 PID 4716 wrote to memory of 2248 4716 dllhost.exe 88 PID 4716 wrote to memory of 2248 4716 dllhost.exe 88 PID 4716 wrote to memory of 2248 4716 dllhost.exe 88 PID 4716 wrote to memory of 1740 4716 dllhost.exe 82 PID 4716 wrote to memory of 1740 4716 dllhost.exe 82 PID 4716 wrote to memory of 1740 4716 dllhost.exe 82 PID 4716 wrote to memory of 2000 4716 dllhost.exe 83 PID 4716 wrote to memory of 2000 4716 dllhost.exe 83 PID 4716 wrote to memory of 2000 4716 dllhost.exe 83 PID 4716 wrote to memory of 2388 4716 dllhost.exe 85 PID 4716 wrote to memory of 2388 4716 dllhost.exe 85 PID 4716 wrote to memory of 2388 4716 dllhost.exe 85 PID 1260 wrote to memory of 4760 1260 cmd.exe 99 PID 1260 wrote to memory of 4760 1260 cmd.exe 99 PID 1260 wrote to memory of 4760 1260 cmd.exe 99 PID 824 wrote to memory of 4772 824 cmd.exe 101 PID 824 wrote to memory of 4772 824 cmd.exe 101 PID 824 wrote to memory of 4772 824 cmd.exe 101 PID 1064 wrote to memory of 4504 1064 cmd.exe 97 PID 1064 wrote to memory of 4504 1064 cmd.exe 97 PID 1064 wrote to memory of 4504 1064 cmd.exe 97 PID 2000 wrote to memory of 4488 2000 cmd.exe 98 PID 2000 wrote to memory of 4488 2000 cmd.exe 98 PID 2000 wrote to memory of 4488 2000 cmd.exe 98 PID 3844 wrote to memory of 4784 3844 cmd.exe 100 PID 3844 wrote to memory of 4784 3844 cmd.exe 100 PID 3844 wrote to memory of 4784 3844 cmd.exe 100 PID 2248 wrote to memory of 4788 2248 cmd.exe 95
Processes
-
C:\Users\Admin\AppData\Local\Temp\afcb8fef0c61a7fa825364e55b02455fb8e22bad9936b275e533d5ace5cf9ac2.exe"C:\Users\Admin\AppData\Local\Temp\afcb8fef0c61a7fa825364e55b02455fb8e22bad9936b275e533d5ace5cf9ac2.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2584 -
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /C chcp 1251 & powershell -Command Add-MpPreference -ExclusionPath "$ENV:USERPROFILE\Desktop" & powershell -Command Add-MpPreference -ExclusionPath "C:\ProgramData\Dllhost" & powershell -Command Add-MpPreference -ExclusionPath "C:\ProgramData\HostData"2⤵
- Suspicious use of WriteProcessMemory
PID:3788 -
C:\Windows\SysWOW64\chcp.comchcp 12513⤵PID:4836
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -Command Add-MpPreference -ExclusionPath "$ENV:USERPROFILE\Desktop"3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4868
-
-
-
C:\ProgramData\Dllhost\dllhost.exe"C:\ProgramData\Dllhost\dllhost.exe"2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4716 -
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "SecurityHealthSystray" /TR "C:\ProgramData\Dllhost\dllhost.exe"3⤵PID:1308
-
C:\Windows\SysWOW64\schtasks.exeSCHTASKS /CREATE /SC HOURLY /TN "SecurityHealthSystray" /TR "C:\ProgramData\Dllhost\dllhost.exe"4⤵
- Creates scheduled task(s)
PID:1912
-
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "WindowsDefender" /TR "C:\ProgramData\Dllhost\dllhost.exe"3⤵
- Suspicious use of WriteProcessMemory
PID:1260 -
C:\Windows\SysWOW64\schtasks.exeSCHTASKS /CREATE /SC HOURLY /TN "WindowsDefender" /TR "C:\ProgramData\Dllhost\dllhost.exe"4⤵
- Creates scheduled task(s)
PID:4760
-
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "WmiPrvSE" /TR "C:\ProgramData\Dllhost\dllhost.exe"3⤵PID:860
-
C:\Windows\SysWOW64\schtasks.exeSCHTASKS /CREATE /SC HOURLY /TN "WmiPrvSE" /TR "C:\ProgramData\Dllhost\dllhost.exe"4⤵
- Creates scheduled task(s)
PID:2092
-
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "AntiMalwareServiceExecutable" /TR "C:\ProgramData\Dllhost\dllhost.exe"3⤵
- Suspicious use of WriteProcessMemory
PID:824 -
C:\Windows\SysWOW64\schtasks.exeSCHTASKS /CREATE /SC HOURLY /TN "AntiMalwareServiceExecutable" /TR "C:\ProgramData\Dllhost\dllhost.exe"4⤵
- Creates scheduled task(s)
PID:4772
-
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "dllhost" /TR "C:\ProgramData\Dllhost\dllhost.exe"3⤵
- Suspicious use of WriteProcessMemory
PID:1064 -
C:\Windows\SysWOW64\schtasks.exeSCHTASKS /CREATE /SC HOURLY /TN "dllhost" /TR "C:\ProgramData\Dllhost\dllhost.exe"4⤵
- Creates scheduled task(s)
PID:4504
-
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "MicrosoftEdgeUpd" /TR "C:\ProgramData\Dllhost\dllhost.exe"3⤵PID:328
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "OneDriveService" /TR "C:\ProgramData\Dllhost\dllhost.exe"3⤵PID:216
-
C:\Windows\SysWOW64\schtasks.exeSCHTASKS /CREATE /SC HOURLY /TN "OneDriveService" /TR "C:\ProgramData\Dllhost\dllhost.exe"4⤵
- Creates scheduled task(s)
PID:4588
-
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "AntiMalwareSericeExecutable\AntiMalwareSericeExecutableService_bk9449" /TR "C:\ProgramData\Dllhost\dllhost.exe"3⤵PID:1740
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "MicrosoftUpdateServices\MicrosoftUpdateServicesService_bk3815" /TR "C:\ProgramData\Dllhost\dllhost.exe"3⤵
- Suspicious use of WriteProcessMemory
PID:2000 -
C:\Windows\SysWOW64\schtasks.exeSCHTASKS /CREATE /SC HOURLY /TN "MicrosoftUpdateServices\MicrosoftUpdateServicesService_bk3815" /TR "C:\ProgramData\Dllhost\dllhost.exe"4⤵
- Creates scheduled task(s)
PID:4488
-
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "SettingSysHost\SettingSysHostService_bk3063" /TR "C:\ProgramData\Dllhost\dllhost.exe"3⤵PID:2388
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "WindowsDefenderServices\WindowsDefenderServicesService_bk7277" /TR "C:\ProgramData\Dllhost\dllhost.exe"3⤵
- Suspicious use of WriteProcessMemory
PID:2248 -
C:\Windows\SysWOW64\schtasks.exeSCHTASKS /CREATE /SC HOURLY /TN "WindowsDefenderServices\WindowsDefenderServicesService_bk7277" /TR "C:\ProgramData\Dllhost\dllhost.exe"4⤵
- Creates scheduled task(s)
PID:4788
-
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "NvStray" /TR "C:\ProgramData\Dllhost\dllhost.exe"3⤵
- Suspicious use of WriteProcessMemory
PID:3844 -
C:\Windows\SysWOW64\schtasks.exeSCHTASKS /CREATE /SC HOURLY /TN "NvStray" /TR "C:\ProgramData\Dllhost\dllhost.exe"4⤵
- Creates scheduled task(s)
PID:4784
-
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /c chcp 1251 & C:\ProgramData\Dllhost\winlogson.exe --config msi.bin --log off3⤵PID:1504
-
C:\Windows\SysWOW64\chcp.comchcp 12514⤵PID:4848
-
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /c chcp 1251 & C:\ProgramData\Dllhost\winlogson.exe --config msi.bin --log off3⤵PID:1308
-
C:\Windows\SysWOW64\chcp.comchcp 12514⤵PID:1828
-
-
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
949KB
MD500424b21f3d70a9078578c7d4497239d
SHA1daee74bb50dbfee854dc539ce3a1084c642ac61d
SHA2569dea2f4cc60ad0bd90f2613d5ca1576b95c9456e2324cb6d19084b71df371df4
SHA512a9b1ec486e03e503b407a24c095c596d1bc34c70c8b1e9f1517ce95bf7008df28152c1c8551df71768bdd6bf68fb6974713743497a507528d7fc3de74f301efa
-
Filesize
949KB
MD500424b21f3d70a9078578c7d4497239d
SHA1daee74bb50dbfee854dc539ce3a1084c642ac61d
SHA2569dea2f4cc60ad0bd90f2613d5ca1576b95c9456e2324cb6d19084b71df371df4
SHA512a9b1ec486e03e503b407a24c095c596d1bc34c70c8b1e9f1517ce95bf7008df28152c1c8551df71768bdd6bf68fb6974713743497a507528d7fc3de74f301efa
-
Filesize
497B
MD513fda2ab01b83a5130842a5bab3892d3
SHA16e18e4b467cde054a63a95d4dfc030f156ecd215
SHA25676973d42c8fceceab7ec85b3d01b218db92564993e93a9bea31c52aa73aeee9e
SHA512c51f9fd6e452fbeeedd4dfaba3c7c887e337f01e68abdd27d4032f8be85def7ef3cf0c77bf60e425b085b76c0539464c6b6e5e805a69397c5519e8ccf9fffccc