Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    151s
  • max time network
    147s
  • platform
    windows10-1703_x64
  • resource
    win10-20220812-en
  • resource tags

    arch:x64arch:x86image:win10-20220812-enlocale:en-usos:windows10-1703-x64system
  • submitted
    04/10/2022, 19:02

General

  • Target

    afcb8fef0c61a7fa825364e55b02455fb8e22bad9936b275e533d5ace5cf9ac2.exe

  • Size

    731KB

  • MD5

    93170f24f0dff996a6154f10b701ac6d

  • SHA1

    09b81530a8dab3955aa3f4b528d99f54d7f73808

  • SHA256

    afcb8fef0c61a7fa825364e55b02455fb8e22bad9936b275e533d5ace5cf9ac2

  • SHA512

    0f7e3d2c02a1d4235c6decc11d2570189d26db86afeac67a4091af2867f0db9d1d0c3e8516f41fa648a0e19053fc192271356d14f5c11cc12586e524d785266d

  • SSDEEP

    768:rZmchlXKGREW6VA6joSRhFH+C9Pe2auEqainmngYWxuv8Gwmwoe9R4ZstojtfcWv:schl6M+lpDCUoHid0bIrlyR

Score
8/10

Malware Config

Signatures

  • Downloads MZ/PE file
  • Executes dropped EXE 1 IoCs
  • Adds Run key to start application 2 TTPs 9 IoCs
  • Legitimate hosting services abused for malware hosting/C2 1 TTPs
  • Creates scheduled task(s) 1 TTPs 9 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 3 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\afcb8fef0c61a7fa825364e55b02455fb8e22bad9936b275e533d5ace5cf9ac2.exe
    "C:\Users\Admin\AppData\Local\Temp\afcb8fef0c61a7fa825364e55b02455fb8e22bad9936b275e533d5ace5cf9ac2.exe"
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:2584
    • C:\Windows\SysWOW64\cmd.exe
      "cmd.exe" /C chcp 1251 & powershell -Command Add-MpPreference -ExclusionPath "$ENV:USERPROFILE\Desktop" & powershell -Command Add-MpPreference -ExclusionPath "C:\ProgramData\Dllhost" & powershell -Command Add-MpPreference -ExclusionPath "C:\ProgramData\HostData"
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:3788
      • C:\Windows\SysWOW64\chcp.com
        chcp 1251
        3⤵
          PID:4836
        • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
          powershell -Command Add-MpPreference -ExclusionPath "$ENV:USERPROFILE\Desktop"
          3⤵
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:4868
      • C:\ProgramData\Dllhost\dllhost.exe
        "C:\ProgramData\Dllhost\dllhost.exe"
        2⤵
        • Executes dropped EXE
        • Adds Run key to start application
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:4716
        • C:\Windows\SysWOW64\cmd.exe
          "cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "SecurityHealthSystray" /TR "C:\ProgramData\Dllhost\dllhost.exe"
          3⤵
            PID:1308
            • C:\Windows\SysWOW64\schtasks.exe
              SCHTASKS /CREATE /SC HOURLY /TN "SecurityHealthSystray" /TR "C:\ProgramData\Dllhost\dllhost.exe"
              4⤵
              • Creates scheduled task(s)
              PID:1912
          • C:\Windows\SysWOW64\cmd.exe
            "cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "WindowsDefender" /TR "C:\ProgramData\Dllhost\dllhost.exe"
            3⤵
            • Suspicious use of WriteProcessMemory
            PID:1260
            • C:\Windows\SysWOW64\schtasks.exe
              SCHTASKS /CREATE /SC HOURLY /TN "WindowsDefender" /TR "C:\ProgramData\Dllhost\dllhost.exe"
              4⤵
              • Creates scheduled task(s)
              PID:4760
          • C:\Windows\SysWOW64\cmd.exe
            "cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "WmiPrvSE" /TR "C:\ProgramData\Dllhost\dllhost.exe"
            3⤵
              PID:860
              • C:\Windows\SysWOW64\schtasks.exe
                SCHTASKS /CREATE /SC HOURLY /TN "WmiPrvSE" /TR "C:\ProgramData\Dllhost\dllhost.exe"
                4⤵
                • Creates scheduled task(s)
                PID:2092
            • C:\Windows\SysWOW64\cmd.exe
              "cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "AntiMalwareServiceExecutable" /TR "C:\ProgramData\Dllhost\dllhost.exe"
              3⤵
              • Suspicious use of WriteProcessMemory
              PID:824
              • C:\Windows\SysWOW64\schtasks.exe
                SCHTASKS /CREATE /SC HOURLY /TN "AntiMalwareServiceExecutable" /TR "C:\ProgramData\Dllhost\dllhost.exe"
                4⤵
                • Creates scheduled task(s)
                PID:4772
            • C:\Windows\SysWOW64\cmd.exe
              "cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "dllhost" /TR "C:\ProgramData\Dllhost\dllhost.exe"
              3⤵
              • Suspicious use of WriteProcessMemory
              PID:1064
              • C:\Windows\SysWOW64\schtasks.exe
                SCHTASKS /CREATE /SC HOURLY /TN "dllhost" /TR "C:\ProgramData\Dllhost\dllhost.exe"
                4⤵
                • Creates scheduled task(s)
                PID:4504
            • C:\Windows\SysWOW64\cmd.exe
              "cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "MicrosoftEdgeUpd" /TR "C:\ProgramData\Dllhost\dllhost.exe"
              3⤵
                PID:328
              • C:\Windows\SysWOW64\cmd.exe
                "cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "OneDriveService" /TR "C:\ProgramData\Dllhost\dllhost.exe"
                3⤵
                  PID:216
                  • C:\Windows\SysWOW64\schtasks.exe
                    SCHTASKS /CREATE /SC HOURLY /TN "OneDriveService" /TR "C:\ProgramData\Dllhost\dllhost.exe"
                    4⤵
                    • Creates scheduled task(s)
                    PID:4588
                • C:\Windows\SysWOW64\cmd.exe
                  "cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "AntiMalwareSericeExecutable\AntiMalwareSericeExecutableService_bk9449" /TR "C:\ProgramData\Dllhost\dllhost.exe"
                  3⤵
                    PID:1740
                  • C:\Windows\SysWOW64\cmd.exe
                    "cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "MicrosoftUpdateServices\MicrosoftUpdateServicesService_bk3815" /TR "C:\ProgramData\Dllhost\dllhost.exe"
                    3⤵
                    • Suspicious use of WriteProcessMemory
                    PID:2000
                    • C:\Windows\SysWOW64\schtasks.exe
                      SCHTASKS /CREATE /SC HOURLY /TN "MicrosoftUpdateServices\MicrosoftUpdateServicesService_bk3815" /TR "C:\ProgramData\Dllhost\dllhost.exe"
                      4⤵
                      • Creates scheduled task(s)
                      PID:4488
                  • C:\Windows\SysWOW64\cmd.exe
                    "cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "SettingSysHost\SettingSysHostService_bk3063" /TR "C:\ProgramData\Dllhost\dllhost.exe"
                    3⤵
                      PID:2388
                    • C:\Windows\SysWOW64\cmd.exe
                      "cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "WindowsDefenderServices\WindowsDefenderServicesService_bk7277" /TR "C:\ProgramData\Dllhost\dllhost.exe"
                      3⤵
                      • Suspicious use of WriteProcessMemory
                      PID:2248
                      • C:\Windows\SysWOW64\schtasks.exe
                        SCHTASKS /CREATE /SC HOURLY /TN "WindowsDefenderServices\WindowsDefenderServicesService_bk7277" /TR "C:\ProgramData\Dllhost\dllhost.exe"
                        4⤵
                        • Creates scheduled task(s)
                        PID:4788
                    • C:\Windows\SysWOW64\cmd.exe
                      "cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "NvStray" /TR "C:\ProgramData\Dllhost\dllhost.exe"
                      3⤵
                      • Suspicious use of WriteProcessMemory
                      PID:3844
                      • C:\Windows\SysWOW64\schtasks.exe
                        SCHTASKS /CREATE /SC HOURLY /TN "NvStray" /TR "C:\ProgramData\Dllhost\dllhost.exe"
                        4⤵
                        • Creates scheduled task(s)
                        PID:4784
                    • C:\Windows\SysWOW64\cmd.exe
                      "cmd.exe" /c chcp 1251 & C:\ProgramData\Dllhost\winlogson.exe --config msi.bin --log off
                      3⤵
                        PID:1504
                        • C:\Windows\SysWOW64\chcp.com
                          chcp 1251
                          4⤵
                            PID:4848
                        • C:\Windows\SysWOW64\cmd.exe
                          "cmd.exe" /c chcp 1251 & C:\ProgramData\Dllhost\winlogson.exe --config msi.bin --log off
                          3⤵
                            PID:1308
                            • C:\Windows\SysWOW64\chcp.com
                              chcp 1251
                              4⤵
                                PID:1828

                        Network

                        MITRE ATT&CK Enterprise v6

                        Replay Monitor

                        Loading Replay Monitor...

                        Downloads

                        • C:\ProgramData\Dllhost\dllhost.exe

                          Filesize

                          949KB

                          MD5

                          00424b21f3d70a9078578c7d4497239d

                          SHA1

                          daee74bb50dbfee854dc539ce3a1084c642ac61d

                          SHA256

                          9dea2f4cc60ad0bd90f2613d5ca1576b95c9456e2324cb6d19084b71df371df4

                          SHA512

                          a9b1ec486e03e503b407a24c095c596d1bc34c70c8b1e9f1517ce95bf7008df28152c1c8551df71768bdd6bf68fb6974713743497a507528d7fc3de74f301efa

                        • C:\ProgramData\Dllhost\dllhost.exe

                          Filesize

                          949KB

                          MD5

                          00424b21f3d70a9078578c7d4497239d

                          SHA1

                          daee74bb50dbfee854dc539ce3a1084c642ac61d

                          SHA256

                          9dea2f4cc60ad0bd90f2613d5ca1576b95c9456e2324cb6d19084b71df371df4

                          SHA512

                          a9b1ec486e03e503b407a24c095c596d1bc34c70c8b1e9f1517ce95bf7008df28152c1c8551df71768bdd6bf68fb6974713743497a507528d7fc3de74f301efa

                        • C:\ProgramData\HostData\logs.uce

                          Filesize

                          497B

                          MD5

                          13fda2ab01b83a5130842a5bab3892d3

                          SHA1

                          6e18e4b467cde054a63a95d4dfc030f156ecd215

                          SHA256

                          76973d42c8fceceab7ec85b3d01b218db92564993e93a9bea31c52aa73aeee9e

                          SHA512

                          c51f9fd6e452fbeeedd4dfaba3c7c887e337f01e68abdd27d4032f8be85def7ef3cf0c77bf60e425b085b76c0539464c6b6e5e805a69397c5519e8ccf9fffccc

                        • memory/2584-146-0x0000000077A40000-0x0000000077BCE000-memory.dmp

                          Filesize

                          1.6MB

                        • memory/2584-130-0x0000000077A40000-0x0000000077BCE000-memory.dmp

                          Filesize

                          1.6MB

                        • memory/2584-138-0x0000000077A40000-0x0000000077BCE000-memory.dmp

                          Filesize

                          1.6MB

                        • memory/2584-139-0x0000000077A40000-0x0000000077BCE000-memory.dmp

                          Filesize

                          1.6MB

                        • memory/2584-140-0x0000000077A40000-0x0000000077BCE000-memory.dmp

                          Filesize

                          1.6MB

                        • memory/2584-141-0x0000000077A40000-0x0000000077BCE000-memory.dmp

                          Filesize

                          1.6MB

                        • memory/2584-142-0x0000000077A40000-0x0000000077BCE000-memory.dmp

                          Filesize

                          1.6MB

                        • memory/2584-143-0x0000000077A40000-0x0000000077BCE000-memory.dmp

                          Filesize

                          1.6MB

                        • memory/2584-144-0x0000000077A40000-0x0000000077BCE000-memory.dmp

                          Filesize

                          1.6MB

                        • memory/2584-145-0x0000000077A40000-0x0000000077BCE000-memory.dmp

                          Filesize

                          1.6MB

                        • memory/2584-117-0x0000000077A40000-0x0000000077BCE000-memory.dmp

                          Filesize

                          1.6MB

                        • memory/2584-147-0x0000000077A40000-0x0000000077BCE000-memory.dmp

                          Filesize

                          1.6MB

                        • memory/2584-148-0x0000000077A40000-0x0000000077BCE000-memory.dmp

                          Filesize

                          1.6MB

                        • memory/2584-149-0x0000000077A40000-0x0000000077BCE000-memory.dmp

                          Filesize

                          1.6MB

                        • memory/2584-150-0x0000000000530000-0x00000000005D8000-memory.dmp

                          Filesize

                          672KB

                        • memory/2584-151-0x0000000077A40000-0x0000000077BCE000-memory.dmp

                          Filesize

                          1.6MB

                        • memory/2584-152-0x0000000077A40000-0x0000000077BCE000-memory.dmp

                          Filesize

                          1.6MB

                        • memory/2584-153-0x0000000077A40000-0x0000000077BCE000-memory.dmp

                          Filesize

                          1.6MB

                        • memory/2584-154-0x0000000005420000-0x000000000591E000-memory.dmp

                          Filesize

                          5.0MB

                        • memory/2584-155-0x0000000004E00000-0x0000000004E92000-memory.dmp

                          Filesize

                          584KB

                        • memory/2584-156-0x0000000077A40000-0x0000000077BCE000-memory.dmp

                          Filesize

                          1.6MB

                        • memory/2584-157-0x0000000077A40000-0x0000000077BCE000-memory.dmp

                          Filesize

                          1.6MB

                        • memory/2584-158-0x0000000077A40000-0x0000000077BCE000-memory.dmp

                          Filesize

                          1.6MB

                        • memory/2584-159-0x0000000077A40000-0x0000000077BCE000-memory.dmp

                          Filesize

                          1.6MB

                        • memory/2584-160-0x0000000077A40000-0x0000000077BCE000-memory.dmp

                          Filesize

                          1.6MB

                        • memory/2584-161-0x0000000077A40000-0x0000000077BCE000-memory.dmp

                          Filesize

                          1.6MB

                        • memory/2584-162-0x0000000077A40000-0x0000000077BCE000-memory.dmp

                          Filesize

                          1.6MB

                        • memory/2584-163-0x0000000077A40000-0x0000000077BCE000-memory.dmp

                          Filesize

                          1.6MB

                        • memory/2584-164-0x0000000077A40000-0x0000000077BCE000-memory.dmp

                          Filesize

                          1.6MB

                        • memory/2584-165-0x0000000077A40000-0x0000000077BCE000-memory.dmp

                          Filesize

                          1.6MB

                        • memory/2584-166-0x0000000077A40000-0x0000000077BCE000-memory.dmp

                          Filesize

                          1.6MB

                        • memory/2584-167-0x0000000077A40000-0x0000000077BCE000-memory.dmp

                          Filesize

                          1.6MB

                        • memory/2584-168-0x0000000077A40000-0x0000000077BCE000-memory.dmp

                          Filesize

                          1.6MB

                        • memory/2584-169-0x0000000077A40000-0x0000000077BCE000-memory.dmp

                          Filesize

                          1.6MB

                        • memory/2584-170-0x0000000077A40000-0x0000000077BCE000-memory.dmp

                          Filesize

                          1.6MB

                        • memory/2584-171-0x0000000004EA0000-0x0000000004EAA000-memory.dmp

                          Filesize

                          40KB

                        • memory/2584-172-0x0000000005070000-0x00000000050D6000-memory.dmp

                          Filesize

                          408KB

                        • memory/2584-118-0x0000000077A40000-0x0000000077BCE000-memory.dmp

                          Filesize

                          1.6MB

                        • memory/2584-119-0x0000000077A40000-0x0000000077BCE000-memory.dmp

                          Filesize

                          1.6MB

                        • memory/2584-120-0x0000000077A40000-0x0000000077BCE000-memory.dmp

                          Filesize

                          1.6MB

                        • memory/2584-121-0x0000000077A40000-0x0000000077BCE000-memory.dmp

                          Filesize

                          1.6MB

                        • memory/2584-122-0x0000000077A40000-0x0000000077BCE000-memory.dmp

                          Filesize

                          1.6MB

                        • memory/2584-123-0x0000000077A40000-0x0000000077BCE000-memory.dmp

                          Filesize

                          1.6MB

                        • memory/2584-124-0x0000000077A40000-0x0000000077BCE000-memory.dmp

                          Filesize

                          1.6MB

                        • memory/2584-125-0x0000000077A40000-0x0000000077BCE000-memory.dmp

                          Filesize

                          1.6MB

                        • memory/2584-126-0x0000000077A40000-0x0000000077BCE000-memory.dmp

                          Filesize

                          1.6MB

                        • memory/2584-127-0x0000000077A40000-0x0000000077BCE000-memory.dmp

                          Filesize

                          1.6MB

                        • memory/2584-128-0x0000000077A40000-0x0000000077BCE000-memory.dmp

                          Filesize

                          1.6MB

                        • memory/2584-129-0x0000000077A40000-0x0000000077BCE000-memory.dmp

                          Filesize

                          1.6MB

                        • memory/2584-137-0x0000000077A40000-0x0000000077BCE000-memory.dmp

                          Filesize

                          1.6MB

                        • memory/2584-131-0x0000000077A40000-0x0000000077BCE000-memory.dmp

                          Filesize

                          1.6MB

                        • memory/2584-132-0x0000000077A40000-0x0000000077BCE000-memory.dmp

                          Filesize

                          1.6MB

                        • memory/2584-133-0x0000000077A40000-0x0000000077BCE000-memory.dmp

                          Filesize

                          1.6MB

                        • memory/2584-134-0x0000000077A40000-0x0000000077BCE000-memory.dmp

                          Filesize

                          1.6MB

                        • memory/2584-135-0x0000000077A40000-0x0000000077BCE000-memory.dmp

                          Filesize

                          1.6MB

                        • memory/2584-136-0x0000000077A40000-0x0000000077BCE000-memory.dmp

                          Filesize

                          1.6MB

                        • memory/3788-174-0x0000000077A40000-0x0000000077BCE000-memory.dmp

                          Filesize

                          1.6MB

                        • memory/3788-175-0x0000000077A40000-0x0000000077BCE000-memory.dmp

                          Filesize

                          1.6MB

                        • memory/3788-176-0x0000000077A40000-0x0000000077BCE000-memory.dmp

                          Filesize

                          1.6MB

                        • memory/3788-178-0x0000000077A40000-0x0000000077BCE000-memory.dmp

                          Filesize

                          1.6MB

                        • memory/3788-177-0x0000000077A40000-0x0000000077BCE000-memory.dmp

                          Filesize

                          1.6MB

                        • memory/4716-409-0x0000000000430000-0x00000000004E0000-memory.dmp

                          Filesize

                          704KB

                        • memory/4836-182-0x0000000077A40000-0x0000000077BCE000-memory.dmp

                          Filesize

                          1.6MB

                        • memory/4836-185-0x0000000077A40000-0x0000000077BCE000-memory.dmp

                          Filesize

                          1.6MB

                        • memory/4836-184-0x0000000077A40000-0x0000000077BCE000-memory.dmp

                          Filesize

                          1.6MB

                        • memory/4836-183-0x0000000077A40000-0x0000000077BCE000-memory.dmp

                          Filesize

                          1.6MB

                        • memory/4836-181-0x0000000077A40000-0x0000000077BCE000-memory.dmp

                          Filesize

                          1.6MB

                        • memory/4836-180-0x0000000077A40000-0x0000000077BCE000-memory.dmp

                          Filesize

                          1.6MB

                        • memory/4836-186-0x0000000077A40000-0x0000000077BCE000-memory.dmp

                          Filesize

                          1.6MB

                        • memory/4868-256-0x0000000007AB0000-0x0000000007AD2000-memory.dmp

                          Filesize

                          136KB

                        • memory/4868-286-0x0000000009A40000-0x0000000009A5E000-memory.dmp

                          Filesize

                          120KB

                        • memory/4868-223-0x0000000005380000-0x00000000053B6000-memory.dmp

                          Filesize

                          216KB

                        • memory/4868-228-0x0000000007C70000-0x0000000008298000-memory.dmp

                          Filesize

                          6.2MB

                        • memory/4868-299-0x0000000009FA0000-0x000000000A034000-memory.dmp

                          Filesize

                          592KB

                        • memory/4868-295-0x0000000009E50000-0x0000000009EF5000-memory.dmp

                          Filesize

                          660KB

                        • memory/4868-188-0x0000000077A40000-0x0000000077BCE000-memory.dmp

                          Filesize

                          1.6MB

                        • memory/4868-285-0x0000000009A80000-0x0000000009AB3000-memory.dmp

                          Filesize

                          204KB

                        • memory/4868-272-0x0000000008BB0000-0x0000000008C26000-memory.dmp

                          Filesize

                          472KB

                        • memory/4868-789-0x0000000009AC0000-0x0000000009ADA000-memory.dmp

                          Filesize

                          104KB

                        • memory/4868-795-0x0000000009A70000-0x0000000009A78000-memory.dmp

                          Filesize

                          32KB

                        • memory/4868-268-0x00000000088C0000-0x000000000890B000-memory.dmp

                          Filesize

                          300KB

                        • memory/4868-261-0x0000000007B50000-0x0000000007BB6000-memory.dmp

                          Filesize

                          408KB

                        • memory/4868-267-0x0000000008360000-0x000000000837C000-memory.dmp

                          Filesize

                          112KB

                        • memory/4868-264-0x00000000084F0000-0x0000000008840000-memory.dmp

                          Filesize

                          3.3MB