Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    91s
  • max time network
    147s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220812-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
  • submitted
    05/10/2022, 18:02

General

  • Target

    3e8ae6d873d3000b9dd899ece06673879d0de30cb211a087243d0e622e42cbcc.exe

  • Size

    951KB

  • MD5

    aeacf2b841487ac2759a2de75224f697

  • SHA1

    6f77dc36130b342ebed691e2095f014ad1b953b9

  • SHA256

    3e8ae6d873d3000b9dd899ece06673879d0de30cb211a087243d0e622e42cbcc

  • SHA512

    3634d26d218f32c2c9c7c02d4fbc923067f4b604f6f67d62286b4b4f4d012d30f1c9f0d25d61866708c897f70899de9d57ec523e4985d48c6fd46fd700cf58d1

  • SSDEEP

    768:5RdutBr/u3GduUrRTj8ObyVUBMfSDFTh0lrpcxNq3ey16HMV1Iu3MCBo6qstNpzJ:5R4HmK3Tj8J4FPHMV1tNRLbwCX

Score
6/10

Malware Config

Signatures

  • Adds Run key to start application 2 TTPs 9 IoCs
  • Program crash 1 IoCs
  • Creates scheduled task(s) 1 TTPs 11 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\3e8ae6d873d3000b9dd899ece06673879d0de30cb211a087243d0e622e42cbcc.exe
    "C:\Users\Admin\AppData\Local\Temp\3e8ae6d873d3000b9dd899ece06673879d0de30cb211a087243d0e622e42cbcc.exe"
    1⤵
    • Adds Run key to start application
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:4928
    • C:\Windows\SysWOW64\cmd.exe
      "cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "SecurityHealthSystray" /TR "C:\Users\Admin\AppData\Local\Temp\3e8ae6d873d3000b9dd899ece06673879d0de30cb211a087243d0e622e42cbcc.exe"
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:4220
      • C:\Windows\SysWOW64\schtasks.exe
        SCHTASKS /CREATE /SC HOURLY /TN "SecurityHealthSystray" /TR "C:\Users\Admin\AppData\Local\Temp\3e8ae6d873d3000b9dd899ece06673879d0de30cb211a087243d0e622e42cbcc.exe"
        3⤵
        • Creates scheduled task(s)
        PID:1212
    • C:\Windows\SysWOW64\cmd.exe
      "cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "WindowsDefender" /TR "C:\Users\Admin\AppData\Local\Temp\3e8ae6d873d3000b9dd899ece06673879d0de30cb211a087243d0e622e42cbcc.exe"
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:768
      • C:\Windows\SysWOW64\schtasks.exe
        SCHTASKS /CREATE /SC HOURLY /TN "WindowsDefender" /TR "C:\Users\Admin\AppData\Local\Temp\3e8ae6d873d3000b9dd899ece06673879d0de30cb211a087243d0e622e42cbcc.exe"
        3⤵
        • Creates scheduled task(s)
        PID:3376
    • C:\Windows\SysWOW64\cmd.exe
      "cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "OneDriveService" /TR "C:\Users\Admin\AppData\Local\Temp\3e8ae6d873d3000b9dd899ece06673879d0de30cb211a087243d0e622e42cbcc.exe"
      2⤵
        PID:1372
      • C:\Windows\SysWOW64\cmd.exe
        "cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "NvStray" /TR "C:\Users\Admin\AppData\Local\Temp\3e8ae6d873d3000b9dd899ece06673879d0de30cb211a087243d0e622e42cbcc.exe"
        2⤵
        • Suspicious use of WriteProcessMemory
        PID:1836
        • C:\Windows\SysWOW64\schtasks.exe
          SCHTASKS /CREATE /SC HOURLY /TN "NvStray" /TR "C:\Users\Admin\AppData\Local\Temp\3e8ae6d873d3000b9dd899ece06673879d0de30cb211a087243d0e622e42cbcc.exe"
          3⤵
          • Creates scheduled task(s)
          PID:3116
      • C:\Windows\SysWOW64\cmd.exe
        "cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "MicrosoftEdgeUpd" /TR "C:\Users\Admin\AppData\Local\Temp\3e8ae6d873d3000b9dd899ece06673879d0de30cb211a087243d0e622e42cbcc.exe"
        2⤵
          PID:1096
          • C:\Windows\SysWOW64\schtasks.exe
            SCHTASKS /CREATE /SC HOURLY /TN "MicrosoftEdgeUpd" /TR "C:\Users\Admin\AppData\Local\Temp\3e8ae6d873d3000b9dd899ece06673879d0de30cb211a087243d0e622e42cbcc.exe"
            3⤵
            • Creates scheduled task(s)
            PID:1820
        • C:\Windows\SysWOW64\cmd.exe
          "cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "dllhost" /TR "C:\Users\Admin\AppData\Local\Temp\3e8ae6d873d3000b9dd899ece06673879d0de30cb211a087243d0e622e42cbcc.exe"
          2⤵
          • Suspicious use of WriteProcessMemory
          PID:1712
          • C:\Windows\SysWOW64\schtasks.exe
            SCHTASKS /CREATE /SC HOURLY /TN "dllhost" /TR "C:\Users\Admin\AppData\Local\Temp\3e8ae6d873d3000b9dd899ece06673879d0de30cb211a087243d0e622e42cbcc.exe"
            3⤵
            • Creates scheduled task(s)
            PID:1620
        • C:\Windows\SysWOW64\cmd.exe
          "cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "AntiMalwareServiceExecutable" /TR "C:\Users\Admin\AppData\Local\Temp\3e8ae6d873d3000b9dd899ece06673879d0de30cb211a087243d0e622e42cbcc.exe"
          2⤵
          • Suspicious use of WriteProcessMemory
          PID:4444
          • C:\Windows\SysWOW64\schtasks.exe
            SCHTASKS /CREATE /SC HOURLY /TN "AntiMalwareServiceExecutable" /TR "C:\Users\Admin\AppData\Local\Temp\3e8ae6d873d3000b9dd899ece06673879d0de30cb211a087243d0e622e42cbcc.exe"
            3⤵
            • Creates scheduled task(s)
            PID:2940
        • C:\Windows\SysWOW64\cmd.exe
          "cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "WmiPrvSE" /TR "C:\Users\Admin\AppData\Local\Temp\3e8ae6d873d3000b9dd899ece06673879d0de30cb211a087243d0e622e42cbcc.exe"
          2⤵
          • Suspicious use of WriteProcessMemory
          PID:4152
          • C:\Windows\SysWOW64\schtasks.exe
            SCHTASKS /CREATE /SC HOURLY /TN "WmiPrvSE" /TR "C:\Users\Admin\AppData\Local\Temp\3e8ae6d873d3000b9dd899ece06673879d0de30cb211a087243d0e622e42cbcc.exe"
            3⤵
            • Creates scheduled task(s)
            PID:3704
        • C:\Windows\SysWOW64\cmd.exe
          "cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "WindowsDefenderServices\WindowsDefenderServicesService_bk6705" /TR "C:\Users\Admin\AppData\Local\Temp\3e8ae6d873d3000b9dd899ece06673879d0de30cb211a087243d0e622e42cbcc.exe"
          2⤵
          • Suspicious use of WriteProcessMemory
          PID:3176
          • C:\Windows\SysWOW64\schtasks.exe
            SCHTASKS /CREATE /SC HOURLY /TN "WindowsDefenderServices\WindowsDefenderServicesService_bk6705" /TR "C:\Users\Admin\AppData\Local\Temp\3e8ae6d873d3000b9dd899ece06673879d0de30cb211a087243d0e622e42cbcc.exe"
            3⤵
            • Creates scheduled task(s)
            PID:3108
        • C:\Windows\SysWOW64\cmd.exe
          "cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "MicrosoftUpdateServices\MicrosoftUpdateServicesService_bk2085" /TR "C:\Users\Admin\AppData\Local\Temp\3e8ae6d873d3000b9dd899ece06673879d0de30cb211a087243d0e622e42cbcc.exe"
          2⤵
          • Suspicious use of WriteProcessMemory
          PID:3480
          • C:\Windows\SysWOW64\schtasks.exe
            SCHTASKS /CREATE /SC HOURLY /TN "MicrosoftUpdateServices\MicrosoftUpdateServicesService_bk2085" /TR "C:\Users\Admin\AppData\Local\Temp\3e8ae6d873d3000b9dd899ece06673879d0de30cb211a087243d0e622e42cbcc.exe"
            3⤵
            • Creates scheduled task(s)
            PID:4064
        • C:\Windows\SysWOW64\cmd.exe
          "cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "SettingSysHost\SettingSysHostService_bk1180" /TR "C:\Users\Admin\AppData\Local\Temp\3e8ae6d873d3000b9dd899ece06673879d0de30cb211a087243d0e622e42cbcc.exe"
          2⤵
          • Suspicious use of WriteProcessMemory
          PID:220
          • C:\Windows\SysWOW64\schtasks.exe
            SCHTASKS /CREATE /SC HOURLY /TN "SettingSysHost\SettingSysHostService_bk1180" /TR "C:\Users\Admin\AppData\Local\Temp\3e8ae6d873d3000b9dd899ece06673879d0de30cb211a087243d0e622e42cbcc.exe"
            3⤵
            • Creates scheduled task(s)
            PID:3740
        • C:\Windows\SysWOW64\cmd.exe
          "cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "AntiMalwareSericeExecutable\AntiMalwareSericeExecutableService_bk4414" /TR "C:\Users\Admin\AppData\Local\Temp\3e8ae6d873d3000b9dd899ece06673879d0de30cb211a087243d0e622e42cbcc.exe"
          2⤵
          • Suspicious use of WriteProcessMemory
          PID:4512
          • C:\Windows\SysWOW64\schtasks.exe
            SCHTASKS /CREATE /SC HOURLY /TN "AntiMalwareSericeExecutable\AntiMalwareSericeExecutableService_bk4414" /TR "C:\Users\Admin\AppData\Local\Temp\3e8ae6d873d3000b9dd899ece06673879d0de30cb211a087243d0e622e42cbcc.exe"
            3⤵
            • Creates scheduled task(s)
            PID:3940
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -u -p 4928 -s 1368
          2⤵
          • Program crash
          PID:328
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -pss -s 464 -p 4928 -ip 4928
        1⤵
          PID:3104

        Network

        MITRE ATT&CK Enterprise v6

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • memory/4928-132-0x0000000000840000-0x00000000008F0000-memory.dmp

          Filesize

          704KB

        • memory/4928-135-0x0000000005430000-0x000000000543A000-memory.dmp

          Filesize

          40KB

        • memory/4928-134-0x0000000005340000-0x00000000053D2000-memory.dmp

          Filesize

          584KB

        • memory/4928-133-0x0000000005A70000-0x0000000006014000-memory.dmp

          Filesize

          5.6MB