Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
145s -
platform
windows10-1703_x64 -
resource
win10-20220901-en -
resource tags
arch:x64arch:x86image:win10-20220901-enlocale:en-usos:windows10-1703-x64system -
submitted
07/10/2022, 22:57
Static task
static1
Behavioral task
behavioral1
Sample
5f949caf7063d0c225bafe99e2f5f17db86e82b701a86d31dcfe4ce6391f4da6.exe
Resource
win10-20220901-en
General
-
Target
5f949caf7063d0c225bafe99e2f5f17db86e82b701a86d31dcfe4ce6391f4da6.exe
-
Size
732KB
-
MD5
a1088f212343e12ae1f08aceb03e60a1
-
SHA1
850e3dd004960e4086c765551a046832eb2feb18
-
SHA256
5f949caf7063d0c225bafe99e2f5f17db86e82b701a86d31dcfe4ce6391f4da6
-
SHA512
aacc5eecf0c362802ff102e488205dc519d9fc676abe256875a0603111554772efd1b4c448698390c1376834925da75dd43dfa9de4046e3d09768adc2156befa
-
SSDEEP
768:rZmchlXKGREW6VA6joSRhFH+C9Pe2auEqainmngYWxuv8Gwmwoe9R4ZstojtfcWv:schl6M+lpDCUoHid0bIrlyR
Malware Config
Signatures
-
Downloads MZ/PE file
-
Executes dropped EXE 1 IoCs
pid Process 4324 dllhost.exe -
Adds Run key to start application 2 TTPs 9 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2368682536-4045190062-1465778271-1000\Software\Microsoft\Windows\CurrentVersion\Run\SecurityHealthSystray = "C:\\Windows\\System32\\SecurityHealthSystray.exe" dllhost.exe Set value (str) \REGISTRY\USER\S-1-5-21-2368682536-4045190062-1465778271-1000\Software\Microsoft\Windows\CurrentVersion\Run\OneDriveService = "C:\\Program Files\\WindowsApps\\Microsoft.x64__8wekyb3gfdfdgd8bbwe/file.exe" dllhost.exe Set value (str) \REGISTRY\USER\S-1-5-21-2368682536-4045190062-1465778271-1000\Software\Microsoft\Windows\CurrentVersion\Run\Cortana = "C:\\Program Files\\WindowsApps\\Microsoft.x64__8wekyb3gfdfdgd8bbwe\\Cortana.exe" dllhost.exe Set value (str) \REGISTRY\USER\S-1-5-21-2368682536-4045190062-1465778271-1000\Software\Microsoft\Windows\CurrentVersion\Run\WmiPrvSE = "C:\\Windows\\System32\\wbem\\WmiPrvSE.exe" dllhost.exe Set value (str) \REGISTRY\USER\S-1-5-21-2368682536-4045190062-1465778271-1000\Software\Microsoft\Windows\CurrentVersion\Run\AntiMalwareServiceExecutable = "C:\\ProgramData\\Microsoft\\Windows Defender\\Platform\\4.18.2111.5-0\\MsMpEng.exe" dllhost.exe Set value (str) \REGISTRY\USER\S-1-5-21-2368682536-4045190062-1465778271-1000\Software\Microsoft\Windows\CurrentVersion\Run\MicrosoftEdgeUpd = "C:\\Program Files\\WindowsApps\\Microsoft.x64__8wekyb3gfdfdgd8bbwe/file.exe" dllhost.exe Set value (str) \REGISTRY\USER\S-1-5-21-2368682536-4045190062-1465778271-1000\Software\Microsoft\Windows\CurrentVersion\Run\NvStray = "C:\\Program Files\\WindowsApps\\Microsoft.x64__8wekyb3gfdfdgd8bbwe/file.exe" dllhost.exe Set value (str) \REGISTRY\USER\S-1-5-21-2368682536-4045190062-1465778271-1000\Software\Microsoft\Windows\CurrentVersion\Run\dllhost = "C:\\ProgramData\\Dllhost\\dllhost.exe" dllhost.exe Set value (str) \REGISTRY\USER\S-1-5-21-2368682536-4045190062-1465778271-1000\Software\Microsoft\Windows\CurrentVersion\Run\WindowsDefender = "C:\\Program Files\\Windows Defender\\MpCmdRun.exe" dllhost.exe -
Legitimate hosting services abused for malware hosting/C2 1 TTPs
-
Creates scheduled task(s) 1 TTPs 7 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 412 schtasks.exe 2184 schtasks.exe 4936 schtasks.exe 2372 schtasks.exe 1420 schtasks.exe 2848 schtasks.exe 508 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 5096 powershell.exe 5096 powershell.exe 5096 powershell.exe 2384 powershell.exe 2384 powershell.exe 2384 powershell.exe 4324 dllhost.exe 4324 dllhost.exe 4324 dllhost.exe 4324 dllhost.exe 4324 dllhost.exe 4324 dllhost.exe 4324 dllhost.exe 4324 dllhost.exe 4324 dllhost.exe 4324 dllhost.exe 4324 dllhost.exe 4324 dllhost.exe 4324 dllhost.exe 4324 dllhost.exe 4324 dllhost.exe 4324 dllhost.exe 4324 dllhost.exe 4324 dllhost.exe 4324 dllhost.exe 4324 dllhost.exe 4324 dllhost.exe 4324 dllhost.exe 4324 dllhost.exe 4324 dllhost.exe 4324 dllhost.exe 4324 dllhost.exe 4324 dllhost.exe 4324 dllhost.exe 4324 dllhost.exe 4324 dllhost.exe 4324 dllhost.exe 4324 dllhost.exe 4324 dllhost.exe 4324 dllhost.exe 4324 dllhost.exe 4324 dllhost.exe 4324 dllhost.exe 4324 dllhost.exe 4324 dllhost.exe 4324 dllhost.exe 4324 dllhost.exe 4324 dllhost.exe 4324 dllhost.exe 4324 dllhost.exe 4324 dllhost.exe 4324 dllhost.exe 4324 dllhost.exe 4324 dllhost.exe 4324 dllhost.exe 4324 dllhost.exe 4324 dllhost.exe 4324 dllhost.exe 4324 dllhost.exe 4324 dllhost.exe 4324 dllhost.exe 4324 dllhost.exe 4324 dllhost.exe 4324 dllhost.exe -
Suspicious use of AdjustPrivilegeToken 4 IoCs
description pid Process Token: SeDebugPrivilege 5096 powershell.exe Token: SeDebugPrivilege 2492 5f949caf7063d0c225bafe99e2f5f17db86e82b701a86d31dcfe4ce6391f4da6.exe Token: SeDebugPrivilege 2384 powershell.exe Token: SeDebugPrivilege 4324 dllhost.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2492 wrote to memory of 4048 2492 5f949caf7063d0c225bafe99e2f5f17db86e82b701a86d31dcfe4ce6391f4da6.exe 66 PID 2492 wrote to memory of 4048 2492 5f949caf7063d0c225bafe99e2f5f17db86e82b701a86d31dcfe4ce6391f4da6.exe 66 PID 2492 wrote to memory of 4048 2492 5f949caf7063d0c225bafe99e2f5f17db86e82b701a86d31dcfe4ce6391f4da6.exe 66 PID 4048 wrote to memory of 3316 4048 cmd.exe 68 PID 4048 wrote to memory of 3316 4048 cmd.exe 68 PID 4048 wrote to memory of 3316 4048 cmd.exe 68 PID 4048 wrote to memory of 5096 4048 cmd.exe 69 PID 4048 wrote to memory of 5096 4048 cmd.exe 69 PID 4048 wrote to memory of 5096 4048 cmd.exe 69 PID 4048 wrote to memory of 2384 4048 cmd.exe 70 PID 4048 wrote to memory of 2384 4048 cmd.exe 70 PID 4048 wrote to memory of 2384 4048 cmd.exe 70 PID 2492 wrote to memory of 4324 2492 5f949caf7063d0c225bafe99e2f5f17db86e82b701a86d31dcfe4ce6391f4da6.exe 71 PID 2492 wrote to memory of 4324 2492 5f949caf7063d0c225bafe99e2f5f17db86e82b701a86d31dcfe4ce6391f4da6.exe 71 PID 2492 wrote to memory of 4324 2492 5f949caf7063d0c225bafe99e2f5f17db86e82b701a86d31dcfe4ce6391f4da6.exe 71 PID 4324 wrote to memory of 4676 4324 dllhost.exe 72 PID 4324 wrote to memory of 4676 4324 dllhost.exe 72 PID 4324 wrote to memory of 4676 4324 dllhost.exe 72 PID 4324 wrote to memory of 3168 4324 dllhost.exe 73 PID 4324 wrote to memory of 3168 4324 dllhost.exe 73 PID 4324 wrote to memory of 3168 4324 dllhost.exe 73 PID 4324 wrote to memory of 4648 4324 dllhost.exe 74 PID 4324 wrote to memory of 4648 4324 dllhost.exe 74 PID 4324 wrote to memory of 4648 4324 dllhost.exe 74 PID 4324 wrote to memory of 4632 4324 dllhost.exe 75 PID 4324 wrote to memory of 4632 4324 dllhost.exe 75 PID 4324 wrote to memory of 4632 4324 dllhost.exe 75 PID 4324 wrote to memory of 4580 4324 dllhost.exe 76 PID 4324 wrote to memory of 4580 4324 dllhost.exe 76 PID 4324 wrote to memory of 4580 4324 dllhost.exe 76 PID 4324 wrote to memory of 4556 4324 dllhost.exe 93 PID 4324 wrote to memory of 4556 4324 dllhost.exe 93 PID 4324 wrote to memory of 4556 4324 dllhost.exe 93 PID 4324 wrote to memory of 3348 4324 dllhost.exe 77 PID 4324 wrote to memory of 3348 4324 dllhost.exe 77 PID 4324 wrote to memory of 3348 4324 dllhost.exe 77 PID 4324 wrote to memory of 4404 4324 dllhost.exe 78 PID 4324 wrote to memory of 4404 4324 dllhost.exe 78 PID 4324 wrote to memory of 4404 4324 dllhost.exe 78 PID 4324 wrote to memory of 4332 4324 dllhost.exe 79 PID 4324 wrote to memory of 4332 4324 dllhost.exe 79 PID 4324 wrote to memory of 4332 4324 dllhost.exe 79 PID 4324 wrote to memory of 4424 4324 dllhost.exe 84 PID 4324 wrote to memory of 4424 4324 dllhost.exe 84 PID 4324 wrote to memory of 4424 4324 dllhost.exe 84 PID 4324 wrote to memory of 4092 4324 dllhost.exe 82 PID 4324 wrote to memory of 4092 4324 dllhost.exe 82 PID 4324 wrote to memory of 4092 4324 dllhost.exe 82 PID 4324 wrote to memory of 1780 4324 dllhost.exe 85 PID 4324 wrote to memory of 1780 4324 dllhost.exe 85 PID 4324 wrote to memory of 1780 4324 dllhost.exe 85 PID 3168 wrote to memory of 508 3168 cmd.exe 95 PID 3168 wrote to memory of 508 3168 cmd.exe 95 PID 3168 wrote to memory of 508 3168 cmd.exe 95 PID 4632 wrote to memory of 412 4632 cmd.exe 96 PID 4632 wrote to memory of 412 4632 cmd.exe 96 PID 4632 wrote to memory of 412 4632 cmd.exe 96 PID 4580 wrote to memory of 2184 4580 cmd.exe 97 PID 4580 wrote to memory of 2184 4580 cmd.exe 97 PID 4580 wrote to memory of 2184 4580 cmd.exe 97 PID 3348 wrote to memory of 4936 3348 cmd.exe 98 PID 3348 wrote to memory of 4936 3348 cmd.exe 98 PID 3348 wrote to memory of 4936 3348 cmd.exe 98 PID 4424 wrote to memory of 2372 4424 cmd.exe 99
Processes
-
C:\Users\Admin\AppData\Local\Temp\5f949caf7063d0c225bafe99e2f5f17db86e82b701a86d31dcfe4ce6391f4da6.exe"C:\Users\Admin\AppData\Local\Temp\5f949caf7063d0c225bafe99e2f5f17db86e82b701a86d31dcfe4ce6391f4da6.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2492 -
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /C chcp 1251 & powershell -Command Add-MpPreference -ExclusionPath "$ENV:USERPROFILE\Desktop" & powershell -Command Add-MpPreference -ExclusionPath "C:\ProgramData\Dllhost" & powershell -Command Add-MpPreference -ExclusionPath "C:\ProgramData\HostData"2⤵
- Suspicious use of WriteProcessMemory
PID:4048 -
C:\Windows\SysWOW64\chcp.comchcp 12513⤵PID:3316
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -Command Add-MpPreference -ExclusionPath "$ENV:USERPROFILE\Desktop"3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5096
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -Command Add-MpPreference -ExclusionPath "C:\ProgramData\Dllhost"3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2384
-
-
-
C:\ProgramData\Dllhost\dllhost.exe"C:\ProgramData\Dllhost\dllhost.exe"2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4324 -
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "SecurityHealthSystray" /TR "C:\ProgramData\Dllhost\dllhost.exe"3⤵PID:4676
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "WindowsDefender" /TR "C:\ProgramData\Dllhost\dllhost.exe"3⤵
- Suspicious use of WriteProcessMemory
PID:3168 -
C:\Windows\SysWOW64\schtasks.exeSCHTASKS /CREATE /SC HOURLY /TN "WindowsDefender" /TR "C:\ProgramData\Dllhost\dllhost.exe"4⤵
- Creates scheduled task(s)
PID:508
-
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "WmiPrvSE" /TR "C:\ProgramData\Dllhost\dllhost.exe"3⤵PID:4648
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "AntiMalwareServiceExecutable" /TR "C:\ProgramData\Dllhost\dllhost.exe"3⤵
- Suspicious use of WriteProcessMemory
PID:4632 -
C:\Windows\SysWOW64\schtasks.exeSCHTASKS /CREATE /SC HOURLY /TN "AntiMalwareServiceExecutable" /TR "C:\ProgramData\Dllhost\dllhost.exe"4⤵
- Creates scheduled task(s)
PID:412
-
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "dllhost" /TR "C:\ProgramData\Dllhost\dllhost.exe"3⤵
- Suspicious use of WriteProcessMemory
PID:4580 -
C:\Windows\SysWOW64\schtasks.exeSCHTASKS /CREATE /SC HOURLY /TN "dllhost" /TR "C:\ProgramData\Dllhost\dllhost.exe"4⤵
- Creates scheduled task(s)
PID:2184
-
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "OneDriveService" /TR "C:\ProgramData\Dllhost\dllhost.exe"3⤵
- Suspicious use of WriteProcessMemory
PID:3348 -
C:\Windows\SysWOW64\schtasks.exeSCHTASKS /CREATE /SC HOURLY /TN "OneDriveService" /TR "C:\ProgramData\Dllhost\dllhost.exe"4⤵
- Creates scheduled task(s)
PID:4936
-
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "NvStray" /TR "C:\ProgramData\Dllhost\dllhost.exe"3⤵PID:4404
-
C:\Windows\SysWOW64\schtasks.exeSCHTASKS /CREATE /SC HOURLY /TN "NvStray" /TR "C:\ProgramData\Dllhost\dllhost.exe"4⤵
- Creates scheduled task(s)
PID:1420
-
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "WindowsDefenderServices\WindowsDefenderServicesService_bk2675" /TR "C:\ProgramData\Dllhost\dllhost.exe"3⤵PID:4332
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "MicrosoftUpdateServices\MicrosoftUpdateServicesService_bk3243" /TR "C:\ProgramData\Dllhost\dllhost.exe"3⤵PID:4092
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "AntiMalwareSericeExecutable\AntiMalwareSericeExecutableService_bk5756" /TR "C:\ProgramData\Dllhost\dllhost.exe"3⤵
- Suspicious use of WriteProcessMemory
PID:4424 -
C:\Windows\SysWOW64\schtasks.exeSCHTASKS /CREATE /SC HOURLY /TN "AntiMalwareSericeExecutable\AntiMalwareSericeExecutableService_bk5756" /TR "C:\ProgramData\Dllhost\dllhost.exe"4⤵
- Creates scheduled task(s)
PID:2372
-
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "SettingSysHost\SettingSysHostService_bk6391" /TR "C:\ProgramData\Dllhost\dllhost.exe"3⤵PID:1780
-
C:\Windows\SysWOW64\schtasks.exeSCHTASKS /CREATE /SC HOURLY /TN "SettingSysHost\SettingSysHostService_bk6391" /TR "C:\ProgramData\Dllhost\dllhost.exe"4⤵
- Creates scheduled task(s)
PID:2848
-
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "MicrosoftEdgeUpd" /TR "C:\ProgramData\Dllhost\dllhost.exe"3⤵PID:4556
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /c chcp 1251 & C:\ProgramData\Dllhost\winlogson.exe --config msi.bin --log off3⤵PID:3284
-
C:\Windows\SysWOW64\chcp.comchcp 12514⤵PID:4696
-
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /c chcp 1251 & C:\ProgramData\Dllhost\winlogson.exe --config msi.bin --log off3⤵PID:3672
-
C:\Windows\SysWOW64\chcp.comchcp 12514⤵PID:4780
-
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /c chcp 1251 & C:\ProgramData\Dllhost\winlogson.exe --config msi.bin --log off3⤵PID:4692
-
C:\Windows\SysWOW64\chcp.comchcp 12514⤵PID:4408
-
-
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
957KB
MD5346dccdd53b99bfce39f1fed4637fa66
SHA1614994e7e25d6a3505aca0d00d2c473b3ab09695
SHA2569b4438020cbceb176c11cd2b0e8b2544e25d823ba8a7dd772df526a2fca7ebd8
SHA512e85c31a68bb64145241ca352241582e4eeec5336202458f0e469bd9212b0260987464bab56740184775d7afa273fd29a0483f7b187441cb954e14bfbaeb14ffd
-
Filesize
957KB
MD5346dccdd53b99bfce39f1fed4637fa66
SHA1614994e7e25d6a3505aca0d00d2c473b3ab09695
SHA2569b4438020cbceb176c11cd2b0e8b2544e25d823ba8a7dd772df526a2fca7ebd8
SHA512e85c31a68bb64145241ca352241582e4eeec5336202458f0e469bd9212b0260987464bab56740184775d7afa273fd29a0483f7b187441cb954e14bfbaeb14ffd
-
Filesize
497B
MD513fda2ab01b83a5130842a5bab3892d3
SHA16e18e4b467cde054a63a95d4dfc030f156ecd215
SHA25676973d42c8fceceab7ec85b3d01b218db92564993e93a9bea31c52aa73aeee9e
SHA512c51f9fd6e452fbeeedd4dfaba3c7c887e337f01e68abdd27d4032f8be85def7ef3cf0c77bf60e425b085b76c0539464c6b6e5e805a69397c5519e8ccf9fffccc
-
Filesize
2KB
MD51c19c16e21c97ed42d5beabc93391fc5
SHA18ad83f8e0b3acf8dfbbf87931e41f0d664c4df68
SHA2561bcd97396c83babfe6c5068ba590d7a3f8b70e72955a9d1e4070648e404cbf05
SHA5127d18776d8f649b3d29c182ff03efc6cea8b527542ee55304980f24577aae8b64e37044407776e220984346c3998ace5f8853afa58c8b38407482a728e9495e0c
-
Filesize
18KB
MD55e45e8e71114feadf541664b46d92d3b
SHA1044a4ca667fd75af867fcdc46bb00247dee00458
SHA2561dac700901bc083e7537c279a427a3abb2da7e40381fdf873925739d2e54f3eb
SHA5129c6d2c0ce21c6640411557c3266eef2ae31eee6231ca94bf3c94ceb034044d61ac7f0a4dafb14598ec5ec33acbb86109175971d3bfb4defdf629075e8cbea19e