Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    150s
  • max time network
    145s
  • platform
    windows10-1703_x64
  • resource
    win10-20220901-en
  • resource tags

    arch:x64arch:x86image:win10-20220901-enlocale:en-usos:windows10-1703-x64system
  • submitted
    07/10/2022, 22:57

General

  • Target

    5f949caf7063d0c225bafe99e2f5f17db86e82b701a86d31dcfe4ce6391f4da6.exe

  • Size

    732KB

  • MD5

    a1088f212343e12ae1f08aceb03e60a1

  • SHA1

    850e3dd004960e4086c765551a046832eb2feb18

  • SHA256

    5f949caf7063d0c225bafe99e2f5f17db86e82b701a86d31dcfe4ce6391f4da6

  • SHA512

    aacc5eecf0c362802ff102e488205dc519d9fc676abe256875a0603111554772efd1b4c448698390c1376834925da75dd43dfa9de4046e3d09768adc2156befa

  • SSDEEP

    768:rZmchlXKGREW6VA6joSRhFH+C9Pe2auEqainmngYWxuv8Gwmwoe9R4ZstojtfcWv:schl6M+lpDCUoHid0bIrlyR

Score
8/10

Malware Config

Signatures

  • Downloads MZ/PE file
  • Executes dropped EXE 1 IoCs
  • Adds Run key to start application 2 TTPs 9 IoCs
  • Legitimate hosting services abused for malware hosting/C2 1 TTPs
  • Creates scheduled task(s) 1 TTPs 7 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 4 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\5f949caf7063d0c225bafe99e2f5f17db86e82b701a86d31dcfe4ce6391f4da6.exe
    "C:\Users\Admin\AppData\Local\Temp\5f949caf7063d0c225bafe99e2f5f17db86e82b701a86d31dcfe4ce6391f4da6.exe"
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:2492
    • C:\Windows\SysWOW64\cmd.exe
      "cmd.exe" /C chcp 1251 & powershell -Command Add-MpPreference -ExclusionPath "$ENV:USERPROFILE\Desktop" & powershell -Command Add-MpPreference -ExclusionPath "C:\ProgramData\Dllhost" & powershell -Command Add-MpPreference -ExclusionPath "C:\ProgramData\HostData"
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:4048
      • C:\Windows\SysWOW64\chcp.com
        chcp 1251
        3⤵
          PID:3316
        • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
          powershell -Command Add-MpPreference -ExclusionPath "$ENV:USERPROFILE\Desktop"
          3⤵
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:5096
        • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
          powershell -Command Add-MpPreference -ExclusionPath "C:\ProgramData\Dllhost"
          3⤵
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:2384
      • C:\ProgramData\Dllhost\dllhost.exe
        "C:\ProgramData\Dllhost\dllhost.exe"
        2⤵
        • Executes dropped EXE
        • Adds Run key to start application
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:4324
        • C:\Windows\SysWOW64\cmd.exe
          "cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "SecurityHealthSystray" /TR "C:\ProgramData\Dllhost\dllhost.exe"
          3⤵
            PID:4676
          • C:\Windows\SysWOW64\cmd.exe
            "cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "WindowsDefender" /TR "C:\ProgramData\Dllhost\dllhost.exe"
            3⤵
            • Suspicious use of WriteProcessMemory
            PID:3168
            • C:\Windows\SysWOW64\schtasks.exe
              SCHTASKS /CREATE /SC HOURLY /TN "WindowsDefender" /TR "C:\ProgramData\Dllhost\dllhost.exe"
              4⤵
              • Creates scheduled task(s)
              PID:508
          • C:\Windows\SysWOW64\cmd.exe
            "cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "WmiPrvSE" /TR "C:\ProgramData\Dllhost\dllhost.exe"
            3⤵
              PID:4648
            • C:\Windows\SysWOW64\cmd.exe
              "cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "AntiMalwareServiceExecutable" /TR "C:\ProgramData\Dllhost\dllhost.exe"
              3⤵
              • Suspicious use of WriteProcessMemory
              PID:4632
              • C:\Windows\SysWOW64\schtasks.exe
                SCHTASKS /CREATE /SC HOURLY /TN "AntiMalwareServiceExecutable" /TR "C:\ProgramData\Dllhost\dllhost.exe"
                4⤵
                • Creates scheduled task(s)
                PID:412
            • C:\Windows\SysWOW64\cmd.exe
              "cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "dllhost" /TR "C:\ProgramData\Dllhost\dllhost.exe"
              3⤵
              • Suspicious use of WriteProcessMemory
              PID:4580
              • C:\Windows\SysWOW64\schtasks.exe
                SCHTASKS /CREATE /SC HOURLY /TN "dllhost" /TR "C:\ProgramData\Dllhost\dllhost.exe"
                4⤵
                • Creates scheduled task(s)
                PID:2184
            • C:\Windows\SysWOW64\cmd.exe
              "cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "OneDriveService" /TR "C:\ProgramData\Dllhost\dllhost.exe"
              3⤵
              • Suspicious use of WriteProcessMemory
              PID:3348
              • C:\Windows\SysWOW64\schtasks.exe
                SCHTASKS /CREATE /SC HOURLY /TN "OneDriveService" /TR "C:\ProgramData\Dllhost\dllhost.exe"
                4⤵
                • Creates scheduled task(s)
                PID:4936
            • C:\Windows\SysWOW64\cmd.exe
              "cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "NvStray" /TR "C:\ProgramData\Dllhost\dllhost.exe"
              3⤵
                PID:4404
                • C:\Windows\SysWOW64\schtasks.exe
                  SCHTASKS /CREATE /SC HOURLY /TN "NvStray" /TR "C:\ProgramData\Dllhost\dllhost.exe"
                  4⤵
                  • Creates scheduled task(s)
                  PID:1420
              • C:\Windows\SysWOW64\cmd.exe
                "cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "WindowsDefenderServices\WindowsDefenderServicesService_bk2675" /TR "C:\ProgramData\Dllhost\dllhost.exe"
                3⤵
                  PID:4332
                • C:\Windows\SysWOW64\cmd.exe
                  "cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "MicrosoftUpdateServices\MicrosoftUpdateServicesService_bk3243" /TR "C:\ProgramData\Dllhost\dllhost.exe"
                  3⤵
                    PID:4092
                  • C:\Windows\SysWOW64\cmd.exe
                    "cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "AntiMalwareSericeExecutable\AntiMalwareSericeExecutableService_bk5756" /TR "C:\ProgramData\Dllhost\dllhost.exe"
                    3⤵
                    • Suspicious use of WriteProcessMemory
                    PID:4424
                    • C:\Windows\SysWOW64\schtasks.exe
                      SCHTASKS /CREATE /SC HOURLY /TN "AntiMalwareSericeExecutable\AntiMalwareSericeExecutableService_bk5756" /TR "C:\ProgramData\Dllhost\dllhost.exe"
                      4⤵
                      • Creates scheduled task(s)
                      PID:2372
                  • C:\Windows\SysWOW64\cmd.exe
                    "cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "SettingSysHost\SettingSysHostService_bk6391" /TR "C:\ProgramData\Dllhost\dllhost.exe"
                    3⤵
                      PID:1780
                      • C:\Windows\SysWOW64\schtasks.exe
                        SCHTASKS /CREATE /SC HOURLY /TN "SettingSysHost\SettingSysHostService_bk6391" /TR "C:\ProgramData\Dllhost\dllhost.exe"
                        4⤵
                        • Creates scheduled task(s)
                        PID:2848
                    • C:\Windows\SysWOW64\cmd.exe
                      "cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "MicrosoftEdgeUpd" /TR "C:\ProgramData\Dllhost\dllhost.exe"
                      3⤵
                        PID:4556
                      • C:\Windows\SysWOW64\cmd.exe
                        "cmd.exe" /c chcp 1251 & C:\ProgramData\Dllhost\winlogson.exe --config msi.bin --log off
                        3⤵
                          PID:3284
                          • C:\Windows\SysWOW64\chcp.com
                            chcp 1251
                            4⤵
                              PID:4696
                          • C:\Windows\SysWOW64\cmd.exe
                            "cmd.exe" /c chcp 1251 & C:\ProgramData\Dllhost\winlogson.exe --config msi.bin --log off
                            3⤵
                              PID:3672
                              • C:\Windows\SysWOW64\chcp.com
                                chcp 1251
                                4⤵
                                  PID:4780
                              • C:\Windows\SysWOW64\cmd.exe
                                "cmd.exe" /c chcp 1251 & C:\ProgramData\Dllhost\winlogson.exe --config msi.bin --log off
                                3⤵
                                  PID:4692
                                  • C:\Windows\SysWOW64\chcp.com
                                    chcp 1251
                                    4⤵
                                      PID:4408

                              Network

                              MITRE ATT&CK Enterprise v6

                              Replay Monitor

                              Loading Replay Monitor...

                              Downloads

                              • C:\ProgramData\Dllhost\dllhost.exe

                                Filesize

                                957KB

                                MD5

                                346dccdd53b99bfce39f1fed4637fa66

                                SHA1

                                614994e7e25d6a3505aca0d00d2c473b3ab09695

                                SHA256

                                9b4438020cbceb176c11cd2b0e8b2544e25d823ba8a7dd772df526a2fca7ebd8

                                SHA512

                                e85c31a68bb64145241ca352241582e4eeec5336202458f0e469bd9212b0260987464bab56740184775d7afa273fd29a0483f7b187441cb954e14bfbaeb14ffd

                              • C:\ProgramData\Dllhost\dllhost.exe

                                Filesize

                                957KB

                                MD5

                                346dccdd53b99bfce39f1fed4637fa66

                                SHA1

                                614994e7e25d6a3505aca0d00d2c473b3ab09695

                                SHA256

                                9b4438020cbceb176c11cd2b0e8b2544e25d823ba8a7dd772df526a2fca7ebd8

                                SHA512

                                e85c31a68bb64145241ca352241582e4eeec5336202458f0e469bd9212b0260987464bab56740184775d7afa273fd29a0483f7b187441cb954e14bfbaeb14ffd

                              • C:\ProgramData\HostData\logs.uce

                                Filesize

                                497B

                                MD5

                                13fda2ab01b83a5130842a5bab3892d3

                                SHA1

                                6e18e4b467cde054a63a95d4dfc030f156ecd215

                                SHA256

                                76973d42c8fceceab7ec85b3d01b218db92564993e93a9bea31c52aa73aeee9e

                                SHA512

                                c51f9fd6e452fbeeedd4dfaba3c7c887e337f01e68abdd27d4032f8be85def7ef3cf0c77bf60e425b085b76c0539464c6b6e5e805a69397c5519e8ccf9fffccc

                              • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log

                                Filesize

                                2KB

                                MD5

                                1c19c16e21c97ed42d5beabc93391fc5

                                SHA1

                                8ad83f8e0b3acf8dfbbf87931e41f0d664c4df68

                                SHA256

                                1bcd97396c83babfe6c5068ba590d7a3f8b70e72955a9d1e4070648e404cbf05

                                SHA512

                                7d18776d8f649b3d29c182ff03efc6cea8b527542ee55304980f24577aae8b64e37044407776e220984346c3998ace5f8853afa58c8b38407482a728e9495e0c

                              • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                Filesize

                                18KB

                                MD5

                                5e45e8e71114feadf541664b46d92d3b

                                SHA1

                                044a4ca667fd75af867fcdc46bb00247dee00458

                                SHA256

                                1dac700901bc083e7537c279a427a3abb2da7e40381fdf873925739d2e54f3eb

                                SHA512

                                9c6d2c0ce21c6640411557c3266eef2ae31eee6231ca94bf3c94ceb034044d61ac7f0a4dafb14598ec5ec33acbb86109175971d3bfb4defdf629075e8cbea19e

                              • memory/2492-149-0x0000000077D90000-0x0000000077F1E000-memory.dmp

                                Filesize

                                1.6MB

                              • memory/2492-128-0x0000000077D90000-0x0000000077F1E000-memory.dmp

                                Filesize

                                1.6MB

                              • memory/2492-134-0x0000000077D90000-0x0000000077F1E000-memory.dmp

                                Filesize

                                1.6MB

                              • memory/2492-135-0x0000000077D90000-0x0000000077F1E000-memory.dmp

                                Filesize

                                1.6MB

                              • memory/2492-136-0x0000000077D90000-0x0000000077F1E000-memory.dmp

                                Filesize

                                1.6MB

                              • memory/2492-137-0x0000000077D90000-0x0000000077F1E000-memory.dmp

                                Filesize

                                1.6MB

                              • memory/2492-138-0x0000000077D90000-0x0000000077F1E000-memory.dmp

                                Filesize

                                1.6MB

                              • memory/2492-139-0x0000000077D90000-0x0000000077F1E000-memory.dmp

                                Filesize

                                1.6MB

                              • memory/2492-140-0x0000000077D90000-0x0000000077F1E000-memory.dmp

                                Filesize

                                1.6MB

                              • memory/2492-141-0x0000000077D90000-0x0000000077F1E000-memory.dmp

                                Filesize

                                1.6MB

                              • memory/2492-142-0x0000000077D90000-0x0000000077F1E000-memory.dmp

                                Filesize

                                1.6MB

                              • memory/2492-144-0x0000000077D90000-0x0000000077F1E000-memory.dmp

                                Filesize

                                1.6MB

                              • memory/2492-143-0x0000000077D90000-0x0000000077F1E000-memory.dmp

                                Filesize

                                1.6MB

                              • memory/2492-145-0x0000000077D90000-0x0000000077F1E000-memory.dmp

                                Filesize

                                1.6MB

                              • memory/2492-146-0x0000000077D90000-0x0000000077F1E000-memory.dmp

                                Filesize

                                1.6MB

                              • memory/2492-147-0x0000000077D90000-0x0000000077F1E000-memory.dmp

                                Filesize

                                1.6MB

                              • memory/2492-148-0x0000000077D90000-0x0000000077F1E000-memory.dmp

                                Filesize

                                1.6MB

                              • memory/2492-120-0x0000000077D90000-0x0000000077F1E000-memory.dmp

                                Filesize

                                1.6MB

                              • memory/2492-150-0x0000000077D90000-0x0000000077F1E000-memory.dmp

                                Filesize

                                1.6MB

                              • memory/2492-151-0x0000000077D90000-0x0000000077F1E000-memory.dmp

                                Filesize

                                1.6MB

                              • memory/2492-152-0x0000000077D90000-0x0000000077F1E000-memory.dmp

                                Filesize

                                1.6MB

                              • memory/2492-153-0x0000000000F80000-0x0000000001028000-memory.dmp

                                Filesize

                                672KB

                              • memory/2492-154-0x0000000077D90000-0x0000000077F1E000-memory.dmp

                                Filesize

                                1.6MB

                              • memory/2492-155-0x0000000077D90000-0x0000000077F1E000-memory.dmp

                                Filesize

                                1.6MB

                              • memory/2492-156-0x0000000077D90000-0x0000000077F1E000-memory.dmp

                                Filesize

                                1.6MB

                              • memory/2492-157-0x0000000005DB0000-0x00000000062AE000-memory.dmp

                                Filesize

                                5.0MB

                              • memory/2492-158-0x00000000058B0000-0x0000000005942000-memory.dmp

                                Filesize

                                584KB

                              • memory/2492-159-0x0000000077D90000-0x0000000077F1E000-memory.dmp

                                Filesize

                                1.6MB

                              • memory/2492-160-0x0000000077D90000-0x0000000077F1E000-memory.dmp

                                Filesize

                                1.6MB

                              • memory/2492-161-0x0000000077D90000-0x0000000077F1E000-memory.dmp

                                Filesize

                                1.6MB

                              • memory/2492-162-0x0000000077D90000-0x0000000077F1E000-memory.dmp

                                Filesize

                                1.6MB

                              • memory/2492-163-0x0000000077D90000-0x0000000077F1E000-memory.dmp

                                Filesize

                                1.6MB

                              • memory/2492-164-0x0000000077D90000-0x0000000077F1E000-memory.dmp

                                Filesize

                                1.6MB

                              • memory/2492-165-0x0000000077D90000-0x0000000077F1E000-memory.dmp

                                Filesize

                                1.6MB

                              • memory/2492-166-0x0000000077D90000-0x0000000077F1E000-memory.dmp

                                Filesize

                                1.6MB

                              • memory/2492-167-0x0000000077D90000-0x0000000077F1E000-memory.dmp

                                Filesize

                                1.6MB

                              • memory/2492-168-0x0000000077D90000-0x0000000077F1E000-memory.dmp

                                Filesize

                                1.6MB

                              • memory/2492-169-0x0000000077D90000-0x0000000077F1E000-memory.dmp

                                Filesize

                                1.6MB

                              • memory/2492-170-0x0000000077D90000-0x0000000077F1E000-memory.dmp

                                Filesize

                                1.6MB

                              • memory/2492-171-0x0000000077D90000-0x0000000077F1E000-memory.dmp

                                Filesize

                                1.6MB

                              • memory/2492-172-0x0000000077D90000-0x0000000077F1E000-memory.dmp

                                Filesize

                                1.6MB

                              • memory/2492-173-0x0000000077D90000-0x0000000077F1E000-memory.dmp

                                Filesize

                                1.6MB

                              • memory/2492-174-0x0000000005850000-0x000000000585A000-memory.dmp

                                Filesize

                                40KB

                              • memory/2492-175-0x0000000005AF0000-0x0000000005B56000-memory.dmp

                                Filesize

                                408KB

                              • memory/2492-121-0x0000000077D90000-0x0000000077F1E000-memory.dmp

                                Filesize

                                1.6MB

                              • memory/2492-122-0x0000000077D90000-0x0000000077F1E000-memory.dmp

                                Filesize

                                1.6MB

                              • memory/2492-123-0x0000000077D90000-0x0000000077F1E000-memory.dmp

                                Filesize

                                1.6MB

                              • memory/2492-124-0x0000000077D90000-0x0000000077F1E000-memory.dmp

                                Filesize

                                1.6MB

                              • memory/2492-125-0x0000000077D90000-0x0000000077F1E000-memory.dmp

                                Filesize

                                1.6MB

                              • memory/2492-126-0x0000000077D90000-0x0000000077F1E000-memory.dmp

                                Filesize

                                1.6MB

                              • memory/2492-127-0x0000000077D90000-0x0000000077F1E000-memory.dmp

                                Filesize

                                1.6MB

                              • memory/2492-129-0x0000000077D90000-0x0000000077F1E000-memory.dmp

                                Filesize

                                1.6MB

                              • memory/2492-133-0x0000000077D90000-0x0000000077F1E000-memory.dmp

                                Filesize

                                1.6MB

                              • memory/2492-130-0x0000000077D90000-0x0000000077F1E000-memory.dmp

                                Filesize

                                1.6MB

                              • memory/2492-131-0x0000000077D90000-0x0000000077F1E000-memory.dmp

                                Filesize

                                1.6MB

                              • memory/2492-132-0x0000000077D90000-0x0000000077F1E000-memory.dmp

                                Filesize

                                1.6MB

                              • memory/3316-185-0x0000000077D90000-0x0000000077F1E000-memory.dmp

                                Filesize

                                1.6MB

                              • memory/3316-186-0x0000000077D90000-0x0000000077F1E000-memory.dmp

                                Filesize

                                1.6MB

                              • memory/3316-187-0x0000000077D90000-0x0000000077F1E000-memory.dmp

                                Filesize

                                1.6MB

                              • memory/3316-184-0x0000000077D90000-0x0000000077F1E000-memory.dmp

                                Filesize

                                1.6MB

                              • memory/3316-189-0x0000000077D90000-0x0000000077F1E000-memory.dmp

                                Filesize

                                1.6MB

                              • memory/3316-188-0x0000000077D90000-0x0000000077F1E000-memory.dmp

                                Filesize

                                1.6MB

                              • memory/3316-183-0x0000000077D90000-0x0000000077F1E000-memory.dmp

                                Filesize

                                1.6MB

                              • memory/4048-181-0x0000000077D90000-0x0000000077F1E000-memory.dmp

                                Filesize

                                1.6MB

                              • memory/4048-178-0x0000000077D90000-0x0000000077F1E000-memory.dmp

                                Filesize

                                1.6MB

                              • memory/4048-179-0x0000000077D90000-0x0000000077F1E000-memory.dmp

                                Filesize

                                1.6MB

                              • memory/4048-180-0x0000000077D90000-0x0000000077F1E000-memory.dmp

                                Filesize

                                1.6MB

                              • memory/4048-177-0x0000000077D90000-0x0000000077F1E000-memory.dmp

                                Filesize

                                1.6MB

                              • memory/4324-719-0x0000000000A70000-0x0000000000B20000-memory.dmp

                                Filesize

                                704KB

                              • memory/5096-264-0x0000000007F80000-0x00000000082D0000-memory.dmp

                                Filesize

                                3.3MB

                              • memory/5096-510-0x0000000009960000-0x0000000009968000-memory.dmp

                                Filesize

                                32KB

                              • memory/5096-260-0x0000000007C30000-0x0000000007C96000-memory.dmp

                                Filesize

                                408KB

                              • memory/5096-288-0x0000000009710000-0x0000000009743000-memory.dmp

                                Filesize

                                204KB

                              • memory/5096-191-0x0000000077D90000-0x0000000077F1E000-memory.dmp

                                Filesize

                                1.6MB

                              • memory/5096-254-0x0000000007560000-0x0000000007582000-memory.dmp

                                Filesize

                                136KB

                              • memory/5096-289-0x00000000096D0000-0x00000000096EE000-memory.dmp

                                Filesize

                                120KB

                              • memory/5096-275-0x00000000085B0000-0x0000000008626000-memory.dmp

                                Filesize

                                472KB

                              • memory/5096-231-0x0000000007600000-0x0000000007C28000-memory.dmp

                                Filesize

                                6.2MB

                              • memory/5096-505-0x0000000009970000-0x000000000998A000-memory.dmp

                                Filesize

                                104KB

                              • memory/5096-226-0x0000000004B00000-0x0000000004B36000-memory.dmp

                                Filesize

                                216KB

                              • memory/5096-270-0x0000000007DC0000-0x0000000007DDC000-memory.dmp

                                Filesize

                                112KB

                              • memory/5096-298-0x0000000009750000-0x00000000097F5000-memory.dmp

                                Filesize

                                660KB

                              • memory/5096-271-0x0000000008350000-0x000000000839B000-memory.dmp

                                Filesize

                                300KB

                              • memory/5096-302-0x00000000099D0000-0x0000000009A64000-memory.dmp

                                Filesize

                                592KB