Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    82s
  • max time network
    145s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220812-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
  • submitted
    08/10/2022, 11:45

General

  • Target

    3c728e72c1b0c5d0edd47901ba8c707854afce58e19ca6758203bf3715a8d96f.exe

  • Size

    959KB

  • MD5

    e9881d550e93e13bc07e4272b5120ac3

  • SHA1

    8e22f590b4c0e834ba0828104362eeb663361f9c

  • SHA256

    3c728e72c1b0c5d0edd47901ba8c707854afce58e19ca6758203bf3715a8d96f

  • SHA512

    e71deb3e4a8daa812d511e1d17dc89b7115b03a622b0db280fb493c23e695fae15693a3577c83341fa8e28c6ded6e6437b341bef7b98a46b43fc09c32fadb160

  • SSDEEP

    768:5RdutBr/u3GduUrRTj8ObyVUBMfSDFTh0lrpcxNq3ey16HMV1Iu3MCBo6qstNpzJ:5R4HmK3Tj8J4FPHMV1tNRLbwCX

Score
6/10

Malware Config

Signatures

  • Adds Run key to start application 2 TTPs 9 IoCs
  • Program crash 1 IoCs
  • Creates scheduled task(s) 1 TTPs 12 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\3c728e72c1b0c5d0edd47901ba8c707854afce58e19ca6758203bf3715a8d96f.exe
    "C:\Users\Admin\AppData\Local\Temp\3c728e72c1b0c5d0edd47901ba8c707854afce58e19ca6758203bf3715a8d96f.exe"
    1⤵
    • Adds Run key to start application
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:4016
    • C:\Windows\SysWOW64\cmd.exe
      "cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "WindowsDefender" /TR "C:\Users\Admin\AppData\Local\Temp\3c728e72c1b0c5d0edd47901ba8c707854afce58e19ca6758203bf3715a8d96f.exe"
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:4752
      • C:\Windows\SysWOW64\schtasks.exe
        SCHTASKS /CREATE /SC HOURLY /TN "WindowsDefender" /TR "C:\Users\Admin\AppData\Local\Temp\3c728e72c1b0c5d0edd47901ba8c707854afce58e19ca6758203bf3715a8d96f.exe"
        3⤵
        • Creates scheduled task(s)
        PID:4176
    • C:\Windows\SysWOW64\cmd.exe
      "cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "SecurityHealthSystray" /TR "C:\Users\Admin\AppData\Local\Temp\3c728e72c1b0c5d0edd47901ba8c707854afce58e19ca6758203bf3715a8d96f.exe"
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:4868
      • C:\Windows\SysWOW64\schtasks.exe
        SCHTASKS /CREATE /SC HOURLY /TN "SecurityHealthSystray" /TR "C:\Users\Admin\AppData\Local\Temp\3c728e72c1b0c5d0edd47901ba8c707854afce58e19ca6758203bf3715a8d96f.exe"
        3⤵
        • Creates scheduled task(s)
        PID:2284
    • C:\Windows\SysWOW64\cmd.exe
      "cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "MicrosoftEdgeUpd" /TR "C:\Users\Admin\AppData\Local\Temp\3c728e72c1b0c5d0edd47901ba8c707854afce58e19ca6758203bf3715a8d96f.exe"
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:4220
      • C:\Windows\SysWOW64\schtasks.exe
        SCHTASKS /CREATE /SC HOURLY /TN "MicrosoftEdgeUpd" /TR "C:\Users\Admin\AppData\Local\Temp\3c728e72c1b0c5d0edd47901ba8c707854afce58e19ca6758203bf3715a8d96f.exe"
        3⤵
        • Creates scheduled task(s)
        PID:3836
    • C:\Windows\SysWOW64\cmd.exe
      "cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "OneDriveService" /TR "C:\Users\Admin\AppData\Local\Temp\3c728e72c1b0c5d0edd47901ba8c707854afce58e19ca6758203bf3715a8d96f.exe"
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:3064
      • C:\Windows\SysWOW64\schtasks.exe
        SCHTASKS /CREATE /SC HOURLY /TN "OneDriveService" /TR "C:\Users\Admin\AppData\Local\Temp\3c728e72c1b0c5d0edd47901ba8c707854afce58e19ca6758203bf3715a8d96f.exe"
        3⤵
        • Creates scheduled task(s)
        PID:4984
    • C:\Windows\SysWOW64\cmd.exe
      "cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "NvStray" /TR "C:\Users\Admin\AppData\Local\Temp\3c728e72c1b0c5d0edd47901ba8c707854afce58e19ca6758203bf3715a8d96f.exe"
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:1464
      • C:\Windows\SysWOW64\schtasks.exe
        SCHTASKS /CREATE /SC HOURLY /TN "NvStray" /TR "C:\Users\Admin\AppData\Local\Temp\3c728e72c1b0c5d0edd47901ba8c707854afce58e19ca6758203bf3715a8d96f.exe"
        3⤵
        • Creates scheduled task(s)
        PID:3740
    • C:\Windows\SysWOW64\cmd.exe
      "cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "dllhost" /TR "C:\Users\Admin\AppData\Local\Temp\3c728e72c1b0c5d0edd47901ba8c707854afce58e19ca6758203bf3715a8d96f.exe"
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:3384
      • C:\Windows\SysWOW64\schtasks.exe
        SCHTASKS /CREATE /SC HOURLY /TN "dllhost" /TR "C:\Users\Admin\AppData\Local\Temp\3c728e72c1b0c5d0edd47901ba8c707854afce58e19ca6758203bf3715a8d96f.exe"
        3⤵
        • Creates scheduled task(s)
        PID:5004
    • C:\Windows\SysWOW64\cmd.exe
      "cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "AntiMalwareServiceExecutable" /TR "C:\Users\Admin\AppData\Local\Temp\3c728e72c1b0c5d0edd47901ba8c707854afce58e19ca6758203bf3715a8d96f.exe"
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:1060
      • C:\Windows\SysWOW64\schtasks.exe
        SCHTASKS /CREATE /SC HOURLY /TN "AntiMalwareServiceExecutable" /TR "C:\Users\Admin\AppData\Local\Temp\3c728e72c1b0c5d0edd47901ba8c707854afce58e19ca6758203bf3715a8d96f.exe"
        3⤵
        • Creates scheduled task(s)
        PID:4496
    • C:\Windows\SysWOW64\cmd.exe
      "cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "WmiPrvSE" /TR "C:\Users\Admin\AppData\Local\Temp\3c728e72c1b0c5d0edd47901ba8c707854afce58e19ca6758203bf3715a8d96f.exe"
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:3084
      • C:\Windows\SysWOW64\schtasks.exe
        SCHTASKS /CREATE /SC HOURLY /TN "WmiPrvSE" /TR "C:\Users\Admin\AppData\Local\Temp\3c728e72c1b0c5d0edd47901ba8c707854afce58e19ca6758203bf3715a8d96f.exe"
        3⤵
        • Creates scheduled task(s)
        PID:376
    • C:\Windows\SysWOW64\cmd.exe
      "cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "AntiMalwareSericeExecutable\AntiMalwareSericeExecutableService_bk8777" /TR "C:\Users\Admin\AppData\Local\Temp\3c728e72c1b0c5d0edd47901ba8c707854afce58e19ca6758203bf3715a8d96f.exe"
      2⤵
        PID:1456
        • C:\Windows\SysWOW64\schtasks.exe
          SCHTASKS /CREATE /SC HOURLY /TN "AntiMalwareSericeExecutable\AntiMalwareSericeExecutableService_bk8777" /TR "C:\Users\Admin\AppData\Local\Temp\3c728e72c1b0c5d0edd47901ba8c707854afce58e19ca6758203bf3715a8d96f.exe"
          3⤵
          • Creates scheduled task(s)
          PID:1484
      • C:\Windows\SysWOW64\cmd.exe
        "cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "MicrosoftUpdateServices\MicrosoftUpdateServicesService_bk2093" /TR "C:\Users\Admin\AppData\Local\Temp\3c728e72c1b0c5d0edd47901ba8c707854afce58e19ca6758203bf3715a8d96f.exe"
        2⤵
          PID:32
          • C:\Windows\SysWOW64\schtasks.exe
            SCHTASKS /CREATE /SC HOURLY /TN "MicrosoftUpdateServices\MicrosoftUpdateServicesService_bk2093" /TR "C:\Users\Admin\AppData\Local\Temp\3c728e72c1b0c5d0edd47901ba8c707854afce58e19ca6758203bf3715a8d96f.exe"
            3⤵
            • Creates scheduled task(s)
            PID:4140
        • C:\Windows\SysWOW64\cmd.exe
          "cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "WindowsDefenderServices\WindowsDefenderServicesService_bk9957" /TR "C:\Users\Admin\AppData\Local\Temp\3c728e72c1b0c5d0edd47901ba8c707854afce58e19ca6758203bf3715a8d96f.exe"
          2⤵
          • Suspicious use of WriteProcessMemory
          PID:2880
          • C:\Windows\SysWOW64\schtasks.exe
            SCHTASKS /CREATE /SC HOURLY /TN "WindowsDefenderServices\WindowsDefenderServicesService_bk9957" /TR "C:\Users\Admin\AppData\Local\Temp\3c728e72c1b0c5d0edd47901ba8c707854afce58e19ca6758203bf3715a8d96f.exe"
            3⤵
            • Creates scheduled task(s)
            PID:3268
        • C:\Windows\SysWOW64\cmd.exe
          "cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "SettingSysHost\SettingSysHostService_bk588" /TR "C:\Users\Admin\AppData\Local\Temp\3c728e72c1b0c5d0edd47901ba8c707854afce58e19ca6758203bf3715a8d96f.exe"
          2⤵
          • Suspicious use of WriteProcessMemory
          PID:644
          • C:\Windows\SysWOW64\schtasks.exe
            SCHTASKS /CREATE /SC HOURLY /TN "SettingSysHost\SettingSysHostService_bk588" /TR "C:\Users\Admin\AppData\Local\Temp\3c728e72c1b0c5d0edd47901ba8c707854afce58e19ca6758203bf3715a8d96f.exe"
            3⤵
            • Creates scheduled task(s)
            PID:5088
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -u -p 4016 -s 1040
          2⤵
          • Program crash
          PID:2144
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -pss -s 428 -p 4016 -ip 4016
        1⤵
          PID:3452

        Network

        MITRE ATT&CK Enterprise v6

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • memory/4016-135-0x0000000004C80000-0x0000000004C8A000-memory.dmp

          Filesize

          40KB

        • memory/4016-134-0x0000000004AE0000-0x0000000004B72000-memory.dmp

          Filesize

          584KB

        • memory/4016-133-0x0000000004FB0000-0x0000000005554000-memory.dmp

          Filesize

          5.6MB

        • memory/4016-132-0x0000000000090000-0x0000000000140000-memory.dmp

          Filesize

          704KB