Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    121s
  • max time network
    140s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220812-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
  • submitted
    19/10/2022, 16:30

General

  • Target

    c945ca17192b854f8f33d60af055838bf6cbb9e9ab0592231e0ad8892e0e25bc.exe

  • Size

    240KB

  • MD5

    a1a00bc855869ddb2f241a4bdbfbd070

  • SHA1

    3d5b0fb5e67df7c780e927eed323aefe152c2e1f

  • SHA256

    c945ca17192b854f8f33d60af055838bf6cbb9e9ab0592231e0ad8892e0e25bc

  • SHA512

    eae8175c557133e629bfafd6f7302c277a94372ecd29180c5ee9131ed4f16921b5802bbdd4e6b5d7b438ebdfb211f0b28efa27102c274ea4aacc84521e95965d

  • SSDEEP

    6144:ZxE++swhjnZSBxnHNvPmOu+QUrT610gj7Q+:3EldAB7vPBLZ+

Malware Config

Signatures

  • ASPack v2.12-2.42 24 IoCs

    Detects executables packed with ASPack v2.12-2.42

  • Sets DLL path for service in the registry 2 TTPs 14 IoCs
  • UPX packed file 64 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Loads dropped DLL 12 IoCs
  • Drops file in System32 directory 14 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\c945ca17192b854f8f33d60af055838bf6cbb9e9ab0592231e0ad8892e0e25bc.exe
    "C:\Users\Admin\AppData\Local\Temp\c945ca17192b854f8f33d60af055838bf6cbb9e9ab0592231e0ad8892e0e25bc.exe"
    1⤵
    • Sets DLL path for service in the registry
    • Drops file in System32 directory
    • Suspicious behavior: EnumeratesProcesses
    PID:4900
  • C:\Windows\SysWOW64\svchost.exe
    C:\Windows\SysWOW64\svchost.exe -k netsvcs -s FastUserSwitchingCompatibility
    1⤵
    • Loads dropped DLL
    PID:4476
  • C:\Windows\SysWOW64\svchost.exe
    C:\Windows\SysWOW64\svchost.exe -k netsvcs -s Irmon
    1⤵
    • Loads dropped DLL
    PID:1712
  • C:\Windows\SysWOW64\svchost.exe
    C:\Windows\SysWOW64\svchost.exe -k netsvcs -s Nla
    1⤵
    • Loads dropped DLL
    PID:1520
  • C:\Windows\SysWOW64\svchost.exe
    C:\Windows\SysWOW64\svchost.exe -k netsvcs -s Ntmssvc
    1⤵
    • Loads dropped DLL
    PID:2064
  • C:\Windows\SysWOW64\svchost.exe
    C:\Windows\SysWOW64\svchost.exe -k netsvcs -s NWCWorkstation
    1⤵
    • Loads dropped DLL
    PID:1640
  • C:\Windows\SysWOW64\svchost.exe
    C:\Windows\SysWOW64\svchost.exe -k netsvcs -s Nwsapagent
    1⤵
    • Loads dropped DLL
    PID:204
  • C:\Windows\SysWOW64\svchost.exe
    C:\Windows\SysWOW64\svchost.exe -k netsvcs -s SRService
    1⤵
    • Loads dropped DLL
    PID:3892
  • C:\Windows\SysWOW64\svchost.exe
    C:\Windows\SysWOW64\svchost.exe -k netsvcs -s WmdmPmSp
    1⤵
    • Loads dropped DLL
    PID:3900
  • C:\Windows\SysWOW64\svchost.exe
    C:\Windows\SysWOW64\svchost.exe -k netsvcs -s LogonHours
    1⤵
    • Loads dropped DLL
    PID:3928
  • C:\Windows\SysWOW64\svchost.exe
    C:\Windows\SysWOW64\svchost.exe -k netsvcs -s PCAudit
    1⤵
    • Loads dropped DLL
    PID:1828
  • C:\Windows\SysWOW64\svchost.exe
    C:\Windows\SysWOW64\svchost.exe -k netsvcs -s helpsvc
    1⤵
    • Loads dropped DLL
    PID:2404
  • C:\Windows\SysWOW64\svchost.exe
    C:\Windows\SysWOW64\svchost.exe -k netsvcs -s uploadmgr
    1⤵
    • Loads dropped DLL
    PID:2196

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Windows\SysWOW64\FastUserSwitchingCompatibility.dll

    Filesize

    240KB

    MD5

    f0c3a37a40df1e2b65d54d299f7a43e0

    SHA1

    c58df056bdb0f949e5aae8d0a43a18dc321a2f66

    SHA256

    9e7ae257404bea0db1dcbc543d451038aa7cff47eccb21d0bc8544f8cb837d2c

    SHA512

    6aa1b30d4623dd5854c7482b5937d8e937dad40c7218638afb6b4c6225d4b962e881f14f7318cf8c4003e368ab3fd749baa81fcec1e22d098c0100410a88ca88

  • C:\Windows\SysWOW64\Irmon.dll

    Filesize

    240KB

    MD5

    f0c3a37a40df1e2b65d54d299f7a43e0

    SHA1

    c58df056bdb0f949e5aae8d0a43a18dc321a2f66

    SHA256

    9e7ae257404bea0db1dcbc543d451038aa7cff47eccb21d0bc8544f8cb837d2c

    SHA512

    6aa1b30d4623dd5854c7482b5937d8e937dad40c7218638afb6b4c6225d4b962e881f14f7318cf8c4003e368ab3fd749baa81fcec1e22d098c0100410a88ca88

  • C:\Windows\SysWOW64\LogonHours.dll

    Filesize

    240KB

    MD5

    f0c3a37a40df1e2b65d54d299f7a43e0

    SHA1

    c58df056bdb0f949e5aae8d0a43a18dc321a2f66

    SHA256

    9e7ae257404bea0db1dcbc543d451038aa7cff47eccb21d0bc8544f8cb837d2c

    SHA512

    6aa1b30d4623dd5854c7482b5937d8e937dad40c7218638afb6b4c6225d4b962e881f14f7318cf8c4003e368ab3fd749baa81fcec1e22d098c0100410a88ca88

  • C:\Windows\SysWOW64\NWCWorkstation.dll

    Filesize

    240KB

    MD5

    f0c3a37a40df1e2b65d54d299f7a43e0

    SHA1

    c58df056bdb0f949e5aae8d0a43a18dc321a2f66

    SHA256

    9e7ae257404bea0db1dcbc543d451038aa7cff47eccb21d0bc8544f8cb837d2c

    SHA512

    6aa1b30d4623dd5854c7482b5937d8e937dad40c7218638afb6b4c6225d4b962e881f14f7318cf8c4003e368ab3fd749baa81fcec1e22d098c0100410a88ca88

  • C:\Windows\SysWOW64\Nla.dll

    Filesize

    240KB

    MD5

    f0c3a37a40df1e2b65d54d299f7a43e0

    SHA1

    c58df056bdb0f949e5aae8d0a43a18dc321a2f66

    SHA256

    9e7ae257404bea0db1dcbc543d451038aa7cff47eccb21d0bc8544f8cb837d2c

    SHA512

    6aa1b30d4623dd5854c7482b5937d8e937dad40c7218638afb6b4c6225d4b962e881f14f7318cf8c4003e368ab3fd749baa81fcec1e22d098c0100410a88ca88

  • C:\Windows\SysWOW64\Ntmssvc.dll

    Filesize

    240KB

    MD5

    f0c3a37a40df1e2b65d54d299f7a43e0

    SHA1

    c58df056bdb0f949e5aae8d0a43a18dc321a2f66

    SHA256

    9e7ae257404bea0db1dcbc543d451038aa7cff47eccb21d0bc8544f8cb837d2c

    SHA512

    6aa1b30d4623dd5854c7482b5937d8e937dad40c7218638afb6b4c6225d4b962e881f14f7318cf8c4003e368ab3fd749baa81fcec1e22d098c0100410a88ca88

  • C:\Windows\SysWOW64\Nwsapagent.dll

    Filesize

    240KB

    MD5

    f0c3a37a40df1e2b65d54d299f7a43e0

    SHA1

    c58df056bdb0f949e5aae8d0a43a18dc321a2f66

    SHA256

    9e7ae257404bea0db1dcbc543d451038aa7cff47eccb21d0bc8544f8cb837d2c

    SHA512

    6aa1b30d4623dd5854c7482b5937d8e937dad40c7218638afb6b4c6225d4b962e881f14f7318cf8c4003e368ab3fd749baa81fcec1e22d098c0100410a88ca88

  • C:\Windows\SysWOW64\PCAudit.dll

    Filesize

    240KB

    MD5

    f0c3a37a40df1e2b65d54d299f7a43e0

    SHA1

    c58df056bdb0f949e5aae8d0a43a18dc321a2f66

    SHA256

    9e7ae257404bea0db1dcbc543d451038aa7cff47eccb21d0bc8544f8cb837d2c

    SHA512

    6aa1b30d4623dd5854c7482b5937d8e937dad40c7218638afb6b4c6225d4b962e881f14f7318cf8c4003e368ab3fd749baa81fcec1e22d098c0100410a88ca88

  • C:\Windows\SysWOW64\SRService.dll

    Filesize

    240KB

    MD5

    f0c3a37a40df1e2b65d54d299f7a43e0

    SHA1

    c58df056bdb0f949e5aae8d0a43a18dc321a2f66

    SHA256

    9e7ae257404bea0db1dcbc543d451038aa7cff47eccb21d0bc8544f8cb837d2c

    SHA512

    6aa1b30d4623dd5854c7482b5937d8e937dad40c7218638afb6b4c6225d4b962e881f14f7318cf8c4003e368ab3fd749baa81fcec1e22d098c0100410a88ca88

  • C:\Windows\SysWOW64\WmdmPmSp.dll

    Filesize

    240KB

    MD5

    f0c3a37a40df1e2b65d54d299f7a43e0

    SHA1

    c58df056bdb0f949e5aae8d0a43a18dc321a2f66

    SHA256

    9e7ae257404bea0db1dcbc543d451038aa7cff47eccb21d0bc8544f8cb837d2c

    SHA512

    6aa1b30d4623dd5854c7482b5937d8e937dad40c7218638afb6b4c6225d4b962e881f14f7318cf8c4003e368ab3fd749baa81fcec1e22d098c0100410a88ca88

  • C:\Windows\SysWOW64\helpsvc.dll

    Filesize

    240KB

    MD5

    f0c3a37a40df1e2b65d54d299f7a43e0

    SHA1

    c58df056bdb0f949e5aae8d0a43a18dc321a2f66

    SHA256

    9e7ae257404bea0db1dcbc543d451038aa7cff47eccb21d0bc8544f8cb837d2c

    SHA512

    6aa1b30d4623dd5854c7482b5937d8e937dad40c7218638afb6b4c6225d4b962e881f14f7318cf8c4003e368ab3fd749baa81fcec1e22d098c0100410a88ca88

  • C:\Windows\SysWOW64\uploadmgr.dll

    Filesize

    240KB

    MD5

    f0c3a37a40df1e2b65d54d299f7a43e0

    SHA1

    c58df056bdb0f949e5aae8d0a43a18dc321a2f66

    SHA256

    9e7ae257404bea0db1dcbc543d451038aa7cff47eccb21d0bc8544f8cb837d2c

    SHA512

    6aa1b30d4623dd5854c7482b5937d8e937dad40c7218638afb6b4c6225d4b962e881f14f7318cf8c4003e368ab3fd749baa81fcec1e22d098c0100410a88ca88

  • \??\c:\windows\SysWOW64\fastuserswitchingcompatibility.dll

    Filesize

    240KB

    MD5

    f0c3a37a40df1e2b65d54d299f7a43e0

    SHA1

    c58df056bdb0f949e5aae8d0a43a18dc321a2f66

    SHA256

    9e7ae257404bea0db1dcbc543d451038aa7cff47eccb21d0bc8544f8cb837d2c

    SHA512

    6aa1b30d4623dd5854c7482b5937d8e937dad40c7218638afb6b4c6225d4b962e881f14f7318cf8c4003e368ab3fd749baa81fcec1e22d098c0100410a88ca88

  • \??\c:\windows\SysWOW64\helpsvc.dll

    Filesize

    240KB

    MD5

    f0c3a37a40df1e2b65d54d299f7a43e0

    SHA1

    c58df056bdb0f949e5aae8d0a43a18dc321a2f66

    SHA256

    9e7ae257404bea0db1dcbc543d451038aa7cff47eccb21d0bc8544f8cb837d2c

    SHA512

    6aa1b30d4623dd5854c7482b5937d8e937dad40c7218638afb6b4c6225d4b962e881f14f7318cf8c4003e368ab3fd749baa81fcec1e22d098c0100410a88ca88

  • \??\c:\windows\SysWOW64\irmon.dll

    Filesize

    240KB

    MD5

    f0c3a37a40df1e2b65d54d299f7a43e0

    SHA1

    c58df056bdb0f949e5aae8d0a43a18dc321a2f66

    SHA256

    9e7ae257404bea0db1dcbc543d451038aa7cff47eccb21d0bc8544f8cb837d2c

    SHA512

    6aa1b30d4623dd5854c7482b5937d8e937dad40c7218638afb6b4c6225d4b962e881f14f7318cf8c4003e368ab3fd749baa81fcec1e22d098c0100410a88ca88

  • \??\c:\windows\SysWOW64\logonhours.dll

    Filesize

    240KB

    MD5

    f0c3a37a40df1e2b65d54d299f7a43e0

    SHA1

    c58df056bdb0f949e5aae8d0a43a18dc321a2f66

    SHA256

    9e7ae257404bea0db1dcbc543d451038aa7cff47eccb21d0bc8544f8cb837d2c

    SHA512

    6aa1b30d4623dd5854c7482b5937d8e937dad40c7218638afb6b4c6225d4b962e881f14f7318cf8c4003e368ab3fd749baa81fcec1e22d098c0100410a88ca88

  • \??\c:\windows\SysWOW64\nla.dll

    Filesize

    240KB

    MD5

    f0c3a37a40df1e2b65d54d299f7a43e0

    SHA1

    c58df056bdb0f949e5aae8d0a43a18dc321a2f66

    SHA256

    9e7ae257404bea0db1dcbc543d451038aa7cff47eccb21d0bc8544f8cb837d2c

    SHA512

    6aa1b30d4623dd5854c7482b5937d8e937dad40c7218638afb6b4c6225d4b962e881f14f7318cf8c4003e368ab3fd749baa81fcec1e22d098c0100410a88ca88

  • \??\c:\windows\SysWOW64\ntmssvc.dll

    Filesize

    240KB

    MD5

    f0c3a37a40df1e2b65d54d299f7a43e0

    SHA1

    c58df056bdb0f949e5aae8d0a43a18dc321a2f66

    SHA256

    9e7ae257404bea0db1dcbc543d451038aa7cff47eccb21d0bc8544f8cb837d2c

    SHA512

    6aa1b30d4623dd5854c7482b5937d8e937dad40c7218638afb6b4c6225d4b962e881f14f7318cf8c4003e368ab3fd749baa81fcec1e22d098c0100410a88ca88

  • \??\c:\windows\SysWOW64\nwcworkstation.dll

    Filesize

    240KB

    MD5

    f0c3a37a40df1e2b65d54d299f7a43e0

    SHA1

    c58df056bdb0f949e5aae8d0a43a18dc321a2f66

    SHA256

    9e7ae257404bea0db1dcbc543d451038aa7cff47eccb21d0bc8544f8cb837d2c

    SHA512

    6aa1b30d4623dd5854c7482b5937d8e937dad40c7218638afb6b4c6225d4b962e881f14f7318cf8c4003e368ab3fd749baa81fcec1e22d098c0100410a88ca88

  • \??\c:\windows\SysWOW64\nwsapagent.dll

    Filesize

    240KB

    MD5

    f0c3a37a40df1e2b65d54d299f7a43e0

    SHA1

    c58df056bdb0f949e5aae8d0a43a18dc321a2f66

    SHA256

    9e7ae257404bea0db1dcbc543d451038aa7cff47eccb21d0bc8544f8cb837d2c

    SHA512

    6aa1b30d4623dd5854c7482b5937d8e937dad40c7218638afb6b4c6225d4b962e881f14f7318cf8c4003e368ab3fd749baa81fcec1e22d098c0100410a88ca88

  • \??\c:\windows\SysWOW64\pcaudit.dll

    Filesize

    240KB

    MD5

    f0c3a37a40df1e2b65d54d299f7a43e0

    SHA1

    c58df056bdb0f949e5aae8d0a43a18dc321a2f66

    SHA256

    9e7ae257404bea0db1dcbc543d451038aa7cff47eccb21d0bc8544f8cb837d2c

    SHA512

    6aa1b30d4623dd5854c7482b5937d8e937dad40c7218638afb6b4c6225d4b962e881f14f7318cf8c4003e368ab3fd749baa81fcec1e22d098c0100410a88ca88

  • \??\c:\windows\SysWOW64\srservice.dll

    Filesize

    240KB

    MD5

    f0c3a37a40df1e2b65d54d299f7a43e0

    SHA1

    c58df056bdb0f949e5aae8d0a43a18dc321a2f66

    SHA256

    9e7ae257404bea0db1dcbc543d451038aa7cff47eccb21d0bc8544f8cb837d2c

    SHA512

    6aa1b30d4623dd5854c7482b5937d8e937dad40c7218638afb6b4c6225d4b962e881f14f7318cf8c4003e368ab3fd749baa81fcec1e22d098c0100410a88ca88

  • \??\c:\windows\SysWOW64\uploadmgr.dll

    Filesize

    240KB

    MD5

    f0c3a37a40df1e2b65d54d299f7a43e0

    SHA1

    c58df056bdb0f949e5aae8d0a43a18dc321a2f66

    SHA256

    9e7ae257404bea0db1dcbc543d451038aa7cff47eccb21d0bc8544f8cb837d2c

    SHA512

    6aa1b30d4623dd5854c7482b5937d8e937dad40c7218638afb6b4c6225d4b962e881f14f7318cf8c4003e368ab3fd749baa81fcec1e22d098c0100410a88ca88

  • \??\c:\windows\SysWOW64\wmdmpmsp.dll

    Filesize

    240KB

    MD5

    f0c3a37a40df1e2b65d54d299f7a43e0

    SHA1

    c58df056bdb0f949e5aae8d0a43a18dc321a2f66

    SHA256

    9e7ae257404bea0db1dcbc543d451038aa7cff47eccb21d0bc8544f8cb837d2c

    SHA512

    6aa1b30d4623dd5854c7482b5937d8e937dad40c7218638afb6b4c6225d4b962e881f14f7318cf8c4003e368ab3fd749baa81fcec1e22d098c0100410a88ca88

  • memory/204-164-0x0000000075470000-0x00000000754BE000-memory.dmp

    Filesize

    312KB

  • memory/204-166-0x0000000075470000-0x00000000754BE000-memory.dmp

    Filesize

    312KB

  • memory/204-199-0x0000000075470000-0x00000000754BE000-memory.dmp

    Filesize

    312KB

  • memory/204-165-0x0000000075470000-0x00000000754BE000-memory.dmp

    Filesize

    312KB

  • memory/1520-150-0x0000000075470000-0x00000000754BE000-memory.dmp

    Filesize

    312KB

  • memory/1520-151-0x0000000075470000-0x00000000754BE000-memory.dmp

    Filesize

    312KB

  • memory/1520-149-0x0000000075470000-0x00000000754BE000-memory.dmp

    Filesize

    312KB

  • memory/1640-159-0x0000000075420000-0x000000007546E000-memory.dmp

    Filesize

    312KB

  • memory/1640-161-0x0000000075420000-0x000000007546E000-memory.dmp

    Filesize

    312KB

  • memory/1640-158-0x0000000075420000-0x000000007546E000-memory.dmp

    Filesize

    312KB

  • memory/1712-145-0x0000000075470000-0x00000000754BE000-memory.dmp

    Filesize

    312KB

  • memory/1712-143-0x0000000075470000-0x00000000754BE000-memory.dmp

    Filesize

    312KB

  • memory/1712-144-0x0000000075470000-0x00000000754BE000-memory.dmp

    Filesize

    312KB

  • memory/1828-185-0x0000000075470000-0x00000000754BE000-memory.dmp

    Filesize

    312KB

  • memory/1828-184-0x0000000075470000-0x00000000754BE000-memory.dmp

    Filesize

    312KB

  • memory/1828-186-0x0000000075470000-0x00000000754BE000-memory.dmp

    Filesize

    312KB

  • memory/2064-160-0x0000000075470000-0x00000000754BE000-memory.dmp

    Filesize

    312KB

  • memory/2064-156-0x0000000075470000-0x00000000754BE000-memory.dmp

    Filesize

    312KB

  • memory/2064-157-0x0000000075470000-0x00000000754BE000-memory.dmp

    Filesize

    312KB

  • memory/2196-196-0x0000000075470000-0x00000000754BE000-memory.dmp

    Filesize

    312KB

  • memory/2196-195-0x0000000075470000-0x00000000754BE000-memory.dmp

    Filesize

    312KB

  • memory/2196-197-0x0000000075470000-0x00000000754BE000-memory.dmp

    Filesize

    312KB

  • memory/2404-191-0x0000000075470000-0x00000000754BE000-memory.dmp

    Filesize

    312KB

  • memory/2404-189-0x0000000075470000-0x00000000754BE000-memory.dmp

    Filesize

    312KB

  • memory/2404-190-0x0000000075470000-0x00000000754BE000-memory.dmp

    Filesize

    312KB

  • memory/3892-176-0x0000000075470000-0x00000000754BE000-memory.dmp

    Filesize

    312KB

  • memory/3892-200-0x0000000075470000-0x00000000754BE000-memory.dmp

    Filesize

    312KB

  • memory/3892-172-0x0000000075470000-0x00000000754BE000-memory.dmp

    Filesize

    312KB

  • memory/3892-171-0x0000000075470000-0x00000000754BE000-memory.dmp

    Filesize

    312KB

  • memory/3900-177-0x0000000075420000-0x000000007546E000-memory.dmp

    Filesize

    312KB

  • memory/3900-174-0x0000000075420000-0x000000007546E000-memory.dmp

    Filesize

    312KB

  • memory/3900-175-0x0000000075420000-0x000000007546E000-memory.dmp

    Filesize

    312KB

  • memory/3928-180-0x0000000075470000-0x00000000754BE000-memory.dmp

    Filesize

    312KB

  • memory/3928-181-0x0000000075470000-0x00000000754BE000-memory.dmp

    Filesize

    312KB

  • memory/3928-179-0x0000000075470000-0x00000000754BE000-memory.dmp

    Filesize

    312KB

  • memory/4476-137-0x0000000075470000-0x00000000754BE000-memory.dmp

    Filesize

    312KB

  • memory/4476-138-0x0000000075470000-0x00000000754BE000-memory.dmp

    Filesize

    312KB

  • memory/4476-139-0x0000000075470000-0x00000000754BE000-memory.dmp

    Filesize

    312KB

  • memory/4900-140-0x00000000025D0000-0x00000000065D0000-memory.dmp

    Filesize

    64.0MB

  • memory/4900-134-0x00000000003A0000-0x00000000003EE000-memory.dmp

    Filesize

    312KB

  • memory/4900-133-0x00000000003A0000-0x00000000003EE000-memory.dmp

    Filesize

    312KB

  • memory/4900-198-0x00000000003A0000-0x00000000003EE000-memory.dmp

    Filesize

    312KB

  • memory/4900-147-0x00000000025D0000-0x00000000065D0000-memory.dmp

    Filesize

    64.0MB

  • memory/4900-132-0x00000000003A0000-0x00000000003EE000-memory.dmp

    Filesize

    312KB