Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    71s
  • max time network
    41s
  • platform
    windows7_x64
  • resource
    win7-20220812-en
  • resource tags

    arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
  • submitted
    30/10/2022, 02:01

General

  • Target

    a6dc1423a43d623df6f7dda0fc75bc4e4447b000c09a0b9e7c60852091d195cd.exe

  • Size

    328KB

  • MD5

    a2b4e4c13a74e4e0078d75d1de6af200

  • SHA1

    1e9bd794bd92f0e210347447fad22e8983372bd8

  • SHA256

    a6dc1423a43d623df6f7dda0fc75bc4e4447b000c09a0b9e7c60852091d195cd

  • SHA512

    4cbcecc9d5e0cb74f433c960f1a930482ae27837967266a8cf5c99c63436cc26cc56bfc63ea55519364abdda839df61b237166cfb9ae24b68941fce6c9391bbd

  • SSDEEP

    6144:eQVUclRDvO4SIA1AT+UBiPVCi55bdbP9GwCUKMCuxZG:e2tbDvJAmTs9C+hGaCkZG

Malware Config

Signatures

  • ASPack v2.12-2.42 26 IoCs

    Detects executables packed with ASPack v2.12-2.42

  • Executes dropped EXE 1 IoCs
  • Sets DLL path for service in the registry 2 TTPs 14 IoCs
  • UPX packed file 57 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Loads dropped DLL 12 IoCs
  • Drops file in System32 directory 14 IoCs
  • Suspicious behavior: EnumeratesProcesses 1 IoCs
  • Suspicious use of WriteProcessMemory 7 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\a6dc1423a43d623df6f7dda0fc75bc4e4447b000c09a0b9e7c60852091d195cd.exe
    "C:\Users\Admin\AppData\Local\Temp\a6dc1423a43d623df6f7dda0fc75bc4e4447b000c09a0b9e7c60852091d195cd.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:1348
    • C:\73d549ed.exe
      C:\73d549ed.exe
      2⤵
      • Executes dropped EXE
      • Sets DLL path for service in the registry
      • Drops file in System32 directory
      • Suspicious behavior: EnumeratesProcesses
      PID:1236
  • C:\Windows\SysWOW64\svchost.exe
    C:\Windows\SysWOW64\svchost.exe -k netsvcs
    1⤵
    • Loads dropped DLL
    PID:240
  • C:\Windows\SysWOW64\svchost.exe
    C:\Windows\SysWOW64\svchost.exe -k netsvcs
    1⤵
    • Loads dropped DLL
    PID:1928
  • C:\Windows\SysWOW64\svchost.exe
    C:\Windows\SysWOW64\svchost.exe -k netsvcs
    1⤵
    • Loads dropped DLL
    PID:1044
  • C:\Windows\SysWOW64\svchost.exe
    C:\Windows\SysWOW64\svchost.exe -k netsvcs
    1⤵
    • Loads dropped DLL
    PID:1636
  • C:\Windows\SysWOW64\svchost.exe
    C:\Windows\SysWOW64\svchost.exe -k netsvcs
    1⤵
    • Loads dropped DLL
    PID:820
  • C:\Windows\SysWOW64\svchost.exe
    C:\Windows\SysWOW64\svchost.exe -k netsvcs
    1⤵
    • Loads dropped DLL
    PID:1724
  • C:\Windows\SysWOW64\svchost.exe
    C:\Windows\SysWOW64\svchost.exe -k netsvcs
    1⤵
    • Loads dropped DLL
    PID:1592
  • C:\Windows\SysWOW64\svchost.exe
    C:\Windows\SysWOW64\svchost.exe -k netsvcs
    1⤵
      PID:2028
    • C:\Windows\SysWOW64\svchost.exe
      C:\Windows\SysWOW64\svchost.exe -k netsvcs
      1⤵
      • Loads dropped DLL
      PID:2040
    • C:\Windows\SysWOW64\svchost.exe
      C:\Windows\SysWOW64\svchost.exe -k netsvcs
      1⤵
      • Loads dropped DLL
      PID:1572
    • C:\Windows\SysWOW64\svchost.exe
      C:\Windows\SysWOW64\svchost.exe -k netsvcs
      1⤵
      • Loads dropped DLL
      PID:736
    • C:\Windows\SysWOW64\svchost.exe
      C:\Windows\SysWOW64\svchost.exe -k netsvcs
      1⤵
      • Loads dropped DLL
      PID:848
    • C:\Windows\SysWOW64\svchost.exe
      C:\Windows\SysWOW64\svchost.exe -k netsvcs
      1⤵
      • Loads dropped DLL
      PID:1800

    Network

    MITRE ATT&CK Enterprise v6

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\73d549ed.exe

      Filesize

      250KB

      MD5

      95b2ca34a5d74a9cd8a0c2d22cc8a8a8

      SHA1

      92fa4cadb1a88806e1b554f88401c7f658339b1d

      SHA256

      41ca492793be2f0dd5e02c3598789e28d1f1149f2a8948554d23ff9db8560d98

      SHA512

      77fbbd0fd964cf85b9e7b1fe0f1b982f670d9c55b7514f0f5e011fe554be6bc4464d6649cf47e3df779c3e4bd8cd5afc589b17c91171e19591881e370cc5270e

    • C:\73d549ed.exe

      Filesize

      250KB

      MD5

      95b2ca34a5d74a9cd8a0c2d22cc8a8a8

      SHA1

      92fa4cadb1a88806e1b554f88401c7f658339b1d

      SHA256

      41ca492793be2f0dd5e02c3598789e28d1f1149f2a8948554d23ff9db8560d98

      SHA512

      77fbbd0fd964cf85b9e7b1fe0f1b982f670d9c55b7514f0f5e011fe554be6bc4464d6649cf47e3df779c3e4bd8cd5afc589b17c91171e19591881e370cc5270e

    • \??\c:\windows\SysWOW64\fastuserswitchingcompatibility.dll

      Filesize

      250KB

      MD5

      11267b7c61c5eb1fd3e34f7ad04092dc

      SHA1

      66101923af0125624b6f8b177075bd6c5e141883

      SHA256

      91fb32d3a26686d4f10066fd83c141a7361a35c9bc7d6ad60e680c6df8a26677

      SHA512

      4b19209afe67635ca7b3b79f1984fdd260e8a8b6208c3453c6306276a08d45e29e856dc8a7d67072fe693d4df7dfdb5bd7b429aae3f3a25c8db927412c6f13d4

    • \??\c:\windows\SysWOW64\helpsvc.dll

      Filesize

      250KB

      MD5

      11267b7c61c5eb1fd3e34f7ad04092dc

      SHA1

      66101923af0125624b6f8b177075bd6c5e141883

      SHA256

      91fb32d3a26686d4f10066fd83c141a7361a35c9bc7d6ad60e680c6df8a26677

      SHA512

      4b19209afe67635ca7b3b79f1984fdd260e8a8b6208c3453c6306276a08d45e29e856dc8a7d67072fe693d4df7dfdb5bd7b429aae3f3a25c8db927412c6f13d4

    • \??\c:\windows\SysWOW64\irmon.dll

      Filesize

      250KB

      MD5

      11267b7c61c5eb1fd3e34f7ad04092dc

      SHA1

      66101923af0125624b6f8b177075bd6c5e141883

      SHA256

      91fb32d3a26686d4f10066fd83c141a7361a35c9bc7d6ad60e680c6df8a26677

      SHA512

      4b19209afe67635ca7b3b79f1984fdd260e8a8b6208c3453c6306276a08d45e29e856dc8a7d67072fe693d4df7dfdb5bd7b429aae3f3a25c8db927412c6f13d4

    • \??\c:\windows\SysWOW64\logonhours.dll

      Filesize

      250KB

      MD5

      11267b7c61c5eb1fd3e34f7ad04092dc

      SHA1

      66101923af0125624b6f8b177075bd6c5e141883

      SHA256

      91fb32d3a26686d4f10066fd83c141a7361a35c9bc7d6ad60e680c6df8a26677

      SHA512

      4b19209afe67635ca7b3b79f1984fdd260e8a8b6208c3453c6306276a08d45e29e856dc8a7d67072fe693d4df7dfdb5bd7b429aae3f3a25c8db927412c6f13d4

    • \??\c:\windows\SysWOW64\nla.dll

      Filesize

      250KB

      MD5

      11267b7c61c5eb1fd3e34f7ad04092dc

      SHA1

      66101923af0125624b6f8b177075bd6c5e141883

      SHA256

      91fb32d3a26686d4f10066fd83c141a7361a35c9bc7d6ad60e680c6df8a26677

      SHA512

      4b19209afe67635ca7b3b79f1984fdd260e8a8b6208c3453c6306276a08d45e29e856dc8a7d67072fe693d4df7dfdb5bd7b429aae3f3a25c8db927412c6f13d4

    • \??\c:\windows\SysWOW64\ntmssvc.dll

      Filesize

      250KB

      MD5

      11267b7c61c5eb1fd3e34f7ad04092dc

      SHA1

      66101923af0125624b6f8b177075bd6c5e141883

      SHA256

      91fb32d3a26686d4f10066fd83c141a7361a35c9bc7d6ad60e680c6df8a26677

      SHA512

      4b19209afe67635ca7b3b79f1984fdd260e8a8b6208c3453c6306276a08d45e29e856dc8a7d67072fe693d4df7dfdb5bd7b429aae3f3a25c8db927412c6f13d4

    • \??\c:\windows\SysWOW64\nwcworkstation.dll

      Filesize

      250KB

      MD5

      11267b7c61c5eb1fd3e34f7ad04092dc

      SHA1

      66101923af0125624b6f8b177075bd6c5e141883

      SHA256

      91fb32d3a26686d4f10066fd83c141a7361a35c9bc7d6ad60e680c6df8a26677

      SHA512

      4b19209afe67635ca7b3b79f1984fdd260e8a8b6208c3453c6306276a08d45e29e856dc8a7d67072fe693d4df7dfdb5bd7b429aae3f3a25c8db927412c6f13d4

    • \??\c:\windows\SysWOW64\nwsapagent.dll

      Filesize

      250KB

      MD5

      11267b7c61c5eb1fd3e34f7ad04092dc

      SHA1

      66101923af0125624b6f8b177075bd6c5e141883

      SHA256

      91fb32d3a26686d4f10066fd83c141a7361a35c9bc7d6ad60e680c6df8a26677

      SHA512

      4b19209afe67635ca7b3b79f1984fdd260e8a8b6208c3453c6306276a08d45e29e856dc8a7d67072fe693d4df7dfdb5bd7b429aae3f3a25c8db927412c6f13d4

    • \??\c:\windows\SysWOW64\pcaudit.dll

      Filesize

      250KB

      MD5

      11267b7c61c5eb1fd3e34f7ad04092dc

      SHA1

      66101923af0125624b6f8b177075bd6c5e141883

      SHA256

      91fb32d3a26686d4f10066fd83c141a7361a35c9bc7d6ad60e680c6df8a26677

      SHA512

      4b19209afe67635ca7b3b79f1984fdd260e8a8b6208c3453c6306276a08d45e29e856dc8a7d67072fe693d4df7dfdb5bd7b429aae3f3a25c8db927412c6f13d4

    • \??\c:\windows\SysWOW64\srservice.dll

      Filesize

      250KB

      MD5

      11267b7c61c5eb1fd3e34f7ad04092dc

      SHA1

      66101923af0125624b6f8b177075bd6c5e141883

      SHA256

      91fb32d3a26686d4f10066fd83c141a7361a35c9bc7d6ad60e680c6df8a26677

      SHA512

      4b19209afe67635ca7b3b79f1984fdd260e8a8b6208c3453c6306276a08d45e29e856dc8a7d67072fe693d4df7dfdb5bd7b429aae3f3a25c8db927412c6f13d4

    • \??\c:\windows\SysWOW64\uploadmgr.dll

      Filesize

      250KB

      MD5

      11267b7c61c5eb1fd3e34f7ad04092dc

      SHA1

      66101923af0125624b6f8b177075bd6c5e141883

      SHA256

      91fb32d3a26686d4f10066fd83c141a7361a35c9bc7d6ad60e680c6df8a26677

      SHA512

      4b19209afe67635ca7b3b79f1984fdd260e8a8b6208c3453c6306276a08d45e29e856dc8a7d67072fe693d4df7dfdb5bd7b429aae3f3a25c8db927412c6f13d4

    • \??\c:\windows\SysWOW64\wmdmpmsp.dll

      Filesize

      250KB

      MD5

      11267b7c61c5eb1fd3e34f7ad04092dc

      SHA1

      66101923af0125624b6f8b177075bd6c5e141883

      SHA256

      91fb32d3a26686d4f10066fd83c141a7361a35c9bc7d6ad60e680c6df8a26677

      SHA512

      4b19209afe67635ca7b3b79f1984fdd260e8a8b6208c3453c6306276a08d45e29e856dc8a7d67072fe693d4df7dfdb5bd7b429aae3f3a25c8db927412c6f13d4

    • \Windows\SysWOW64\FastUserSwitchingCompatibility.dll

      Filesize

      250KB

      MD5

      11267b7c61c5eb1fd3e34f7ad04092dc

      SHA1

      66101923af0125624b6f8b177075bd6c5e141883

      SHA256

      91fb32d3a26686d4f10066fd83c141a7361a35c9bc7d6ad60e680c6df8a26677

      SHA512

      4b19209afe67635ca7b3b79f1984fdd260e8a8b6208c3453c6306276a08d45e29e856dc8a7d67072fe693d4df7dfdb5bd7b429aae3f3a25c8db927412c6f13d4

    • \Windows\SysWOW64\Irmon.dll

      Filesize

      250KB

      MD5

      11267b7c61c5eb1fd3e34f7ad04092dc

      SHA1

      66101923af0125624b6f8b177075bd6c5e141883

      SHA256

      91fb32d3a26686d4f10066fd83c141a7361a35c9bc7d6ad60e680c6df8a26677

      SHA512

      4b19209afe67635ca7b3b79f1984fdd260e8a8b6208c3453c6306276a08d45e29e856dc8a7d67072fe693d4df7dfdb5bd7b429aae3f3a25c8db927412c6f13d4

    • \Windows\SysWOW64\LogonHours.dll

      Filesize

      250KB

      MD5

      11267b7c61c5eb1fd3e34f7ad04092dc

      SHA1

      66101923af0125624b6f8b177075bd6c5e141883

      SHA256

      91fb32d3a26686d4f10066fd83c141a7361a35c9bc7d6ad60e680c6df8a26677

      SHA512

      4b19209afe67635ca7b3b79f1984fdd260e8a8b6208c3453c6306276a08d45e29e856dc8a7d67072fe693d4df7dfdb5bd7b429aae3f3a25c8db927412c6f13d4

    • \Windows\SysWOW64\NWCWorkstation.dll

      Filesize

      250KB

      MD5

      11267b7c61c5eb1fd3e34f7ad04092dc

      SHA1

      66101923af0125624b6f8b177075bd6c5e141883

      SHA256

      91fb32d3a26686d4f10066fd83c141a7361a35c9bc7d6ad60e680c6df8a26677

      SHA512

      4b19209afe67635ca7b3b79f1984fdd260e8a8b6208c3453c6306276a08d45e29e856dc8a7d67072fe693d4df7dfdb5bd7b429aae3f3a25c8db927412c6f13d4

    • \Windows\SysWOW64\Nla.dll

      Filesize

      250KB

      MD5

      11267b7c61c5eb1fd3e34f7ad04092dc

      SHA1

      66101923af0125624b6f8b177075bd6c5e141883

      SHA256

      91fb32d3a26686d4f10066fd83c141a7361a35c9bc7d6ad60e680c6df8a26677

      SHA512

      4b19209afe67635ca7b3b79f1984fdd260e8a8b6208c3453c6306276a08d45e29e856dc8a7d67072fe693d4df7dfdb5bd7b429aae3f3a25c8db927412c6f13d4

    • \Windows\SysWOW64\Ntmssvc.dll

      Filesize

      250KB

      MD5

      11267b7c61c5eb1fd3e34f7ad04092dc

      SHA1

      66101923af0125624b6f8b177075bd6c5e141883

      SHA256

      91fb32d3a26686d4f10066fd83c141a7361a35c9bc7d6ad60e680c6df8a26677

      SHA512

      4b19209afe67635ca7b3b79f1984fdd260e8a8b6208c3453c6306276a08d45e29e856dc8a7d67072fe693d4df7dfdb5bd7b429aae3f3a25c8db927412c6f13d4

    • \Windows\SysWOW64\Nwsapagent.dll

      Filesize

      250KB

      MD5

      11267b7c61c5eb1fd3e34f7ad04092dc

      SHA1

      66101923af0125624b6f8b177075bd6c5e141883

      SHA256

      91fb32d3a26686d4f10066fd83c141a7361a35c9bc7d6ad60e680c6df8a26677

      SHA512

      4b19209afe67635ca7b3b79f1984fdd260e8a8b6208c3453c6306276a08d45e29e856dc8a7d67072fe693d4df7dfdb5bd7b429aae3f3a25c8db927412c6f13d4

    • \Windows\SysWOW64\PCAudit.dll

      Filesize

      250KB

      MD5

      11267b7c61c5eb1fd3e34f7ad04092dc

      SHA1

      66101923af0125624b6f8b177075bd6c5e141883

      SHA256

      91fb32d3a26686d4f10066fd83c141a7361a35c9bc7d6ad60e680c6df8a26677

      SHA512

      4b19209afe67635ca7b3b79f1984fdd260e8a8b6208c3453c6306276a08d45e29e856dc8a7d67072fe693d4df7dfdb5bd7b429aae3f3a25c8db927412c6f13d4

    • \Windows\SysWOW64\SRService.dll

      Filesize

      250KB

      MD5

      11267b7c61c5eb1fd3e34f7ad04092dc

      SHA1

      66101923af0125624b6f8b177075bd6c5e141883

      SHA256

      91fb32d3a26686d4f10066fd83c141a7361a35c9bc7d6ad60e680c6df8a26677

      SHA512

      4b19209afe67635ca7b3b79f1984fdd260e8a8b6208c3453c6306276a08d45e29e856dc8a7d67072fe693d4df7dfdb5bd7b429aae3f3a25c8db927412c6f13d4

    • \Windows\SysWOW64\WmdmPmSp.dll

      Filesize

      250KB

      MD5

      11267b7c61c5eb1fd3e34f7ad04092dc

      SHA1

      66101923af0125624b6f8b177075bd6c5e141883

      SHA256

      91fb32d3a26686d4f10066fd83c141a7361a35c9bc7d6ad60e680c6df8a26677

      SHA512

      4b19209afe67635ca7b3b79f1984fdd260e8a8b6208c3453c6306276a08d45e29e856dc8a7d67072fe693d4df7dfdb5bd7b429aae3f3a25c8db927412c6f13d4

    • \Windows\SysWOW64\helpsvc.dll

      Filesize

      250KB

      MD5

      11267b7c61c5eb1fd3e34f7ad04092dc

      SHA1

      66101923af0125624b6f8b177075bd6c5e141883

      SHA256

      91fb32d3a26686d4f10066fd83c141a7361a35c9bc7d6ad60e680c6df8a26677

      SHA512

      4b19209afe67635ca7b3b79f1984fdd260e8a8b6208c3453c6306276a08d45e29e856dc8a7d67072fe693d4df7dfdb5bd7b429aae3f3a25c8db927412c6f13d4

    • \Windows\SysWOW64\uploadmgr.dll

      Filesize

      250KB

      MD5

      11267b7c61c5eb1fd3e34f7ad04092dc

      SHA1

      66101923af0125624b6f8b177075bd6c5e141883

      SHA256

      91fb32d3a26686d4f10066fd83c141a7361a35c9bc7d6ad60e680c6df8a26677

      SHA512

      4b19209afe67635ca7b3b79f1984fdd260e8a8b6208c3453c6306276a08d45e29e856dc8a7d67072fe693d4df7dfdb5bd7b429aae3f3a25c8db927412c6f13d4

    • memory/240-66-0x0000000074820000-0x000000007486D000-memory.dmp

      Filesize

      308KB

    • memory/240-67-0x0000000074820000-0x000000007486D000-memory.dmp

      Filesize

      308KB

    • memory/240-68-0x0000000074820000-0x000000007486D000-memory.dmp

      Filesize

      308KB

    • memory/736-124-0x0000000074820000-0x000000007486D000-memory.dmp

      Filesize

      308KB

    • memory/736-123-0x0000000074820000-0x000000007486D000-memory.dmp

      Filesize

      308KB

    • memory/736-122-0x0000000074820000-0x000000007486D000-memory.dmp

      Filesize

      308KB

    • memory/820-95-0x0000000074820000-0x000000007486D000-memory.dmp

      Filesize

      308KB

    • memory/820-94-0x0000000074820000-0x000000007486D000-memory.dmp

      Filesize

      308KB

    • memory/820-96-0x0000000074820000-0x000000007486D000-memory.dmp

      Filesize

      308KB

    • memory/848-129-0x0000000074820000-0x000000007486D000-memory.dmp

      Filesize

      308KB

    • memory/848-130-0x0000000074820000-0x000000007486D000-memory.dmp

      Filesize

      308KB

    • memory/848-128-0x0000000074820000-0x000000007486D000-memory.dmp

      Filesize

      308KB

    • memory/1044-83-0x0000000074820000-0x000000007486D000-memory.dmp

      Filesize

      308KB

    • memory/1044-80-0x0000000074820000-0x000000007486D000-memory.dmp

      Filesize

      308KB

    • memory/1044-81-0x0000000074820000-0x000000007486D000-memory.dmp

      Filesize

      308KB

    • memory/1044-82-0x0000000074820000-0x000000007486D000-memory.dmp

      Filesize

      308KB

    • memory/1236-69-0x00000000000F0000-0x000000000013D000-memory.dmp

      Filesize

      308KB

    • memory/1236-137-0x00000000000F0000-0x00000000000FD000-memory.dmp

      Filesize

      52KB

    • memory/1236-136-0x0000000001370000-0x00000000013BD000-memory.dmp

      Filesize

      308KB

    • memory/1236-70-0x00000000027C0000-0x00000000067C0000-memory.dmp

      Filesize

      64.0MB

    • memory/1236-62-0x0000000001370000-0x00000000013BD000-memory.dmp

      Filesize

      308KB

    • memory/1236-59-0x0000000074F41000-0x0000000074F43000-memory.dmp

      Filesize

      8KB

    • memory/1236-58-0x0000000001370000-0x00000000013BD000-memory.dmp

      Filesize

      308KB

    • memory/1236-90-0x00000000027C0000-0x00000000067C0000-memory.dmp

      Filesize

      64.0MB

    • memory/1236-61-0x0000000001370000-0x00000000013BD000-memory.dmp

      Filesize

      308KB

    • memory/1348-57-0x0000000000160000-0x00000000001AD000-memory.dmp

      Filesize

      308KB

    • memory/1348-56-0x0000000000400000-0x0000000000454000-memory.dmp

      Filesize

      336KB

    • memory/1348-97-0x0000000000400000-0x0000000000454000-memory.dmp

      Filesize

      336KB

    • memory/1592-108-0x0000000074820000-0x000000007486D000-memory.dmp

      Filesize

      308KB

    • memory/1592-107-0x0000000074820000-0x000000007486D000-memory.dmp

      Filesize

      308KB

    • memory/1592-106-0x0000000074820000-0x000000007486D000-memory.dmp

      Filesize

      308KB

    • memory/1636-88-0x0000000074820000-0x000000007486D000-memory.dmp

      Filesize

      308KB

    • memory/1636-89-0x0000000074820000-0x000000007486D000-memory.dmp

      Filesize

      308KB

    • memory/1636-87-0x0000000074820000-0x000000007486D000-memory.dmp

      Filesize

      308KB

    • memory/1928-75-0x00000000742D0000-0x000000007431D000-memory.dmp

      Filesize

      308KB

    • memory/1928-76-0x00000000742D0000-0x000000007431D000-memory.dmp

      Filesize

      308KB

    • memory/1928-74-0x00000000742D0000-0x000000007431D000-memory.dmp

      Filesize

      308KB