Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    174s
  • max time network
    195s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20221111-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
  • submitted
    01/12/2022, 00:51

General

  • Target

    976163a074492950d1ab0d3d6b0b779a8d8a253660292cd3b8bf4ab87de738fb.exe

  • Size

    298KB

  • MD5

    7fb28a19ee289df3e6fb3140c6eaa1ba

  • SHA1

    0d94a5163134a18f64d9afb97b940b736662b3d1

  • SHA256

    976163a074492950d1ab0d3d6b0b779a8d8a253660292cd3b8bf4ab87de738fb

  • SHA512

    8d5a1dac7fcd48ed36e251a0b598346b627bf820dc8d978dc8c2eb5f5a54f101c3acb1143045b4e1e49e03e679af3475b84c8f43b445795a43ccc7c824fb699f

  • SSDEEP

    6144:2yHzI4LhBgjCvJwPNtkdtRSO4Z0zFQrwtQHxw9sAD:R7g6J6NO4O4UFQHHxLAD

Score
8/10

Malware Config

Signatures

  • Sets DLL path for service in the registry 2 TTPs 14 IoCs
  • UPX packed file 29 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Loads dropped DLL 12 IoCs
  • Drops file in System32 directory 14 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\976163a074492950d1ab0d3d6b0b779a8d8a253660292cd3b8bf4ab87de738fb.exe
    "C:\Users\Admin\AppData\Local\Temp\976163a074492950d1ab0d3d6b0b779a8d8a253660292cd3b8bf4ab87de738fb.exe"
    1⤵
    • Sets DLL path for service in the registry
    • Drops file in System32 directory
    • Suspicious behavior: EnumeratesProcesses
    PID:672
  • C:\Windows\SysWOW64\svchost.exe
    C:\Windows\SysWOW64\svchost.exe -k netsvcs -s FastUserSwitchingCompatibility
    1⤵
    • Loads dropped DLL
    PID:4720
  • C:\Windows\SysWOW64\svchost.exe
    C:\Windows\SysWOW64\svchost.exe -k netsvcs -s Irmon
    1⤵
    • Loads dropped DLL
    PID:4344
  • C:\Windows\SysWOW64\svchost.exe
    C:\Windows\SysWOW64\svchost.exe -k netsvcs -s Nla
    1⤵
    • Loads dropped DLL
    PID:3128
  • C:\Windows\SysWOW64\svchost.exe
    C:\Windows\SysWOW64\svchost.exe -k netsvcs -s Ntmssvc
    1⤵
    • Loads dropped DLL
    PID:2856
  • C:\Windows\SysWOW64\svchost.exe
    C:\Windows\SysWOW64\svchost.exe -k netsvcs -s NWCWorkstation
    1⤵
    • Loads dropped DLL
    PID:4836
  • C:\Windows\SysWOW64\svchost.exe
    C:\Windows\SysWOW64\svchost.exe -k netsvcs -s Nwsapagent
    1⤵
    • Loads dropped DLL
    PID:4544
  • C:\Windows\SysWOW64\svchost.exe
    C:\Windows\SysWOW64\svchost.exe -k netsvcs -s SRService
    1⤵
    • Loads dropped DLL
    PID:3172
  • C:\Windows\SysWOW64\svchost.exe
    C:\Windows\SysWOW64\svchost.exe -k netsvcs -s WmdmPmSp
    1⤵
    • Loads dropped DLL
    PID:3236
  • C:\Windows\SysWOW64\svchost.exe
    C:\Windows\SysWOW64\svchost.exe -k netsvcs -s LogonHours
    1⤵
    • Loads dropped DLL
    PID:3164
  • C:\Windows\SysWOW64\svchost.exe
    C:\Windows\SysWOW64\svchost.exe -k netsvcs -s PCAudit
    1⤵
    • Loads dropped DLL
    PID:2804
  • C:\Windows\SysWOW64\svchost.exe
    C:\Windows\SysWOW64\svchost.exe -k netsvcs -s helpsvc
    1⤵
    • Loads dropped DLL
    PID:2520
  • C:\Windows\SysWOW64\svchost.exe
    C:\Windows\SysWOW64\svchost.exe -k netsvcs -s uploadmgr
    1⤵
    • Loads dropped DLL
    PID:3916

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Windows\SysWOW64\FastUserSwitchingCompatibility.dll

    Filesize

    298KB

    MD5

    00210157fc12852f233498c9607c6d86

    SHA1

    f3e42f203043357035543897fe78de7de8af6d5f

    SHA256

    2327dfe7566d3e4cc8e093ae57941d187e44b2f18ed2e9b021307cad9bce546e

    SHA512

    feb668a8d13e8829654f7b12dcc153fe87db0d82ac1113848336dcfa684efe1c633476dc2aa82629dcc6f51de417bc0b4fcaa7d30b7d232a8a08230ab7fb20b6

  • C:\Windows\SysWOW64\Irmon.dll

    Filesize

    298KB

    MD5

    00210157fc12852f233498c9607c6d86

    SHA1

    f3e42f203043357035543897fe78de7de8af6d5f

    SHA256

    2327dfe7566d3e4cc8e093ae57941d187e44b2f18ed2e9b021307cad9bce546e

    SHA512

    feb668a8d13e8829654f7b12dcc153fe87db0d82ac1113848336dcfa684efe1c633476dc2aa82629dcc6f51de417bc0b4fcaa7d30b7d232a8a08230ab7fb20b6

  • C:\Windows\SysWOW64\LogonHours.dll

    Filesize

    298KB

    MD5

    00210157fc12852f233498c9607c6d86

    SHA1

    f3e42f203043357035543897fe78de7de8af6d5f

    SHA256

    2327dfe7566d3e4cc8e093ae57941d187e44b2f18ed2e9b021307cad9bce546e

    SHA512

    feb668a8d13e8829654f7b12dcc153fe87db0d82ac1113848336dcfa684efe1c633476dc2aa82629dcc6f51de417bc0b4fcaa7d30b7d232a8a08230ab7fb20b6

  • C:\Windows\SysWOW64\NWCWorkstation.dll

    Filesize

    298KB

    MD5

    00210157fc12852f233498c9607c6d86

    SHA1

    f3e42f203043357035543897fe78de7de8af6d5f

    SHA256

    2327dfe7566d3e4cc8e093ae57941d187e44b2f18ed2e9b021307cad9bce546e

    SHA512

    feb668a8d13e8829654f7b12dcc153fe87db0d82ac1113848336dcfa684efe1c633476dc2aa82629dcc6f51de417bc0b4fcaa7d30b7d232a8a08230ab7fb20b6

  • C:\Windows\SysWOW64\Nla.dll

    Filesize

    298KB

    MD5

    00210157fc12852f233498c9607c6d86

    SHA1

    f3e42f203043357035543897fe78de7de8af6d5f

    SHA256

    2327dfe7566d3e4cc8e093ae57941d187e44b2f18ed2e9b021307cad9bce546e

    SHA512

    feb668a8d13e8829654f7b12dcc153fe87db0d82ac1113848336dcfa684efe1c633476dc2aa82629dcc6f51de417bc0b4fcaa7d30b7d232a8a08230ab7fb20b6

  • C:\Windows\SysWOW64\Ntmssvc.dll

    Filesize

    298KB

    MD5

    00210157fc12852f233498c9607c6d86

    SHA1

    f3e42f203043357035543897fe78de7de8af6d5f

    SHA256

    2327dfe7566d3e4cc8e093ae57941d187e44b2f18ed2e9b021307cad9bce546e

    SHA512

    feb668a8d13e8829654f7b12dcc153fe87db0d82ac1113848336dcfa684efe1c633476dc2aa82629dcc6f51de417bc0b4fcaa7d30b7d232a8a08230ab7fb20b6

  • C:\Windows\SysWOW64\Nwsapagent.dll

    Filesize

    298KB

    MD5

    00210157fc12852f233498c9607c6d86

    SHA1

    f3e42f203043357035543897fe78de7de8af6d5f

    SHA256

    2327dfe7566d3e4cc8e093ae57941d187e44b2f18ed2e9b021307cad9bce546e

    SHA512

    feb668a8d13e8829654f7b12dcc153fe87db0d82ac1113848336dcfa684efe1c633476dc2aa82629dcc6f51de417bc0b4fcaa7d30b7d232a8a08230ab7fb20b6

  • C:\Windows\SysWOW64\PCAudit.dll

    Filesize

    298KB

    MD5

    00210157fc12852f233498c9607c6d86

    SHA1

    f3e42f203043357035543897fe78de7de8af6d5f

    SHA256

    2327dfe7566d3e4cc8e093ae57941d187e44b2f18ed2e9b021307cad9bce546e

    SHA512

    feb668a8d13e8829654f7b12dcc153fe87db0d82ac1113848336dcfa684efe1c633476dc2aa82629dcc6f51de417bc0b4fcaa7d30b7d232a8a08230ab7fb20b6

  • C:\Windows\SysWOW64\SRService.dll

    Filesize

    298KB

    MD5

    00210157fc12852f233498c9607c6d86

    SHA1

    f3e42f203043357035543897fe78de7de8af6d5f

    SHA256

    2327dfe7566d3e4cc8e093ae57941d187e44b2f18ed2e9b021307cad9bce546e

    SHA512

    feb668a8d13e8829654f7b12dcc153fe87db0d82ac1113848336dcfa684efe1c633476dc2aa82629dcc6f51de417bc0b4fcaa7d30b7d232a8a08230ab7fb20b6

  • C:\Windows\SysWOW64\WmdmPmSp.dll

    Filesize

    298KB

    MD5

    00210157fc12852f233498c9607c6d86

    SHA1

    f3e42f203043357035543897fe78de7de8af6d5f

    SHA256

    2327dfe7566d3e4cc8e093ae57941d187e44b2f18ed2e9b021307cad9bce546e

    SHA512

    feb668a8d13e8829654f7b12dcc153fe87db0d82ac1113848336dcfa684efe1c633476dc2aa82629dcc6f51de417bc0b4fcaa7d30b7d232a8a08230ab7fb20b6

  • C:\Windows\SysWOW64\helpsvc.dll

    Filesize

    298KB

    MD5

    00210157fc12852f233498c9607c6d86

    SHA1

    f3e42f203043357035543897fe78de7de8af6d5f

    SHA256

    2327dfe7566d3e4cc8e093ae57941d187e44b2f18ed2e9b021307cad9bce546e

    SHA512

    feb668a8d13e8829654f7b12dcc153fe87db0d82ac1113848336dcfa684efe1c633476dc2aa82629dcc6f51de417bc0b4fcaa7d30b7d232a8a08230ab7fb20b6

  • C:\Windows\SysWOW64\uploadmgr.dll

    Filesize

    298KB

    MD5

    00210157fc12852f233498c9607c6d86

    SHA1

    f3e42f203043357035543897fe78de7de8af6d5f

    SHA256

    2327dfe7566d3e4cc8e093ae57941d187e44b2f18ed2e9b021307cad9bce546e

    SHA512

    feb668a8d13e8829654f7b12dcc153fe87db0d82ac1113848336dcfa684efe1c633476dc2aa82629dcc6f51de417bc0b4fcaa7d30b7d232a8a08230ab7fb20b6

  • \??\c:\windows\SysWOW64\fastuserswitchingcompatibility.dll

    Filesize

    298KB

    MD5

    00210157fc12852f233498c9607c6d86

    SHA1

    f3e42f203043357035543897fe78de7de8af6d5f

    SHA256

    2327dfe7566d3e4cc8e093ae57941d187e44b2f18ed2e9b021307cad9bce546e

    SHA512

    feb668a8d13e8829654f7b12dcc153fe87db0d82ac1113848336dcfa684efe1c633476dc2aa82629dcc6f51de417bc0b4fcaa7d30b7d232a8a08230ab7fb20b6

  • \??\c:\windows\SysWOW64\helpsvc.dll

    Filesize

    298KB

    MD5

    00210157fc12852f233498c9607c6d86

    SHA1

    f3e42f203043357035543897fe78de7de8af6d5f

    SHA256

    2327dfe7566d3e4cc8e093ae57941d187e44b2f18ed2e9b021307cad9bce546e

    SHA512

    feb668a8d13e8829654f7b12dcc153fe87db0d82ac1113848336dcfa684efe1c633476dc2aa82629dcc6f51de417bc0b4fcaa7d30b7d232a8a08230ab7fb20b6

  • \??\c:\windows\SysWOW64\irmon.dll

    Filesize

    298KB

    MD5

    00210157fc12852f233498c9607c6d86

    SHA1

    f3e42f203043357035543897fe78de7de8af6d5f

    SHA256

    2327dfe7566d3e4cc8e093ae57941d187e44b2f18ed2e9b021307cad9bce546e

    SHA512

    feb668a8d13e8829654f7b12dcc153fe87db0d82ac1113848336dcfa684efe1c633476dc2aa82629dcc6f51de417bc0b4fcaa7d30b7d232a8a08230ab7fb20b6

  • \??\c:\windows\SysWOW64\logonhours.dll

    Filesize

    298KB

    MD5

    00210157fc12852f233498c9607c6d86

    SHA1

    f3e42f203043357035543897fe78de7de8af6d5f

    SHA256

    2327dfe7566d3e4cc8e093ae57941d187e44b2f18ed2e9b021307cad9bce546e

    SHA512

    feb668a8d13e8829654f7b12dcc153fe87db0d82ac1113848336dcfa684efe1c633476dc2aa82629dcc6f51de417bc0b4fcaa7d30b7d232a8a08230ab7fb20b6

  • \??\c:\windows\SysWOW64\nla.dll

    Filesize

    298KB

    MD5

    00210157fc12852f233498c9607c6d86

    SHA1

    f3e42f203043357035543897fe78de7de8af6d5f

    SHA256

    2327dfe7566d3e4cc8e093ae57941d187e44b2f18ed2e9b021307cad9bce546e

    SHA512

    feb668a8d13e8829654f7b12dcc153fe87db0d82ac1113848336dcfa684efe1c633476dc2aa82629dcc6f51de417bc0b4fcaa7d30b7d232a8a08230ab7fb20b6

  • \??\c:\windows\SysWOW64\ntmssvc.dll

    Filesize

    298KB

    MD5

    00210157fc12852f233498c9607c6d86

    SHA1

    f3e42f203043357035543897fe78de7de8af6d5f

    SHA256

    2327dfe7566d3e4cc8e093ae57941d187e44b2f18ed2e9b021307cad9bce546e

    SHA512

    feb668a8d13e8829654f7b12dcc153fe87db0d82ac1113848336dcfa684efe1c633476dc2aa82629dcc6f51de417bc0b4fcaa7d30b7d232a8a08230ab7fb20b6

  • \??\c:\windows\SysWOW64\nwcworkstation.dll

    Filesize

    298KB

    MD5

    00210157fc12852f233498c9607c6d86

    SHA1

    f3e42f203043357035543897fe78de7de8af6d5f

    SHA256

    2327dfe7566d3e4cc8e093ae57941d187e44b2f18ed2e9b021307cad9bce546e

    SHA512

    feb668a8d13e8829654f7b12dcc153fe87db0d82ac1113848336dcfa684efe1c633476dc2aa82629dcc6f51de417bc0b4fcaa7d30b7d232a8a08230ab7fb20b6

  • \??\c:\windows\SysWOW64\nwsapagent.dll

    Filesize

    298KB

    MD5

    00210157fc12852f233498c9607c6d86

    SHA1

    f3e42f203043357035543897fe78de7de8af6d5f

    SHA256

    2327dfe7566d3e4cc8e093ae57941d187e44b2f18ed2e9b021307cad9bce546e

    SHA512

    feb668a8d13e8829654f7b12dcc153fe87db0d82ac1113848336dcfa684efe1c633476dc2aa82629dcc6f51de417bc0b4fcaa7d30b7d232a8a08230ab7fb20b6

  • \??\c:\windows\SysWOW64\pcaudit.dll

    Filesize

    298KB

    MD5

    00210157fc12852f233498c9607c6d86

    SHA1

    f3e42f203043357035543897fe78de7de8af6d5f

    SHA256

    2327dfe7566d3e4cc8e093ae57941d187e44b2f18ed2e9b021307cad9bce546e

    SHA512

    feb668a8d13e8829654f7b12dcc153fe87db0d82ac1113848336dcfa684efe1c633476dc2aa82629dcc6f51de417bc0b4fcaa7d30b7d232a8a08230ab7fb20b6

  • \??\c:\windows\SysWOW64\srservice.dll

    Filesize

    298KB

    MD5

    00210157fc12852f233498c9607c6d86

    SHA1

    f3e42f203043357035543897fe78de7de8af6d5f

    SHA256

    2327dfe7566d3e4cc8e093ae57941d187e44b2f18ed2e9b021307cad9bce546e

    SHA512

    feb668a8d13e8829654f7b12dcc153fe87db0d82ac1113848336dcfa684efe1c633476dc2aa82629dcc6f51de417bc0b4fcaa7d30b7d232a8a08230ab7fb20b6

  • \??\c:\windows\SysWOW64\uploadmgr.dll

    Filesize

    298KB

    MD5

    00210157fc12852f233498c9607c6d86

    SHA1

    f3e42f203043357035543897fe78de7de8af6d5f

    SHA256

    2327dfe7566d3e4cc8e093ae57941d187e44b2f18ed2e9b021307cad9bce546e

    SHA512

    feb668a8d13e8829654f7b12dcc153fe87db0d82ac1113848336dcfa684efe1c633476dc2aa82629dcc6f51de417bc0b4fcaa7d30b7d232a8a08230ab7fb20b6

  • \??\c:\windows\SysWOW64\wmdmpmsp.dll

    Filesize

    298KB

    MD5

    00210157fc12852f233498c9607c6d86

    SHA1

    f3e42f203043357035543897fe78de7de8af6d5f

    SHA256

    2327dfe7566d3e4cc8e093ae57941d187e44b2f18ed2e9b021307cad9bce546e

    SHA512

    feb668a8d13e8829654f7b12dcc153fe87db0d82ac1113848336dcfa684efe1c633476dc2aa82629dcc6f51de417bc0b4fcaa7d30b7d232a8a08230ab7fb20b6

  • memory/672-147-0x0000000000760000-0x00000000007AD000-memory.dmp

    Filesize

    308KB

  • memory/672-133-0x0000000002730000-0x0000000006730000-memory.dmp

    Filesize

    64.0MB

  • memory/672-134-0x0000000002730000-0x0000000006730000-memory.dmp

    Filesize

    64.0MB

  • memory/672-132-0x0000000000760000-0x00000000007AD000-memory.dmp

    Filesize

    308KB

  • memory/3128-145-0x0000000074CF0000-0x0000000074D3D000-memory.dmp

    Filesize

    308KB

  • memory/3916-162-0x0000000074D70000-0x0000000074DBD000-memory.dmp

    Filesize

    308KB

  • memory/4720-137-0x0000000074D70000-0x0000000074DBD000-memory.dmp

    Filesize

    308KB