Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

8

Static

static

3

svchost_du...py.exe

windows7-x64

8

svchost_du...py.exe

windows10-1703-x64

8

svchost_du...py.exe

windows10-2004-x64

8

svchost_du...py.exe

windows11-21h2-x64

8

Resubmissions

12/04/2024, 13:32

240412-qtgfpsag84 8

12/04/2024, 13:32

240412-qtc4aaag83 8

12/04/2024, 13:32

240412-qtcshsag82 8

12/04/2024, 13:32

240412-qtb6zsag79 8

12/04/2024, 13:32

240412-qtbkfsdh4s 8

09/04/2024, 05:34

240409-f9mmjsbc9t 8

09/04/2024, 05:33

240409-f9bkaabc8w 8

09/04/2024, 05:33

240409-f86n2abc71 8

09/04/2024, 05:33

240409-f8wh3afh27 8

01/02/2024, 11:29

240201-nlq9tsebck 10

Analysis

  • max time kernel
    287s
  • max time network
    306s
  • platform
    windows11-21h2_x64
  • resource
    win11-20240221-en
  • resource tags

    arch:x64arch:x86image:win11-20240221-enlocale:en-usos:windows11-21h2-x64system
  • submitted
    09/04/2024, 05:33

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    svchost_dump_SCY - Copy.exe

  • Size

    5.2MB

  • MD5

    5fd3d21a968f4b8a1577b5405ab1c36a

  • SHA1

    710e5ab0fceb71b982b966c3a7406ebdf1d2aa82

  • SHA256

    7ac7b42889e14cbd8c7cebe692566ca045d0034f9ff103fc3ef9c5e035dc594f

  • SHA512

    085a31c0412ba0a3d612a66ec8d95ce900e148240f92f9ec8c4d07b6c8e32cf233e92aefc7b4b53a91f5eacacd1cf3a8fcdf8cd7c206afa46014a9e4a9ddf53f

  • SSDEEP

    98304:jgoX+R+gW1CkQFBAFGspWvuL136BRiGQiiyBrDbnh57cpbJLyns:coXxFGWL56BVrDbn77cjIs

Score
8/10
evasion

Malware Config

Signatures

  • Modifies Windows Firewall 2 TTPs 4 IoCs
    evasion
  • Executes dropped EXE 1 IoCs
  • Drops file in Windows directory 4 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Creates scheduled task(s) 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistence
  • Suspicious behavior: EnumeratesProcesses 10 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of WriteProcessMemory 26 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence

Processes

  • C:\Users\Admin\AppData\Local\Temp\svchost_dump_SCY - Copy.exe
    "C:\Users\Admin\AppData\Local\Temp\svchost_dump_SCY - Copy.exe"
    1⤵
    • Drops file in Windows directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:2492
    • C:\Windows\System32\Wbem\WMIC.exe
      WMIC /Node:localhost /Namespace:\\root\SecurityCenter2 Path AntiVirusProduct Get displayName
      2⤵
      • Suspicious use of AdjustPrivilegeToken
      PID:3920
    • C:\Windows\System32\netsh.exe
      "C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="SvcHostX" dir=in action=allow program="C:\Windows\System\svchost.exe" enable=yes
      2⤵
      • Modifies Windows Firewall
      PID:2912
    • C:\Windows\System32\netsh.exe
      "C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="SvcHostX" dir=out action=allow program="C:\Windows\System\svchost.exe" enable=yes
      2⤵
      • Modifies Windows Firewall
      PID:4432
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath c:\windows\
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:3984
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath \\?\C:\Windows \
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:2828
    • C:\Windows\SYSTEM32\schtasks.exe
      schtasks /delete /TN "Timer"
      2⤵
        PID:2720
      • C:\Windows\SYSTEM32\schtasks.exe
        schtasks /create /sc minute /ED "11/02/2024" /mo 7 /tn "Timer" /tr c:\windows\system\svchost.exe /ru SYSTEM
        2⤵
        • Creates scheduled task(s)
        PID:644
      • C:\Windows\System\svchost.exe
        "C:\Windows\System\svchost.exe" formal
        2⤵
        • Executes dropped EXE
        • Drops file in Windows directory
        • Suspicious use of WriteProcessMemory
        PID:2148
        • C:\Windows\System32\Wbem\WMIC.exe
          WMIC /Node:localhost /Namespace:\\root\SecurityCenter2 Path AntiVirusProduct Get displayName
          3⤵
          • Suspicious use of AdjustPrivilegeToken
          PID:2728
        • C:\Windows\System32\netsh.exe
          "C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="SvcHostX" dir=in action=allow program="C:\Windows\System\svchost.exe" enable=yes
          3⤵
          • Modifies Windows Firewall
          PID:3704
        • C:\Windows\System32\netsh.exe
          "C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="SvcHostX" dir=out action=allow program="C:\Windows\System\svchost.exe" enable=yes
          3⤵
          • Modifies Windows Firewall
          PID:692
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath c:\windows\
          3⤵
          • Suspicious behavior: EnumeratesProcesses
          PID:948
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath \\?\C:\Windows \
          3⤵
          • Suspicious behavior: EnumeratesProcesses
          PID:4024

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
      Filesize

      2KB

      MD5

      627073ee3ca9676911bee35548eff2b8

      SHA1

      4c4b68c65e2cab9864b51167d710aa29ebdcff2e

      SHA256

      85b280a39fc31ba1e15fb06102a05b8405ff3b82feb181d4170f04e466dd647c

      SHA512

      3c5f6c03e253b83c57e8d6f0334187dbdcdf4fa549eecd36cbc1322dca6d3ca891dc6a019c49ec2eafb88f82d0434299c31e4dfaab123acb42e0546218f311fb

      Download Submit

    • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
      Filesize

      944B

      MD5

      1a9fa92a4f2e2ec9e244d43a6a4f8fb9

      SHA1

      9910190edfaccece1dfcc1d92e357772f5dae8f7

      SHA256

      0ee052d5333fd5fd86bc84856fec98e045f077a7ac8051651bf7c521b9706888

      SHA512

      5d2361476fa22200e6f83883efe7dcb8c3fe7dae8d56e04e28a36e9ae1270c327b6aa161d92b239593da7661289d002c574446ecfd6bd19928209aae25e3ef64

      Download Submit

    • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
      Filesize

      944B

      MD5

      65e096ec6f4418ede91340e8e9e9686a

      SHA1

      25d31c0acc193b21264bea7d15721af5c9cb411b

      SHA256

      601102ba83d0a58bfe96573730d18c667829eb76b5c5aecfa578a14c29209f3c

      SHA512

      1ec4fa953cdad82639147e01b6d3920c1562c39d5b6d5e4594351cea7f1d0caad471dd1f354a05154ff8c572049f49048527442218fe4b437bbcf7236d4c38ac

      Download Submit

    • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_ztqdrhjv.1xy.ps1
      Filesize

      60B

      MD5

      d17fe0a3f47be24a6453e9ef58c94641

      SHA1

      6ab83620379fc69f80c0242105ddffd7d98d5d9d

      SHA256

      96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

      SHA512

      5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

      Download Submit

    • C:\Users\Admin\AppData\Roaming\tor\cached-microdesc-consensus
      Filesize

      2.7MB

      MD5

      277abb67ec3376d7c576732a62c39916

      SHA1

      70faa899ea7c8618289668813f04c69613fd6995

      SHA256

      62ce6ee974509a141b66d66c4dfe41565f9ba90f3d62cd286d7a08834f2b10d4

      SHA512

      f385313c49f7b153488f12be7ea04ed5c1220a85b7dc1382dcb862b8d5b155c5999971d3e8c7b37abdfcf8c2ff23f971a0a477a24f23ff8d08e2bcbe90f5021b

      Download Submit

    • C:\Users\Admin\AppData\Roaming\tor\cached-microdescs.new
      Filesize

      10.2MB

      MD5

      f7f52add22dadf28181ba60fc032cbc4

      SHA1

      ba3b1ed390e1d56c3666304c7c18c8b01a1d6002

      SHA256

      e7e575d0338c4606c31609bbb1a7de93e52498722769a99a29ee80210a512bda

      SHA512

      cbe8a9080ca39dd2e3ef40a01cb80daa7c68419a768a516d96ddeae92ba9854c14e95f968edb977dac1a370406e1e9cffb34833c73b6d79800d7f63a13b2a94b

      Download Submit

    • C:\Windows\System\svchost.exe
      Filesize

      5.2MB

      MD5

      5fd3d21a968f4b8a1577b5405ab1c36a

      SHA1

      710e5ab0fceb71b982b966c3a7406ebdf1d2aa82

      SHA256

      7ac7b42889e14cbd8c7cebe692566ca045d0034f9ff103fc3ef9c5e035dc594f

      SHA512

      085a31c0412ba0a3d612a66ec8d95ce900e148240f92f9ec8c4d07b6c8e32cf233e92aefc7b4b53a91f5eacacd1cf3a8fcdf8cd7c206afa46014a9e4a9ddf53f

      Download Submit

    • memory/948-70-0x00000291F0E90000-0x00000291F0EA0000-memory.dmp

      Filesize

      64KB

      Download

    • memory/948-55-0x00000291F0E90000-0x00000291F0EA0000-memory.dmp

      Filesize

      64KB

      Download

    • memory/948-50-0x00007FFEDABD0000-0x00007FFEDB692000-memory.dmp

      Filesize

      10.8MB

      Download

    • memory/948-54-0x00000291F0E90000-0x00000291F0EA0000-memory.dmp

      Filesize

      64KB

      Download

    • memory/948-59-0x00000291F0E90000-0x00000291F0EA0000-memory.dmp

      Filesize

      64KB

      Download

    • memory/948-72-0x00007FFEDABD0000-0x00007FFEDB692000-memory.dmp

      Filesize

      10.8MB

      Download

    • memory/2148-69-0x0000000140000000-0x0000000140636000-memory.dmp

      Filesize

      6.2MB

      Download

    • memory/2148-77-0x00000000368E0000-0x0000000036DC2000-memory.dmp

      Filesize

      4.9MB

      Download

    • memory/2148-43-0x0000000140000000-0x0000000140636000-memory.dmp

      Filesize

      6.2MB

      Download

    • memory/2492-44-0x0000000140000000-0x0000000140636000-memory.dmp

      Filesize

      6.2MB

      Download

    • memory/2492-13-0x0000000140000000-0x0000000140636000-memory.dmp

      Filesize

      6.2MB

      Download

    • memory/2492-0-0x0000000140000000-0x0000000140636000-memory.dmp

      Filesize

      6.2MB

      Download

    • memory/2828-14-0x00007FFEDABD0000-0x00007FFEDB692000-memory.dmp

      Filesize

      10.8MB

      Download

    • memory/2828-30-0x00007FFEDABD0000-0x00007FFEDB692000-memory.dmp

      Filesize

      10.8MB

      Download

    • memory/2828-26-0x000001F14AE60000-0x000001F14AE70000-memory.dmp

      Filesize

      64KB

      Download

    • memory/2828-17-0x000001F14AE60000-0x000001F14AE70000-memory.dmp

      Filesize

      64KB

      Download

    • memory/2828-15-0x000001F14AE60000-0x000001F14AE70000-memory.dmp

      Filesize

      64KB

      Download

    • memory/3984-4-0x000001469CDB0000-0x000001469CDC0000-memory.dmp

      Filesize

      64KB

      Download

    • memory/3984-16-0x000001469CDB0000-0x000001469CDC0000-memory.dmp

      Filesize

      64KB

      Download

    • memory/3984-34-0x00007FFEDABD0000-0x00007FFEDB692000-memory.dmp

      Filesize

      10.8MB

      Download

    • memory/3984-3-0x000001469CDB0000-0x000001469CDC0000-memory.dmp

      Filesize

      64KB

      Download

    • memory/3984-27-0x000001469CDB0000-0x000001469CDC0000-memory.dmp

      Filesize

      64KB

      Download

    • memory/3984-2-0x000001469CD30000-0x000001469CD52000-memory.dmp

      Filesize

      136KB

      Download

    • memory/3984-1-0x00007FFEDABD0000-0x00007FFEDB692000-memory.dmp

      Filesize

      10.8MB

      Download

    • memory/4024-58-0x000001CD0F690000-0x000001CD0F6A0000-memory.dmp

      Filesize

      64KB

      Download

    • memory/4024-60-0x000001CD0F690000-0x000001CD0F6A0000-memory.dmp

      Filesize

      64KB

      Download

    • memory/4024-57-0x00007FFEDABD0000-0x00007FFEDB692000-memory.dmp

      Filesize

      10.8MB

      Download

    • memory/4024-73-0x000001CD0F690000-0x000001CD0F6A0000-memory.dmp

      Filesize

      64KB

      Download

    • memory/4024-76-0x00007FFEDABD0000-0x00007FFEDB692000-memory.dmp

      Filesize

      10.8MB

      Download