Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
154s -
max time network
158s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
21/05/2024, 11:24
Behavioral task
behavioral1
Sample
taskhost.exe
Resource
win7-20240508-en
General
-
Target
taskhost.exe
-
Size
19.8MB
-
MD5
74595855031cc4eb18b48346f876cd2e
-
SHA1
24bf72be8f93f2da8defe6c47004ecde786458ef
-
SHA256
2ea5e2feaf74e9ea6d7760ae2a20742a8861157607584e566e32b1ba329d378a
-
SHA512
33227d3e36a95fd4b9fcee533997bab9080a735c52417a10114a01d81c15eebcccca1cb99c6cfaf70691fc5149a41f8cffd4ee5fd54e0a593aaeb1ca6438b240
-
SSDEEP
393216:xao4ZbKh+7uRQSn44pfrovhexQ0s0kl1X5+twDyClkzmv7PXVTpa:xaoAW+qpf6hKQJ+tcH6zmv7Xa
Malware Config
Signatures
-
Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" taskhost.exe -
XMRig Miner payload 2 IoCs
resource yara_rule behavioral2/files/0x0007000000023287-42.dat family_xmrig behavioral2/files/0x0007000000023287-42.dat xmrig -
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 2 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ taskhost.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ audiodg.exe -
Checks BIOS information in registry 2 TTPs 4 IoCs
BIOS information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion taskhost.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion audiodg.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion audiodg.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion taskhost.exe -
Executes dropped EXE 3 IoCs
pid Process 4444 Packs.exe 4296 audiodg.exe 1508 MicrosoftHost.exe -
resource yara_rule behavioral2/memory/2388-0-0x00007FF777A30000-0x00007FF7796DF000-memory.dmp themida behavioral2/memory/2388-4-0x00007FF777A30000-0x00007FF7796DF000-memory.dmp themida behavioral2/memory/2388-2-0x00007FF777A30000-0x00007FF7796DF000-memory.dmp themida behavioral2/memory/2388-3-0x00007FF777A30000-0x00007FF7796DF000-memory.dmp themida behavioral2/memory/2388-5-0x00007FF777A30000-0x00007FF7796DF000-memory.dmp themida behavioral2/memory/2388-8-0x00007FF777A30000-0x00007FF7796DF000-memory.dmp themida behavioral2/memory/2388-7-0x00007FF777A30000-0x00007FF7796DF000-memory.dmp themida behavioral2/memory/2388-6-0x00007FF777A30000-0x00007FF7796DF000-memory.dmp themida behavioral2/memory/2388-9-0x00007FF777A30000-0x00007FF7796DF000-memory.dmp themida behavioral2/memory/2388-15-0x00007FF777A30000-0x00007FF7796DF000-memory.dmp themida behavioral2/memory/2388-29-0x00007FF777A30000-0x00007FF7796DF000-memory.dmp themida behavioral2/files/0x0012000000023285-43.dat themida behavioral2/memory/4296-47-0x00007FF715210000-0x00007FF7160DB000-memory.dmp themida behavioral2/memory/4296-49-0x00007FF715210000-0x00007FF7160DB000-memory.dmp themida behavioral2/memory/4296-50-0x00007FF715210000-0x00007FF7160DB000-memory.dmp themida behavioral2/memory/4296-52-0x00007FF715210000-0x00007FF7160DB000-memory.dmp themida behavioral2/memory/4296-51-0x00007FF715210000-0x00007FF7160DB000-memory.dmp themida behavioral2/memory/4296-53-0x00007FF715210000-0x00007FF7160DB000-memory.dmp themida behavioral2/memory/4296-55-0x00007FF715210000-0x00007FF7160DB000-memory.dmp themida behavioral2/memory/4296-54-0x00007FF715210000-0x00007FF7160DB000-memory.dmp themida behavioral2/memory/2388-57-0x00007FF777A30000-0x00007FF7796DF000-memory.dmp themida behavioral2/memory/4296-62-0x00007FF715210000-0x00007FF7160DB000-memory.dmp themida behavioral2/memory/2388-67-0x00007FF777A30000-0x00007FF7796DF000-memory.dmp themida behavioral2/memory/4296-74-0x00007FF715210000-0x00007FF7160DB000-memory.dmp themida behavioral2/memory/2388-75-0x00007FF777A30000-0x00007FF7796DF000-memory.dmp themida behavioral2/memory/4296-77-0x00007FF715210000-0x00007FF7160DB000-memory.dmp themida behavioral2/memory/4296-80-0x00007FF715210000-0x00007FF7160DB000-memory.dmp themida behavioral2/memory/2388-79-0x00007FF777A30000-0x00007FF7796DF000-memory.dmp themida behavioral2/memory/4296-84-0x00007FF715210000-0x00007FF7160DB000-memory.dmp themida behavioral2/memory/2388-83-0x00007FF777A30000-0x00007FF7796DF000-memory.dmp themida behavioral2/memory/4296-86-0x00007FF715210000-0x00007FF7160DB000-memory.dmp themida behavioral2/memory/2388-89-0x00007FF777A30000-0x00007FF7796DF000-memory.dmp themida behavioral2/memory/4296-93-0x00007FF715210000-0x00007FF7160DB000-memory.dmp themida behavioral2/memory/2388-92-0x00007FF777A30000-0x00007FF7796DF000-memory.dmp themida behavioral2/memory/4296-99-0x00007FF715210000-0x00007FF7160DB000-memory.dmp themida behavioral2/memory/2388-98-0x00007FF777A30000-0x00007FF7796DF000-memory.dmp themida behavioral2/memory/4296-102-0x00007FF715210000-0x00007FF7160DB000-memory.dmp themida behavioral2/memory/2388-104-0x00007FF777A30000-0x00007FF7796DF000-memory.dmp themida behavioral2/memory/4296-107-0x00007FF715210000-0x00007FF7160DB000-memory.dmp themida behavioral2/memory/2388-109-0x00007FF777A30000-0x00007FF7796DF000-memory.dmp themida behavioral2/memory/4296-112-0x00007FF715210000-0x00007FF7160DB000-memory.dmp themida behavioral2/memory/2388-111-0x00007FF777A30000-0x00007FF7796DF000-memory.dmp themida behavioral2/memory/4296-114-0x00007FF715210000-0x00007FF7160DB000-memory.dmp themida behavioral2/memory/2388-116-0x00007FF777A30000-0x00007FF7796DF000-memory.dmp themida -
description ioc Process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA taskhost.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA audiodg.exe -
AutoIT Executable 39 IoCs
AutoIT scripts compiled to PE executables.
resource yara_rule behavioral2/memory/2388-4-0x00007FF777A30000-0x00007FF7796DF000-memory.dmp autoit_exe behavioral2/memory/2388-3-0x00007FF777A30000-0x00007FF7796DF000-memory.dmp autoit_exe behavioral2/memory/2388-5-0x00007FF777A30000-0x00007FF7796DF000-memory.dmp autoit_exe behavioral2/memory/2388-8-0x00007FF777A30000-0x00007FF7796DF000-memory.dmp autoit_exe behavioral2/memory/2388-7-0x00007FF777A30000-0x00007FF7796DF000-memory.dmp autoit_exe behavioral2/memory/2388-6-0x00007FF777A30000-0x00007FF7796DF000-memory.dmp autoit_exe behavioral2/memory/2388-9-0x00007FF777A30000-0x00007FF7796DF000-memory.dmp autoit_exe behavioral2/memory/2388-15-0x00007FF777A30000-0x00007FF7796DF000-memory.dmp autoit_exe behavioral2/memory/2388-29-0x00007FF777A30000-0x00007FF7796DF000-memory.dmp autoit_exe behavioral2/memory/4296-50-0x00007FF715210000-0x00007FF7160DB000-memory.dmp autoit_exe behavioral2/memory/4296-52-0x00007FF715210000-0x00007FF7160DB000-memory.dmp autoit_exe behavioral2/memory/4296-51-0x00007FF715210000-0x00007FF7160DB000-memory.dmp autoit_exe behavioral2/memory/4296-53-0x00007FF715210000-0x00007FF7160DB000-memory.dmp autoit_exe behavioral2/memory/4296-55-0x00007FF715210000-0x00007FF7160DB000-memory.dmp autoit_exe behavioral2/memory/4296-54-0x00007FF715210000-0x00007FF7160DB000-memory.dmp autoit_exe behavioral2/memory/2388-57-0x00007FF777A30000-0x00007FF7796DF000-memory.dmp autoit_exe behavioral2/memory/4296-62-0x00007FF715210000-0x00007FF7160DB000-memory.dmp autoit_exe behavioral2/memory/2388-67-0x00007FF777A30000-0x00007FF7796DF000-memory.dmp autoit_exe behavioral2/memory/4296-74-0x00007FF715210000-0x00007FF7160DB000-memory.dmp autoit_exe behavioral2/memory/2388-75-0x00007FF777A30000-0x00007FF7796DF000-memory.dmp autoit_exe behavioral2/memory/4296-77-0x00007FF715210000-0x00007FF7160DB000-memory.dmp autoit_exe behavioral2/memory/4296-80-0x00007FF715210000-0x00007FF7160DB000-memory.dmp autoit_exe behavioral2/memory/2388-79-0x00007FF777A30000-0x00007FF7796DF000-memory.dmp autoit_exe behavioral2/memory/4296-84-0x00007FF715210000-0x00007FF7160DB000-memory.dmp autoit_exe behavioral2/memory/2388-83-0x00007FF777A30000-0x00007FF7796DF000-memory.dmp autoit_exe behavioral2/memory/4296-86-0x00007FF715210000-0x00007FF7160DB000-memory.dmp autoit_exe behavioral2/memory/2388-89-0x00007FF777A30000-0x00007FF7796DF000-memory.dmp autoit_exe behavioral2/memory/4296-93-0x00007FF715210000-0x00007FF7160DB000-memory.dmp autoit_exe behavioral2/memory/2388-92-0x00007FF777A30000-0x00007FF7796DF000-memory.dmp autoit_exe behavioral2/memory/4296-99-0x00007FF715210000-0x00007FF7160DB000-memory.dmp autoit_exe behavioral2/memory/2388-98-0x00007FF777A30000-0x00007FF7796DF000-memory.dmp autoit_exe behavioral2/memory/4296-102-0x00007FF715210000-0x00007FF7160DB000-memory.dmp autoit_exe behavioral2/memory/2388-104-0x00007FF777A30000-0x00007FF7796DF000-memory.dmp autoit_exe behavioral2/memory/4296-107-0x00007FF715210000-0x00007FF7160DB000-memory.dmp autoit_exe behavioral2/memory/2388-109-0x00007FF777A30000-0x00007FF7796DF000-memory.dmp autoit_exe behavioral2/memory/4296-112-0x00007FF715210000-0x00007FF7160DB000-memory.dmp autoit_exe behavioral2/memory/2388-111-0x00007FF777A30000-0x00007FF7796DF000-memory.dmp autoit_exe behavioral2/memory/4296-114-0x00007FF715210000-0x00007FF7160DB000-memory.dmp autoit_exe behavioral2/memory/2388-116-0x00007FF777A30000-0x00007FF7796DF000-memory.dmp autoit_exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
pid Process 2388 taskhost.exe 4296 audiodg.exe -
Gathers network information 2 TTPs 1 IoCs
Uses commandline utility to view network configuration.
pid Process 3496 ipconfig.exe -
NTFS ADS 2 IoCs
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\winmgmts:\localhost\root\CIMV2 taskhost.exe File opened for modification C:\Users\Admin\AppData\Local\Temp\winmgmts:\localhost\ taskhost.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2388 taskhost.exe 2388 taskhost.exe 2388 taskhost.exe 2388 taskhost.exe 2388 taskhost.exe 2388 taskhost.exe 2388 taskhost.exe 2388 taskhost.exe 2388 taskhost.exe 2388 taskhost.exe 2388 taskhost.exe 2388 taskhost.exe 2388 taskhost.exe 2388 taskhost.exe 2388 taskhost.exe 2388 taskhost.exe 2388 taskhost.exe 2388 taskhost.exe 2388 taskhost.exe 2388 taskhost.exe 2388 taskhost.exe 2388 taskhost.exe 2388 taskhost.exe 2388 taskhost.exe 2388 taskhost.exe 2388 taskhost.exe 2388 taskhost.exe 2388 taskhost.exe 2388 taskhost.exe 2388 taskhost.exe 2388 taskhost.exe 2388 taskhost.exe 2388 taskhost.exe 2388 taskhost.exe 2388 taskhost.exe 2388 taskhost.exe 2388 taskhost.exe 2388 taskhost.exe 2388 taskhost.exe 2388 taskhost.exe 2388 taskhost.exe 2388 taskhost.exe 2388 taskhost.exe 2388 taskhost.exe 2388 taskhost.exe 2388 taskhost.exe 2388 taskhost.exe 2388 taskhost.exe 2388 taskhost.exe 2388 taskhost.exe 2388 taskhost.exe 2388 taskhost.exe 2388 taskhost.exe 2388 taskhost.exe 2388 taskhost.exe 2388 taskhost.exe 2388 taskhost.exe 2388 taskhost.exe 2388 taskhost.exe 2388 taskhost.exe 2388 taskhost.exe 2388 taskhost.exe 2388 taskhost.exe 2388 taskhost.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 2388 taskhost.exe -
Suspicious behavior: LoadsDriver 1 IoCs
pid Process 656 Process not Found -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeLockMemoryPrivilege 1508 MicrosoftHost.exe Token: SeLockMemoryPrivilege 1508 MicrosoftHost.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 1508 MicrosoftHost.exe -
Suspicious use of WriteProcessMemory 15 IoCs
description pid Process procid_target PID 2388 wrote to memory of 1292 2388 taskhost.exe 93 PID 2388 wrote to memory of 1292 2388 taskhost.exe 93 PID 1292 wrote to memory of 3496 1292 cmd.exe 95 PID 1292 wrote to memory of 3496 1292 cmd.exe 95 PID 2388 wrote to memory of 3516 2388 taskhost.exe 96 PID 2388 wrote to memory of 3516 2388 taskhost.exe 96 PID 3516 wrote to memory of 2180 3516 cmd.exe 98 PID 3516 wrote to memory of 2180 3516 cmd.exe 98 PID 2388 wrote to memory of 4444 2388 taskhost.exe 100 PID 2388 wrote to memory of 4444 2388 taskhost.exe 100 PID 2388 wrote to memory of 4444 2388 taskhost.exe 100 PID 2388 wrote to memory of 4296 2388 taskhost.exe 104 PID 2388 wrote to memory of 4296 2388 taskhost.exe 104 PID 2388 wrote to memory of 1508 2388 taskhost.exe 105 PID 2388 wrote to memory of 1508 2388 taskhost.exe 105
Processes
-
C:\Users\Admin\AppData\Local\Temp\taskhost.exe"C:\Users\Admin\AppData\Local\Temp\taskhost.exe"1⤵
- Modifies visiblity of hidden/system files in Explorer
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- NTFS ADS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of WriteProcessMemory
PID:2388 -
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ipconfig /flushdns2⤵
- Suspicious use of WriteProcessMemory
PID:1292 -
C:\Windows\system32\ipconfig.exeipconfig /flushdns3⤵
- Gathers network information
PID:3496
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c gpupdate /force2⤵
- Suspicious use of WriteProcessMemory
PID:3516 -
C:\Windows\system32\gpupdate.exegpupdate /force3⤵PID:2180
-
-
-
C:\ProgramData\Setup\Packs.exeC:\ProgramData\Setup\Packs.exe -ppidar2⤵
- Executes dropped EXE
PID:4444
-
-
C:\ProgramData\WindowsTask\audiodg.exeC:\ProgramData\WindowsTask\audiodg.exe2⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:4296
-
-
C:\ProgramData\WindowsTask\MicrosoftHost.exeC:\ProgramData\WindowsTask\MicrosoftHost.exe -o stratum+tcp://185.139.69.167:3333 -u RandomX_CPU --donate-level=1 -k --cpu-priority=0 -t42⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:1508
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4240 --field-trial-handle=2692,i,8678872182442199182,12502579059484928042,262144 --variations-seed-version /prefetch:81⤵PID:1484
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.2MB
MD51ee4321c311d7e58208c61630fa3f278
SHA167ef36cf785ec0d4602eb35a98c23420beba2e2a
SHA256463ce847b6f7b32d1f4f49dfaaa2ce4a1061b6dfca1fb6a1bf39f7f40117266d
SHA512f0bbf219926d7316bce936e4c362f2b5195420b7ee14538dd61d8a362921351cdde80705fcff8249773284a10067149f5a60291fa965aaaaca65fc535a5a8ffd
-
Filesize
14KB
MD50c0195c48b6b8582fa6f6373032118da
SHA1d25340ae8e92a6d29f599fef426a2bc1b5217299
SHA25611bd2c9f9e2397c9a16e0990e4ed2cf0679498fe0fd418a3dfdac60b5c160ee5
SHA512ab28e99659f219fec553155a0810de90f0c5b07dc9b66bda86d7686499fb0ec5fddeb7cd7a3c5b77dccb5e865f2715c2d81f4d40df4431c92ac7860c7e01720d
-
Filesize
5.7MB
MD55bda5e3354916c14aeef5e9c1589ea99
SHA1a9bf3059461f569a290fbbfe0e59d9629f5749ec
SHA2567fa2c88d0732f4f432320d0b8cdc8a024b5efcae99da74dcd06dc91089ffd101
SHA5125a9b55bf1124002e67468f133f47008426f19f1acb7de76eb001fc94ff4e9170142fa8b394bc8cee8d805a8484724135ef0251f029bd1304954b0aa2a2f8a987
-
Filesize
7.8MB
MD52c478377002d8f8c188252f338e10d17
SHA171c3b3154ae57c9e692c32653ab8859c23680b30
SHA256bda32a05036ce8fabd53f41509c114c5bf2c9d8343fb7725b6b21903ca44a89c
SHA512fd183050382e834dadec658d0f9673607049a605c5c7dafe997d74b3921dafca0b677b8cfba9733cfd1d9c80581133281778f6be46f7080c5d743ea2c6f99dde