Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
381s -
max time network
381s -
platform
windows7_x64 -
resource
win7-20240704-en -
resource tags
arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system -
submitted
07/07/2024, 13:14
Static task
static1
Behavioral task
behavioral1
Sample
Sound Blaster creative set-up.fix.exe
Resource
win7-20240704-en
Errors
General
-
Target
Sound Blaster creative set-up.fix.exe
-
Size
202KB
-
MD5
69e54877c8aee907efaad8e96ffa8bad
-
SHA1
fa005fa2f233fb07c0a58b06b0c88610164097a8
-
SHA256
83b491f66cbcc39a71daff3cb9f2e6228a77959aebdf6a87b4c95f884de588a4
-
SHA512
db4d864dd8ae525b48941491ff257e8eee64ba93cdf1e9fd96a21d124bc01dfe660fe9451a87cb306964c2966854a0626d5f777bb35aec47c83c5956f2f4b917
-
SSDEEP
3072:9nx83hRxFJiN09QcRD21e+/2EIjcvlCHQnDPvrcUPn6+byteiYD8+YdzNrj:FCxiN0f1fcvlCwnDbvytDYo7
Malware Config
Signatures
-
Executes dropped EXE 3 IoCs
pid Process 3000 dllhost.exe 2164 4f6d82eb10a040658aa7ca149b72ce8f.exe 1584 0435cf9f226d4ab7a1eacdfc7f64050a.exe -
Loads dropped DLL 3 IoCs
pid Process 2232 Sound Blaster creative set-up.fix.exe 3000 dllhost.exe 3000 dllhost.exe -
Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Windows\CurrentVersion\Run\8b01369728c0c734139e93e5df923b49 = "\"C:\\ProgramData\\dllhost.exe\" .." dllhost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\8b01369728c0c734139e93e5df923b49 = "\"C:\\ProgramData\\dllhost.exe\" .." dllhost.exe -
Launches sc.exe 3 IoCs
Sc.exe is a Windows utlilty to control services on the system.
pid Process 2604 sc.exe 1724 sc.exe 2304 sc.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Kills process with taskkill 1 IoCs
pid Process 332 taskkill.exe -
Suspicious behavior: EnumeratesProcesses 1 IoCs
pid Process 2612 powershell.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 2612 powershell.exe Token: SeDebugPrivilege 332 taskkill.exe Token: SeDebugPrivilege 3000 dllhost.exe Token: 33 3000 dllhost.exe Token: SeIncBasePriorityPrivilege 3000 dllhost.exe Token: 33 3000 dllhost.exe Token: SeIncBasePriorityPrivilege 3000 dllhost.exe Token: 33 3000 dllhost.exe Token: SeIncBasePriorityPrivilege 3000 dllhost.exe Token: 33 3000 dllhost.exe Token: SeIncBasePriorityPrivilege 3000 dllhost.exe Token: 33 3000 dllhost.exe Token: SeIncBasePriorityPrivilege 3000 dllhost.exe Token: 33 3000 dllhost.exe Token: SeIncBasePriorityPrivilege 3000 dllhost.exe Token: 33 3000 dllhost.exe Token: SeIncBasePriorityPrivilege 3000 dllhost.exe Token: 33 3000 dllhost.exe Token: SeIncBasePriorityPrivilege 3000 dllhost.exe Token: 33 3000 dllhost.exe Token: SeIncBasePriorityPrivilege 3000 dllhost.exe Token: 33 3000 dllhost.exe Token: SeIncBasePriorityPrivilege 3000 dllhost.exe Token: 33 3000 dllhost.exe Token: SeIncBasePriorityPrivilege 3000 dllhost.exe Token: 33 3000 dllhost.exe Token: SeIncBasePriorityPrivilege 3000 dllhost.exe Token: 33 3000 dllhost.exe Token: SeIncBasePriorityPrivilege 3000 dllhost.exe Token: 33 3000 dllhost.exe Token: SeIncBasePriorityPrivilege 3000 dllhost.exe Token: 33 3000 dllhost.exe Token: SeIncBasePriorityPrivilege 3000 dllhost.exe Token: 33 3000 dllhost.exe Token: SeIncBasePriorityPrivilege 3000 dllhost.exe Token: 33 3000 dllhost.exe Token: SeIncBasePriorityPrivilege 3000 dllhost.exe Token: 33 3000 dllhost.exe Token: SeIncBasePriorityPrivilege 3000 dllhost.exe Token: 33 3000 dllhost.exe Token: SeIncBasePriorityPrivilege 3000 dllhost.exe Token: 33 3000 dllhost.exe Token: SeIncBasePriorityPrivilege 3000 dllhost.exe Token: 33 3000 dllhost.exe Token: SeIncBasePriorityPrivilege 3000 dllhost.exe Token: 33 3000 dllhost.exe Token: SeIncBasePriorityPrivilege 3000 dllhost.exe Token: 33 3000 dllhost.exe Token: SeIncBasePriorityPrivilege 3000 dllhost.exe Token: 33 3000 dllhost.exe Token: SeIncBasePriorityPrivilege 3000 dllhost.exe Token: 33 3000 dllhost.exe Token: SeIncBasePriorityPrivilege 3000 dllhost.exe Token: 33 3000 dllhost.exe Token: SeIncBasePriorityPrivilege 3000 dllhost.exe Token: 33 3000 dllhost.exe Token: SeIncBasePriorityPrivilege 3000 dllhost.exe Token: 33 3000 dllhost.exe Token: SeIncBasePriorityPrivilege 3000 dllhost.exe Token: 33 3000 dllhost.exe Token: SeIncBasePriorityPrivilege 3000 dllhost.exe Token: 33 3000 dllhost.exe Token: SeIncBasePriorityPrivilege 3000 dllhost.exe Token: 33 3000 dllhost.exe -
Suspicious use of WriteProcessMemory 52 IoCs
description pid Process procid_target PID 2232 wrote to memory of 3000 2232 Sound Blaster creative set-up.fix.exe 30 PID 2232 wrote to memory of 3000 2232 Sound Blaster creative set-up.fix.exe 30 PID 2232 wrote to memory of 3000 2232 Sound Blaster creative set-up.fix.exe 30 PID 2232 wrote to memory of 3000 2232 Sound Blaster creative set-up.fix.exe 30 PID 3000 wrote to memory of 2808 3000 dllhost.exe 31 PID 3000 wrote to memory of 2808 3000 dllhost.exe 31 PID 3000 wrote to memory of 2808 3000 dllhost.exe 31 PID 3000 wrote to memory of 2808 3000 dllhost.exe 31 PID 2808 wrote to memory of 2612 2808 cmd.exe 33 PID 2808 wrote to memory of 2612 2808 cmd.exe 33 PID 2808 wrote to memory of 2612 2808 cmd.exe 33 PID 2808 wrote to memory of 2612 2808 cmd.exe 33 PID 3000 wrote to memory of 1376 3000 dllhost.exe 34 PID 3000 wrote to memory of 1376 3000 dllhost.exe 34 PID 3000 wrote to memory of 1376 3000 dllhost.exe 34 PID 3000 wrote to memory of 1376 3000 dllhost.exe 34 PID 1376 wrote to memory of 2604 1376 cmd.exe 36 PID 1376 wrote to memory of 2604 1376 cmd.exe 36 PID 1376 wrote to memory of 2604 1376 cmd.exe 36 PID 1376 wrote to memory of 2604 1376 cmd.exe 36 PID 3000 wrote to memory of 2636 3000 dllhost.exe 37 PID 3000 wrote to memory of 2636 3000 dllhost.exe 37 PID 3000 wrote to memory of 2636 3000 dllhost.exe 37 PID 3000 wrote to memory of 2636 3000 dllhost.exe 37 PID 2636 wrote to memory of 1724 2636 cmd.exe 39 PID 2636 wrote to memory of 1724 2636 cmd.exe 39 PID 2636 wrote to memory of 1724 2636 cmd.exe 39 PID 2636 wrote to memory of 1724 2636 cmd.exe 39 PID 3000 wrote to memory of 2156 3000 dllhost.exe 40 PID 3000 wrote to memory of 2156 3000 dllhost.exe 40 PID 3000 wrote to memory of 2156 3000 dllhost.exe 40 PID 3000 wrote to memory of 2156 3000 dllhost.exe 40 PID 2156 wrote to memory of 2304 2156 cmd.exe 42 PID 2156 wrote to memory of 2304 2156 cmd.exe 42 PID 2156 wrote to memory of 2304 2156 cmd.exe 42 PID 2156 wrote to memory of 2304 2156 cmd.exe 42 PID 3000 wrote to memory of 2144 3000 dllhost.exe 43 PID 3000 wrote to memory of 2144 3000 dllhost.exe 43 PID 3000 wrote to memory of 2144 3000 dllhost.exe 43 PID 3000 wrote to memory of 2144 3000 dllhost.exe 43 PID 2144 wrote to memory of 332 2144 cmd.exe 45 PID 2144 wrote to memory of 332 2144 cmd.exe 45 PID 2144 wrote to memory of 332 2144 cmd.exe 45 PID 2144 wrote to memory of 332 2144 cmd.exe 45 PID 3000 wrote to memory of 2164 3000 dllhost.exe 57 PID 3000 wrote to memory of 2164 3000 dllhost.exe 57 PID 3000 wrote to memory of 2164 3000 dllhost.exe 57 PID 3000 wrote to memory of 2164 3000 dllhost.exe 57 PID 3000 wrote to memory of 1584 3000 dllhost.exe 58 PID 3000 wrote to memory of 1584 3000 dllhost.exe 58 PID 3000 wrote to memory of 1584 3000 dllhost.exe 58 PID 3000 wrote to memory of 1584 3000 dllhost.exe 58
Processes
-
C:\Users\Admin\AppData\Local\Temp\Sound Blaster creative set-up.fix.exe"C:\Users\Admin\AppData\Local\Temp\Sound Blaster creative set-up.fix.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2232 -
C:\ProgramData\dllhost.exe"C:\ProgramData\dllhost.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3000 -
C:\Windows\SysWOW64\cmd.execmd /c powershell Set-MpPreference -DisableRealtimeMonitoring $true3⤵
- Suspicious use of WriteProcessMemory
PID:2808 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell Set-MpPreference -DisableRealtimeMonitoring $true4⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2612
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c sc query windefend3⤵
- Suspicious use of WriteProcessMemory
PID:1376 -
C:\Windows\SysWOW64\sc.exesc query windefend4⤵
- Launches sc.exe
PID:2604
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c sc stop windefend3⤵
- Suspicious use of WriteProcessMemory
PID:2636 -
C:\Windows\SysWOW64\sc.exesc stop windefend4⤵
- Launches sc.exe
PID:1724
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c sc delete windefend3⤵
- Suspicious use of WriteProcessMemory
PID:2156 -
C:\Windows\SysWOW64\sc.exesc delete windefend4⤵
- Launches sc.exe
PID:2304
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c taskkill /f /im svchost.exe3⤵
- Suspicious use of WriteProcessMemory
PID:2144 -
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im svchost.exe4⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:332
-
-
-
C:\Users\Admin\AppData\Local\Temp\4f6d82eb10a040658aa7ca149b72ce8f.exe"C:\Users\Admin\AppData\Local\Temp\4f6d82eb10a040658aa7ca149b72ce8f.exe"3⤵
- Executes dropped EXE
PID:2164
-
-
C:\Users\Admin\AppData\Local\Temp\0435cf9f226d4ab7a1eacdfc7f64050a.exe"C:\Users\Admin\AppData\Local\Temp\0435cf9f226d4ab7a1eacdfc7f64050a.exe"3⤵
- Executes dropped EXE
PID:1584
-
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs1⤵PID:1952
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs1⤵PID:2512
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs1⤵PID:1068
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted1⤵PID:1048
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs1⤵PID:2484
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs1⤵PID:2256
-
C:\Windows\system32\LogonUI.exe"LogonUI.exe" /flags:0x11⤵PID:908
-
C:\Windows\system32\LogonUI.exe"LogonUI.exe" /flags:0x11⤵PID:844
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
202KB
MD569e54877c8aee907efaad8e96ffa8bad
SHA1fa005fa2f233fb07c0a58b06b0c88610164097a8
SHA25683b491f66cbcc39a71daff3cb9f2e6228a77959aebdf6a87b4c95f884de588a4
SHA512db4d864dd8ae525b48941491ff257e8eee64ba93cdf1e9fd96a21d124bc01dfe660fe9451a87cb306964c2966854a0626d5f777bb35aec47c83c5956f2f4b917
-
Filesize
997KB
MD528aaac578be4ce06cb695e4f927b4302
SHA1880ab0560b81e05e920f9ec1d6c0ecf5e04eaa7e
SHA2568929d3b749ff91527b8e407eff6bde4bb0bb27739313b5c0db0434cbf700dbfc
SHA512068698bda0543c773b36830f6760456e40e9046d9d20089ad88cb646ef5c7bd6c6716c6d59cfc7abd5bffb9129f5a7076e2f9c9b321795f224923f00b7b91374
-
Filesize
961KB
MD54723c3c04794c09bbcb6e03f48440f15
SHA1a5ef69c9dc9eacc2099d9c239146a0e360f1837f
SHA2560d635f035cdb2fd3afda768cd631481ff980957b614a3cf3fca6c592c6c06470
SHA5125b68e1cd3d6bb85b5f449014cc288423faea76ff0ecf8834047dac1ed6e84c4d858a7ed23abe3625d781391f636893736bf5c00474ad0995e75611c1557c5c4a