Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    149s
  • max time network
    153s
  • platform
    windows10-1703_x64
  • resource
    win10-20240404-en
  • resource tags

    arch:x64arch:x86image:win10-20240404-enlocale:en-usos:windows10-1703-x64system
  • submitted
    21/08/2024, 13:45

General

  • Target

    Svhost.exe

  • Size

    399KB

  • MD5

    7d4970831fafb993a4b0de345cb6832b

  • SHA1

    ff95a1c11fe502a396f65cb817abf6796dfb791a

  • SHA256

    fa47d6d85592087d1cba503253670920ac9545deb3176006fc79606b21ae966c

  • SHA512

    9b27ecaca0dc6b7b68acdcfc4308f213b94ddfea3cbc357ee96e1cc82bd2e3cfb06c4c8a9ce5647fbde18931f5e2b34e5a119295c4548d719b7a85d425657b84

  • SSDEEP

    6144:PaSpJQYtBJ5666+e6VlWT8b9L+s82y00ZFlTzubWKrhtwwD:PPph95o+PVle8Is8LZFFCrhtw4

Malware Config

Signatures

  • Modifies WinLogon for persistence 2 TTPs 2 IoCs
  • Event Triggered Execution: AppInit DLLs 1 TTPs

    Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by AppInit DLLs loaded into processes.

  • Adds Run key to start application 2 TTPs 1 IoCs
  • Drops file in Windows directory 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Delays execution with timeout.exe 1 IoCs
  • Kills process with taskkill 1 IoCs
  • Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 16 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

Processes

  • C:\Users\Admin\AppData\Local\Temp\Svhost.exe
    "C:\Users\Admin\AppData\Local\Temp\Svhost.exe"
    1⤵
    • Modifies WinLogon for persistence
    • Adds Run key to start application
    • Drops file in Windows directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:2824
    • C:\Windows\SYSTEM32\CMD.exe
      "CMD" /C SchTaSKs /CrEAte /F /sc OnLoGoN /rl HighEst /tn "svchost.exe" /tr "C:\Users\Admin\AppData\Roaming\xdwdAvast Antivirus Upgrade.exe" & exit
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:3444
      • C:\Windows\system32\schtasks.exe
        SchTaSKs /CrEAte /F /sc OnLoGoN /rl HighEst /tn "svchost.exe" /tr "C:\Users\Admin\AppData\Roaming\xdwdAvast Antivirus Upgrade.exe"
        3⤵
        • Scheduled Task/Job: Scheduled Task
        PID:4180
    • C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe" /c schtASks /deLeTe /F /Tn "svchost.exe" & exit
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:5076
      • C:\Windows\system32\schtasks.exe
        schtASks /deLeTe /F /Tn "svchost.exe"
        3⤵
          PID:4980
      • C:\Windows\SYSTEM32\CMD.exe
        "CMD" /C taskkill /im explorer.exe /f
        2⤵
        • Suspicious use of WriteProcessMemory
        PID:1296
        • C:\Windows\system32\taskkill.exe
          taskkill /im explorer.exe /f
          3⤵
          • Kills process with taskkill
          • Suspicious use of AdjustPrivilegeToken
          PID:3260
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmp9BD9.tmp.bat""
        2⤵
        • Suspicious use of WriteProcessMemory
        PID:3644
        • C:\Windows\system32\timeout.exe
          timeout 5
          3⤵
          • Delays execution with timeout.exe
          PID:1792
    • C:\Windows\system32\wbem\WmiApSrv.exe
      C:\Windows\system32\wbem\WmiApSrv.exe
      1⤵
      • Suspicious behavior: EnumeratesProcesses
      PID:4848

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\Temp\tmp9BD9.tmp.bat

      Filesize

      262B

      MD5

      729324bab31d55db11306fdd91643e25

      SHA1

      20ffc24b2edda91e9334823184edaa045619ae9e

      SHA256

      e8bafe2040195eae8f9d886f02c4ddf5e94d9958e86af86580081be39d86c51e

      SHA512

      1af7006dbda7bd8affa360761d3a4d5975444ac5d83c43e9469a746b98e7a91b4420c5ac15c2c5a70e9951babb7986602595502bcbec93ece50596120db14c25

    • C:\Windows\xdwd.dll

      Filesize

      136KB

      MD5

      16e5a492c9c6ae34c59683be9c51fa31

      SHA1

      97031b41f5c56f371c28ae0d62a2df7d585adaba

      SHA256

      35c8d022e1d917f1aabdceae98097ccc072161b302f84c768ca63e4b32ac2b66

      SHA512

      20fd369172ef5e3e2fde388666b42e8fe5f0c2bfa338c0345f45e98af6561a249ba3ecc48c3f16efcc73f02ecb67b3ddb1e2e8f0e77d18fa00ac34e6379e50b6

    • memory/2824-119-0x00007FFA5EE10000-0x00007FFA5F7FC000-memory.dmp

      Filesize

      9.9MB

    • memory/2824-1-0x0000000000F50000-0x0000000000FB8000-memory.dmp

      Filesize

      416KB

    • memory/2824-2-0x00007FFA5EE13000-0x00007FFA5EE14000-memory.dmp

      Filesize

      4KB

    • memory/2824-39-0x00007FFA5EE10000-0x00007FFA5F7FC000-memory.dmp

      Filesize

      9.9MB

    • memory/2824-1131-0x00007FFA5EE10000-0x00007FFA5F7FC000-memory.dmp

      Filesize

      9.9MB

    • memory/2824-0-0x00007FFA5EE13000-0x00007FFA5EE14000-memory.dmp

      Filesize

      4KB

    • memory/4848-62-0x00007FFA6A855000-0x00007FFA6A856000-memory.dmp

      Filesize

      4KB

    • memory/4848-65-0x00007FFA5B090000-0x00007FFA5B0B2000-memory.dmp

      Filesize

      136KB

    • memory/4848-66-0x00007FFA6A7B0000-0x00007FFA6A98B000-memory.dmp

      Filesize

      1.9MB

    • memory/4848-64-0x00007FFA6A7B0000-0x00007FFA6A98B000-memory.dmp

      Filesize

      1.9MB

    • memory/4848-63-0x00007FFA6A7B0000-0x00007FFA6A98B000-memory.dmp

      Filesize

      1.9MB