Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
153s -
platform
windows10-1703_x64 -
resource
win10-20240404-en -
resource tags
arch:x64arch:x86image:win10-20240404-enlocale:en-usos:windows10-1703-x64system -
submitted
21/08/2024, 13:45
Static task
static1
Behavioral task
behavioral1
Sample
Svhost.exe
Resource
win7-20240729-en
Behavioral task
behavioral2
Sample
Svhost.exe
Resource
win10-20240404-en
Behavioral task
behavioral3
Sample
Svhost.exe
Resource
win10v2004-20240802-en
Behavioral task
behavioral4
Sample
Svhost.exe
Resource
win11-20240802-en
Behavioral task
behavioral5
Sample
Svhost.exe
Resource
macos-20240711.1-en
Behavioral task
behavioral6
Sample
Svhost.exe
Resource
macos-20240711.1-en
General
-
Target
Svhost.exe
-
Size
399KB
-
MD5
7d4970831fafb993a4b0de345cb6832b
-
SHA1
ff95a1c11fe502a396f65cb817abf6796dfb791a
-
SHA256
fa47d6d85592087d1cba503253670920ac9545deb3176006fc79606b21ae966c
-
SHA512
9b27ecaca0dc6b7b68acdcfc4308f213b94ddfea3cbc357ee96e1cc82bd2e3cfb06c4c8a9ce5647fbde18931f5e2b34e5a119295c4548d719b7a85d425657b84
-
SSDEEP
6144:PaSpJQYtBJ5666+e6VlWT8b9L+s82y00ZFlTzubWKrhtwwD:PPph95o+PVle8Is8LZFFCrhtw4
Malware Config
Signatures
-
Modifies WinLogon for persistence 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\Windows\\System32\\userinit.exe,C:\\Users\\Admin\\AppData\\Roaming\\xdwdAvast Antivirus Upgrade.exe" Svhost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\Windows\\System32\\userinit.exe" Svhost.exe -
Event Triggered Execution: AppInit DLLs 1 TTPs
Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by AppInit DLLs loaded into processes.
-
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000\Software\Microsoft\Windows\CurrentVersion\Run\xdwdfghfghfg = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\Templates\\xdwdMicrosoft Dynamics Upgrade.exe" Svhost.exe -
Drops file in Windows directory 1 IoCs
description ioc Process File created C:\Windows\xdwd.dll Svhost.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Delays execution with timeout.exe 1 IoCs
pid Process 1792 timeout.exe -
Kills process with taskkill 1 IoCs
pid Process 3260 taskkill.exe -
Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 4180 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2824 Svhost.exe 2824 Svhost.exe 2824 Svhost.exe 2824 Svhost.exe 2824 Svhost.exe 2824 Svhost.exe 2824 Svhost.exe 2824 Svhost.exe 2824 Svhost.exe 2824 Svhost.exe 2824 Svhost.exe 2824 Svhost.exe 2824 Svhost.exe 2824 Svhost.exe 2824 Svhost.exe 2824 Svhost.exe 2824 Svhost.exe 2824 Svhost.exe 2824 Svhost.exe 2824 Svhost.exe 2824 Svhost.exe 2824 Svhost.exe 2824 Svhost.exe 2824 Svhost.exe 2824 Svhost.exe 2824 Svhost.exe 2824 Svhost.exe 2824 Svhost.exe 2824 Svhost.exe 2824 Svhost.exe 2824 Svhost.exe 2824 Svhost.exe 2824 Svhost.exe 4848 WmiApSrv.exe 4848 WmiApSrv.exe 2824 Svhost.exe 2824 Svhost.exe 2824 Svhost.exe 2824 Svhost.exe 2824 Svhost.exe 2824 Svhost.exe 2824 Svhost.exe 2824 Svhost.exe 2824 Svhost.exe 2824 Svhost.exe 2824 Svhost.exe 2824 Svhost.exe 2824 Svhost.exe 2824 Svhost.exe 2824 Svhost.exe 2824 Svhost.exe 2824 Svhost.exe 2824 Svhost.exe 2824 Svhost.exe 2824 Svhost.exe 2824 Svhost.exe 2824 Svhost.exe 2824 Svhost.exe 2824 Svhost.exe 2824 Svhost.exe 2824 Svhost.exe 2824 Svhost.exe 2824 Svhost.exe 2824 Svhost.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 2824 Svhost.exe Token: SeDebugPrivilege 3260 taskkill.exe -
Suspicious use of WriteProcessMemory 16 IoCs
description pid Process procid_target PID 2824 wrote to memory of 3444 2824 Svhost.exe 75 PID 2824 wrote to memory of 3444 2824 Svhost.exe 75 PID 3444 wrote to memory of 4180 3444 CMD.exe 77 PID 3444 wrote to memory of 4180 3444 CMD.exe 77 PID 2824 wrote to memory of 5076 2824 Svhost.exe 79 PID 2824 wrote to memory of 5076 2824 Svhost.exe 79 PID 2824 wrote to memory of 1296 2824 Svhost.exe 81 PID 2824 wrote to memory of 1296 2824 Svhost.exe 81 PID 1296 wrote to memory of 3260 1296 CMD.exe 83 PID 1296 wrote to memory of 3260 1296 CMD.exe 83 PID 5076 wrote to memory of 4980 5076 cmd.exe 84 PID 5076 wrote to memory of 4980 5076 cmd.exe 84 PID 2824 wrote to memory of 3644 2824 Svhost.exe 85 PID 2824 wrote to memory of 3644 2824 Svhost.exe 85 PID 3644 wrote to memory of 1792 3644 cmd.exe 87 PID 3644 wrote to memory of 1792 3644 cmd.exe 87 -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\Svhost.exe"C:\Users\Admin\AppData\Local\Temp\Svhost.exe"1⤵
- Modifies WinLogon for persistence
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2824 -
C:\Windows\SYSTEM32\CMD.exe"CMD" /C SchTaSKs /CrEAte /F /sc OnLoGoN /rl HighEst /tn "svchost.exe" /tr "C:\Users\Admin\AppData\Roaming\xdwdAvast Antivirus Upgrade.exe" & exit2⤵
- Suspicious use of WriteProcessMemory
PID:3444 -
C:\Windows\system32\schtasks.exeSchTaSKs /CrEAte /F /sc OnLoGoN /rl HighEst /tn "svchost.exe" /tr "C:\Users\Admin\AppData\Roaming\xdwdAvast Antivirus Upgrade.exe"3⤵
- Scheduled Task/Job: Scheduled Task
PID:4180
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c schtASks /deLeTe /F /Tn "svchost.exe" & exit2⤵
- Suspicious use of WriteProcessMemory
PID:5076 -
C:\Windows\system32\schtasks.exeschtASks /deLeTe /F /Tn "svchost.exe"3⤵PID:4980
-
-
-
C:\Windows\SYSTEM32\CMD.exe"CMD" /C taskkill /im explorer.exe /f2⤵
- Suspicious use of WriteProcessMemory
PID:1296 -
C:\Windows\system32\taskkill.exetaskkill /im explorer.exe /f3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:3260
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmp9BD9.tmp.bat""2⤵
- Suspicious use of WriteProcessMemory
PID:3644 -
C:\Windows\system32\timeout.exetimeout 53⤵
- Delays execution with timeout.exe
PID:1792
-
-
-
C:\Windows\system32\wbem\WmiApSrv.exeC:\Windows\system32\wbem\WmiApSrv.exe1⤵
- Suspicious behavior: EnumeratesProcesses
PID:4848
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Event Triggered Execution
1AppInit DLLs
1Scheduled Task/Job
1Scheduled Task
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
262B
MD5729324bab31d55db11306fdd91643e25
SHA120ffc24b2edda91e9334823184edaa045619ae9e
SHA256e8bafe2040195eae8f9d886f02c4ddf5e94d9958e86af86580081be39d86c51e
SHA5121af7006dbda7bd8affa360761d3a4d5975444ac5d83c43e9469a746b98e7a91b4420c5ac15c2c5a70e9951babb7986602595502bcbec93ece50596120db14c25
-
Filesize
136KB
MD516e5a492c9c6ae34c59683be9c51fa31
SHA197031b41f5c56f371c28ae0d62a2df7d585adaba
SHA25635c8d022e1d917f1aabdceae98097ccc072161b302f84c768ca63e4b32ac2b66
SHA51220fd369172ef5e3e2fde388666b42e8fe5f0c2bfa338c0345f45e98af6561a249ba3ecc48c3f16efcc73f02ecb67b3ddb1e2e8f0e77d18fa00ac34e6379e50b6