Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    147s
  • max time network
    157s
  • platform
    windows11-21h2_x64
  • resource
    win11-20240802-en
  • resource tags

    arch:x64arch:x86image:win11-20240802-enlocale:en-usos:windows11-21h2-x64system
  • submitted
    21/08/2024, 13:45

General

  • Target

    Svhost.exe

  • Size

    399KB

  • MD5

    7d4970831fafb993a4b0de345cb6832b

  • SHA1

    ff95a1c11fe502a396f65cb817abf6796dfb791a

  • SHA256

    fa47d6d85592087d1cba503253670920ac9545deb3176006fc79606b21ae966c

  • SHA512

    9b27ecaca0dc6b7b68acdcfc4308f213b94ddfea3cbc357ee96e1cc82bd2e3cfb06c4c8a9ce5647fbde18931f5e2b34e5a119295c4548d719b7a85d425657b84

  • SSDEEP

    6144:PaSpJQYtBJ5666+e6VlWT8b9L+s82y00ZFlTzubWKrhtwwD:PPph95o+PVle8Is8LZFFCrhtw4

Malware Config

Signatures

  • Modifies WinLogon for persistence 2 TTPs 2 IoCs
  • Boot or Logon Autostart Execution: Active Setup 2 TTPs 1 IoCs

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

  • Event Triggered Execution: AppInit DLLs 1 TTPs

    Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by AppInit DLLs loaded into processes.

  • Loads dropped DLL 3 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • Drops file in Windows directory 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Delays execution with timeout.exe 2 IoCs
  • Kills process with taskkill 2 IoCs
  • Modifies registry class 1 IoCs
  • Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 6 IoCs
  • Suspicious use of WriteProcessMemory 26 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

Processes

  • C:\Users\Admin\AppData\Local\Temp\Svhost.exe
    "C:\Users\Admin\AppData\Local\Temp\Svhost.exe"
    1⤵
    • Modifies WinLogon for persistence
    • Adds Run key to start application
    • Drops file in Windows directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:1488
    • C:\Windows\SYSTEM32\CMD.exe
      "CMD" /C SchTaSKs /CrEAte /F /sc OnLoGoN /rl HighEst /tn "svchost.exe" /tr "C:\Users\Admin\AppData\Roaming\xdwdAvast Antivirus Upgrade.exe" & exit
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:4612
      • C:\Windows\system32\schtasks.exe
        SchTaSKs /CrEAte /F /sc OnLoGoN /rl HighEst /tn "svchost.exe" /tr "C:\Users\Admin\AppData\Roaming\xdwdAvast Antivirus Upgrade.exe"
        3⤵
        • Scheduled Task/Job: Scheduled Task
        PID:4160
    • C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe" /c schtASks /deLeTe /F /Tn "svchost.exe" & exit
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:1212
      • C:\Windows\system32\schtasks.exe
        schtASks /deLeTe /F /Tn "svchost.exe"
        3⤵
          PID:1808
      • C:\Windows\SYSTEM32\CMD.exe
        "CMD" /C taskkill /im explorer.exe /f
        2⤵
        • Suspicious use of WriteProcessMemory
        PID:1440
        • C:\Windows\system32\taskkill.exe
          taskkill /im explorer.exe /f
          3⤵
          • Kills process with taskkill
          • Suspicious use of AdjustPrivilegeToken
          PID:4184
      • C:\Windows\System32\cmd.exe
        "C:\Windows\System32\cmd.exe" /c schtASks /deLeTe /F /Tn "svchost.exe" & exit
        2⤵
        • Suspicious use of WriteProcessMemory
        PID:32
        • C:\Windows\system32\schtasks.exe
          schtASks /deLeTe /F /Tn "svchost.exe"
          3⤵
            PID:2016
        • C:\Windows\system32\cmd.exe
          C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmp9263.tmp.bat""
          2⤵
          • Suspicious use of WriteProcessMemory
          PID:5012
          • C:\Windows\system32\timeout.exe
            timeout 5
            3⤵
            • Delays execution with timeout.exe
            PID:4868
          • C:\Windows\explorer.exe
            explorer.exe
            3⤵
            • Boot or Logon Autostart Execution: Active Setup
            • Modifies registry class
            • Suspicious use of AdjustPrivilegeToken
            PID:3180
          • C:\Windows\system32\taskkill.exe
            taskkill /im xdwdAvast Antivirus Upgrade.exe /f
            3⤵
            • Kills process with taskkill
            PID:3040
          • C:\Windows\system32\timeout.exe
            timeout 3
            3⤵
            • Delays execution with timeout.exe
            PID:432
      • C:\Windows\system32\wbem\WmiApSrv.exe
        C:\Windows\system32\wbem\WmiApSrv.exe
        1⤵
        • Loads dropped DLL
        • Suspicious behavior: EnumeratesProcesses
        PID:1420
      • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
        "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
        1⤵
          PID:1340
        • C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe
          "C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe" -ServerName:CortanaUI.AppXstmwaab17q5s3y22tp6apqz7a45vwv65.mca
          1⤵
            PID:3524

          Network

          MITRE ATT&CK Enterprise v15

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          • C:\Users\Admin\AppData\Local\Temp\tmp9263.tmp.bat

            Filesize

            262B

            MD5

            1903fbaead4e164a4800b390f9d8777d

            SHA1

            c0127375f00b693e112f692fc719c5098ac8423d

            SHA256

            f461d109a868d263b8274fac3bdd13ea7c73035fafb8f96d299f56a94e226e4b

            SHA512

            068ff68b33d127bd44e895637639b11c5dc8b45c14bf97f23283c0a86eaf059b48a2e630759692cf1e3550c1ee6758a596dab63abea72bcb4b443cd324b9a421

          • C:\Windows\xdwd.dll

            Filesize

            136KB

            MD5

            16e5a492c9c6ae34c59683be9c51fa31

            SHA1

            97031b41f5c56f371c28ae0d62a2df7d585adaba

            SHA256

            35c8d022e1d917f1aabdceae98097ccc072161b302f84c768ca63e4b32ac2b66

            SHA512

            20fd369172ef5e3e2fde388666b42e8fe5f0c2bfa338c0345f45e98af6561a249ba3ecc48c3f16efcc73f02ecb67b3ddb1e2e8f0e77d18fa00ac34e6379e50b6

          • memory/1420-90-0x00007FFD33A90000-0x00007FFD33A91000-memory.dmp

            Filesize

            4KB

          • memory/1488-144-0x00007FFD12A40000-0x00007FFD13502000-memory.dmp

            Filesize

            10.8MB

          • memory/1488-51-0x00007FFD12A40000-0x00007FFD13502000-memory.dmp

            Filesize

            10.8MB

          • memory/1488-2-0x00007FFD12A43000-0x00007FFD12A45000-memory.dmp

            Filesize

            8KB

          • memory/1488-0-0x00007FFD12A43000-0x00007FFD12A45000-memory.dmp

            Filesize

            8KB

          • memory/1488-1-0x0000000000420000-0x0000000000488000-memory.dmp

            Filesize

            416KB

          • memory/1488-1103-0x00007FFD12A40000-0x00007FFD13502000-memory.dmp

            Filesize

            10.8MB

          • memory/3524-1119-0x000001E803020000-0x000001E803120000-memory.dmp

            Filesize

            1024KB

          • memory/3524-1145-0x000001E803020000-0x000001E803120000-memory.dmp

            Filesize

            1024KB

          • memory/3524-1171-0x000001E836980000-0x000001E836A80000-memory.dmp

            Filesize

            1024KB

          • memory/3524-1208-0x000001E8350B0000-0x000001E8350D0000-memory.dmp

            Filesize

            128KB

          • memory/3524-1209-0x000001E836820000-0x000001E836840000-memory.dmp

            Filesize

            128KB

          • memory/3524-1210-0x000001E835110000-0x000001E835130000-memory.dmp

            Filesize

            128KB