Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    150s
  • max time network
    174s
  • platform
    windows7_x64
  • resource
    win7-20230220-en
  • resource tags

    arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
  • submitted
    01/05/2023, 18:33

General

  • Target

    d03cbd58c678636f83ffbd13e07784124672ba8908c0e95c6293106ec72885d7.exe

  • Size

    611KB

  • MD5

    8014ae9b23a0e6d6f5bb01b2495f9c54

  • SHA1

    7d2fbcf2c6ae97abde9ed3dc8c90f5d2b8edf920

  • SHA256

    d03cbd58c678636f83ffbd13e07784124672ba8908c0e95c6293106ec72885d7

  • SHA512

    89bce67d148cca59467b46af1aa58842c8ecc6b0e674513ab175d63ddde257971edf4475b306c93d8f31218d0992f1602c13d5aeb4d104e1549b0fa4914537f9

  • SSDEEP

    12288:Ky901ewSvw3XmTAk3qbdLKZnfrXfS0NhdYX91le7X1:Kywe1i2TAk6xLorXfa96L1

Malware Config

Signatures

  • Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs
  • Executes dropped EXE 3 IoCs
  • Loads dropped DLL 6 IoCs
  • Windows security modification 2 TTPs 2 IoCs
  • Adds Run key to start application 2 TTPs 4 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 21 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\d03cbd58c678636f83ffbd13e07784124672ba8908c0e95c6293106ec72885d7.exe
    "C:\Users\Admin\AppData\Local\Temp\d03cbd58c678636f83ffbd13e07784124672ba8908c0e95c6293106ec72885d7.exe"
    1⤵
    • Loads dropped DLL
    • Adds Run key to start application
    • Suspicious use of WriteProcessMemory
    PID:932
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\st531230.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\st531230.exe
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Adds Run key to start application
      • Suspicious use of WriteProcessMemory
      PID:1976
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\22517135.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\22517135.exe
        3⤵
        • Modifies Windows Defender Real-time Protection settings
        • Executes dropped EXE
        • Windows security modification
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:584
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\kp349817.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\kp349817.exe
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Suspicious use of AdjustPrivilegeToken
        PID:1880

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\st531230.exe

    Filesize

    457KB

    MD5

    06d3b78530286575b32cd19381f27b4e

    SHA1

    d9a65642e96df110d4151944e803ca0dcf63d706

    SHA256

    df91a2ce0c716220ca457ce88ea568bedfa69309b4dc504cb2c03396fef08005

    SHA512

    50fd4f6d8d87c7cb8fdbecd67dfae97749c4562e548c5d9198ffe1bcb60cdc2730233378d9a3dc339dfcd92b02f184f54b1b9eb40748b6a6bf7d2f69b71530c1

  • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\st531230.exe

    Filesize

    457KB

    MD5

    06d3b78530286575b32cd19381f27b4e

    SHA1

    d9a65642e96df110d4151944e803ca0dcf63d706

    SHA256

    df91a2ce0c716220ca457ce88ea568bedfa69309b4dc504cb2c03396fef08005

    SHA512

    50fd4f6d8d87c7cb8fdbecd67dfae97749c4562e548c5d9198ffe1bcb60cdc2730233378d9a3dc339dfcd92b02f184f54b1b9eb40748b6a6bf7d2f69b71530c1

  • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\22517135.exe

    Filesize

    11KB

    MD5

    7e93bacbbc33e6652e147e7fe07572a0

    SHA1

    421a7167da01c8da4dc4d5234ca3dd84e319e762

    SHA256

    850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38

    SHA512

    250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91

  • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\22517135.exe

    Filesize

    11KB

    MD5

    7e93bacbbc33e6652e147e7fe07572a0

    SHA1

    421a7167da01c8da4dc4d5234ca3dd84e319e762

    SHA256

    850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38

    SHA512

    250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91

  • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\kp349817.exe

    Filesize

    459KB

    MD5

    1d016cdd1baeddc8f113d58cd7565cb3

    SHA1

    63b5cae741e33cca04258688f138b3a8c12d0b57

    SHA256

    e203a12d8551312e0d7e33edcebda5f4fe019886e1b65cf4a5ee0aa89b8a10e1

    SHA512

    61398c26da5f7f7eb7e236536fcc924f63f835050191e6b8f6e33e24968cbca45152f80e9616f741d287ca2f91b6587e60a4cf17680b6cfaf007abc94c694a6e

  • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\kp349817.exe

    Filesize

    459KB

    MD5

    1d016cdd1baeddc8f113d58cd7565cb3

    SHA1

    63b5cae741e33cca04258688f138b3a8c12d0b57

    SHA256

    e203a12d8551312e0d7e33edcebda5f4fe019886e1b65cf4a5ee0aa89b8a10e1

    SHA512

    61398c26da5f7f7eb7e236536fcc924f63f835050191e6b8f6e33e24968cbca45152f80e9616f741d287ca2f91b6587e60a4cf17680b6cfaf007abc94c694a6e

  • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\kp349817.exe

    Filesize

    459KB

    MD5

    1d016cdd1baeddc8f113d58cd7565cb3

    SHA1

    63b5cae741e33cca04258688f138b3a8c12d0b57

    SHA256

    e203a12d8551312e0d7e33edcebda5f4fe019886e1b65cf4a5ee0aa89b8a10e1

    SHA512

    61398c26da5f7f7eb7e236536fcc924f63f835050191e6b8f6e33e24968cbca45152f80e9616f741d287ca2f91b6587e60a4cf17680b6cfaf007abc94c694a6e

  • \Users\Admin\AppData\Local\Temp\IXP000.TMP\st531230.exe

    Filesize

    457KB

    MD5

    06d3b78530286575b32cd19381f27b4e

    SHA1

    d9a65642e96df110d4151944e803ca0dcf63d706

    SHA256

    df91a2ce0c716220ca457ce88ea568bedfa69309b4dc504cb2c03396fef08005

    SHA512

    50fd4f6d8d87c7cb8fdbecd67dfae97749c4562e548c5d9198ffe1bcb60cdc2730233378d9a3dc339dfcd92b02f184f54b1b9eb40748b6a6bf7d2f69b71530c1

  • \Users\Admin\AppData\Local\Temp\IXP000.TMP\st531230.exe

    Filesize

    457KB

    MD5

    06d3b78530286575b32cd19381f27b4e

    SHA1

    d9a65642e96df110d4151944e803ca0dcf63d706

    SHA256

    df91a2ce0c716220ca457ce88ea568bedfa69309b4dc504cb2c03396fef08005

    SHA512

    50fd4f6d8d87c7cb8fdbecd67dfae97749c4562e548c5d9198ffe1bcb60cdc2730233378d9a3dc339dfcd92b02f184f54b1b9eb40748b6a6bf7d2f69b71530c1

  • \Users\Admin\AppData\Local\Temp\IXP001.TMP\22517135.exe

    Filesize

    11KB

    MD5

    7e93bacbbc33e6652e147e7fe07572a0

    SHA1

    421a7167da01c8da4dc4d5234ca3dd84e319e762

    SHA256

    850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38

    SHA512

    250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91

  • \Users\Admin\AppData\Local\Temp\IXP001.TMP\kp349817.exe

    Filesize

    459KB

    MD5

    1d016cdd1baeddc8f113d58cd7565cb3

    SHA1

    63b5cae741e33cca04258688f138b3a8c12d0b57

    SHA256

    e203a12d8551312e0d7e33edcebda5f4fe019886e1b65cf4a5ee0aa89b8a10e1

    SHA512

    61398c26da5f7f7eb7e236536fcc924f63f835050191e6b8f6e33e24968cbca45152f80e9616f741d287ca2f91b6587e60a4cf17680b6cfaf007abc94c694a6e

  • \Users\Admin\AppData\Local\Temp\IXP001.TMP\kp349817.exe

    Filesize

    459KB

    MD5

    1d016cdd1baeddc8f113d58cd7565cb3

    SHA1

    63b5cae741e33cca04258688f138b3a8c12d0b57

    SHA256

    e203a12d8551312e0d7e33edcebda5f4fe019886e1b65cf4a5ee0aa89b8a10e1

    SHA512

    61398c26da5f7f7eb7e236536fcc924f63f835050191e6b8f6e33e24968cbca45152f80e9616f741d287ca2f91b6587e60a4cf17680b6cfaf007abc94c694a6e

  • \Users\Admin\AppData\Local\Temp\IXP001.TMP\kp349817.exe

    Filesize

    459KB

    MD5

    1d016cdd1baeddc8f113d58cd7565cb3

    SHA1

    63b5cae741e33cca04258688f138b3a8c12d0b57

    SHA256

    e203a12d8551312e0d7e33edcebda5f4fe019886e1b65cf4a5ee0aa89b8a10e1

    SHA512

    61398c26da5f7f7eb7e236536fcc924f63f835050191e6b8f6e33e24968cbca45152f80e9616f741d287ca2f91b6587e60a4cf17680b6cfaf007abc94c694a6e

  • memory/584-72-0x00000000003A0000-0x00000000003AA000-memory.dmp

    Filesize

    40KB

  • memory/1880-107-0x0000000002370000-0x00000000023A5000-memory.dmp

    Filesize

    212KB

  • memory/1880-121-0x0000000002370000-0x00000000023A5000-memory.dmp

    Filesize

    212KB

  • memory/1880-85-0x0000000002370000-0x00000000023AA000-memory.dmp

    Filesize

    232KB

  • memory/1880-86-0x0000000002370000-0x00000000023A5000-memory.dmp

    Filesize

    212KB

  • memory/1880-87-0x0000000002370000-0x00000000023A5000-memory.dmp

    Filesize

    212KB

  • memory/1880-89-0x0000000002370000-0x00000000023A5000-memory.dmp

    Filesize

    212KB

  • memory/1880-91-0x0000000002370000-0x00000000023A5000-memory.dmp

    Filesize

    212KB

  • memory/1880-93-0x0000000002370000-0x00000000023A5000-memory.dmp

    Filesize

    212KB

  • memory/1880-95-0x0000000002370000-0x00000000023A5000-memory.dmp

    Filesize

    212KB

  • memory/1880-97-0x0000000002370000-0x00000000023A5000-memory.dmp

    Filesize

    212KB

  • memory/1880-99-0x0000000002370000-0x00000000023A5000-memory.dmp

    Filesize

    212KB

  • memory/1880-101-0x0000000002370000-0x00000000023A5000-memory.dmp

    Filesize

    212KB

  • memory/1880-103-0x0000000002370000-0x00000000023A5000-memory.dmp

    Filesize

    212KB

  • memory/1880-105-0x0000000002370000-0x00000000023A5000-memory.dmp

    Filesize

    212KB

  • memory/1880-83-0x0000000000260000-0x00000000002A6000-memory.dmp

    Filesize

    280KB

  • memory/1880-109-0x0000000002370000-0x00000000023A5000-memory.dmp

    Filesize

    212KB

  • memory/1880-111-0x0000000002370000-0x00000000023A5000-memory.dmp

    Filesize

    212KB

  • memory/1880-113-0x0000000002370000-0x00000000023A5000-memory.dmp

    Filesize

    212KB

  • memory/1880-115-0x0000000002370000-0x00000000023A5000-memory.dmp

    Filesize

    212KB

  • memory/1880-117-0x0000000002370000-0x00000000023A5000-memory.dmp

    Filesize

    212KB

  • memory/1880-119-0x0000000002370000-0x00000000023A5000-memory.dmp

    Filesize

    212KB

  • memory/1880-84-0x0000000000C00000-0x0000000000C3C000-memory.dmp

    Filesize

    240KB

  • memory/1880-123-0x0000000002370000-0x00000000023A5000-memory.dmp

    Filesize

    212KB

  • memory/1880-129-0x0000000002370000-0x00000000023A5000-memory.dmp

    Filesize

    212KB

  • memory/1880-127-0x0000000002370000-0x00000000023A5000-memory.dmp

    Filesize

    212KB

  • memory/1880-125-0x0000000002370000-0x00000000023A5000-memory.dmp

    Filesize

    212KB

  • memory/1880-131-0x0000000002370000-0x00000000023A5000-memory.dmp

    Filesize

    212KB

  • memory/1880-133-0x0000000002370000-0x00000000023A5000-memory.dmp

    Filesize

    212KB

  • memory/1880-135-0x0000000002370000-0x00000000023A5000-memory.dmp

    Filesize

    212KB

  • memory/1880-137-0x0000000002370000-0x00000000023A5000-memory.dmp

    Filesize

    212KB

  • memory/1880-139-0x0000000002370000-0x00000000023A5000-memory.dmp

    Filesize

    212KB

  • memory/1880-141-0x0000000002370000-0x00000000023A5000-memory.dmp

    Filesize

    212KB

  • memory/1880-143-0x0000000002370000-0x00000000023A5000-memory.dmp

    Filesize

    212KB

  • memory/1880-145-0x0000000002370000-0x00000000023A5000-memory.dmp

    Filesize

    212KB

  • memory/1880-147-0x0000000002370000-0x00000000023A5000-memory.dmp

    Filesize

    212KB

  • memory/1880-149-0x0000000002370000-0x00000000023A5000-memory.dmp

    Filesize

    212KB

  • memory/1880-634-0x0000000004DB0000-0x0000000004DF0000-memory.dmp

    Filesize

    256KB

  • memory/1880-636-0x0000000004DB0000-0x0000000004DF0000-memory.dmp

    Filesize

    256KB

  • memory/1880-638-0x0000000004DB0000-0x0000000004DF0000-memory.dmp

    Filesize

    256KB

  • memory/1880-882-0x0000000004DB0000-0x0000000004DF0000-memory.dmp

    Filesize

    256KB

  • memory/1880-883-0x0000000004DB0000-0x0000000004DF0000-memory.dmp

    Filesize

    256KB

  • memory/1880-884-0x0000000004DB0000-0x0000000004DF0000-memory.dmp

    Filesize

    256KB

  • memory/1880-887-0x0000000004DB0000-0x0000000004DF0000-memory.dmp

    Filesize

    256KB