Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    153s
  • max time network
    176s
  • platform
    windows7_x64
  • resource
    win7-20230220-en
  • resource tags

    arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
  • submitted
    01/05/2023, 18:42

General

  • Target

    da7fad334a87ea8bbac628d2d0eea50038993e077d4c93e5ee45f9c899e67d78.exe

  • Size

    939KB

  • MD5

    8d52bd9554828ebda2d146da3bdf15dd

  • SHA1

    90e5a53f4d0fa15b60f00f1e7974519e1b37a54c

  • SHA256

    da7fad334a87ea8bbac628d2d0eea50038993e077d4c93e5ee45f9c899e67d78

  • SHA512

    053ab82bd5acc64164b1bf07cd537055c14f405aa706c0aae838c39a5fe514704c1928d3af27a6f7f9cd68c6b3b3f7521971667a0283c9b27a980e2d298a53fa

  • SSDEEP

    24576:gy+QwbLXPYNNNrL9jRRuPcUEWKOIOYpOS:nluiLzRuPcUSOnYA

Malware Config

Signatures

  • Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs
  • Executes dropped EXE 4 IoCs
  • Loads dropped DLL 10 IoCs
  • Windows security modification 2 TTPs 2 IoCs
  • Adds Run key to start application 2 TTPs 6 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 28 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\da7fad334a87ea8bbac628d2d0eea50038993e077d4c93e5ee45f9c899e67d78.exe
    "C:\Users\Admin\AppData\Local\Temp\da7fad334a87ea8bbac628d2d0eea50038993e077d4c93e5ee45f9c899e67d78.exe"
    1⤵
    • Loads dropped DLL
    • Adds Run key to start application
    • Suspicious use of WriteProcessMemory
    PID:1716
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\za369770.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\za369770.exe
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Adds Run key to start application
      • Suspicious use of WriteProcessMemory
      PID:1284
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\za024015.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\za024015.exe
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Adds Run key to start application
        • Suspicious use of WriteProcessMemory
        PID:1496
        • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\30207487.exe
          C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\30207487.exe
          4⤵
          • Modifies Windows Defender Real-time Protection settings
          • Executes dropped EXE
          • Loads dropped DLL
          • Windows security modification
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:1508
        • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\w75Fe25.exe
          C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\w75Fe25.exe
          4⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • Suspicious use of AdjustPrivilegeToken
          PID:1372

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\za369770.exe

    Filesize

    723KB

    MD5

    2f0f83b8a08721640f69a27cb8423f48

    SHA1

    99c152d0b15afebc1327934ce3192c992288d71f

    SHA256

    2c4bbbe21bfd2741a549a6cf576711c4ebf3a1fd641babec22a4dfcf45f956f2

    SHA512

    65c759ed19f4de7c8c4e11e00185a0cbe4b7fb2ed78972b9adc99caececf959a343001f57407d47dc971c6ce3921b5af66641f17c296e8f8e27c54c84d9b0e80

  • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\za369770.exe

    Filesize

    723KB

    MD5

    2f0f83b8a08721640f69a27cb8423f48

    SHA1

    99c152d0b15afebc1327934ce3192c992288d71f

    SHA256

    2c4bbbe21bfd2741a549a6cf576711c4ebf3a1fd641babec22a4dfcf45f956f2

    SHA512

    65c759ed19f4de7c8c4e11e00185a0cbe4b7fb2ed78972b9adc99caececf959a343001f57407d47dc971c6ce3921b5af66641f17c296e8f8e27c54c84d9b0e80

  • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\za024015.exe

    Filesize

    541KB

    MD5

    76f07765f2f24e1b59f6e98e7f4b6c54

    SHA1

    121c18087aa725970eb5697f5022d828e425c436

    SHA256

    74bfd46c9df22a967dc8c9c504b0694ee02e2b3d4277d729cdb8667bbd2c68a0

    SHA512

    71365728f4ac6c349b50034fbb213a2506b644ca7b73c180ffb9da61f6682bfa72b8f5b5d16c5dfdecae9ca9529cc74122095faf52aa59562392e81bc2e42e06

  • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\za024015.exe

    Filesize

    541KB

    MD5

    76f07765f2f24e1b59f6e98e7f4b6c54

    SHA1

    121c18087aa725970eb5697f5022d828e425c436

    SHA256

    74bfd46c9df22a967dc8c9c504b0694ee02e2b3d4277d729cdb8667bbd2c68a0

    SHA512

    71365728f4ac6c349b50034fbb213a2506b644ca7b73c180ffb9da61f6682bfa72b8f5b5d16c5dfdecae9ca9529cc74122095faf52aa59562392e81bc2e42e06

  • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\30207487.exe

    Filesize

    257KB

    MD5

    183e2a5982e0bdee9fd8dc8c69d10899

    SHA1

    7748cb5203afcaae09310452d4776a24d41e8a4b

    SHA256

    fbce00949dcabe9643071523849aa79c4eae943c31b25a5b1d91b184161cf63f

    SHA512

    fe76a8d81e82c62bc77bfab6d443b287746b87d9b49ab20020762c72bcecd1354e58a0ff3466ec3ac8c85ce5f44eb69f3f55647ce43523dc5f63ead86b52e514

  • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\30207487.exe

    Filesize

    257KB

    MD5

    183e2a5982e0bdee9fd8dc8c69d10899

    SHA1

    7748cb5203afcaae09310452d4776a24d41e8a4b

    SHA256

    fbce00949dcabe9643071523849aa79c4eae943c31b25a5b1d91b184161cf63f

    SHA512

    fe76a8d81e82c62bc77bfab6d443b287746b87d9b49ab20020762c72bcecd1354e58a0ff3466ec3ac8c85ce5f44eb69f3f55647ce43523dc5f63ead86b52e514

  • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\30207487.exe

    Filesize

    257KB

    MD5

    183e2a5982e0bdee9fd8dc8c69d10899

    SHA1

    7748cb5203afcaae09310452d4776a24d41e8a4b

    SHA256

    fbce00949dcabe9643071523849aa79c4eae943c31b25a5b1d91b184161cf63f

    SHA512

    fe76a8d81e82c62bc77bfab6d443b287746b87d9b49ab20020762c72bcecd1354e58a0ff3466ec3ac8c85ce5f44eb69f3f55647ce43523dc5f63ead86b52e514

  • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\w75Fe25.exe

    Filesize

    340KB

    MD5

    12fff22f6e59bb9f53c09c48d9d85832

    SHA1

    8fc41d0ef8e976a3ca3c176c7b3da32de8a12188

    SHA256

    9e005ecc5e92e011d21de1071b448a869a70412a48040db2c00983a993378a73

    SHA512

    b3835b859b74ff1acc28f90773a0ff6182256a90c6fa9709c3e999b99543cbf2aa4bafe989d0db424a8cd007569e5e3fb3ee20cf64c5b82cde87fd7269eebf64

  • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\w75Fe25.exe

    Filesize

    340KB

    MD5

    12fff22f6e59bb9f53c09c48d9d85832

    SHA1

    8fc41d0ef8e976a3ca3c176c7b3da32de8a12188

    SHA256

    9e005ecc5e92e011d21de1071b448a869a70412a48040db2c00983a993378a73

    SHA512

    b3835b859b74ff1acc28f90773a0ff6182256a90c6fa9709c3e999b99543cbf2aa4bafe989d0db424a8cd007569e5e3fb3ee20cf64c5b82cde87fd7269eebf64

  • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\w75Fe25.exe

    Filesize

    340KB

    MD5

    12fff22f6e59bb9f53c09c48d9d85832

    SHA1

    8fc41d0ef8e976a3ca3c176c7b3da32de8a12188

    SHA256

    9e005ecc5e92e011d21de1071b448a869a70412a48040db2c00983a993378a73

    SHA512

    b3835b859b74ff1acc28f90773a0ff6182256a90c6fa9709c3e999b99543cbf2aa4bafe989d0db424a8cd007569e5e3fb3ee20cf64c5b82cde87fd7269eebf64

  • \Users\Admin\AppData\Local\Temp\IXP000.TMP\za369770.exe

    Filesize

    723KB

    MD5

    2f0f83b8a08721640f69a27cb8423f48

    SHA1

    99c152d0b15afebc1327934ce3192c992288d71f

    SHA256

    2c4bbbe21bfd2741a549a6cf576711c4ebf3a1fd641babec22a4dfcf45f956f2

    SHA512

    65c759ed19f4de7c8c4e11e00185a0cbe4b7fb2ed78972b9adc99caececf959a343001f57407d47dc971c6ce3921b5af66641f17c296e8f8e27c54c84d9b0e80

  • \Users\Admin\AppData\Local\Temp\IXP000.TMP\za369770.exe

    Filesize

    723KB

    MD5

    2f0f83b8a08721640f69a27cb8423f48

    SHA1

    99c152d0b15afebc1327934ce3192c992288d71f

    SHA256

    2c4bbbe21bfd2741a549a6cf576711c4ebf3a1fd641babec22a4dfcf45f956f2

    SHA512

    65c759ed19f4de7c8c4e11e00185a0cbe4b7fb2ed78972b9adc99caececf959a343001f57407d47dc971c6ce3921b5af66641f17c296e8f8e27c54c84d9b0e80

  • \Users\Admin\AppData\Local\Temp\IXP001.TMP\za024015.exe

    Filesize

    541KB

    MD5

    76f07765f2f24e1b59f6e98e7f4b6c54

    SHA1

    121c18087aa725970eb5697f5022d828e425c436

    SHA256

    74bfd46c9df22a967dc8c9c504b0694ee02e2b3d4277d729cdb8667bbd2c68a0

    SHA512

    71365728f4ac6c349b50034fbb213a2506b644ca7b73c180ffb9da61f6682bfa72b8f5b5d16c5dfdecae9ca9529cc74122095faf52aa59562392e81bc2e42e06

  • \Users\Admin\AppData\Local\Temp\IXP001.TMP\za024015.exe

    Filesize

    541KB

    MD5

    76f07765f2f24e1b59f6e98e7f4b6c54

    SHA1

    121c18087aa725970eb5697f5022d828e425c436

    SHA256

    74bfd46c9df22a967dc8c9c504b0694ee02e2b3d4277d729cdb8667bbd2c68a0

    SHA512

    71365728f4ac6c349b50034fbb213a2506b644ca7b73c180ffb9da61f6682bfa72b8f5b5d16c5dfdecae9ca9529cc74122095faf52aa59562392e81bc2e42e06

  • \Users\Admin\AppData\Local\Temp\IXP002.TMP\30207487.exe

    Filesize

    257KB

    MD5

    183e2a5982e0bdee9fd8dc8c69d10899

    SHA1

    7748cb5203afcaae09310452d4776a24d41e8a4b

    SHA256

    fbce00949dcabe9643071523849aa79c4eae943c31b25a5b1d91b184161cf63f

    SHA512

    fe76a8d81e82c62bc77bfab6d443b287746b87d9b49ab20020762c72bcecd1354e58a0ff3466ec3ac8c85ce5f44eb69f3f55647ce43523dc5f63ead86b52e514

  • \Users\Admin\AppData\Local\Temp\IXP002.TMP\30207487.exe

    Filesize

    257KB

    MD5

    183e2a5982e0bdee9fd8dc8c69d10899

    SHA1

    7748cb5203afcaae09310452d4776a24d41e8a4b

    SHA256

    fbce00949dcabe9643071523849aa79c4eae943c31b25a5b1d91b184161cf63f

    SHA512

    fe76a8d81e82c62bc77bfab6d443b287746b87d9b49ab20020762c72bcecd1354e58a0ff3466ec3ac8c85ce5f44eb69f3f55647ce43523dc5f63ead86b52e514

  • \Users\Admin\AppData\Local\Temp\IXP002.TMP\30207487.exe

    Filesize

    257KB

    MD5

    183e2a5982e0bdee9fd8dc8c69d10899

    SHA1

    7748cb5203afcaae09310452d4776a24d41e8a4b

    SHA256

    fbce00949dcabe9643071523849aa79c4eae943c31b25a5b1d91b184161cf63f

    SHA512

    fe76a8d81e82c62bc77bfab6d443b287746b87d9b49ab20020762c72bcecd1354e58a0ff3466ec3ac8c85ce5f44eb69f3f55647ce43523dc5f63ead86b52e514

  • \Users\Admin\AppData\Local\Temp\IXP002.TMP\w75Fe25.exe

    Filesize

    340KB

    MD5

    12fff22f6e59bb9f53c09c48d9d85832

    SHA1

    8fc41d0ef8e976a3ca3c176c7b3da32de8a12188

    SHA256

    9e005ecc5e92e011d21de1071b448a869a70412a48040db2c00983a993378a73

    SHA512

    b3835b859b74ff1acc28f90773a0ff6182256a90c6fa9709c3e999b99543cbf2aa4bafe989d0db424a8cd007569e5e3fb3ee20cf64c5b82cde87fd7269eebf64

  • \Users\Admin\AppData\Local\Temp\IXP002.TMP\w75Fe25.exe

    Filesize

    340KB

    MD5

    12fff22f6e59bb9f53c09c48d9d85832

    SHA1

    8fc41d0ef8e976a3ca3c176c7b3da32de8a12188

    SHA256

    9e005ecc5e92e011d21de1071b448a869a70412a48040db2c00983a993378a73

    SHA512

    b3835b859b74ff1acc28f90773a0ff6182256a90c6fa9709c3e999b99543cbf2aa4bafe989d0db424a8cd007569e5e3fb3ee20cf64c5b82cde87fd7269eebf64

  • \Users\Admin\AppData\Local\Temp\IXP002.TMP\w75Fe25.exe

    Filesize

    340KB

    MD5

    12fff22f6e59bb9f53c09c48d9d85832

    SHA1

    8fc41d0ef8e976a3ca3c176c7b3da32de8a12188

    SHA256

    9e005ecc5e92e011d21de1071b448a869a70412a48040db2c00983a993378a73

    SHA512

    b3835b859b74ff1acc28f90773a0ff6182256a90c6fa9709c3e999b99543cbf2aa4bafe989d0db424a8cd007569e5e3fb3ee20cf64c5b82cde87fd7269eebf64

  • memory/1372-162-0x00000000048D0000-0x0000000004905000-memory.dmp

    Filesize

    212KB

  • memory/1372-146-0x00000000048D0000-0x0000000004905000-memory.dmp

    Filesize

    212KB

  • memory/1372-137-0x0000000003210000-0x000000000324C000-memory.dmp

    Filesize

    240KB

  • memory/1372-164-0x00000000048D0000-0x0000000004905000-memory.dmp

    Filesize

    212KB

  • memory/1372-160-0x00000000048D0000-0x0000000004905000-memory.dmp

    Filesize

    212KB

  • memory/1372-158-0x00000000048D0000-0x0000000004905000-memory.dmp

    Filesize

    212KB

  • memory/1372-156-0x00000000048D0000-0x0000000004905000-memory.dmp

    Filesize

    212KB

  • memory/1372-154-0x00000000048D0000-0x0000000004905000-memory.dmp

    Filesize

    212KB

  • memory/1372-152-0x00000000048D0000-0x0000000004905000-memory.dmp

    Filesize

    212KB

  • memory/1372-148-0x00000000048D0000-0x0000000004905000-memory.dmp

    Filesize

    212KB

  • memory/1372-150-0x00000000048D0000-0x0000000004905000-memory.dmp

    Filesize

    212KB

  • memory/1372-168-0x00000000048D0000-0x0000000004905000-memory.dmp

    Filesize

    212KB

  • memory/1372-144-0x00000000048D0000-0x0000000004905000-memory.dmp

    Filesize

    212KB

  • memory/1372-142-0x00000000048D0000-0x0000000004905000-memory.dmp

    Filesize

    212KB

  • memory/1372-141-0x00000000048D0000-0x0000000004905000-memory.dmp

    Filesize

    212KB

  • memory/1372-140-0x0000000006FB0000-0x0000000006FF0000-memory.dmp

    Filesize

    256KB

  • memory/1372-139-0x0000000000240000-0x0000000000286000-memory.dmp

    Filesize

    280KB

  • memory/1372-138-0x00000000048D0000-0x000000000490A000-memory.dmp

    Filesize

    232KB

  • memory/1372-166-0x00000000048D0000-0x0000000004905000-memory.dmp

    Filesize

    212KB

  • memory/1372-172-0x00000000048D0000-0x0000000004905000-memory.dmp

    Filesize

    212KB

  • memory/1372-170-0x00000000048D0000-0x0000000004905000-memory.dmp

    Filesize

    212KB

  • memory/1372-934-0x0000000006FB0000-0x0000000006FF0000-memory.dmp

    Filesize

    256KB

  • memory/1372-935-0x0000000006FB0000-0x0000000006FF0000-memory.dmp

    Filesize

    256KB

  • memory/1372-937-0x0000000006FB0000-0x0000000006FF0000-memory.dmp

    Filesize

    256KB

  • memory/1508-91-0x0000000007260000-0x00000000072A0000-memory.dmp

    Filesize

    256KB

  • memory/1508-126-0x0000000000400000-0x0000000002B9B000-memory.dmp

    Filesize

    39.6MB

  • memory/1508-124-0x0000000007260000-0x00000000072A0000-memory.dmp

    Filesize

    256KB

  • memory/1508-123-0x0000000007260000-0x00000000072A0000-memory.dmp

    Filesize

    256KB

  • memory/1508-121-0x00000000031D0000-0x00000000031E3000-memory.dmp

    Filesize

    76KB

  • memory/1508-119-0x00000000031D0000-0x00000000031E3000-memory.dmp

    Filesize

    76KB

  • memory/1508-117-0x00000000031D0000-0x00000000031E3000-memory.dmp

    Filesize

    76KB

  • memory/1508-115-0x00000000031D0000-0x00000000031E3000-memory.dmp

    Filesize

    76KB

  • memory/1508-113-0x00000000031D0000-0x00000000031E3000-memory.dmp

    Filesize

    76KB

  • memory/1508-111-0x00000000031D0000-0x00000000031E3000-memory.dmp

    Filesize

    76KB

  • memory/1508-109-0x00000000031D0000-0x00000000031E3000-memory.dmp

    Filesize

    76KB

  • memory/1508-107-0x00000000031D0000-0x00000000031E3000-memory.dmp

    Filesize

    76KB

  • memory/1508-105-0x00000000031D0000-0x00000000031E3000-memory.dmp

    Filesize

    76KB

  • memory/1508-103-0x00000000031D0000-0x00000000031E3000-memory.dmp

    Filesize

    76KB

  • memory/1508-101-0x00000000031D0000-0x00000000031E3000-memory.dmp

    Filesize

    76KB

  • memory/1508-99-0x00000000031D0000-0x00000000031E3000-memory.dmp

    Filesize

    76KB

  • memory/1508-95-0x00000000031D0000-0x00000000031E3000-memory.dmp

    Filesize

    76KB

  • memory/1508-97-0x00000000031D0000-0x00000000031E3000-memory.dmp

    Filesize

    76KB

  • memory/1508-94-0x00000000031D0000-0x00000000031E3000-memory.dmp

    Filesize

    76KB

  • memory/1508-93-0x0000000007260000-0x00000000072A0000-memory.dmp

    Filesize

    256KB

  • memory/1508-92-0x00000000031D0000-0x00000000031E8000-memory.dmp

    Filesize

    96KB

  • memory/1508-90-0x0000000000400000-0x0000000002B9B000-memory.dmp

    Filesize

    39.6MB

  • memory/1508-89-0x0000000002C20000-0x0000000002C3A000-memory.dmp

    Filesize

    104KB

  • memory/1508-88-0x00000000002E0000-0x000000000030D000-memory.dmp

    Filesize

    180KB