Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
153s -
max time network
176s -
platform
windows7_x64 -
resource
win7-20230220-en -
resource tags
arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system -
submitted
01/05/2023, 18:42
Static task
static1
Behavioral task
behavioral1
Sample
da7fad334a87ea8bbac628d2d0eea50038993e077d4c93e5ee45f9c899e67d78.exe
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
da7fad334a87ea8bbac628d2d0eea50038993e077d4c93e5ee45f9c899e67d78.exe
Resource
win10v2004-20230220-en
General
-
Target
da7fad334a87ea8bbac628d2d0eea50038993e077d4c93e5ee45f9c899e67d78.exe
-
Size
939KB
-
MD5
8d52bd9554828ebda2d146da3bdf15dd
-
SHA1
90e5a53f4d0fa15b60f00f1e7974519e1b37a54c
-
SHA256
da7fad334a87ea8bbac628d2d0eea50038993e077d4c93e5ee45f9c899e67d78
-
SHA512
053ab82bd5acc64164b1bf07cd537055c14f405aa706c0aae838c39a5fe514704c1928d3af27a6f7f9cd68c6b3b3f7521971667a0283c9b27a980e2d298a53fa
-
SSDEEP
24576:gy+QwbLXPYNNNrL9jRRuPcUEWKOIOYpOS:nluiLzRuPcUSOnYA
Malware Config
Signatures
-
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" 30207487.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" 30207487.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" 30207487.exe Key created \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection 30207487.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" 30207487.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" 30207487.exe -
Executes dropped EXE 4 IoCs
pid Process 1284 za369770.exe 1496 za024015.exe 1508 30207487.exe 1372 w75Fe25.exe -
Loads dropped DLL 10 IoCs
pid Process 1716 da7fad334a87ea8bbac628d2d0eea50038993e077d4c93e5ee45f9c899e67d78.exe 1284 za369770.exe 1284 za369770.exe 1496 za024015.exe 1496 za024015.exe 1496 za024015.exe 1508 30207487.exe 1496 za024015.exe 1496 za024015.exe 1372 w75Fe25.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0" 30207487.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Features 30207487.exe -
Adds Run key to start application 2 TTPs 6 IoCs
description ioc Process Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce za369770.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" za369770.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce za024015.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\"" za024015.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce da7fad334a87ea8bbac628d2d0eea50038993e077d4c93e5ee45f9c899e67d78.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" da7fad334a87ea8bbac628d2d0eea50038993e077d4c93e5ee45f9c899e67d78.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 1508 30207487.exe 1508 30207487.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 1508 30207487.exe Token: SeDebugPrivilege 1372 w75Fe25.exe -
Suspicious use of WriteProcessMemory 28 IoCs
description pid Process procid_target PID 1716 wrote to memory of 1284 1716 da7fad334a87ea8bbac628d2d0eea50038993e077d4c93e5ee45f9c899e67d78.exe 28 PID 1716 wrote to memory of 1284 1716 da7fad334a87ea8bbac628d2d0eea50038993e077d4c93e5ee45f9c899e67d78.exe 28 PID 1716 wrote to memory of 1284 1716 da7fad334a87ea8bbac628d2d0eea50038993e077d4c93e5ee45f9c899e67d78.exe 28 PID 1716 wrote to memory of 1284 1716 da7fad334a87ea8bbac628d2d0eea50038993e077d4c93e5ee45f9c899e67d78.exe 28 PID 1716 wrote to memory of 1284 1716 da7fad334a87ea8bbac628d2d0eea50038993e077d4c93e5ee45f9c899e67d78.exe 28 PID 1716 wrote to memory of 1284 1716 da7fad334a87ea8bbac628d2d0eea50038993e077d4c93e5ee45f9c899e67d78.exe 28 PID 1716 wrote to memory of 1284 1716 da7fad334a87ea8bbac628d2d0eea50038993e077d4c93e5ee45f9c899e67d78.exe 28 PID 1284 wrote to memory of 1496 1284 za369770.exe 29 PID 1284 wrote to memory of 1496 1284 za369770.exe 29 PID 1284 wrote to memory of 1496 1284 za369770.exe 29 PID 1284 wrote to memory of 1496 1284 za369770.exe 29 PID 1284 wrote to memory of 1496 1284 za369770.exe 29 PID 1284 wrote to memory of 1496 1284 za369770.exe 29 PID 1284 wrote to memory of 1496 1284 za369770.exe 29 PID 1496 wrote to memory of 1508 1496 za024015.exe 30 PID 1496 wrote to memory of 1508 1496 za024015.exe 30 PID 1496 wrote to memory of 1508 1496 za024015.exe 30 PID 1496 wrote to memory of 1508 1496 za024015.exe 30 PID 1496 wrote to memory of 1508 1496 za024015.exe 30 PID 1496 wrote to memory of 1508 1496 za024015.exe 30 PID 1496 wrote to memory of 1508 1496 za024015.exe 30 PID 1496 wrote to memory of 1372 1496 za024015.exe 31 PID 1496 wrote to memory of 1372 1496 za024015.exe 31 PID 1496 wrote to memory of 1372 1496 za024015.exe 31 PID 1496 wrote to memory of 1372 1496 za024015.exe 31 PID 1496 wrote to memory of 1372 1496 za024015.exe 31 PID 1496 wrote to memory of 1372 1496 za024015.exe 31 PID 1496 wrote to memory of 1372 1496 za024015.exe 31
Processes
-
C:\Users\Admin\AppData\Local\Temp\da7fad334a87ea8bbac628d2d0eea50038993e077d4c93e5ee45f9c899e67d78.exe"C:\Users\Admin\AppData\Local\Temp\da7fad334a87ea8bbac628d2d0eea50038993e077d4c93e5ee45f9c899e67d78.exe"1⤵
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:1716 -
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\za369770.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\za369770.exe2⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:1284 -
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\za024015.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\za024015.exe3⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:1496 -
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\30207487.exeC:\Users\Admin\AppData\Local\Temp\IXP002.TMP\30207487.exe4⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Loads dropped DLL
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1508
-
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\w75Fe25.exeC:\Users\Admin\AppData\Local\Temp\IXP002.TMP\w75Fe25.exe4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
PID:1372
-
-
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
723KB
MD52f0f83b8a08721640f69a27cb8423f48
SHA199c152d0b15afebc1327934ce3192c992288d71f
SHA2562c4bbbe21bfd2741a549a6cf576711c4ebf3a1fd641babec22a4dfcf45f956f2
SHA51265c759ed19f4de7c8c4e11e00185a0cbe4b7fb2ed78972b9adc99caececf959a343001f57407d47dc971c6ce3921b5af66641f17c296e8f8e27c54c84d9b0e80
-
Filesize
723KB
MD52f0f83b8a08721640f69a27cb8423f48
SHA199c152d0b15afebc1327934ce3192c992288d71f
SHA2562c4bbbe21bfd2741a549a6cf576711c4ebf3a1fd641babec22a4dfcf45f956f2
SHA51265c759ed19f4de7c8c4e11e00185a0cbe4b7fb2ed78972b9adc99caececf959a343001f57407d47dc971c6ce3921b5af66641f17c296e8f8e27c54c84d9b0e80
-
Filesize
541KB
MD576f07765f2f24e1b59f6e98e7f4b6c54
SHA1121c18087aa725970eb5697f5022d828e425c436
SHA25674bfd46c9df22a967dc8c9c504b0694ee02e2b3d4277d729cdb8667bbd2c68a0
SHA51271365728f4ac6c349b50034fbb213a2506b644ca7b73c180ffb9da61f6682bfa72b8f5b5d16c5dfdecae9ca9529cc74122095faf52aa59562392e81bc2e42e06
-
Filesize
541KB
MD576f07765f2f24e1b59f6e98e7f4b6c54
SHA1121c18087aa725970eb5697f5022d828e425c436
SHA25674bfd46c9df22a967dc8c9c504b0694ee02e2b3d4277d729cdb8667bbd2c68a0
SHA51271365728f4ac6c349b50034fbb213a2506b644ca7b73c180ffb9da61f6682bfa72b8f5b5d16c5dfdecae9ca9529cc74122095faf52aa59562392e81bc2e42e06
-
Filesize
257KB
MD5183e2a5982e0bdee9fd8dc8c69d10899
SHA17748cb5203afcaae09310452d4776a24d41e8a4b
SHA256fbce00949dcabe9643071523849aa79c4eae943c31b25a5b1d91b184161cf63f
SHA512fe76a8d81e82c62bc77bfab6d443b287746b87d9b49ab20020762c72bcecd1354e58a0ff3466ec3ac8c85ce5f44eb69f3f55647ce43523dc5f63ead86b52e514
-
Filesize
257KB
MD5183e2a5982e0bdee9fd8dc8c69d10899
SHA17748cb5203afcaae09310452d4776a24d41e8a4b
SHA256fbce00949dcabe9643071523849aa79c4eae943c31b25a5b1d91b184161cf63f
SHA512fe76a8d81e82c62bc77bfab6d443b287746b87d9b49ab20020762c72bcecd1354e58a0ff3466ec3ac8c85ce5f44eb69f3f55647ce43523dc5f63ead86b52e514
-
Filesize
257KB
MD5183e2a5982e0bdee9fd8dc8c69d10899
SHA17748cb5203afcaae09310452d4776a24d41e8a4b
SHA256fbce00949dcabe9643071523849aa79c4eae943c31b25a5b1d91b184161cf63f
SHA512fe76a8d81e82c62bc77bfab6d443b287746b87d9b49ab20020762c72bcecd1354e58a0ff3466ec3ac8c85ce5f44eb69f3f55647ce43523dc5f63ead86b52e514
-
Filesize
340KB
MD512fff22f6e59bb9f53c09c48d9d85832
SHA18fc41d0ef8e976a3ca3c176c7b3da32de8a12188
SHA2569e005ecc5e92e011d21de1071b448a869a70412a48040db2c00983a993378a73
SHA512b3835b859b74ff1acc28f90773a0ff6182256a90c6fa9709c3e999b99543cbf2aa4bafe989d0db424a8cd007569e5e3fb3ee20cf64c5b82cde87fd7269eebf64
-
Filesize
340KB
MD512fff22f6e59bb9f53c09c48d9d85832
SHA18fc41d0ef8e976a3ca3c176c7b3da32de8a12188
SHA2569e005ecc5e92e011d21de1071b448a869a70412a48040db2c00983a993378a73
SHA512b3835b859b74ff1acc28f90773a0ff6182256a90c6fa9709c3e999b99543cbf2aa4bafe989d0db424a8cd007569e5e3fb3ee20cf64c5b82cde87fd7269eebf64
-
Filesize
340KB
MD512fff22f6e59bb9f53c09c48d9d85832
SHA18fc41d0ef8e976a3ca3c176c7b3da32de8a12188
SHA2569e005ecc5e92e011d21de1071b448a869a70412a48040db2c00983a993378a73
SHA512b3835b859b74ff1acc28f90773a0ff6182256a90c6fa9709c3e999b99543cbf2aa4bafe989d0db424a8cd007569e5e3fb3ee20cf64c5b82cde87fd7269eebf64
-
Filesize
723KB
MD52f0f83b8a08721640f69a27cb8423f48
SHA199c152d0b15afebc1327934ce3192c992288d71f
SHA2562c4bbbe21bfd2741a549a6cf576711c4ebf3a1fd641babec22a4dfcf45f956f2
SHA51265c759ed19f4de7c8c4e11e00185a0cbe4b7fb2ed78972b9adc99caececf959a343001f57407d47dc971c6ce3921b5af66641f17c296e8f8e27c54c84d9b0e80
-
Filesize
723KB
MD52f0f83b8a08721640f69a27cb8423f48
SHA199c152d0b15afebc1327934ce3192c992288d71f
SHA2562c4bbbe21bfd2741a549a6cf576711c4ebf3a1fd641babec22a4dfcf45f956f2
SHA51265c759ed19f4de7c8c4e11e00185a0cbe4b7fb2ed78972b9adc99caececf959a343001f57407d47dc971c6ce3921b5af66641f17c296e8f8e27c54c84d9b0e80
-
Filesize
541KB
MD576f07765f2f24e1b59f6e98e7f4b6c54
SHA1121c18087aa725970eb5697f5022d828e425c436
SHA25674bfd46c9df22a967dc8c9c504b0694ee02e2b3d4277d729cdb8667bbd2c68a0
SHA51271365728f4ac6c349b50034fbb213a2506b644ca7b73c180ffb9da61f6682bfa72b8f5b5d16c5dfdecae9ca9529cc74122095faf52aa59562392e81bc2e42e06
-
Filesize
541KB
MD576f07765f2f24e1b59f6e98e7f4b6c54
SHA1121c18087aa725970eb5697f5022d828e425c436
SHA25674bfd46c9df22a967dc8c9c504b0694ee02e2b3d4277d729cdb8667bbd2c68a0
SHA51271365728f4ac6c349b50034fbb213a2506b644ca7b73c180ffb9da61f6682bfa72b8f5b5d16c5dfdecae9ca9529cc74122095faf52aa59562392e81bc2e42e06
-
Filesize
257KB
MD5183e2a5982e0bdee9fd8dc8c69d10899
SHA17748cb5203afcaae09310452d4776a24d41e8a4b
SHA256fbce00949dcabe9643071523849aa79c4eae943c31b25a5b1d91b184161cf63f
SHA512fe76a8d81e82c62bc77bfab6d443b287746b87d9b49ab20020762c72bcecd1354e58a0ff3466ec3ac8c85ce5f44eb69f3f55647ce43523dc5f63ead86b52e514
-
Filesize
257KB
MD5183e2a5982e0bdee9fd8dc8c69d10899
SHA17748cb5203afcaae09310452d4776a24d41e8a4b
SHA256fbce00949dcabe9643071523849aa79c4eae943c31b25a5b1d91b184161cf63f
SHA512fe76a8d81e82c62bc77bfab6d443b287746b87d9b49ab20020762c72bcecd1354e58a0ff3466ec3ac8c85ce5f44eb69f3f55647ce43523dc5f63ead86b52e514
-
Filesize
257KB
MD5183e2a5982e0bdee9fd8dc8c69d10899
SHA17748cb5203afcaae09310452d4776a24d41e8a4b
SHA256fbce00949dcabe9643071523849aa79c4eae943c31b25a5b1d91b184161cf63f
SHA512fe76a8d81e82c62bc77bfab6d443b287746b87d9b49ab20020762c72bcecd1354e58a0ff3466ec3ac8c85ce5f44eb69f3f55647ce43523dc5f63ead86b52e514
-
Filesize
340KB
MD512fff22f6e59bb9f53c09c48d9d85832
SHA18fc41d0ef8e976a3ca3c176c7b3da32de8a12188
SHA2569e005ecc5e92e011d21de1071b448a869a70412a48040db2c00983a993378a73
SHA512b3835b859b74ff1acc28f90773a0ff6182256a90c6fa9709c3e999b99543cbf2aa4bafe989d0db424a8cd007569e5e3fb3ee20cf64c5b82cde87fd7269eebf64
-
Filesize
340KB
MD512fff22f6e59bb9f53c09c48d9d85832
SHA18fc41d0ef8e976a3ca3c176c7b3da32de8a12188
SHA2569e005ecc5e92e011d21de1071b448a869a70412a48040db2c00983a993378a73
SHA512b3835b859b74ff1acc28f90773a0ff6182256a90c6fa9709c3e999b99543cbf2aa4bafe989d0db424a8cd007569e5e3fb3ee20cf64c5b82cde87fd7269eebf64
-
Filesize
340KB
MD512fff22f6e59bb9f53c09c48d9d85832
SHA18fc41d0ef8e976a3ca3c176c7b3da32de8a12188
SHA2569e005ecc5e92e011d21de1071b448a869a70412a48040db2c00983a993378a73
SHA512b3835b859b74ff1acc28f90773a0ff6182256a90c6fa9709c3e999b99543cbf2aa4bafe989d0db424a8cd007569e5e3fb3ee20cf64c5b82cde87fd7269eebf64