Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
152s -
max time network
162s -
platform
windows7_x64 -
resource
win7-20230220-en -
resource tags
arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system -
submitted
01/05/2023, 18:45
Static task
static1
Behavioral task
behavioral1
Sample
dde1dcb89625ecfc4c397f96ac3e1c59132f1bf030cd431e11809e8c4a2eeeb5.exe
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
dde1dcb89625ecfc4c397f96ac3e1c59132f1bf030cd431e11809e8c4a2eeeb5.exe
Resource
win10v2004-20230220-en
General
-
Target
dde1dcb89625ecfc4c397f96ac3e1c59132f1bf030cd431e11809e8c4a2eeeb5.exe
-
Size
727KB
-
MD5
786bfd76d91e7a1e9282e065aea3aa0b
-
SHA1
8cb2966788fa3921f2336767295ecabab830f182
-
SHA256
dde1dcb89625ecfc4c397f96ac3e1c59132f1bf030cd431e11809e8c4a2eeeb5
-
SHA512
fe7ac0b158655d9847fdde21f221e29e35765a8ecf8705b8f6fca233830ad1224d78276e7e1d380e0201d77eb0ef04948a29f8a0d20aa6aa1586c2f25f324f5f
-
SSDEEP
12288:Dy90ITOjIAJ9tyzHdvW42h+FqvpVfcjf3efhr5UMhwryDrIn6QHnwbIUO7U9Bp:DyOjjLmdvWbsFeXfcjfOBDwryDr667T3
Malware Config
Signatures
-
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" 30410949.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" 30410949.exe Key created \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection 30410949.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" 30410949.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" 30410949.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" 30410949.exe -
Executes dropped EXE 3 IoCs
pid Process 944 un567716.exe 760 30410949.exe 928 rk416392.exe -
Loads dropped DLL 8 IoCs
pid Process 1368 dde1dcb89625ecfc4c397f96ac3e1c59132f1bf030cd431e11809e8c4a2eeeb5.exe 944 un567716.exe 944 un567716.exe 944 un567716.exe 760 30410949.exe 944 un567716.exe 944 un567716.exe 928 rk416392.exe -
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Features 30410949.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0" 30410949.exe -
Adds Run key to start application 2 TTPs 4 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" un567716.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce dde1dcb89625ecfc4c397f96ac3e1c59132f1bf030cd431e11809e8c4a2eeeb5.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" dde1dcb89625ecfc4c397f96ac3e1c59132f1bf030cd431e11809e8c4a2eeeb5.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce un567716.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 760 30410949.exe 760 30410949.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 760 30410949.exe Token: SeDebugPrivilege 928 rk416392.exe -
Suspicious use of WriteProcessMemory 21 IoCs
description pid Process procid_target PID 1368 wrote to memory of 944 1368 dde1dcb89625ecfc4c397f96ac3e1c59132f1bf030cd431e11809e8c4a2eeeb5.exe 27 PID 1368 wrote to memory of 944 1368 dde1dcb89625ecfc4c397f96ac3e1c59132f1bf030cd431e11809e8c4a2eeeb5.exe 27 PID 1368 wrote to memory of 944 1368 dde1dcb89625ecfc4c397f96ac3e1c59132f1bf030cd431e11809e8c4a2eeeb5.exe 27 PID 1368 wrote to memory of 944 1368 dde1dcb89625ecfc4c397f96ac3e1c59132f1bf030cd431e11809e8c4a2eeeb5.exe 27 PID 1368 wrote to memory of 944 1368 dde1dcb89625ecfc4c397f96ac3e1c59132f1bf030cd431e11809e8c4a2eeeb5.exe 27 PID 1368 wrote to memory of 944 1368 dde1dcb89625ecfc4c397f96ac3e1c59132f1bf030cd431e11809e8c4a2eeeb5.exe 27 PID 1368 wrote to memory of 944 1368 dde1dcb89625ecfc4c397f96ac3e1c59132f1bf030cd431e11809e8c4a2eeeb5.exe 27 PID 944 wrote to memory of 760 944 un567716.exe 28 PID 944 wrote to memory of 760 944 un567716.exe 28 PID 944 wrote to memory of 760 944 un567716.exe 28 PID 944 wrote to memory of 760 944 un567716.exe 28 PID 944 wrote to memory of 760 944 un567716.exe 28 PID 944 wrote to memory of 760 944 un567716.exe 28 PID 944 wrote to memory of 760 944 un567716.exe 28 PID 944 wrote to memory of 928 944 un567716.exe 29 PID 944 wrote to memory of 928 944 un567716.exe 29 PID 944 wrote to memory of 928 944 un567716.exe 29 PID 944 wrote to memory of 928 944 un567716.exe 29 PID 944 wrote to memory of 928 944 un567716.exe 29 PID 944 wrote to memory of 928 944 un567716.exe 29 PID 944 wrote to memory of 928 944 un567716.exe 29
Processes
-
C:\Users\Admin\AppData\Local\Temp\dde1dcb89625ecfc4c397f96ac3e1c59132f1bf030cd431e11809e8c4a2eeeb5.exe"C:\Users\Admin\AppData\Local\Temp\dde1dcb89625ecfc4c397f96ac3e1c59132f1bf030cd431e11809e8c4a2eeeb5.exe"1⤵
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:1368 -
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un567716.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un567716.exe2⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:944 -
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\30410949.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\30410949.exe3⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Loads dropped DLL
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:760
-
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\rk416392.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\rk416392.exe3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
PID:928
-
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
573KB
MD5063bedd6b832b9df47d5061981d65bdf
SHA1b128ad0e5e78716a5887823859eed6323c529054
SHA2565877b7aefb2c360af76592aef45793b90bb5c952af8a9cbff875765a71fa7261
SHA512a95763aae4b6db9ee61a494811467427e85fcaffe4b0c386c145f9ee0dad8186e475a5ebea2dda3e216cdcc0b6b7738303b56bffb04f39c54908256e0f79da89
-
Filesize
573KB
MD5063bedd6b832b9df47d5061981d65bdf
SHA1b128ad0e5e78716a5887823859eed6323c529054
SHA2565877b7aefb2c360af76592aef45793b90bb5c952af8a9cbff875765a71fa7261
SHA512a95763aae4b6db9ee61a494811467427e85fcaffe4b0c386c145f9ee0dad8186e475a5ebea2dda3e216cdcc0b6b7738303b56bffb04f39c54908256e0f79da89
-
Filesize
332KB
MD544d81c65a5e4f9b00bc142cc4175357d
SHA1401c4ec5bc0ff9028441bd00b197f847a6e41d12
SHA256aa111c8145abd57f2a6f028fdcb03ce59269f1767f60c947dc26afdf35f37bcd
SHA512457e227d1930cdb780961c9be9ddcd24b17019ef20b59ef971dcf0572f33e3d159e4ea2a25d1b9ce61637b2b4bf7a660175de51b5dd89eda57946f2933c71574
-
Filesize
332KB
MD544d81c65a5e4f9b00bc142cc4175357d
SHA1401c4ec5bc0ff9028441bd00b197f847a6e41d12
SHA256aa111c8145abd57f2a6f028fdcb03ce59269f1767f60c947dc26afdf35f37bcd
SHA512457e227d1930cdb780961c9be9ddcd24b17019ef20b59ef971dcf0572f33e3d159e4ea2a25d1b9ce61637b2b4bf7a660175de51b5dd89eda57946f2933c71574
-
Filesize
332KB
MD544d81c65a5e4f9b00bc142cc4175357d
SHA1401c4ec5bc0ff9028441bd00b197f847a6e41d12
SHA256aa111c8145abd57f2a6f028fdcb03ce59269f1767f60c947dc26afdf35f37bcd
SHA512457e227d1930cdb780961c9be9ddcd24b17019ef20b59ef971dcf0572f33e3d159e4ea2a25d1b9ce61637b2b4bf7a660175de51b5dd89eda57946f2933c71574
-
Filesize
415KB
MD58f6b9c4f3df3baa9820cf28fe99fa5ce
SHA1638dcbe398f446687d552077a4fd748069cf4a3d
SHA256c81013bf2a5dc878c888c7fd87dfe16393d28568b8c519e181f01f7a45b8f0a4
SHA5125b3ac5fa7822302eadecd50b175b46c2dbbf67e42fa2c070e03e21eb40d0687de3b6e7721d2c8a0bd7fb6d8be2828b7ad76b91c0e86e472c68f341448152ce93
-
Filesize
415KB
MD58f6b9c4f3df3baa9820cf28fe99fa5ce
SHA1638dcbe398f446687d552077a4fd748069cf4a3d
SHA256c81013bf2a5dc878c888c7fd87dfe16393d28568b8c519e181f01f7a45b8f0a4
SHA5125b3ac5fa7822302eadecd50b175b46c2dbbf67e42fa2c070e03e21eb40d0687de3b6e7721d2c8a0bd7fb6d8be2828b7ad76b91c0e86e472c68f341448152ce93
-
Filesize
415KB
MD58f6b9c4f3df3baa9820cf28fe99fa5ce
SHA1638dcbe398f446687d552077a4fd748069cf4a3d
SHA256c81013bf2a5dc878c888c7fd87dfe16393d28568b8c519e181f01f7a45b8f0a4
SHA5125b3ac5fa7822302eadecd50b175b46c2dbbf67e42fa2c070e03e21eb40d0687de3b6e7721d2c8a0bd7fb6d8be2828b7ad76b91c0e86e472c68f341448152ce93
-
Filesize
573KB
MD5063bedd6b832b9df47d5061981d65bdf
SHA1b128ad0e5e78716a5887823859eed6323c529054
SHA2565877b7aefb2c360af76592aef45793b90bb5c952af8a9cbff875765a71fa7261
SHA512a95763aae4b6db9ee61a494811467427e85fcaffe4b0c386c145f9ee0dad8186e475a5ebea2dda3e216cdcc0b6b7738303b56bffb04f39c54908256e0f79da89
-
Filesize
573KB
MD5063bedd6b832b9df47d5061981d65bdf
SHA1b128ad0e5e78716a5887823859eed6323c529054
SHA2565877b7aefb2c360af76592aef45793b90bb5c952af8a9cbff875765a71fa7261
SHA512a95763aae4b6db9ee61a494811467427e85fcaffe4b0c386c145f9ee0dad8186e475a5ebea2dda3e216cdcc0b6b7738303b56bffb04f39c54908256e0f79da89
-
Filesize
332KB
MD544d81c65a5e4f9b00bc142cc4175357d
SHA1401c4ec5bc0ff9028441bd00b197f847a6e41d12
SHA256aa111c8145abd57f2a6f028fdcb03ce59269f1767f60c947dc26afdf35f37bcd
SHA512457e227d1930cdb780961c9be9ddcd24b17019ef20b59ef971dcf0572f33e3d159e4ea2a25d1b9ce61637b2b4bf7a660175de51b5dd89eda57946f2933c71574
-
Filesize
332KB
MD544d81c65a5e4f9b00bc142cc4175357d
SHA1401c4ec5bc0ff9028441bd00b197f847a6e41d12
SHA256aa111c8145abd57f2a6f028fdcb03ce59269f1767f60c947dc26afdf35f37bcd
SHA512457e227d1930cdb780961c9be9ddcd24b17019ef20b59ef971dcf0572f33e3d159e4ea2a25d1b9ce61637b2b4bf7a660175de51b5dd89eda57946f2933c71574
-
Filesize
332KB
MD544d81c65a5e4f9b00bc142cc4175357d
SHA1401c4ec5bc0ff9028441bd00b197f847a6e41d12
SHA256aa111c8145abd57f2a6f028fdcb03ce59269f1767f60c947dc26afdf35f37bcd
SHA512457e227d1930cdb780961c9be9ddcd24b17019ef20b59ef971dcf0572f33e3d159e4ea2a25d1b9ce61637b2b4bf7a660175de51b5dd89eda57946f2933c71574
-
Filesize
415KB
MD58f6b9c4f3df3baa9820cf28fe99fa5ce
SHA1638dcbe398f446687d552077a4fd748069cf4a3d
SHA256c81013bf2a5dc878c888c7fd87dfe16393d28568b8c519e181f01f7a45b8f0a4
SHA5125b3ac5fa7822302eadecd50b175b46c2dbbf67e42fa2c070e03e21eb40d0687de3b6e7721d2c8a0bd7fb6d8be2828b7ad76b91c0e86e472c68f341448152ce93
-
Filesize
415KB
MD58f6b9c4f3df3baa9820cf28fe99fa5ce
SHA1638dcbe398f446687d552077a4fd748069cf4a3d
SHA256c81013bf2a5dc878c888c7fd87dfe16393d28568b8c519e181f01f7a45b8f0a4
SHA5125b3ac5fa7822302eadecd50b175b46c2dbbf67e42fa2c070e03e21eb40d0687de3b6e7721d2c8a0bd7fb6d8be2828b7ad76b91c0e86e472c68f341448152ce93
-
Filesize
415KB
MD58f6b9c4f3df3baa9820cf28fe99fa5ce
SHA1638dcbe398f446687d552077a4fd748069cf4a3d
SHA256c81013bf2a5dc878c888c7fd87dfe16393d28568b8c519e181f01f7a45b8f0a4
SHA5125b3ac5fa7822302eadecd50b175b46c2dbbf67e42fa2c070e03e21eb40d0687de3b6e7721d2c8a0bd7fb6d8be2828b7ad76b91c0e86e472c68f341448152ce93