Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    152s
  • max time network
    162s
  • platform
    windows7_x64
  • resource
    win7-20230220-en
  • resource tags

    arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
  • submitted
    01/05/2023, 18:45

General

  • Target

    dde1dcb89625ecfc4c397f96ac3e1c59132f1bf030cd431e11809e8c4a2eeeb5.exe

  • Size

    727KB

  • MD5

    786bfd76d91e7a1e9282e065aea3aa0b

  • SHA1

    8cb2966788fa3921f2336767295ecabab830f182

  • SHA256

    dde1dcb89625ecfc4c397f96ac3e1c59132f1bf030cd431e11809e8c4a2eeeb5

  • SHA512

    fe7ac0b158655d9847fdde21f221e29e35765a8ecf8705b8f6fca233830ad1224d78276e7e1d380e0201d77eb0ef04948a29f8a0d20aa6aa1586c2f25f324f5f

  • SSDEEP

    12288:Dy90ITOjIAJ9tyzHdvW42h+FqvpVfcjf3efhr5UMhwryDrIn6QHnwbIUO7U9Bp:DyOjjLmdvWbsFeXfcjfOBDwryDr667T3

Malware Config

Signatures

  • Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs
  • Executes dropped EXE 3 IoCs
  • Loads dropped DLL 8 IoCs
  • Windows security modification 2 TTPs 2 IoCs
  • Adds Run key to start application 2 TTPs 4 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 21 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\dde1dcb89625ecfc4c397f96ac3e1c59132f1bf030cd431e11809e8c4a2eeeb5.exe
    "C:\Users\Admin\AppData\Local\Temp\dde1dcb89625ecfc4c397f96ac3e1c59132f1bf030cd431e11809e8c4a2eeeb5.exe"
    1⤵
    • Loads dropped DLL
    • Adds Run key to start application
    • Suspicious use of WriteProcessMemory
    PID:1368
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un567716.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un567716.exe
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Adds Run key to start application
      • Suspicious use of WriteProcessMemory
      PID:944
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\30410949.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\30410949.exe
        3⤵
        • Modifies Windows Defender Real-time Protection settings
        • Executes dropped EXE
        • Loads dropped DLL
        • Windows security modification
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:760
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\rk416392.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\rk416392.exe
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Suspicious use of AdjustPrivilegeToken
        PID:928

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un567716.exe

    Filesize

    573KB

    MD5

    063bedd6b832b9df47d5061981d65bdf

    SHA1

    b128ad0e5e78716a5887823859eed6323c529054

    SHA256

    5877b7aefb2c360af76592aef45793b90bb5c952af8a9cbff875765a71fa7261

    SHA512

    a95763aae4b6db9ee61a494811467427e85fcaffe4b0c386c145f9ee0dad8186e475a5ebea2dda3e216cdcc0b6b7738303b56bffb04f39c54908256e0f79da89

  • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un567716.exe

    Filesize

    573KB

    MD5

    063bedd6b832b9df47d5061981d65bdf

    SHA1

    b128ad0e5e78716a5887823859eed6323c529054

    SHA256

    5877b7aefb2c360af76592aef45793b90bb5c952af8a9cbff875765a71fa7261

    SHA512

    a95763aae4b6db9ee61a494811467427e85fcaffe4b0c386c145f9ee0dad8186e475a5ebea2dda3e216cdcc0b6b7738303b56bffb04f39c54908256e0f79da89

  • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\30410949.exe

    Filesize

    332KB

    MD5

    44d81c65a5e4f9b00bc142cc4175357d

    SHA1

    401c4ec5bc0ff9028441bd00b197f847a6e41d12

    SHA256

    aa111c8145abd57f2a6f028fdcb03ce59269f1767f60c947dc26afdf35f37bcd

    SHA512

    457e227d1930cdb780961c9be9ddcd24b17019ef20b59ef971dcf0572f33e3d159e4ea2a25d1b9ce61637b2b4bf7a660175de51b5dd89eda57946f2933c71574

  • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\30410949.exe

    Filesize

    332KB

    MD5

    44d81c65a5e4f9b00bc142cc4175357d

    SHA1

    401c4ec5bc0ff9028441bd00b197f847a6e41d12

    SHA256

    aa111c8145abd57f2a6f028fdcb03ce59269f1767f60c947dc26afdf35f37bcd

    SHA512

    457e227d1930cdb780961c9be9ddcd24b17019ef20b59ef971dcf0572f33e3d159e4ea2a25d1b9ce61637b2b4bf7a660175de51b5dd89eda57946f2933c71574

  • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\30410949.exe

    Filesize

    332KB

    MD5

    44d81c65a5e4f9b00bc142cc4175357d

    SHA1

    401c4ec5bc0ff9028441bd00b197f847a6e41d12

    SHA256

    aa111c8145abd57f2a6f028fdcb03ce59269f1767f60c947dc26afdf35f37bcd

    SHA512

    457e227d1930cdb780961c9be9ddcd24b17019ef20b59ef971dcf0572f33e3d159e4ea2a25d1b9ce61637b2b4bf7a660175de51b5dd89eda57946f2933c71574

  • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\rk416392.exe

    Filesize

    415KB

    MD5

    8f6b9c4f3df3baa9820cf28fe99fa5ce

    SHA1

    638dcbe398f446687d552077a4fd748069cf4a3d

    SHA256

    c81013bf2a5dc878c888c7fd87dfe16393d28568b8c519e181f01f7a45b8f0a4

    SHA512

    5b3ac5fa7822302eadecd50b175b46c2dbbf67e42fa2c070e03e21eb40d0687de3b6e7721d2c8a0bd7fb6d8be2828b7ad76b91c0e86e472c68f341448152ce93

  • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\rk416392.exe

    Filesize

    415KB

    MD5

    8f6b9c4f3df3baa9820cf28fe99fa5ce

    SHA1

    638dcbe398f446687d552077a4fd748069cf4a3d

    SHA256

    c81013bf2a5dc878c888c7fd87dfe16393d28568b8c519e181f01f7a45b8f0a4

    SHA512

    5b3ac5fa7822302eadecd50b175b46c2dbbf67e42fa2c070e03e21eb40d0687de3b6e7721d2c8a0bd7fb6d8be2828b7ad76b91c0e86e472c68f341448152ce93

  • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\rk416392.exe

    Filesize

    415KB

    MD5

    8f6b9c4f3df3baa9820cf28fe99fa5ce

    SHA1

    638dcbe398f446687d552077a4fd748069cf4a3d

    SHA256

    c81013bf2a5dc878c888c7fd87dfe16393d28568b8c519e181f01f7a45b8f0a4

    SHA512

    5b3ac5fa7822302eadecd50b175b46c2dbbf67e42fa2c070e03e21eb40d0687de3b6e7721d2c8a0bd7fb6d8be2828b7ad76b91c0e86e472c68f341448152ce93

  • \Users\Admin\AppData\Local\Temp\IXP000.TMP\un567716.exe

    Filesize

    573KB

    MD5

    063bedd6b832b9df47d5061981d65bdf

    SHA1

    b128ad0e5e78716a5887823859eed6323c529054

    SHA256

    5877b7aefb2c360af76592aef45793b90bb5c952af8a9cbff875765a71fa7261

    SHA512

    a95763aae4b6db9ee61a494811467427e85fcaffe4b0c386c145f9ee0dad8186e475a5ebea2dda3e216cdcc0b6b7738303b56bffb04f39c54908256e0f79da89

  • \Users\Admin\AppData\Local\Temp\IXP000.TMP\un567716.exe

    Filesize

    573KB

    MD5

    063bedd6b832b9df47d5061981d65bdf

    SHA1

    b128ad0e5e78716a5887823859eed6323c529054

    SHA256

    5877b7aefb2c360af76592aef45793b90bb5c952af8a9cbff875765a71fa7261

    SHA512

    a95763aae4b6db9ee61a494811467427e85fcaffe4b0c386c145f9ee0dad8186e475a5ebea2dda3e216cdcc0b6b7738303b56bffb04f39c54908256e0f79da89

  • \Users\Admin\AppData\Local\Temp\IXP001.TMP\30410949.exe

    Filesize

    332KB

    MD5

    44d81c65a5e4f9b00bc142cc4175357d

    SHA1

    401c4ec5bc0ff9028441bd00b197f847a6e41d12

    SHA256

    aa111c8145abd57f2a6f028fdcb03ce59269f1767f60c947dc26afdf35f37bcd

    SHA512

    457e227d1930cdb780961c9be9ddcd24b17019ef20b59ef971dcf0572f33e3d159e4ea2a25d1b9ce61637b2b4bf7a660175de51b5dd89eda57946f2933c71574

  • \Users\Admin\AppData\Local\Temp\IXP001.TMP\30410949.exe

    Filesize

    332KB

    MD5

    44d81c65a5e4f9b00bc142cc4175357d

    SHA1

    401c4ec5bc0ff9028441bd00b197f847a6e41d12

    SHA256

    aa111c8145abd57f2a6f028fdcb03ce59269f1767f60c947dc26afdf35f37bcd

    SHA512

    457e227d1930cdb780961c9be9ddcd24b17019ef20b59ef971dcf0572f33e3d159e4ea2a25d1b9ce61637b2b4bf7a660175de51b5dd89eda57946f2933c71574

  • \Users\Admin\AppData\Local\Temp\IXP001.TMP\30410949.exe

    Filesize

    332KB

    MD5

    44d81c65a5e4f9b00bc142cc4175357d

    SHA1

    401c4ec5bc0ff9028441bd00b197f847a6e41d12

    SHA256

    aa111c8145abd57f2a6f028fdcb03ce59269f1767f60c947dc26afdf35f37bcd

    SHA512

    457e227d1930cdb780961c9be9ddcd24b17019ef20b59ef971dcf0572f33e3d159e4ea2a25d1b9ce61637b2b4bf7a660175de51b5dd89eda57946f2933c71574

  • \Users\Admin\AppData\Local\Temp\IXP001.TMP\rk416392.exe

    Filesize

    415KB

    MD5

    8f6b9c4f3df3baa9820cf28fe99fa5ce

    SHA1

    638dcbe398f446687d552077a4fd748069cf4a3d

    SHA256

    c81013bf2a5dc878c888c7fd87dfe16393d28568b8c519e181f01f7a45b8f0a4

    SHA512

    5b3ac5fa7822302eadecd50b175b46c2dbbf67e42fa2c070e03e21eb40d0687de3b6e7721d2c8a0bd7fb6d8be2828b7ad76b91c0e86e472c68f341448152ce93

  • \Users\Admin\AppData\Local\Temp\IXP001.TMP\rk416392.exe

    Filesize

    415KB

    MD5

    8f6b9c4f3df3baa9820cf28fe99fa5ce

    SHA1

    638dcbe398f446687d552077a4fd748069cf4a3d

    SHA256

    c81013bf2a5dc878c888c7fd87dfe16393d28568b8c519e181f01f7a45b8f0a4

    SHA512

    5b3ac5fa7822302eadecd50b175b46c2dbbf67e42fa2c070e03e21eb40d0687de3b6e7721d2c8a0bd7fb6d8be2828b7ad76b91c0e86e472c68f341448152ce93

  • \Users\Admin\AppData\Local\Temp\IXP001.TMP\rk416392.exe

    Filesize

    415KB

    MD5

    8f6b9c4f3df3baa9820cf28fe99fa5ce

    SHA1

    638dcbe398f446687d552077a4fd748069cf4a3d

    SHA256

    c81013bf2a5dc878c888c7fd87dfe16393d28568b8c519e181f01f7a45b8f0a4

    SHA512

    5b3ac5fa7822302eadecd50b175b46c2dbbf67e42fa2c070e03e21eb40d0687de3b6e7721d2c8a0bd7fb6d8be2828b7ad76b91c0e86e472c68f341448152ce93

  • memory/760-86-0x00000000004F0000-0x0000000000502000-memory.dmp

    Filesize

    72KB

  • memory/760-88-0x00000000004F0000-0x0000000000502000-memory.dmp

    Filesize

    72KB

  • memory/760-92-0x00000000004F0000-0x0000000000502000-memory.dmp

    Filesize

    72KB

  • memory/760-102-0x00000000004F0000-0x0000000000502000-memory.dmp

    Filesize

    72KB

  • memory/760-104-0x00000000004F0000-0x0000000000502000-memory.dmp

    Filesize

    72KB

  • memory/760-108-0x00000000004F0000-0x0000000000502000-memory.dmp

    Filesize

    72KB

  • memory/760-106-0x00000000004F0000-0x0000000000502000-memory.dmp

    Filesize

    72KB

  • memory/760-100-0x00000000004F0000-0x0000000000502000-memory.dmp

    Filesize

    72KB

  • memory/760-98-0x00000000004F0000-0x0000000000502000-memory.dmp

    Filesize

    72KB

  • memory/760-96-0x00000000004F0000-0x0000000000502000-memory.dmp

    Filesize

    72KB

  • memory/760-94-0x00000000004F0000-0x0000000000502000-memory.dmp

    Filesize

    72KB

  • memory/760-90-0x00000000004F0000-0x0000000000502000-memory.dmp

    Filesize

    72KB

  • memory/760-110-0x0000000002010000-0x0000000002050000-memory.dmp

    Filesize

    256KB

  • memory/760-109-0x0000000002010000-0x0000000002050000-memory.dmp

    Filesize

    256KB

  • memory/760-111-0x0000000000400000-0x0000000000466000-memory.dmp

    Filesize

    408KB

  • memory/760-113-0x0000000000400000-0x0000000000466000-memory.dmp

    Filesize

    408KB

  • memory/760-84-0x00000000004F0000-0x0000000000502000-memory.dmp

    Filesize

    72KB

  • memory/760-82-0x00000000004F0000-0x0000000000502000-memory.dmp

    Filesize

    72KB

  • memory/760-81-0x00000000004F0000-0x0000000000502000-memory.dmp

    Filesize

    72KB

  • memory/760-80-0x00000000004F0000-0x0000000000508000-memory.dmp

    Filesize

    96KB

  • memory/760-79-0x00000000003D0000-0x00000000003EA000-memory.dmp

    Filesize

    104KB

  • memory/760-78-0x0000000000240000-0x000000000026D000-memory.dmp

    Filesize

    180KB

  • memory/928-126-0x0000000002260000-0x0000000002295000-memory.dmp

    Filesize

    212KB

  • memory/928-147-0x0000000002260000-0x0000000002295000-memory.dmp

    Filesize

    212KB

  • memory/928-127-0x0000000002260000-0x0000000002295000-memory.dmp

    Filesize

    212KB

  • memory/928-124-0x00000000021E0000-0x000000000221C000-memory.dmp

    Filesize

    240KB

  • memory/928-129-0x0000000002260000-0x0000000002295000-memory.dmp

    Filesize

    212KB

  • memory/928-131-0x0000000002260000-0x0000000002295000-memory.dmp

    Filesize

    212KB

  • memory/928-139-0x0000000002260000-0x0000000002295000-memory.dmp

    Filesize

    212KB

  • memory/928-137-0x0000000002260000-0x0000000002295000-memory.dmp

    Filesize

    212KB

  • memory/928-135-0x0000000002260000-0x0000000002295000-memory.dmp

    Filesize

    212KB

  • memory/928-141-0x0000000002260000-0x0000000002295000-memory.dmp

    Filesize

    212KB

  • memory/928-143-0x0000000002260000-0x0000000002295000-memory.dmp

    Filesize

    212KB

  • memory/928-145-0x0000000002260000-0x0000000002295000-memory.dmp

    Filesize

    212KB

  • memory/928-149-0x0000000002260000-0x0000000002295000-memory.dmp

    Filesize

    212KB

  • memory/928-125-0x0000000002260000-0x000000000229A000-memory.dmp

    Filesize

    232KB

  • memory/928-133-0x0000000002260000-0x0000000002295000-memory.dmp

    Filesize

    212KB

  • memory/928-151-0x0000000002260000-0x0000000002295000-memory.dmp

    Filesize

    212KB

  • memory/928-153-0x0000000002260000-0x0000000002295000-memory.dmp

    Filesize

    212KB

  • memory/928-157-0x0000000002260000-0x0000000002295000-memory.dmp

    Filesize

    212KB

  • memory/928-155-0x0000000002260000-0x0000000002295000-memory.dmp

    Filesize

    212KB

  • memory/928-375-0x0000000000240000-0x0000000000286000-memory.dmp

    Filesize

    280KB

  • memory/928-379-0x0000000004C30000-0x0000000004C70000-memory.dmp

    Filesize

    256KB

  • memory/928-381-0x0000000004C30000-0x0000000004C70000-memory.dmp

    Filesize

    256KB

  • memory/928-377-0x0000000004C30000-0x0000000004C70000-memory.dmp

    Filesize

    256KB

  • memory/928-922-0x0000000004C30000-0x0000000004C70000-memory.dmp

    Filesize

    256KB

  • memory/928-924-0x0000000004C30000-0x0000000004C70000-memory.dmp

    Filesize

    256KB

  • memory/928-925-0x0000000004C30000-0x0000000004C70000-memory.dmp

    Filesize

    256KB

  • memory/928-926-0x0000000004C30000-0x0000000004C70000-memory.dmp

    Filesize

    256KB