Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
152s -
max time network
158s -
platform
windows7_x64 -
resource
win7-20230220-en -
resource tags
arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system -
submitted
01/05/2023, 18:47
Static task
static1
Behavioral task
behavioral1
Sample
dfae8f819ffd5eedff28d22c04c632a18a32dca85901207cdc5c878d37cd56a6.exe
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
dfae8f819ffd5eedff28d22c04c632a18a32dca85901207cdc5c878d37cd56a6.exe
Resource
win10v2004-20230220-en
General
-
Target
dfae8f819ffd5eedff28d22c04c632a18a32dca85901207cdc5c878d37cd56a6.exe
-
Size
687KB
-
MD5
28ff621758160f1b33d532bab870f7e2
-
SHA1
713733f18f619b41b86fe88a742cbc84e9969050
-
SHA256
dfae8f819ffd5eedff28d22c04c632a18a32dca85901207cdc5c878d37cd56a6
-
SHA512
783c7bb8cc0997393380821844fa9871414bc9ad8b3b0397fc5574f1da900b97254dadf811a9e30b9ea95f6e57ef875b2337dc04b1f13a941a5924e48ded586f
-
SSDEEP
12288:Uy90/8a3KNIF/aYWyCS42OI6QBDuYOCF5NLvB/wMfyseT2ziKhw8:UyA0wilSVOI6cuzC7NVrfyseyzL5
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection 72517916.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" 72517916.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" 72517916.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" 72517916.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" 72517916.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" 72517916.exe -
Executes dropped EXE 3 IoCs
pid Process 1716 un220178.exe 1924 72517916.exe 1316 rk852646.exe -
Loads dropped DLL 8 IoCs
pid Process 1928 dfae8f819ffd5eedff28d22c04c632a18a32dca85901207cdc5c878d37cd56a6.exe 1716 un220178.exe 1716 un220178.exe 1716 un220178.exe 1924 72517916.exe 1716 un220178.exe 1716 un220178.exe 1316 rk852646.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0" 72517916.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Features 72517916.exe -
Adds Run key to start application 2 TTPs 4 IoCs
description ioc Process Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce un220178.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" un220178.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce dfae8f819ffd5eedff28d22c04c632a18a32dca85901207cdc5c878d37cd56a6.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" dfae8f819ffd5eedff28d22c04c632a18a32dca85901207cdc5c878d37cd56a6.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 1924 72517916.exe 1924 72517916.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 1924 72517916.exe Token: SeDebugPrivilege 1316 rk852646.exe -
Suspicious use of WriteProcessMemory 21 IoCs
description pid Process procid_target PID 1928 wrote to memory of 1716 1928 dfae8f819ffd5eedff28d22c04c632a18a32dca85901207cdc5c878d37cd56a6.exe 27 PID 1928 wrote to memory of 1716 1928 dfae8f819ffd5eedff28d22c04c632a18a32dca85901207cdc5c878d37cd56a6.exe 27 PID 1928 wrote to memory of 1716 1928 dfae8f819ffd5eedff28d22c04c632a18a32dca85901207cdc5c878d37cd56a6.exe 27 PID 1928 wrote to memory of 1716 1928 dfae8f819ffd5eedff28d22c04c632a18a32dca85901207cdc5c878d37cd56a6.exe 27 PID 1928 wrote to memory of 1716 1928 dfae8f819ffd5eedff28d22c04c632a18a32dca85901207cdc5c878d37cd56a6.exe 27 PID 1928 wrote to memory of 1716 1928 dfae8f819ffd5eedff28d22c04c632a18a32dca85901207cdc5c878d37cd56a6.exe 27 PID 1928 wrote to memory of 1716 1928 dfae8f819ffd5eedff28d22c04c632a18a32dca85901207cdc5c878d37cd56a6.exe 27 PID 1716 wrote to memory of 1924 1716 un220178.exe 28 PID 1716 wrote to memory of 1924 1716 un220178.exe 28 PID 1716 wrote to memory of 1924 1716 un220178.exe 28 PID 1716 wrote to memory of 1924 1716 un220178.exe 28 PID 1716 wrote to memory of 1924 1716 un220178.exe 28 PID 1716 wrote to memory of 1924 1716 un220178.exe 28 PID 1716 wrote to memory of 1924 1716 un220178.exe 28 PID 1716 wrote to memory of 1316 1716 un220178.exe 29 PID 1716 wrote to memory of 1316 1716 un220178.exe 29 PID 1716 wrote to memory of 1316 1716 un220178.exe 29 PID 1716 wrote to memory of 1316 1716 un220178.exe 29 PID 1716 wrote to memory of 1316 1716 un220178.exe 29 PID 1716 wrote to memory of 1316 1716 un220178.exe 29 PID 1716 wrote to memory of 1316 1716 un220178.exe 29
Processes
-
C:\Users\Admin\AppData\Local\Temp\dfae8f819ffd5eedff28d22c04c632a18a32dca85901207cdc5c878d37cd56a6.exe"C:\Users\Admin\AppData\Local\Temp\dfae8f819ffd5eedff28d22c04c632a18a32dca85901207cdc5c878d37cd56a6.exe"1⤵
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:1928 -
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un220178.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un220178.exe2⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:1716 -
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\72517916.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\72517916.exe3⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Loads dropped DLL
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1924
-
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\rk852646.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\rk852646.exe3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
PID:1316
-
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
533KB
MD5e4cb0d46e29aa07655a20c66f5a59e2b
SHA1d42afba648de13db6c076dacfaacb532970e76b1
SHA256cd9492ce33dfbf58bd5668a3b1fbde3c165afb42fc26a198c813362a4ae4d20a
SHA5121feb1ea6e88a89f2540edcb1eb51b0a5bc425176d0d2db683c91cf9b8fe389c6c8e3b1eb39ef399ddb60060851f1d8f2db6873eeaf98b38d0e45ce8c5bc24890
-
Filesize
533KB
MD5e4cb0d46e29aa07655a20c66f5a59e2b
SHA1d42afba648de13db6c076dacfaacb532970e76b1
SHA256cd9492ce33dfbf58bd5668a3b1fbde3c165afb42fc26a198c813362a4ae4d20a
SHA5121feb1ea6e88a89f2540edcb1eb51b0a5bc425176d0d2db683c91cf9b8fe389c6c8e3b1eb39ef399ddb60060851f1d8f2db6873eeaf98b38d0e45ce8c5bc24890
-
Filesize
249KB
MD5d6d95b8210b9f278ae696ff03c4fbceb
SHA15a7b09caae228b6fa8f3e8af803cde0a24a3753d
SHA256b7a04a7c0843488989d963a7abbe221dd7efc4bf6c30b4c6a54bc1bf5a591f0a
SHA5129986e18d4af3603ee8760879e488c4e36375e578a55e129d8c06720b665cd1815770606c758abfd6d27ef61bc82d2adbe037d46f64f9e9dc7d7c763f2799b0f8
-
Filesize
249KB
MD5d6d95b8210b9f278ae696ff03c4fbceb
SHA15a7b09caae228b6fa8f3e8af803cde0a24a3753d
SHA256b7a04a7c0843488989d963a7abbe221dd7efc4bf6c30b4c6a54bc1bf5a591f0a
SHA5129986e18d4af3603ee8760879e488c4e36375e578a55e129d8c06720b665cd1815770606c758abfd6d27ef61bc82d2adbe037d46f64f9e9dc7d7c763f2799b0f8
-
Filesize
249KB
MD5d6d95b8210b9f278ae696ff03c4fbceb
SHA15a7b09caae228b6fa8f3e8af803cde0a24a3753d
SHA256b7a04a7c0843488989d963a7abbe221dd7efc4bf6c30b4c6a54bc1bf5a591f0a
SHA5129986e18d4af3603ee8760879e488c4e36375e578a55e129d8c06720b665cd1815770606c758abfd6d27ef61bc82d2adbe037d46f64f9e9dc7d7c763f2799b0f8
-
Filesize
332KB
MD5946b47955f44fe4feea000bbb16eda66
SHA181c25c931da3f1d86cc28275dbce4af3a81ab695
SHA2566b858faf6e7991aeb21d441fc854d00dce67181b804564306225f3032b3faf01
SHA5120787f530ac35467916dddc38d4e023336597cbed3d96195b623bac012435306883255f78abfd8f1676d1cf14530f4cfe38145d676be74911c2ad94a9df371ea7
-
Filesize
332KB
MD5946b47955f44fe4feea000bbb16eda66
SHA181c25c931da3f1d86cc28275dbce4af3a81ab695
SHA2566b858faf6e7991aeb21d441fc854d00dce67181b804564306225f3032b3faf01
SHA5120787f530ac35467916dddc38d4e023336597cbed3d96195b623bac012435306883255f78abfd8f1676d1cf14530f4cfe38145d676be74911c2ad94a9df371ea7
-
Filesize
332KB
MD5946b47955f44fe4feea000bbb16eda66
SHA181c25c931da3f1d86cc28275dbce4af3a81ab695
SHA2566b858faf6e7991aeb21d441fc854d00dce67181b804564306225f3032b3faf01
SHA5120787f530ac35467916dddc38d4e023336597cbed3d96195b623bac012435306883255f78abfd8f1676d1cf14530f4cfe38145d676be74911c2ad94a9df371ea7
-
Filesize
533KB
MD5e4cb0d46e29aa07655a20c66f5a59e2b
SHA1d42afba648de13db6c076dacfaacb532970e76b1
SHA256cd9492ce33dfbf58bd5668a3b1fbde3c165afb42fc26a198c813362a4ae4d20a
SHA5121feb1ea6e88a89f2540edcb1eb51b0a5bc425176d0d2db683c91cf9b8fe389c6c8e3b1eb39ef399ddb60060851f1d8f2db6873eeaf98b38d0e45ce8c5bc24890
-
Filesize
533KB
MD5e4cb0d46e29aa07655a20c66f5a59e2b
SHA1d42afba648de13db6c076dacfaacb532970e76b1
SHA256cd9492ce33dfbf58bd5668a3b1fbde3c165afb42fc26a198c813362a4ae4d20a
SHA5121feb1ea6e88a89f2540edcb1eb51b0a5bc425176d0d2db683c91cf9b8fe389c6c8e3b1eb39ef399ddb60060851f1d8f2db6873eeaf98b38d0e45ce8c5bc24890
-
Filesize
249KB
MD5d6d95b8210b9f278ae696ff03c4fbceb
SHA15a7b09caae228b6fa8f3e8af803cde0a24a3753d
SHA256b7a04a7c0843488989d963a7abbe221dd7efc4bf6c30b4c6a54bc1bf5a591f0a
SHA5129986e18d4af3603ee8760879e488c4e36375e578a55e129d8c06720b665cd1815770606c758abfd6d27ef61bc82d2adbe037d46f64f9e9dc7d7c763f2799b0f8
-
Filesize
249KB
MD5d6d95b8210b9f278ae696ff03c4fbceb
SHA15a7b09caae228b6fa8f3e8af803cde0a24a3753d
SHA256b7a04a7c0843488989d963a7abbe221dd7efc4bf6c30b4c6a54bc1bf5a591f0a
SHA5129986e18d4af3603ee8760879e488c4e36375e578a55e129d8c06720b665cd1815770606c758abfd6d27ef61bc82d2adbe037d46f64f9e9dc7d7c763f2799b0f8
-
Filesize
249KB
MD5d6d95b8210b9f278ae696ff03c4fbceb
SHA15a7b09caae228b6fa8f3e8af803cde0a24a3753d
SHA256b7a04a7c0843488989d963a7abbe221dd7efc4bf6c30b4c6a54bc1bf5a591f0a
SHA5129986e18d4af3603ee8760879e488c4e36375e578a55e129d8c06720b665cd1815770606c758abfd6d27ef61bc82d2adbe037d46f64f9e9dc7d7c763f2799b0f8
-
Filesize
332KB
MD5946b47955f44fe4feea000bbb16eda66
SHA181c25c931da3f1d86cc28275dbce4af3a81ab695
SHA2566b858faf6e7991aeb21d441fc854d00dce67181b804564306225f3032b3faf01
SHA5120787f530ac35467916dddc38d4e023336597cbed3d96195b623bac012435306883255f78abfd8f1676d1cf14530f4cfe38145d676be74911c2ad94a9df371ea7
-
Filesize
332KB
MD5946b47955f44fe4feea000bbb16eda66
SHA181c25c931da3f1d86cc28275dbce4af3a81ab695
SHA2566b858faf6e7991aeb21d441fc854d00dce67181b804564306225f3032b3faf01
SHA5120787f530ac35467916dddc38d4e023336597cbed3d96195b623bac012435306883255f78abfd8f1676d1cf14530f4cfe38145d676be74911c2ad94a9df371ea7
-
Filesize
332KB
MD5946b47955f44fe4feea000bbb16eda66
SHA181c25c931da3f1d86cc28275dbce4af3a81ab695
SHA2566b858faf6e7991aeb21d441fc854d00dce67181b804564306225f3032b3faf01
SHA5120787f530ac35467916dddc38d4e023336597cbed3d96195b623bac012435306883255f78abfd8f1676d1cf14530f4cfe38145d676be74911c2ad94a9df371ea7