Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    152s
  • max time network
    158s
  • platform
    windows7_x64
  • resource
    win7-20230220-en
  • resource tags

    arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
  • submitted
    01/05/2023, 18:47

General

  • Target

    dfae8f819ffd5eedff28d22c04c632a18a32dca85901207cdc5c878d37cd56a6.exe

  • Size

    687KB

  • MD5

    28ff621758160f1b33d532bab870f7e2

  • SHA1

    713733f18f619b41b86fe88a742cbc84e9969050

  • SHA256

    dfae8f819ffd5eedff28d22c04c632a18a32dca85901207cdc5c878d37cd56a6

  • SHA512

    783c7bb8cc0997393380821844fa9871414bc9ad8b3b0397fc5574f1da900b97254dadf811a9e30b9ea95f6e57ef875b2337dc04b1f13a941a5924e48ded586f

  • SSDEEP

    12288:Uy90/8a3KNIF/aYWyCS42OI6QBDuYOCF5NLvB/wMfyseT2ziKhw8:UyA0wilSVOI6cuzC7NVrfyseyzL5

Malware Config

Signatures

  • Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs
  • Executes dropped EXE 3 IoCs
  • Loads dropped DLL 8 IoCs
  • Windows security modification 2 TTPs 2 IoCs
  • Adds Run key to start application 2 TTPs 4 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 21 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\dfae8f819ffd5eedff28d22c04c632a18a32dca85901207cdc5c878d37cd56a6.exe
    "C:\Users\Admin\AppData\Local\Temp\dfae8f819ffd5eedff28d22c04c632a18a32dca85901207cdc5c878d37cd56a6.exe"
    1⤵
    • Loads dropped DLL
    • Adds Run key to start application
    • Suspicious use of WriteProcessMemory
    PID:1928
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un220178.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un220178.exe
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Adds Run key to start application
      • Suspicious use of WriteProcessMemory
      PID:1716
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\72517916.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\72517916.exe
        3⤵
        • Modifies Windows Defender Real-time Protection settings
        • Executes dropped EXE
        • Loads dropped DLL
        • Windows security modification
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:1924
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\rk852646.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\rk852646.exe
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Suspicious use of AdjustPrivilegeToken
        PID:1316

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un220178.exe

    Filesize

    533KB

    MD5

    e4cb0d46e29aa07655a20c66f5a59e2b

    SHA1

    d42afba648de13db6c076dacfaacb532970e76b1

    SHA256

    cd9492ce33dfbf58bd5668a3b1fbde3c165afb42fc26a198c813362a4ae4d20a

    SHA512

    1feb1ea6e88a89f2540edcb1eb51b0a5bc425176d0d2db683c91cf9b8fe389c6c8e3b1eb39ef399ddb60060851f1d8f2db6873eeaf98b38d0e45ce8c5bc24890

  • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un220178.exe

    Filesize

    533KB

    MD5

    e4cb0d46e29aa07655a20c66f5a59e2b

    SHA1

    d42afba648de13db6c076dacfaacb532970e76b1

    SHA256

    cd9492ce33dfbf58bd5668a3b1fbde3c165afb42fc26a198c813362a4ae4d20a

    SHA512

    1feb1ea6e88a89f2540edcb1eb51b0a5bc425176d0d2db683c91cf9b8fe389c6c8e3b1eb39ef399ddb60060851f1d8f2db6873eeaf98b38d0e45ce8c5bc24890

  • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\72517916.exe

    Filesize

    249KB

    MD5

    d6d95b8210b9f278ae696ff03c4fbceb

    SHA1

    5a7b09caae228b6fa8f3e8af803cde0a24a3753d

    SHA256

    b7a04a7c0843488989d963a7abbe221dd7efc4bf6c30b4c6a54bc1bf5a591f0a

    SHA512

    9986e18d4af3603ee8760879e488c4e36375e578a55e129d8c06720b665cd1815770606c758abfd6d27ef61bc82d2adbe037d46f64f9e9dc7d7c763f2799b0f8

  • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\72517916.exe

    Filesize

    249KB

    MD5

    d6d95b8210b9f278ae696ff03c4fbceb

    SHA1

    5a7b09caae228b6fa8f3e8af803cde0a24a3753d

    SHA256

    b7a04a7c0843488989d963a7abbe221dd7efc4bf6c30b4c6a54bc1bf5a591f0a

    SHA512

    9986e18d4af3603ee8760879e488c4e36375e578a55e129d8c06720b665cd1815770606c758abfd6d27ef61bc82d2adbe037d46f64f9e9dc7d7c763f2799b0f8

  • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\72517916.exe

    Filesize

    249KB

    MD5

    d6d95b8210b9f278ae696ff03c4fbceb

    SHA1

    5a7b09caae228b6fa8f3e8af803cde0a24a3753d

    SHA256

    b7a04a7c0843488989d963a7abbe221dd7efc4bf6c30b4c6a54bc1bf5a591f0a

    SHA512

    9986e18d4af3603ee8760879e488c4e36375e578a55e129d8c06720b665cd1815770606c758abfd6d27ef61bc82d2adbe037d46f64f9e9dc7d7c763f2799b0f8

  • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\rk852646.exe

    Filesize

    332KB

    MD5

    946b47955f44fe4feea000bbb16eda66

    SHA1

    81c25c931da3f1d86cc28275dbce4af3a81ab695

    SHA256

    6b858faf6e7991aeb21d441fc854d00dce67181b804564306225f3032b3faf01

    SHA512

    0787f530ac35467916dddc38d4e023336597cbed3d96195b623bac012435306883255f78abfd8f1676d1cf14530f4cfe38145d676be74911c2ad94a9df371ea7

  • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\rk852646.exe

    Filesize

    332KB

    MD5

    946b47955f44fe4feea000bbb16eda66

    SHA1

    81c25c931da3f1d86cc28275dbce4af3a81ab695

    SHA256

    6b858faf6e7991aeb21d441fc854d00dce67181b804564306225f3032b3faf01

    SHA512

    0787f530ac35467916dddc38d4e023336597cbed3d96195b623bac012435306883255f78abfd8f1676d1cf14530f4cfe38145d676be74911c2ad94a9df371ea7

  • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\rk852646.exe

    Filesize

    332KB

    MD5

    946b47955f44fe4feea000bbb16eda66

    SHA1

    81c25c931da3f1d86cc28275dbce4af3a81ab695

    SHA256

    6b858faf6e7991aeb21d441fc854d00dce67181b804564306225f3032b3faf01

    SHA512

    0787f530ac35467916dddc38d4e023336597cbed3d96195b623bac012435306883255f78abfd8f1676d1cf14530f4cfe38145d676be74911c2ad94a9df371ea7

  • \Users\Admin\AppData\Local\Temp\IXP000.TMP\un220178.exe

    Filesize

    533KB

    MD5

    e4cb0d46e29aa07655a20c66f5a59e2b

    SHA1

    d42afba648de13db6c076dacfaacb532970e76b1

    SHA256

    cd9492ce33dfbf58bd5668a3b1fbde3c165afb42fc26a198c813362a4ae4d20a

    SHA512

    1feb1ea6e88a89f2540edcb1eb51b0a5bc425176d0d2db683c91cf9b8fe389c6c8e3b1eb39ef399ddb60060851f1d8f2db6873eeaf98b38d0e45ce8c5bc24890

  • \Users\Admin\AppData\Local\Temp\IXP000.TMP\un220178.exe

    Filesize

    533KB

    MD5

    e4cb0d46e29aa07655a20c66f5a59e2b

    SHA1

    d42afba648de13db6c076dacfaacb532970e76b1

    SHA256

    cd9492ce33dfbf58bd5668a3b1fbde3c165afb42fc26a198c813362a4ae4d20a

    SHA512

    1feb1ea6e88a89f2540edcb1eb51b0a5bc425176d0d2db683c91cf9b8fe389c6c8e3b1eb39ef399ddb60060851f1d8f2db6873eeaf98b38d0e45ce8c5bc24890

  • \Users\Admin\AppData\Local\Temp\IXP001.TMP\72517916.exe

    Filesize

    249KB

    MD5

    d6d95b8210b9f278ae696ff03c4fbceb

    SHA1

    5a7b09caae228b6fa8f3e8af803cde0a24a3753d

    SHA256

    b7a04a7c0843488989d963a7abbe221dd7efc4bf6c30b4c6a54bc1bf5a591f0a

    SHA512

    9986e18d4af3603ee8760879e488c4e36375e578a55e129d8c06720b665cd1815770606c758abfd6d27ef61bc82d2adbe037d46f64f9e9dc7d7c763f2799b0f8

  • \Users\Admin\AppData\Local\Temp\IXP001.TMP\72517916.exe

    Filesize

    249KB

    MD5

    d6d95b8210b9f278ae696ff03c4fbceb

    SHA1

    5a7b09caae228b6fa8f3e8af803cde0a24a3753d

    SHA256

    b7a04a7c0843488989d963a7abbe221dd7efc4bf6c30b4c6a54bc1bf5a591f0a

    SHA512

    9986e18d4af3603ee8760879e488c4e36375e578a55e129d8c06720b665cd1815770606c758abfd6d27ef61bc82d2adbe037d46f64f9e9dc7d7c763f2799b0f8

  • \Users\Admin\AppData\Local\Temp\IXP001.TMP\72517916.exe

    Filesize

    249KB

    MD5

    d6d95b8210b9f278ae696ff03c4fbceb

    SHA1

    5a7b09caae228b6fa8f3e8af803cde0a24a3753d

    SHA256

    b7a04a7c0843488989d963a7abbe221dd7efc4bf6c30b4c6a54bc1bf5a591f0a

    SHA512

    9986e18d4af3603ee8760879e488c4e36375e578a55e129d8c06720b665cd1815770606c758abfd6d27ef61bc82d2adbe037d46f64f9e9dc7d7c763f2799b0f8

  • \Users\Admin\AppData\Local\Temp\IXP001.TMP\rk852646.exe

    Filesize

    332KB

    MD5

    946b47955f44fe4feea000bbb16eda66

    SHA1

    81c25c931da3f1d86cc28275dbce4af3a81ab695

    SHA256

    6b858faf6e7991aeb21d441fc854d00dce67181b804564306225f3032b3faf01

    SHA512

    0787f530ac35467916dddc38d4e023336597cbed3d96195b623bac012435306883255f78abfd8f1676d1cf14530f4cfe38145d676be74911c2ad94a9df371ea7

  • \Users\Admin\AppData\Local\Temp\IXP001.TMP\rk852646.exe

    Filesize

    332KB

    MD5

    946b47955f44fe4feea000bbb16eda66

    SHA1

    81c25c931da3f1d86cc28275dbce4af3a81ab695

    SHA256

    6b858faf6e7991aeb21d441fc854d00dce67181b804564306225f3032b3faf01

    SHA512

    0787f530ac35467916dddc38d4e023336597cbed3d96195b623bac012435306883255f78abfd8f1676d1cf14530f4cfe38145d676be74911c2ad94a9df371ea7

  • \Users\Admin\AppData\Local\Temp\IXP001.TMP\rk852646.exe

    Filesize

    332KB

    MD5

    946b47955f44fe4feea000bbb16eda66

    SHA1

    81c25c931da3f1d86cc28275dbce4af3a81ab695

    SHA256

    6b858faf6e7991aeb21d441fc854d00dce67181b804564306225f3032b3faf01

    SHA512

    0787f530ac35467916dddc38d4e023336597cbed3d96195b623bac012435306883255f78abfd8f1676d1cf14530f4cfe38145d676be74911c2ad94a9df371ea7

  • memory/1316-134-0x0000000004A90000-0x0000000004AC5000-memory.dmp

    Filesize

    212KB

  • memory/1316-158-0x0000000004A90000-0x0000000004AC5000-memory.dmp

    Filesize

    212KB

  • memory/1316-927-0x0000000004C40000-0x0000000004C80000-memory.dmp

    Filesize

    256KB

  • memory/1316-926-0x0000000004C40000-0x0000000004C80000-memory.dmp

    Filesize

    256KB

  • memory/1316-925-0x0000000004C40000-0x0000000004C80000-memory.dmp

    Filesize

    256KB

  • memory/1316-924-0x0000000004C40000-0x0000000004C80000-memory.dmp

    Filesize

    256KB

  • memory/1316-921-0x0000000004C40000-0x0000000004C80000-memory.dmp

    Filesize

    256KB

  • memory/1316-225-0x0000000004C40000-0x0000000004C80000-memory.dmp

    Filesize

    256KB

  • memory/1316-223-0x0000000004C40000-0x0000000004C80000-memory.dmp

    Filesize

    256KB

  • memory/1316-221-0x0000000004C40000-0x0000000004C80000-memory.dmp

    Filesize

    256KB

  • memory/1316-219-0x0000000000390000-0x00000000003D6000-memory.dmp

    Filesize

    280KB

  • memory/1316-146-0x0000000004A90000-0x0000000004AC5000-memory.dmp

    Filesize

    212KB

  • memory/1316-148-0x0000000004A90000-0x0000000004AC5000-memory.dmp

    Filesize

    212KB

  • memory/1316-150-0x0000000004A90000-0x0000000004AC5000-memory.dmp

    Filesize

    212KB

  • memory/1316-154-0x0000000004A90000-0x0000000004AC5000-memory.dmp

    Filesize

    212KB

  • memory/1316-156-0x0000000004A90000-0x0000000004AC5000-memory.dmp

    Filesize

    212KB

  • memory/1316-152-0x0000000004A90000-0x0000000004AC5000-memory.dmp

    Filesize

    212KB

  • memory/1316-144-0x0000000004A90000-0x0000000004AC5000-memory.dmp

    Filesize

    212KB

  • memory/1316-142-0x0000000004A90000-0x0000000004AC5000-memory.dmp

    Filesize

    212KB

  • memory/1316-140-0x0000000004A90000-0x0000000004AC5000-memory.dmp

    Filesize

    212KB

  • memory/1316-136-0x0000000004A90000-0x0000000004AC5000-memory.dmp

    Filesize

    212KB

  • memory/1316-138-0x0000000004A90000-0x0000000004AC5000-memory.dmp

    Filesize

    212KB

  • memory/1316-123-0x0000000004860000-0x000000000489C000-memory.dmp

    Filesize

    240KB

  • memory/1316-124-0x0000000004A90000-0x0000000004ACA000-memory.dmp

    Filesize

    232KB

  • memory/1316-126-0x0000000004A90000-0x0000000004AC5000-memory.dmp

    Filesize

    212KB

  • memory/1316-125-0x0000000004A90000-0x0000000004AC5000-memory.dmp

    Filesize

    212KB

  • memory/1316-128-0x0000000004A90000-0x0000000004AC5000-memory.dmp

    Filesize

    212KB

  • memory/1316-132-0x0000000004A90000-0x0000000004AC5000-memory.dmp

    Filesize

    212KB

  • memory/1316-130-0x0000000004A90000-0x0000000004AC5000-memory.dmp

    Filesize

    212KB

  • memory/1924-110-0x0000000003020000-0x0000000003033000-memory.dmp

    Filesize

    76KB

  • memory/1924-108-0x0000000003020000-0x0000000003033000-memory.dmp

    Filesize

    76KB

  • memory/1924-79-0x0000000000240000-0x000000000026D000-memory.dmp

    Filesize

    180KB

  • memory/1924-78-0x0000000000350000-0x000000000036A000-memory.dmp

    Filesize

    104KB

  • memory/1924-82-0x0000000003020000-0x0000000003038000-memory.dmp

    Filesize

    96KB

  • memory/1924-83-0x0000000003020000-0x0000000003033000-memory.dmp

    Filesize

    76KB

  • memory/1924-84-0x0000000003020000-0x0000000003033000-memory.dmp

    Filesize

    76KB

  • memory/1924-112-0x0000000000400000-0x0000000002B9A000-memory.dmp

    Filesize

    39.6MB

  • memory/1924-86-0x0000000003020000-0x0000000003033000-memory.dmp

    Filesize

    76KB

  • memory/1924-106-0x0000000003020000-0x0000000003033000-memory.dmp

    Filesize

    76KB

  • memory/1924-80-0x0000000007160000-0x00000000071A0000-memory.dmp

    Filesize

    256KB

  • memory/1924-81-0x0000000007160000-0x00000000071A0000-memory.dmp

    Filesize

    256KB

  • memory/1924-111-0x0000000000400000-0x0000000002B9A000-memory.dmp

    Filesize

    39.6MB

  • memory/1924-104-0x0000000003020000-0x0000000003033000-memory.dmp

    Filesize

    76KB

  • memory/1924-100-0x0000000003020000-0x0000000003033000-memory.dmp

    Filesize

    76KB

  • memory/1924-102-0x0000000003020000-0x0000000003033000-memory.dmp

    Filesize

    76KB

  • memory/1924-98-0x0000000003020000-0x0000000003033000-memory.dmp

    Filesize

    76KB

  • memory/1924-96-0x0000000003020000-0x0000000003033000-memory.dmp

    Filesize

    76KB

  • memory/1924-94-0x0000000003020000-0x0000000003033000-memory.dmp

    Filesize

    76KB

  • memory/1924-92-0x0000000003020000-0x0000000003033000-memory.dmp

    Filesize

    76KB

  • memory/1924-90-0x0000000003020000-0x0000000003033000-memory.dmp

    Filesize

    76KB

  • memory/1924-88-0x0000000003020000-0x0000000003033000-memory.dmp

    Filesize

    76KB