Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    152s
  • max time network
    189s
  • platform
    windows7_x64
  • resource
    win7-20230220-en
  • resource tags

    arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
  • submitted
    01/05/2023, 19:18

General

  • Target

    f3878e3193c9cf4f56105966f1bba82ab5ffa81cb0117b3b9102e4ae405c037b.exe

  • Size

    693KB

  • MD5

    4b9e25f182a3ec7a379c101134ce7320

  • SHA1

    5eb756750abe820c9565b489e8ac90b20c06f233

  • SHA256

    f3878e3193c9cf4f56105966f1bba82ab5ffa81cb0117b3b9102e4ae405c037b

  • SHA512

    24090aed61e9b7c319b400366c4876ddaa25587eed14ab04a66603cc16b6b5d637f638f22b1c77d3648690118c773afae40b94e0c94ef6c7be62facab506f240

  • SSDEEP

    12288:Yy90D9PUZ3I0XPZAhrOyQJwSkcEJ2tvtwreXYUKCoWz6FW18bzK9A+LAFnC:YyQY7BAhCxccNtvtyeoU/J6FW18bzSxz

Malware Config

Signatures

  • Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs
  • Executes dropped EXE 3 IoCs
  • Loads dropped DLL 8 IoCs
  • Windows security modification 2 TTPs 2 IoCs
  • Adds Run key to start application 2 TTPs 4 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 21 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\f3878e3193c9cf4f56105966f1bba82ab5ffa81cb0117b3b9102e4ae405c037b.exe
    "C:\Users\Admin\AppData\Local\Temp\f3878e3193c9cf4f56105966f1bba82ab5ffa81cb0117b3b9102e4ae405c037b.exe"
    1⤵
    • Loads dropped DLL
    • Adds Run key to start application
    • Suspicious use of WriteProcessMemory
    PID:1940
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un767156.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un767156.exe
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Adds Run key to start application
      • Suspicious use of WriteProcessMemory
      PID:380
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\65745420.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\65745420.exe
        3⤵
        • Modifies Windows Defender Real-time Protection settings
        • Executes dropped EXE
        • Loads dropped DLL
        • Windows security modification
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:1460
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\rk469979.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\rk469979.exe
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Suspicious use of AdjustPrivilegeToken
        PID:1636

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un767156.exe

    Filesize

    540KB

    MD5

    e7013ba8775cc855b3e16226989c0e96

    SHA1

    e0a77ced0e2d33194346bb83f1755c1c3d7a8e7f

    SHA256

    7356ea11a956704246ec5cb9f852e9bed8123f1e68ba6d80e6c064b4183aebec

    SHA512

    be664dd23061e7cdafb3b169cfda5250b1f180dfbfc82e7c409ec542494379c5430156e011c5fc65866d5ca8649d4b663d36608c06f0f5f350417f1b60991e55

  • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un767156.exe

    Filesize

    540KB

    MD5

    e7013ba8775cc855b3e16226989c0e96

    SHA1

    e0a77ced0e2d33194346bb83f1755c1c3d7a8e7f

    SHA256

    7356ea11a956704246ec5cb9f852e9bed8123f1e68ba6d80e6c064b4183aebec

    SHA512

    be664dd23061e7cdafb3b169cfda5250b1f180dfbfc82e7c409ec542494379c5430156e011c5fc65866d5ca8649d4b663d36608c06f0f5f350417f1b60991e55

  • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\65745420.exe

    Filesize

    258KB

    MD5

    63fad0828043cd7e27373613053c89be

    SHA1

    4c5bb83fde449f75dff5dc3996f67c96f0eeb655

    SHA256

    9d8d3b9a06e0e3970220b454d58a30c75cba2913f2f7385d766b19d985235922

    SHA512

    2984c26096ada19b72dffc66aebdefed1723f09f1c806914e6930c10ecae01f565339b29b888899d4e1e5de0a9791e767ac959029daaf10ca77c2ef3d848df5b

  • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\65745420.exe

    Filesize

    258KB

    MD5

    63fad0828043cd7e27373613053c89be

    SHA1

    4c5bb83fde449f75dff5dc3996f67c96f0eeb655

    SHA256

    9d8d3b9a06e0e3970220b454d58a30c75cba2913f2f7385d766b19d985235922

    SHA512

    2984c26096ada19b72dffc66aebdefed1723f09f1c806914e6930c10ecae01f565339b29b888899d4e1e5de0a9791e767ac959029daaf10ca77c2ef3d848df5b

  • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\65745420.exe

    Filesize

    258KB

    MD5

    63fad0828043cd7e27373613053c89be

    SHA1

    4c5bb83fde449f75dff5dc3996f67c96f0eeb655

    SHA256

    9d8d3b9a06e0e3970220b454d58a30c75cba2913f2f7385d766b19d985235922

    SHA512

    2984c26096ada19b72dffc66aebdefed1723f09f1c806914e6930c10ecae01f565339b29b888899d4e1e5de0a9791e767ac959029daaf10ca77c2ef3d848df5b

  • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\rk469979.exe

    Filesize

    340KB

    MD5

    7d89039aa8848f728d64988feb89abc9

    SHA1

    6344a11b85b889f69b9cceadedb8921909654fc6

    SHA256

    b620eb337f466925899eec924e2381f77381cf95c1f4727b8a16126f17e6dc97

    SHA512

    c1c9983802b93ff4b8323cff71719cfeff00f8728c36223bf81b1364ae0d6ffb11397bf97c2e875bfd2cab550cf1fa64959b653c12665b94dbdf640f067752eb

  • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\rk469979.exe

    Filesize

    340KB

    MD5

    7d89039aa8848f728d64988feb89abc9

    SHA1

    6344a11b85b889f69b9cceadedb8921909654fc6

    SHA256

    b620eb337f466925899eec924e2381f77381cf95c1f4727b8a16126f17e6dc97

    SHA512

    c1c9983802b93ff4b8323cff71719cfeff00f8728c36223bf81b1364ae0d6ffb11397bf97c2e875bfd2cab550cf1fa64959b653c12665b94dbdf640f067752eb

  • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\rk469979.exe

    Filesize

    340KB

    MD5

    7d89039aa8848f728d64988feb89abc9

    SHA1

    6344a11b85b889f69b9cceadedb8921909654fc6

    SHA256

    b620eb337f466925899eec924e2381f77381cf95c1f4727b8a16126f17e6dc97

    SHA512

    c1c9983802b93ff4b8323cff71719cfeff00f8728c36223bf81b1364ae0d6ffb11397bf97c2e875bfd2cab550cf1fa64959b653c12665b94dbdf640f067752eb

  • \Users\Admin\AppData\Local\Temp\IXP000.TMP\un767156.exe

    Filesize

    540KB

    MD5

    e7013ba8775cc855b3e16226989c0e96

    SHA1

    e0a77ced0e2d33194346bb83f1755c1c3d7a8e7f

    SHA256

    7356ea11a956704246ec5cb9f852e9bed8123f1e68ba6d80e6c064b4183aebec

    SHA512

    be664dd23061e7cdafb3b169cfda5250b1f180dfbfc82e7c409ec542494379c5430156e011c5fc65866d5ca8649d4b663d36608c06f0f5f350417f1b60991e55

  • \Users\Admin\AppData\Local\Temp\IXP000.TMP\un767156.exe

    Filesize

    540KB

    MD5

    e7013ba8775cc855b3e16226989c0e96

    SHA1

    e0a77ced0e2d33194346bb83f1755c1c3d7a8e7f

    SHA256

    7356ea11a956704246ec5cb9f852e9bed8123f1e68ba6d80e6c064b4183aebec

    SHA512

    be664dd23061e7cdafb3b169cfda5250b1f180dfbfc82e7c409ec542494379c5430156e011c5fc65866d5ca8649d4b663d36608c06f0f5f350417f1b60991e55

  • \Users\Admin\AppData\Local\Temp\IXP001.TMP\65745420.exe

    Filesize

    258KB

    MD5

    63fad0828043cd7e27373613053c89be

    SHA1

    4c5bb83fde449f75dff5dc3996f67c96f0eeb655

    SHA256

    9d8d3b9a06e0e3970220b454d58a30c75cba2913f2f7385d766b19d985235922

    SHA512

    2984c26096ada19b72dffc66aebdefed1723f09f1c806914e6930c10ecae01f565339b29b888899d4e1e5de0a9791e767ac959029daaf10ca77c2ef3d848df5b

  • \Users\Admin\AppData\Local\Temp\IXP001.TMP\65745420.exe

    Filesize

    258KB

    MD5

    63fad0828043cd7e27373613053c89be

    SHA1

    4c5bb83fde449f75dff5dc3996f67c96f0eeb655

    SHA256

    9d8d3b9a06e0e3970220b454d58a30c75cba2913f2f7385d766b19d985235922

    SHA512

    2984c26096ada19b72dffc66aebdefed1723f09f1c806914e6930c10ecae01f565339b29b888899d4e1e5de0a9791e767ac959029daaf10ca77c2ef3d848df5b

  • \Users\Admin\AppData\Local\Temp\IXP001.TMP\65745420.exe

    Filesize

    258KB

    MD5

    63fad0828043cd7e27373613053c89be

    SHA1

    4c5bb83fde449f75dff5dc3996f67c96f0eeb655

    SHA256

    9d8d3b9a06e0e3970220b454d58a30c75cba2913f2f7385d766b19d985235922

    SHA512

    2984c26096ada19b72dffc66aebdefed1723f09f1c806914e6930c10ecae01f565339b29b888899d4e1e5de0a9791e767ac959029daaf10ca77c2ef3d848df5b

  • \Users\Admin\AppData\Local\Temp\IXP001.TMP\rk469979.exe

    Filesize

    340KB

    MD5

    7d89039aa8848f728d64988feb89abc9

    SHA1

    6344a11b85b889f69b9cceadedb8921909654fc6

    SHA256

    b620eb337f466925899eec924e2381f77381cf95c1f4727b8a16126f17e6dc97

    SHA512

    c1c9983802b93ff4b8323cff71719cfeff00f8728c36223bf81b1364ae0d6ffb11397bf97c2e875bfd2cab550cf1fa64959b653c12665b94dbdf640f067752eb

  • \Users\Admin\AppData\Local\Temp\IXP001.TMP\rk469979.exe

    Filesize

    340KB

    MD5

    7d89039aa8848f728d64988feb89abc9

    SHA1

    6344a11b85b889f69b9cceadedb8921909654fc6

    SHA256

    b620eb337f466925899eec924e2381f77381cf95c1f4727b8a16126f17e6dc97

    SHA512

    c1c9983802b93ff4b8323cff71719cfeff00f8728c36223bf81b1364ae0d6ffb11397bf97c2e875bfd2cab550cf1fa64959b653c12665b94dbdf640f067752eb

  • \Users\Admin\AppData\Local\Temp\IXP001.TMP\rk469979.exe

    Filesize

    340KB

    MD5

    7d89039aa8848f728d64988feb89abc9

    SHA1

    6344a11b85b889f69b9cceadedb8921909654fc6

    SHA256

    b620eb337f466925899eec924e2381f77381cf95c1f4727b8a16126f17e6dc97

    SHA512

    c1c9983802b93ff4b8323cff71719cfeff00f8728c36223bf81b1364ae0d6ffb11397bf97c2e875bfd2cab550cf1fa64959b653c12665b94dbdf640f067752eb

  • memory/1460-85-0x0000000004860000-0x0000000004873000-memory.dmp

    Filesize

    76KB

  • memory/1460-87-0x0000000004860000-0x0000000004873000-memory.dmp

    Filesize

    76KB

  • memory/1460-89-0x0000000004860000-0x0000000004873000-memory.dmp

    Filesize

    76KB

  • memory/1460-91-0x0000000004860000-0x0000000004873000-memory.dmp

    Filesize

    76KB

  • memory/1460-93-0x0000000004860000-0x0000000004873000-memory.dmp

    Filesize

    76KB

  • memory/1460-95-0x0000000004860000-0x0000000004873000-memory.dmp

    Filesize

    76KB

  • memory/1460-97-0x0000000004860000-0x0000000004873000-memory.dmp

    Filesize

    76KB

  • memory/1460-99-0x0000000004860000-0x0000000004873000-memory.dmp

    Filesize

    76KB

  • memory/1460-101-0x0000000004860000-0x0000000004873000-memory.dmp

    Filesize

    76KB

  • memory/1460-105-0x0000000004860000-0x0000000004873000-memory.dmp

    Filesize

    76KB

  • memory/1460-103-0x0000000004860000-0x0000000004873000-memory.dmp

    Filesize

    76KB

  • memory/1460-107-0x0000000004860000-0x0000000004873000-memory.dmp

    Filesize

    76KB

  • memory/1460-109-0x0000000004860000-0x0000000004873000-memory.dmp

    Filesize

    76KB

  • memory/1460-110-0x0000000000400000-0x0000000002B9B000-memory.dmp

    Filesize

    39.6MB

  • memory/1460-111-0x00000000070D0000-0x0000000007110000-memory.dmp

    Filesize

    256KB

  • memory/1460-113-0x0000000000400000-0x0000000002B9B000-memory.dmp

    Filesize

    39.6MB

  • memory/1460-83-0x0000000004860000-0x0000000004873000-memory.dmp

    Filesize

    76KB

  • memory/1460-82-0x0000000004860000-0x0000000004873000-memory.dmp

    Filesize

    76KB

  • memory/1460-81-0x0000000004860000-0x0000000004878000-memory.dmp

    Filesize

    96KB

  • memory/1460-79-0x0000000000270000-0x000000000029D000-memory.dmp

    Filesize

    180KB

  • memory/1460-80-0x00000000070D0000-0x0000000007110000-memory.dmp

    Filesize

    256KB

  • memory/1460-78-0x00000000045F0000-0x000000000460A000-memory.dmp

    Filesize

    104KB

  • memory/1636-125-0x0000000004630000-0x000000000466A000-memory.dmp

    Filesize

    232KB

  • memory/1636-144-0x0000000004630000-0x0000000004665000-memory.dmp

    Filesize

    212KB

  • memory/1636-126-0x00000000002D0000-0x0000000000316000-memory.dmp

    Filesize

    280KB

  • memory/1636-128-0x00000000071A0000-0x00000000071E0000-memory.dmp

    Filesize

    256KB

  • memory/1636-127-0x00000000071A0000-0x00000000071E0000-memory.dmp

    Filesize

    256KB

  • memory/1636-130-0x0000000004630000-0x0000000004665000-memory.dmp

    Filesize

    212KB

  • memory/1636-132-0x0000000004630000-0x0000000004665000-memory.dmp

    Filesize

    212KB

  • memory/1636-129-0x0000000004630000-0x0000000004665000-memory.dmp

    Filesize

    212KB

  • memory/1636-134-0x0000000004630000-0x0000000004665000-memory.dmp

    Filesize

    212KB

  • memory/1636-136-0x0000000004630000-0x0000000004665000-memory.dmp

    Filesize

    212KB

  • memory/1636-138-0x0000000004630000-0x0000000004665000-memory.dmp

    Filesize

    212KB

  • memory/1636-140-0x0000000004630000-0x0000000004665000-memory.dmp

    Filesize

    212KB

  • memory/1636-142-0x0000000004630000-0x0000000004665000-memory.dmp

    Filesize

    212KB

  • memory/1636-124-0x00000000031D0000-0x000000000320C000-memory.dmp

    Filesize

    240KB

  • memory/1636-146-0x0000000004630000-0x0000000004665000-memory.dmp

    Filesize

    212KB

  • memory/1636-148-0x0000000004630000-0x0000000004665000-memory.dmp

    Filesize

    212KB

  • memory/1636-150-0x0000000004630000-0x0000000004665000-memory.dmp

    Filesize

    212KB

  • memory/1636-152-0x0000000004630000-0x0000000004665000-memory.dmp

    Filesize

    212KB

  • memory/1636-154-0x0000000004630000-0x0000000004665000-memory.dmp

    Filesize

    212KB

  • memory/1636-156-0x0000000004630000-0x0000000004665000-memory.dmp

    Filesize

    212KB

  • memory/1636-158-0x0000000004630000-0x0000000004665000-memory.dmp

    Filesize

    212KB

  • memory/1636-160-0x0000000004630000-0x0000000004665000-memory.dmp

    Filesize

    212KB

  • memory/1636-922-0x00000000071A0000-0x00000000071E0000-memory.dmp

    Filesize

    256KB

  • memory/1636-923-0x00000000071A0000-0x00000000071E0000-memory.dmp

    Filesize

    256KB

  • memory/1636-924-0x00000000071A0000-0x00000000071E0000-memory.dmp

    Filesize

    256KB

  • memory/1636-926-0x00000000071A0000-0x00000000071E0000-memory.dmp

    Filesize

    256KB