Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    228s
  • max time network
    299s
  • platform
    windows7_x64
  • resource
    win7-20230220-en
  • resource tags

    arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
  • submitted
    01/05/2023, 19:36

General

  • Target

    fe6450a225302d7f9cab3ee73681548d9bf49e41bb42870ba21d374b04ef7e2f.exe

  • Size

    696KB

  • MD5

    1feca7be483a7ede6047b2021bba9291

  • SHA1

    232052904b9db804906180ccf2ba113a90eb89e6

  • SHA256

    fe6450a225302d7f9cab3ee73681548d9bf49e41bb42870ba21d374b04ef7e2f

  • SHA512

    1a32cb9bde9022d2554b276eee3b05bc523d276f4dfd1a40df7b073f6adceb43418fada2ac18228acb13beaa336ce22a149da7f0edf850ab08b7de36133eb8d8

  • SSDEEP

    12288:zy90Tq4C00Xa9KJ2A/+tZ9CO3IhMY/NN4MWL6+718buKjA+KQujtlU:zyyqsfKoA/+tXCFneZ6+718bugIbjtlU

Malware Config

Signatures

  • Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs
  • Executes dropped EXE 3 IoCs
  • Loads dropped DLL 8 IoCs
  • Windows security modification 2 TTPs 2 IoCs
  • Adds Run key to start application 2 TTPs 4 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 21 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\fe6450a225302d7f9cab3ee73681548d9bf49e41bb42870ba21d374b04ef7e2f.exe
    "C:\Users\Admin\AppData\Local\Temp\fe6450a225302d7f9cab3ee73681548d9bf49e41bb42870ba21d374b04ef7e2f.exe"
    1⤵
    • Loads dropped DLL
    • Adds Run key to start application
    • Suspicious use of WriteProcessMemory
    PID:1776
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un815342.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un815342.exe
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Adds Run key to start application
      • Suspicious use of WriteProcessMemory
      PID:268
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\43383082.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\43383082.exe
        3⤵
        • Modifies Windows Defender Real-time Protection settings
        • Executes dropped EXE
        • Loads dropped DLL
        • Windows security modification
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:580
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\rk342776.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\rk342776.exe
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Suspicious use of AdjustPrivilegeToken
        PID:1044

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un815342.exe

    Filesize

    541KB

    MD5

    b5ec3f70c6df9edfc2dace7f701f805d

    SHA1

    b3ed76d78cd26c6acd0e32c4b23f4c8bfa238bbc

    SHA256

    138fbb8de2e879362135632a6e5ef689388f0759e3854467a9817bcdb42bdf2c

    SHA512

    5edb7496511bb17330088a57f8a4900443ef7880e9c20ef40113019007b026341f383ab1923a8f409ba40832c45fb0302499309ecc819d20b6cbcb124fc1ee52

  • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un815342.exe

    Filesize

    541KB

    MD5

    b5ec3f70c6df9edfc2dace7f701f805d

    SHA1

    b3ed76d78cd26c6acd0e32c4b23f4c8bfa238bbc

    SHA256

    138fbb8de2e879362135632a6e5ef689388f0759e3854467a9817bcdb42bdf2c

    SHA512

    5edb7496511bb17330088a57f8a4900443ef7880e9c20ef40113019007b026341f383ab1923a8f409ba40832c45fb0302499309ecc819d20b6cbcb124fc1ee52

  • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\43383082.exe

    Filesize

    258KB

    MD5

    88fc9da8525f441b05688e184a99a983

    SHA1

    16a4d0f6f1a16659897c092d00eb4f79e0f04b88

    SHA256

    23533d104e8a7c6cf358a63f41dc01fbe03cfa6a6db87d898abd295de0f2ca9a

    SHA512

    31311ec3048fa731277370dee537351bd1cf4f07e975f586320d5ea64f70b477f0b32253001d6c2b363935aeafa96953a33343b3571fc989fdce7a67e5541ccb

  • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\43383082.exe

    Filesize

    258KB

    MD5

    88fc9da8525f441b05688e184a99a983

    SHA1

    16a4d0f6f1a16659897c092d00eb4f79e0f04b88

    SHA256

    23533d104e8a7c6cf358a63f41dc01fbe03cfa6a6db87d898abd295de0f2ca9a

    SHA512

    31311ec3048fa731277370dee537351bd1cf4f07e975f586320d5ea64f70b477f0b32253001d6c2b363935aeafa96953a33343b3571fc989fdce7a67e5541ccb

  • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\43383082.exe

    Filesize

    258KB

    MD5

    88fc9da8525f441b05688e184a99a983

    SHA1

    16a4d0f6f1a16659897c092d00eb4f79e0f04b88

    SHA256

    23533d104e8a7c6cf358a63f41dc01fbe03cfa6a6db87d898abd295de0f2ca9a

    SHA512

    31311ec3048fa731277370dee537351bd1cf4f07e975f586320d5ea64f70b477f0b32253001d6c2b363935aeafa96953a33343b3571fc989fdce7a67e5541ccb

  • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\rk342776.exe

    Filesize

    340KB

    MD5

    b16b06fb5c3aa4421d5ce16427673f03

    SHA1

    1411c24051963ac29d15f706d2c3140aad48bd06

    SHA256

    02b4a968e81c5cd1d05a161808e1d0ca93eff89dd6cef87d046a3ab18bcc9056

    SHA512

    7d4f4223b8956efec0473e0022fd79eda5d242be33f758e598c0f166bb5c438bead3665fa0dc4cc354a6090870345ad272b2dafbee2190d683e682a14042042f

  • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\rk342776.exe

    Filesize

    340KB

    MD5

    b16b06fb5c3aa4421d5ce16427673f03

    SHA1

    1411c24051963ac29d15f706d2c3140aad48bd06

    SHA256

    02b4a968e81c5cd1d05a161808e1d0ca93eff89dd6cef87d046a3ab18bcc9056

    SHA512

    7d4f4223b8956efec0473e0022fd79eda5d242be33f758e598c0f166bb5c438bead3665fa0dc4cc354a6090870345ad272b2dafbee2190d683e682a14042042f

  • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\rk342776.exe

    Filesize

    340KB

    MD5

    b16b06fb5c3aa4421d5ce16427673f03

    SHA1

    1411c24051963ac29d15f706d2c3140aad48bd06

    SHA256

    02b4a968e81c5cd1d05a161808e1d0ca93eff89dd6cef87d046a3ab18bcc9056

    SHA512

    7d4f4223b8956efec0473e0022fd79eda5d242be33f758e598c0f166bb5c438bead3665fa0dc4cc354a6090870345ad272b2dafbee2190d683e682a14042042f

  • \Users\Admin\AppData\Local\Temp\IXP000.TMP\un815342.exe

    Filesize

    541KB

    MD5

    b5ec3f70c6df9edfc2dace7f701f805d

    SHA1

    b3ed76d78cd26c6acd0e32c4b23f4c8bfa238bbc

    SHA256

    138fbb8de2e879362135632a6e5ef689388f0759e3854467a9817bcdb42bdf2c

    SHA512

    5edb7496511bb17330088a57f8a4900443ef7880e9c20ef40113019007b026341f383ab1923a8f409ba40832c45fb0302499309ecc819d20b6cbcb124fc1ee52

  • \Users\Admin\AppData\Local\Temp\IXP000.TMP\un815342.exe

    Filesize

    541KB

    MD5

    b5ec3f70c6df9edfc2dace7f701f805d

    SHA1

    b3ed76d78cd26c6acd0e32c4b23f4c8bfa238bbc

    SHA256

    138fbb8de2e879362135632a6e5ef689388f0759e3854467a9817bcdb42bdf2c

    SHA512

    5edb7496511bb17330088a57f8a4900443ef7880e9c20ef40113019007b026341f383ab1923a8f409ba40832c45fb0302499309ecc819d20b6cbcb124fc1ee52

  • \Users\Admin\AppData\Local\Temp\IXP001.TMP\43383082.exe

    Filesize

    258KB

    MD5

    88fc9da8525f441b05688e184a99a983

    SHA1

    16a4d0f6f1a16659897c092d00eb4f79e0f04b88

    SHA256

    23533d104e8a7c6cf358a63f41dc01fbe03cfa6a6db87d898abd295de0f2ca9a

    SHA512

    31311ec3048fa731277370dee537351bd1cf4f07e975f586320d5ea64f70b477f0b32253001d6c2b363935aeafa96953a33343b3571fc989fdce7a67e5541ccb

  • \Users\Admin\AppData\Local\Temp\IXP001.TMP\43383082.exe

    Filesize

    258KB

    MD5

    88fc9da8525f441b05688e184a99a983

    SHA1

    16a4d0f6f1a16659897c092d00eb4f79e0f04b88

    SHA256

    23533d104e8a7c6cf358a63f41dc01fbe03cfa6a6db87d898abd295de0f2ca9a

    SHA512

    31311ec3048fa731277370dee537351bd1cf4f07e975f586320d5ea64f70b477f0b32253001d6c2b363935aeafa96953a33343b3571fc989fdce7a67e5541ccb

  • \Users\Admin\AppData\Local\Temp\IXP001.TMP\43383082.exe

    Filesize

    258KB

    MD5

    88fc9da8525f441b05688e184a99a983

    SHA1

    16a4d0f6f1a16659897c092d00eb4f79e0f04b88

    SHA256

    23533d104e8a7c6cf358a63f41dc01fbe03cfa6a6db87d898abd295de0f2ca9a

    SHA512

    31311ec3048fa731277370dee537351bd1cf4f07e975f586320d5ea64f70b477f0b32253001d6c2b363935aeafa96953a33343b3571fc989fdce7a67e5541ccb

  • \Users\Admin\AppData\Local\Temp\IXP001.TMP\rk342776.exe

    Filesize

    340KB

    MD5

    b16b06fb5c3aa4421d5ce16427673f03

    SHA1

    1411c24051963ac29d15f706d2c3140aad48bd06

    SHA256

    02b4a968e81c5cd1d05a161808e1d0ca93eff89dd6cef87d046a3ab18bcc9056

    SHA512

    7d4f4223b8956efec0473e0022fd79eda5d242be33f758e598c0f166bb5c438bead3665fa0dc4cc354a6090870345ad272b2dafbee2190d683e682a14042042f

  • \Users\Admin\AppData\Local\Temp\IXP001.TMP\rk342776.exe

    Filesize

    340KB

    MD5

    b16b06fb5c3aa4421d5ce16427673f03

    SHA1

    1411c24051963ac29d15f706d2c3140aad48bd06

    SHA256

    02b4a968e81c5cd1d05a161808e1d0ca93eff89dd6cef87d046a3ab18bcc9056

    SHA512

    7d4f4223b8956efec0473e0022fd79eda5d242be33f758e598c0f166bb5c438bead3665fa0dc4cc354a6090870345ad272b2dafbee2190d683e682a14042042f

  • \Users\Admin\AppData\Local\Temp\IXP001.TMP\rk342776.exe

    Filesize

    340KB

    MD5

    b16b06fb5c3aa4421d5ce16427673f03

    SHA1

    1411c24051963ac29d15f706d2c3140aad48bd06

    SHA256

    02b4a968e81c5cd1d05a161808e1d0ca93eff89dd6cef87d046a3ab18bcc9056

    SHA512

    7d4f4223b8956efec0473e0022fd79eda5d242be33f758e598c0f166bb5c438bead3665fa0dc4cc354a6090870345ad272b2dafbee2190d683e682a14042042f

  • memory/580-84-0x0000000003220000-0x0000000003233000-memory.dmp

    Filesize

    76KB

  • memory/580-86-0x0000000003220000-0x0000000003233000-memory.dmp

    Filesize

    76KB

  • memory/580-88-0x0000000003220000-0x0000000003233000-memory.dmp

    Filesize

    76KB

  • memory/580-92-0x0000000003220000-0x0000000003233000-memory.dmp

    Filesize

    76KB

  • memory/580-90-0x0000000003220000-0x0000000003233000-memory.dmp

    Filesize

    76KB

  • memory/580-96-0x0000000003220000-0x0000000003233000-memory.dmp

    Filesize

    76KB

  • memory/580-94-0x0000000003220000-0x0000000003233000-memory.dmp

    Filesize

    76KB

  • memory/580-98-0x0000000003220000-0x0000000003233000-memory.dmp

    Filesize

    76KB

  • memory/580-100-0x0000000003220000-0x0000000003233000-memory.dmp

    Filesize

    76KB

  • memory/580-102-0x0000000003220000-0x0000000003233000-memory.dmp

    Filesize

    76KB

  • memory/580-104-0x0000000003220000-0x0000000003233000-memory.dmp

    Filesize

    76KB

  • memory/580-108-0x0000000003220000-0x0000000003233000-memory.dmp

    Filesize

    76KB

  • memory/580-106-0x0000000003220000-0x0000000003233000-memory.dmp

    Filesize

    76KB

  • memory/580-110-0x0000000003220000-0x0000000003233000-memory.dmp

    Filesize

    76KB

  • memory/580-111-0x0000000000400000-0x0000000002B9B000-memory.dmp

    Filesize

    39.6MB

  • memory/580-113-0x0000000000400000-0x0000000002B9B000-memory.dmp

    Filesize

    39.6MB

  • memory/580-83-0x0000000003220000-0x0000000003233000-memory.dmp

    Filesize

    76KB

  • memory/580-82-0x0000000003240000-0x0000000003280000-memory.dmp

    Filesize

    256KB

  • memory/580-81-0x0000000003240000-0x0000000003280000-memory.dmp

    Filesize

    256KB

  • memory/580-80-0x0000000000240000-0x000000000026D000-memory.dmp

    Filesize

    180KB

  • memory/580-79-0x0000000003220000-0x0000000003238000-memory.dmp

    Filesize

    96KB

  • memory/580-78-0x0000000002BE0000-0x0000000002BFA000-memory.dmp

    Filesize

    104KB

  • memory/1044-127-0x0000000004BD0000-0x0000000004C05000-memory.dmp

    Filesize

    212KB

  • memory/1044-138-0x0000000007000000-0x0000000007040000-memory.dmp

    Filesize

    256KB

  • memory/1044-126-0x0000000004BD0000-0x0000000004C05000-memory.dmp

    Filesize

    212KB

  • memory/1044-124-0x0000000004B90000-0x0000000004BCC000-memory.dmp

    Filesize

    240KB

  • memory/1044-129-0x0000000004BD0000-0x0000000004C05000-memory.dmp

    Filesize

    212KB

  • memory/1044-131-0x0000000004BD0000-0x0000000004C05000-memory.dmp

    Filesize

    212KB

  • memory/1044-133-0x0000000004BD0000-0x0000000004C05000-memory.dmp

    Filesize

    212KB

  • memory/1044-135-0x0000000004BD0000-0x0000000004C05000-memory.dmp

    Filesize

    212KB

  • memory/1044-136-0x0000000000280000-0x00000000002C6000-memory.dmp

    Filesize

    280KB

  • memory/1044-139-0x0000000004BD0000-0x0000000004C05000-memory.dmp

    Filesize

    212KB

  • memory/1044-140-0x0000000007000000-0x0000000007040000-memory.dmp

    Filesize

    256KB

  • memory/1044-144-0x0000000004BD0000-0x0000000004C05000-memory.dmp

    Filesize

    212KB

  • memory/1044-142-0x0000000004BD0000-0x0000000004C05000-memory.dmp

    Filesize

    212KB

  • memory/1044-125-0x0000000004BD0000-0x0000000004C0A000-memory.dmp

    Filesize

    232KB

  • memory/1044-146-0x0000000004BD0000-0x0000000004C05000-memory.dmp

    Filesize

    212KB

  • memory/1044-148-0x0000000004BD0000-0x0000000004C05000-memory.dmp

    Filesize

    212KB

  • memory/1044-150-0x0000000004BD0000-0x0000000004C05000-memory.dmp

    Filesize

    212KB

  • memory/1044-152-0x0000000004BD0000-0x0000000004C05000-memory.dmp

    Filesize

    212KB

  • memory/1044-154-0x0000000004BD0000-0x0000000004C05000-memory.dmp

    Filesize

    212KB

  • memory/1044-156-0x0000000004BD0000-0x0000000004C05000-memory.dmp

    Filesize

    212KB

  • memory/1044-158-0x0000000004BD0000-0x0000000004C05000-memory.dmp

    Filesize

    212KB

  • memory/1044-160-0x0000000004BD0000-0x0000000004C05000-memory.dmp

    Filesize

    212KB

  • memory/1044-922-0x0000000007000000-0x0000000007040000-memory.dmp

    Filesize

    256KB

  • memory/1044-923-0x0000000007000000-0x0000000007040000-memory.dmp

    Filesize

    256KB

  • memory/1044-924-0x0000000007000000-0x0000000007040000-memory.dmp

    Filesize

    256KB

  • memory/1044-925-0x0000000007000000-0x0000000007040000-memory.dmp

    Filesize

    256KB

  • memory/1044-928-0x0000000007000000-0x0000000007040000-memory.dmp

    Filesize

    256KB