Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    145s
  • max time network
    190s
  • platform
    windows7_x64
  • resource
    win7-20230220-en
  • resource tags

    arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
  • submitted
    01/05/2023, 19:37

General

  • Target

    fee0a609f1554529890f1c56c3aa61734e8e36e69bbf1afa749ec7e3b90e5f96.exe

  • Size

    747KB

  • MD5

    37888df004aa3046b1388383dd80adf1

  • SHA1

    531177ae8a01b4e6e14f89ec045d44076081dea5

  • SHA256

    fee0a609f1554529890f1c56c3aa61734e8e36e69bbf1afa749ec7e3b90e5f96

  • SHA512

    a05c00dec7c753397e540c4f3a4cca4c74a30c9295cee2070bee8920800d4302cb83a2933cbe42c101fcd0df8ca4103568918a9a61cf39f284a7afbcced1b827

  • SSDEEP

    12288:Iy90sqaJpsFCf9E/fH4ir30LGYzs4Bde7k+HZC1XbN4wJnuyG5tyNoC:IyNoYu//Hr2Zs4WpHZCBbNZJuyGnW

Malware Config

Signatures

  • Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs
  • Executes dropped EXE 3 IoCs
  • Loads dropped DLL 8 IoCs
  • Windows security modification 2 TTPs 2 IoCs
  • Adds Run key to start application 2 TTPs 4 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 21 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\fee0a609f1554529890f1c56c3aa61734e8e36e69bbf1afa749ec7e3b90e5f96.exe
    "C:\Users\Admin\AppData\Local\Temp\fee0a609f1554529890f1c56c3aa61734e8e36e69bbf1afa749ec7e3b90e5f96.exe"
    1⤵
    • Loads dropped DLL
    • Adds Run key to start application
    • Suspicious use of WriteProcessMemory
    PID:1984
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un777065.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un777065.exe
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Adds Run key to start application
      • Suspicious use of WriteProcessMemory
      PID:1912
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\25594768.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\25594768.exe
        3⤵
        • Modifies Windows Defender Real-time Protection settings
        • Executes dropped EXE
        • Loads dropped DLL
        • Windows security modification
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:1324
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\rk938003.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\rk938003.exe
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Suspicious use of AdjustPrivilegeToken
        PID:1944

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un777065.exe

    Filesize

    593KB

    MD5

    e917f1d5245cbe7b6a95282f4013f7b7

    SHA1

    c5de960d37e2a9c6426eef72ef0484a210a9fb20

    SHA256

    ae58d6a2cac88313c3235194cadb02b4b32766effbf214cd3bd62e38b2946ce0

    SHA512

    1da045945ed6db620e3a04b3e9e05e537f04b70574ad538b02cafd563cf47bf70444ed8517a39eb25b25dedde3c77de9a5462bc21667c239728ac565aaae2f78

  • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un777065.exe

    Filesize

    593KB

    MD5

    e917f1d5245cbe7b6a95282f4013f7b7

    SHA1

    c5de960d37e2a9c6426eef72ef0484a210a9fb20

    SHA256

    ae58d6a2cac88313c3235194cadb02b4b32766effbf214cd3bd62e38b2946ce0

    SHA512

    1da045945ed6db620e3a04b3e9e05e537f04b70574ad538b02cafd563cf47bf70444ed8517a39eb25b25dedde3c77de9a5462bc21667c239728ac565aaae2f78

  • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\25594768.exe

    Filesize

    377KB

    MD5

    f3e2f9f6609858f2b4ae4cd9015b71b9

    SHA1

    55e237e3b1163ae83260c71e625ca49e43d6f308

    SHA256

    01c15148cb46f0bcd6a9cfe5877fcfecc198707e79c1a897da81e5c194ca7284

    SHA512

    4d31ed5d147c94bab7963c71d45293dda8cb2df9a01db68815aea1b0e5c6804b057ebe4ea4562570538ad7ea87b3f73f7e115289291ac45b0c9a7f9b33f2a264

  • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\25594768.exe

    Filesize

    377KB

    MD5

    f3e2f9f6609858f2b4ae4cd9015b71b9

    SHA1

    55e237e3b1163ae83260c71e625ca49e43d6f308

    SHA256

    01c15148cb46f0bcd6a9cfe5877fcfecc198707e79c1a897da81e5c194ca7284

    SHA512

    4d31ed5d147c94bab7963c71d45293dda8cb2df9a01db68815aea1b0e5c6804b057ebe4ea4562570538ad7ea87b3f73f7e115289291ac45b0c9a7f9b33f2a264

  • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\25594768.exe

    Filesize

    377KB

    MD5

    f3e2f9f6609858f2b4ae4cd9015b71b9

    SHA1

    55e237e3b1163ae83260c71e625ca49e43d6f308

    SHA256

    01c15148cb46f0bcd6a9cfe5877fcfecc198707e79c1a897da81e5c194ca7284

    SHA512

    4d31ed5d147c94bab7963c71d45293dda8cb2df9a01db68815aea1b0e5c6804b057ebe4ea4562570538ad7ea87b3f73f7e115289291ac45b0c9a7f9b33f2a264

  • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\rk938003.exe

    Filesize

    459KB

    MD5

    960416951edc7cfa6a71a8763f926896

    SHA1

    a7932f375439309f2a7b4a2c6062b82a3a398dc1

    SHA256

    7c694c156db07b95ef4b411ca609b82a8bc9af4a02b5d32750fa67bb637c5daa

    SHA512

    f6cca0bb0111846120464af223774269a27e2e24019d95d0261302066b51910776cd2d28b05b0096a5348cb2f46182b79750c386b35dd3ff52f3c1af77119976

  • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\rk938003.exe

    Filesize

    459KB

    MD5

    960416951edc7cfa6a71a8763f926896

    SHA1

    a7932f375439309f2a7b4a2c6062b82a3a398dc1

    SHA256

    7c694c156db07b95ef4b411ca609b82a8bc9af4a02b5d32750fa67bb637c5daa

    SHA512

    f6cca0bb0111846120464af223774269a27e2e24019d95d0261302066b51910776cd2d28b05b0096a5348cb2f46182b79750c386b35dd3ff52f3c1af77119976

  • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\rk938003.exe

    Filesize

    459KB

    MD5

    960416951edc7cfa6a71a8763f926896

    SHA1

    a7932f375439309f2a7b4a2c6062b82a3a398dc1

    SHA256

    7c694c156db07b95ef4b411ca609b82a8bc9af4a02b5d32750fa67bb637c5daa

    SHA512

    f6cca0bb0111846120464af223774269a27e2e24019d95d0261302066b51910776cd2d28b05b0096a5348cb2f46182b79750c386b35dd3ff52f3c1af77119976

  • \Users\Admin\AppData\Local\Temp\IXP000.TMP\un777065.exe

    Filesize

    593KB

    MD5

    e917f1d5245cbe7b6a95282f4013f7b7

    SHA1

    c5de960d37e2a9c6426eef72ef0484a210a9fb20

    SHA256

    ae58d6a2cac88313c3235194cadb02b4b32766effbf214cd3bd62e38b2946ce0

    SHA512

    1da045945ed6db620e3a04b3e9e05e537f04b70574ad538b02cafd563cf47bf70444ed8517a39eb25b25dedde3c77de9a5462bc21667c239728ac565aaae2f78

  • \Users\Admin\AppData\Local\Temp\IXP000.TMP\un777065.exe

    Filesize

    593KB

    MD5

    e917f1d5245cbe7b6a95282f4013f7b7

    SHA1

    c5de960d37e2a9c6426eef72ef0484a210a9fb20

    SHA256

    ae58d6a2cac88313c3235194cadb02b4b32766effbf214cd3bd62e38b2946ce0

    SHA512

    1da045945ed6db620e3a04b3e9e05e537f04b70574ad538b02cafd563cf47bf70444ed8517a39eb25b25dedde3c77de9a5462bc21667c239728ac565aaae2f78

  • \Users\Admin\AppData\Local\Temp\IXP001.TMP\25594768.exe

    Filesize

    377KB

    MD5

    f3e2f9f6609858f2b4ae4cd9015b71b9

    SHA1

    55e237e3b1163ae83260c71e625ca49e43d6f308

    SHA256

    01c15148cb46f0bcd6a9cfe5877fcfecc198707e79c1a897da81e5c194ca7284

    SHA512

    4d31ed5d147c94bab7963c71d45293dda8cb2df9a01db68815aea1b0e5c6804b057ebe4ea4562570538ad7ea87b3f73f7e115289291ac45b0c9a7f9b33f2a264

  • \Users\Admin\AppData\Local\Temp\IXP001.TMP\25594768.exe

    Filesize

    377KB

    MD5

    f3e2f9f6609858f2b4ae4cd9015b71b9

    SHA1

    55e237e3b1163ae83260c71e625ca49e43d6f308

    SHA256

    01c15148cb46f0bcd6a9cfe5877fcfecc198707e79c1a897da81e5c194ca7284

    SHA512

    4d31ed5d147c94bab7963c71d45293dda8cb2df9a01db68815aea1b0e5c6804b057ebe4ea4562570538ad7ea87b3f73f7e115289291ac45b0c9a7f9b33f2a264

  • \Users\Admin\AppData\Local\Temp\IXP001.TMP\25594768.exe

    Filesize

    377KB

    MD5

    f3e2f9f6609858f2b4ae4cd9015b71b9

    SHA1

    55e237e3b1163ae83260c71e625ca49e43d6f308

    SHA256

    01c15148cb46f0bcd6a9cfe5877fcfecc198707e79c1a897da81e5c194ca7284

    SHA512

    4d31ed5d147c94bab7963c71d45293dda8cb2df9a01db68815aea1b0e5c6804b057ebe4ea4562570538ad7ea87b3f73f7e115289291ac45b0c9a7f9b33f2a264

  • \Users\Admin\AppData\Local\Temp\IXP001.TMP\rk938003.exe

    Filesize

    459KB

    MD5

    960416951edc7cfa6a71a8763f926896

    SHA1

    a7932f375439309f2a7b4a2c6062b82a3a398dc1

    SHA256

    7c694c156db07b95ef4b411ca609b82a8bc9af4a02b5d32750fa67bb637c5daa

    SHA512

    f6cca0bb0111846120464af223774269a27e2e24019d95d0261302066b51910776cd2d28b05b0096a5348cb2f46182b79750c386b35dd3ff52f3c1af77119976

  • \Users\Admin\AppData\Local\Temp\IXP001.TMP\rk938003.exe

    Filesize

    459KB

    MD5

    960416951edc7cfa6a71a8763f926896

    SHA1

    a7932f375439309f2a7b4a2c6062b82a3a398dc1

    SHA256

    7c694c156db07b95ef4b411ca609b82a8bc9af4a02b5d32750fa67bb637c5daa

    SHA512

    f6cca0bb0111846120464af223774269a27e2e24019d95d0261302066b51910776cd2d28b05b0096a5348cb2f46182b79750c386b35dd3ff52f3c1af77119976

  • \Users\Admin\AppData\Local\Temp\IXP001.TMP\rk938003.exe

    Filesize

    459KB

    MD5

    960416951edc7cfa6a71a8763f926896

    SHA1

    a7932f375439309f2a7b4a2c6062b82a3a398dc1

    SHA256

    7c694c156db07b95ef4b411ca609b82a8bc9af4a02b5d32750fa67bb637c5daa

    SHA512

    f6cca0bb0111846120464af223774269a27e2e24019d95d0261302066b51910776cd2d28b05b0096a5348cb2f46182b79750c386b35dd3ff52f3c1af77119976

  • memory/1324-106-0x0000000000F40000-0x0000000000F52000-memory.dmp

    Filesize

    72KB

  • memory/1324-90-0x0000000000F40000-0x0000000000F52000-memory.dmp

    Filesize

    72KB

  • memory/1324-88-0x0000000000F40000-0x0000000000F52000-memory.dmp

    Filesize

    72KB

  • memory/1324-87-0x0000000000F40000-0x0000000000F52000-memory.dmp

    Filesize

    72KB

  • memory/1324-92-0x0000000000F40000-0x0000000000F52000-memory.dmp

    Filesize

    72KB

  • memory/1324-94-0x0000000000F40000-0x0000000000F52000-memory.dmp

    Filesize

    72KB

  • memory/1324-96-0x0000000000F40000-0x0000000000F52000-memory.dmp

    Filesize

    72KB

  • memory/1324-98-0x0000000000F40000-0x0000000000F52000-memory.dmp

    Filesize

    72KB

  • memory/1324-100-0x0000000000F40000-0x0000000000F52000-memory.dmp

    Filesize

    72KB

  • memory/1324-102-0x0000000000F40000-0x0000000000F52000-memory.dmp

    Filesize

    72KB

  • memory/1324-108-0x0000000000F40000-0x0000000000F52000-memory.dmp

    Filesize

    72KB

  • memory/1324-114-0x0000000000F40000-0x0000000000F52000-memory.dmp

    Filesize

    72KB

  • memory/1324-112-0x0000000000F40000-0x0000000000F52000-memory.dmp

    Filesize

    72KB

  • memory/1324-110-0x0000000000F40000-0x0000000000F52000-memory.dmp

    Filesize

    72KB

  • memory/1324-86-0x0000000000F40000-0x0000000000F58000-memory.dmp

    Filesize

    96KB

  • memory/1324-104-0x0000000000F40000-0x0000000000F52000-memory.dmp

    Filesize

    72KB

  • memory/1324-117-0x0000000000400000-0x0000000000803000-memory.dmp

    Filesize

    4.0MB

  • memory/1324-83-0x0000000004E50000-0x0000000004E90000-memory.dmp

    Filesize

    256KB

  • memory/1324-82-0x0000000000400000-0x0000000000803000-memory.dmp

    Filesize

    4.0MB

  • memory/1324-80-0x0000000004E50000-0x0000000004E90000-memory.dmp

    Filesize

    256KB

  • memory/1324-81-0x0000000004E50000-0x0000000004E90000-memory.dmp

    Filesize

    256KB

  • memory/1324-79-0x0000000000240000-0x000000000026D000-memory.dmp

    Filesize

    180KB

  • memory/1324-78-0x0000000000ED0000-0x0000000000EEA000-memory.dmp

    Filesize

    104KB

  • memory/1944-128-0x0000000002330000-0x000000000236C000-memory.dmp

    Filesize

    240KB

  • memory/1944-129-0x00000000025B0000-0x00000000025EA000-memory.dmp

    Filesize

    232KB

  • memory/1944-130-0x0000000000340000-0x0000000000386000-memory.dmp

    Filesize

    280KB

  • memory/1944-131-0x0000000004E10000-0x0000000004E50000-memory.dmp

    Filesize

    256KB

  • memory/1944-132-0x0000000004E10000-0x0000000004E50000-memory.dmp

    Filesize

    256KB

  • memory/1944-133-0x00000000025B0000-0x00000000025E5000-memory.dmp

    Filesize

    212KB

  • memory/1944-134-0x00000000025B0000-0x00000000025E5000-memory.dmp

    Filesize

    212KB

  • memory/1944-136-0x00000000025B0000-0x00000000025E5000-memory.dmp

    Filesize

    212KB

  • memory/1944-138-0x00000000025B0000-0x00000000025E5000-memory.dmp

    Filesize

    212KB

  • memory/1944-140-0x00000000025B0000-0x00000000025E5000-memory.dmp

    Filesize

    212KB

  • memory/1944-142-0x00000000025B0000-0x00000000025E5000-memory.dmp

    Filesize

    212KB

  • memory/1944-144-0x00000000025B0000-0x00000000025E5000-memory.dmp

    Filesize

    212KB

  • memory/1944-146-0x00000000025B0000-0x00000000025E5000-memory.dmp

    Filesize

    212KB

  • memory/1944-148-0x00000000025B0000-0x00000000025E5000-memory.dmp

    Filesize

    212KB

  • memory/1944-150-0x00000000025B0000-0x00000000025E5000-memory.dmp

    Filesize

    212KB

  • memory/1944-152-0x00000000025B0000-0x00000000025E5000-memory.dmp

    Filesize

    212KB

  • memory/1944-154-0x00000000025B0000-0x00000000025E5000-memory.dmp

    Filesize

    212KB

  • memory/1944-156-0x00000000025B0000-0x00000000025E5000-memory.dmp

    Filesize

    212KB

  • memory/1944-158-0x00000000025B0000-0x00000000025E5000-memory.dmp

    Filesize

    212KB

  • memory/1944-160-0x00000000025B0000-0x00000000025E5000-memory.dmp

    Filesize

    212KB

  • memory/1944-162-0x00000000025B0000-0x00000000025E5000-memory.dmp

    Filesize

    212KB

  • memory/1944-927-0x0000000004E10000-0x0000000004E50000-memory.dmp

    Filesize

    256KB

  • memory/1944-930-0x0000000004E10000-0x0000000004E50000-memory.dmp

    Filesize

    256KB