Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    149s
  • max time network
    166s
  • platform
    windows7_x64
  • resource
    win7-20230220-en
  • resource tags

    arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
  • submitted
    05/05/2023, 19:25

General

  • Target

    c1632a93dc892ed28ae8861398f25db3b117c843864581eeba25ef29267cee09.exe

  • Size

    695KB

  • MD5

    2b33a0ff9afe21bba8070386738dd9a1

  • SHA1

    36853c50dc3d9498f2c989f12d11688555e72b29

  • SHA256

    c1632a93dc892ed28ae8861398f25db3b117c843864581eeba25ef29267cee09

  • SHA512

    f3bd20a5bef7984eb95475ceab8c74b4e721026e22cdb5dc93db62c102c4edccafa61bb9fdf22ed97f6d8cc8d24c50bfe8e3f9ac82ff0a70fb191a0be34a1056

  • SSDEEP

    12288:ey90tiWyrr2PoTl/Y7TfZdkpD1K4M0QNi8/4PTZdoXfwQ1yiZUDZf7Wg:eyYyPRyfZ2w0Q9QPTzovwQOgg

Malware Config

Signatures

  • Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs
  • Executes dropped EXE 3 IoCs
  • Loads dropped DLL 8 IoCs
  • Windows security modification 2 TTPs 2 IoCs
  • Adds Run key to start application 2 TTPs 4 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 21 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\c1632a93dc892ed28ae8861398f25db3b117c843864581eeba25ef29267cee09.exe
    "C:\Users\Admin\AppData\Local\Temp\c1632a93dc892ed28ae8861398f25db3b117c843864581eeba25ef29267cee09.exe"
    1⤵
    • Loads dropped DLL
    • Adds Run key to start application
    • Suspicious use of WriteProcessMemory
    PID:1964
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un299961.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un299961.exe
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Adds Run key to start application
      • Suspicious use of WriteProcessMemory
      PID:1956
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\19985000.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\19985000.exe
        3⤵
        • Modifies Windows Defender Real-time Protection settings
        • Executes dropped EXE
        • Loads dropped DLL
        • Windows security modification
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:1208
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\rk880250.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\rk880250.exe
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Suspicious use of AdjustPrivilegeToken
        PID:1392

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un299961.exe

    Filesize

    541KB

    MD5

    e8bebe50132975fa77d11fabcc4f4526

    SHA1

    45f227db2669134d18368a39ad6e0892c17a90f7

    SHA256

    6672ae09ef0ab01d41161d9d792caab248271f5d29c917eb6b28ae31f6c75bbc

    SHA512

    051279fc1b54bf7c92c00b6b9fea259ea16fbf0711b2c37ae13044cbca2dfa0c35a997b0ef344060ef4d6918855f2e663eba43f2d44930351b2a7a02f1c640c7

  • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un299961.exe

    Filesize

    541KB

    MD5

    e8bebe50132975fa77d11fabcc4f4526

    SHA1

    45f227db2669134d18368a39ad6e0892c17a90f7

    SHA256

    6672ae09ef0ab01d41161d9d792caab248271f5d29c917eb6b28ae31f6c75bbc

    SHA512

    051279fc1b54bf7c92c00b6b9fea259ea16fbf0711b2c37ae13044cbca2dfa0c35a997b0ef344060ef4d6918855f2e663eba43f2d44930351b2a7a02f1c640c7

  • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\19985000.exe

    Filesize

    258KB

    MD5

    0456d29cd856a216de10ea210144af2d

    SHA1

    a6f4933df5d1845ff198ea1e031960d8f37baf22

    SHA256

    78cb54a66a0ad873b22677c5ccfeee4a503da0a8a0fc516d96104ac1de3e027d

    SHA512

    af526de445cc261c74146839212010cb4ffa0eb5a6dac2d6f0b1c633b217304a557c2c1aac3cf1948e00c9e5345b08051c0f65eb57cd7bea471e6d2a31fb4677

  • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\19985000.exe

    Filesize

    258KB

    MD5

    0456d29cd856a216de10ea210144af2d

    SHA1

    a6f4933df5d1845ff198ea1e031960d8f37baf22

    SHA256

    78cb54a66a0ad873b22677c5ccfeee4a503da0a8a0fc516d96104ac1de3e027d

    SHA512

    af526de445cc261c74146839212010cb4ffa0eb5a6dac2d6f0b1c633b217304a557c2c1aac3cf1948e00c9e5345b08051c0f65eb57cd7bea471e6d2a31fb4677

  • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\19985000.exe

    Filesize

    258KB

    MD5

    0456d29cd856a216de10ea210144af2d

    SHA1

    a6f4933df5d1845ff198ea1e031960d8f37baf22

    SHA256

    78cb54a66a0ad873b22677c5ccfeee4a503da0a8a0fc516d96104ac1de3e027d

    SHA512

    af526de445cc261c74146839212010cb4ffa0eb5a6dac2d6f0b1c633b217304a557c2c1aac3cf1948e00c9e5345b08051c0f65eb57cd7bea471e6d2a31fb4677

  • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\rk880250.exe

    Filesize

    340KB

    MD5

    798cf522a76e389588fa71cb8d5e0c46

    SHA1

    e221cf88d35b49f6c57a359a239857114289e0f7

    SHA256

    f7e30143393a333d44f09efe1d6c0d224ff8f4b5efedbec30e435901ad39cb9b

    SHA512

    ae000d0bd6b55ad8a1d4e2807c98b9ecfa9da85e6152ef9f57fdce6f77fe1bb525d2a8a1865ab8ee0b76f1f229896d2d00f04ec07ba52d0b90c43374284b4606

  • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\rk880250.exe

    Filesize

    340KB

    MD5

    798cf522a76e389588fa71cb8d5e0c46

    SHA1

    e221cf88d35b49f6c57a359a239857114289e0f7

    SHA256

    f7e30143393a333d44f09efe1d6c0d224ff8f4b5efedbec30e435901ad39cb9b

    SHA512

    ae000d0bd6b55ad8a1d4e2807c98b9ecfa9da85e6152ef9f57fdce6f77fe1bb525d2a8a1865ab8ee0b76f1f229896d2d00f04ec07ba52d0b90c43374284b4606

  • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\rk880250.exe

    Filesize

    340KB

    MD5

    798cf522a76e389588fa71cb8d5e0c46

    SHA1

    e221cf88d35b49f6c57a359a239857114289e0f7

    SHA256

    f7e30143393a333d44f09efe1d6c0d224ff8f4b5efedbec30e435901ad39cb9b

    SHA512

    ae000d0bd6b55ad8a1d4e2807c98b9ecfa9da85e6152ef9f57fdce6f77fe1bb525d2a8a1865ab8ee0b76f1f229896d2d00f04ec07ba52d0b90c43374284b4606

  • \Users\Admin\AppData\Local\Temp\IXP000.TMP\un299961.exe

    Filesize

    541KB

    MD5

    e8bebe50132975fa77d11fabcc4f4526

    SHA1

    45f227db2669134d18368a39ad6e0892c17a90f7

    SHA256

    6672ae09ef0ab01d41161d9d792caab248271f5d29c917eb6b28ae31f6c75bbc

    SHA512

    051279fc1b54bf7c92c00b6b9fea259ea16fbf0711b2c37ae13044cbca2dfa0c35a997b0ef344060ef4d6918855f2e663eba43f2d44930351b2a7a02f1c640c7

  • \Users\Admin\AppData\Local\Temp\IXP000.TMP\un299961.exe

    Filesize

    541KB

    MD5

    e8bebe50132975fa77d11fabcc4f4526

    SHA1

    45f227db2669134d18368a39ad6e0892c17a90f7

    SHA256

    6672ae09ef0ab01d41161d9d792caab248271f5d29c917eb6b28ae31f6c75bbc

    SHA512

    051279fc1b54bf7c92c00b6b9fea259ea16fbf0711b2c37ae13044cbca2dfa0c35a997b0ef344060ef4d6918855f2e663eba43f2d44930351b2a7a02f1c640c7

  • \Users\Admin\AppData\Local\Temp\IXP001.TMP\19985000.exe

    Filesize

    258KB

    MD5

    0456d29cd856a216de10ea210144af2d

    SHA1

    a6f4933df5d1845ff198ea1e031960d8f37baf22

    SHA256

    78cb54a66a0ad873b22677c5ccfeee4a503da0a8a0fc516d96104ac1de3e027d

    SHA512

    af526de445cc261c74146839212010cb4ffa0eb5a6dac2d6f0b1c633b217304a557c2c1aac3cf1948e00c9e5345b08051c0f65eb57cd7bea471e6d2a31fb4677

  • \Users\Admin\AppData\Local\Temp\IXP001.TMP\19985000.exe

    Filesize

    258KB

    MD5

    0456d29cd856a216de10ea210144af2d

    SHA1

    a6f4933df5d1845ff198ea1e031960d8f37baf22

    SHA256

    78cb54a66a0ad873b22677c5ccfeee4a503da0a8a0fc516d96104ac1de3e027d

    SHA512

    af526de445cc261c74146839212010cb4ffa0eb5a6dac2d6f0b1c633b217304a557c2c1aac3cf1948e00c9e5345b08051c0f65eb57cd7bea471e6d2a31fb4677

  • \Users\Admin\AppData\Local\Temp\IXP001.TMP\19985000.exe

    Filesize

    258KB

    MD5

    0456d29cd856a216de10ea210144af2d

    SHA1

    a6f4933df5d1845ff198ea1e031960d8f37baf22

    SHA256

    78cb54a66a0ad873b22677c5ccfeee4a503da0a8a0fc516d96104ac1de3e027d

    SHA512

    af526de445cc261c74146839212010cb4ffa0eb5a6dac2d6f0b1c633b217304a557c2c1aac3cf1948e00c9e5345b08051c0f65eb57cd7bea471e6d2a31fb4677

  • \Users\Admin\AppData\Local\Temp\IXP001.TMP\rk880250.exe

    Filesize

    340KB

    MD5

    798cf522a76e389588fa71cb8d5e0c46

    SHA1

    e221cf88d35b49f6c57a359a239857114289e0f7

    SHA256

    f7e30143393a333d44f09efe1d6c0d224ff8f4b5efedbec30e435901ad39cb9b

    SHA512

    ae000d0bd6b55ad8a1d4e2807c98b9ecfa9da85e6152ef9f57fdce6f77fe1bb525d2a8a1865ab8ee0b76f1f229896d2d00f04ec07ba52d0b90c43374284b4606

  • \Users\Admin\AppData\Local\Temp\IXP001.TMP\rk880250.exe

    Filesize

    340KB

    MD5

    798cf522a76e389588fa71cb8d5e0c46

    SHA1

    e221cf88d35b49f6c57a359a239857114289e0f7

    SHA256

    f7e30143393a333d44f09efe1d6c0d224ff8f4b5efedbec30e435901ad39cb9b

    SHA512

    ae000d0bd6b55ad8a1d4e2807c98b9ecfa9da85e6152ef9f57fdce6f77fe1bb525d2a8a1865ab8ee0b76f1f229896d2d00f04ec07ba52d0b90c43374284b4606

  • \Users\Admin\AppData\Local\Temp\IXP001.TMP\rk880250.exe

    Filesize

    340KB

    MD5

    798cf522a76e389588fa71cb8d5e0c46

    SHA1

    e221cf88d35b49f6c57a359a239857114289e0f7

    SHA256

    f7e30143393a333d44f09efe1d6c0d224ff8f4b5efedbec30e435901ad39cb9b

    SHA512

    ae000d0bd6b55ad8a1d4e2807c98b9ecfa9da85e6152ef9f57fdce6f77fe1bb525d2a8a1865ab8ee0b76f1f229896d2d00f04ec07ba52d0b90c43374284b4606

  • memory/1208-93-0x0000000002FD0000-0x0000000002FE3000-memory.dmp

    Filesize

    76KB

  • memory/1208-89-0x0000000000250000-0x000000000027D000-memory.dmp

    Filesize

    180KB

  • memory/1208-87-0x0000000002FD0000-0x0000000002FE3000-memory.dmp

    Filesize

    76KB

  • memory/1208-90-0x0000000003300000-0x0000000003340000-memory.dmp

    Filesize

    256KB

  • memory/1208-95-0x0000000002FD0000-0x0000000002FE3000-memory.dmp

    Filesize

    76KB

  • memory/1208-107-0x0000000002FD0000-0x0000000002FE3000-memory.dmp

    Filesize

    76KB

  • memory/1208-109-0x0000000002FD0000-0x0000000002FE3000-memory.dmp

    Filesize

    76KB

  • memory/1208-105-0x0000000002FD0000-0x0000000002FE3000-memory.dmp

    Filesize

    76KB

  • memory/1208-103-0x0000000002FD0000-0x0000000002FE3000-memory.dmp

    Filesize

    76KB

  • memory/1208-101-0x0000000002FD0000-0x0000000002FE3000-memory.dmp

    Filesize

    76KB

  • memory/1208-99-0x0000000002FD0000-0x0000000002FE3000-memory.dmp

    Filesize

    76KB

  • memory/1208-97-0x0000000002FD0000-0x0000000002FE3000-memory.dmp

    Filesize

    76KB

  • memory/1208-85-0x0000000002FD0000-0x0000000002FE3000-memory.dmp

    Filesize

    76KB

  • memory/1208-91-0x0000000002FD0000-0x0000000002FE3000-memory.dmp

    Filesize

    76KB

  • memory/1208-110-0x0000000000400000-0x0000000002B9B000-memory.dmp

    Filesize

    39.6MB

  • memory/1208-83-0x0000000002FD0000-0x0000000002FE3000-memory.dmp

    Filesize

    76KB

  • memory/1208-81-0x0000000002FD0000-0x0000000002FE3000-memory.dmp

    Filesize

    76KB

  • memory/1208-80-0x0000000002FD0000-0x0000000002FE3000-memory.dmp

    Filesize

    76KB

  • memory/1208-79-0x0000000002FD0000-0x0000000002FE8000-memory.dmp

    Filesize

    96KB

  • memory/1208-78-0x00000000003E0000-0x00000000003FA000-memory.dmp

    Filesize

    104KB

  • memory/1208-112-0x0000000000400000-0x0000000002B9B000-memory.dmp

    Filesize

    39.6MB

  • memory/1392-123-0x0000000002E30000-0x0000000002E6C000-memory.dmp

    Filesize

    240KB

  • memory/1392-124-0x00000000032B0000-0x00000000032EA000-memory.dmp

    Filesize

    232KB

  • memory/1392-125-0x00000000032B0000-0x00000000032E5000-memory.dmp

    Filesize

    212KB

  • memory/1392-126-0x00000000032B0000-0x00000000032E5000-memory.dmp

    Filesize

    212KB

  • memory/1392-128-0x00000000032B0000-0x00000000032E5000-memory.dmp

    Filesize

    212KB

  • memory/1392-130-0x00000000032B0000-0x00000000032E5000-memory.dmp

    Filesize

    212KB

  • memory/1392-132-0x00000000032B0000-0x00000000032E5000-memory.dmp

    Filesize

    212KB

  • memory/1392-134-0x00000000032B0000-0x00000000032E5000-memory.dmp

    Filesize

    212KB

  • memory/1392-136-0x00000000032B0000-0x00000000032E5000-memory.dmp

    Filesize

    212KB

  • memory/1392-138-0x00000000032B0000-0x00000000032E5000-memory.dmp

    Filesize

    212KB

  • memory/1392-140-0x00000000032B0000-0x00000000032E5000-memory.dmp

    Filesize

    212KB

  • memory/1392-142-0x00000000032B0000-0x00000000032E5000-memory.dmp

    Filesize

    212KB

  • memory/1392-144-0x00000000032B0000-0x00000000032E5000-memory.dmp

    Filesize

    212KB

  • memory/1392-146-0x00000000032B0000-0x00000000032E5000-memory.dmp

    Filesize

    212KB

  • memory/1392-148-0x00000000032B0000-0x00000000032E5000-memory.dmp

    Filesize

    212KB

  • memory/1392-150-0x00000000032B0000-0x00000000032E5000-memory.dmp

    Filesize

    212KB

  • memory/1392-152-0x00000000032B0000-0x00000000032E5000-memory.dmp

    Filesize

    212KB

  • memory/1392-154-0x00000000032B0000-0x00000000032E5000-memory.dmp

    Filesize

    212KB

  • memory/1392-156-0x00000000032B0000-0x00000000032E5000-memory.dmp

    Filesize

    212KB

  • memory/1392-795-0x00000000002E0000-0x0000000000326000-memory.dmp

    Filesize

    280KB

  • memory/1392-797-0x0000000004E70000-0x0000000004EB0000-memory.dmp

    Filesize

    256KB

  • memory/1392-919-0x0000000004E70000-0x0000000004EB0000-memory.dmp

    Filesize

    256KB