Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
145s -
max time network
157s -
platform
windows7_x64 -
resource
win7-20230220-en -
resource tags
arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system -
submitted
05/05/2023, 19:25
Static task
static1
Behavioral task
behavioral1
Sample
c19a69cf76117d64b6a17d16fe5be6f59e19154bf577aec3037fd6ddf0ccd78b.exe
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
c19a69cf76117d64b6a17d16fe5be6f59e19154bf577aec3037fd6ddf0ccd78b.exe
Resource
win10v2004-20230220-en
General
-
Target
c19a69cf76117d64b6a17d16fe5be6f59e19154bf577aec3037fd6ddf0ccd78b.exe
-
Size
691KB
-
MD5
14323b95a1c2c784f36f833c811ceea1
-
SHA1
7e8e378645bb44620ee875c5214bdfd0267c74cd
-
SHA256
c19a69cf76117d64b6a17d16fe5be6f59e19154bf577aec3037fd6ddf0ccd78b
-
SHA512
35fd892795fb1674a66191d0f9d1728bb0766587921bfd77c8413b187a130cebe9a92690f75d7631daa2f10862cf86ebb3b372aa66c885acd57424d65a3c01a1
-
SSDEEP
12288:sy90HNE/SkBw74Ps8VuwdAPZRHrrQ0vPQ2+m1Of/46twd22u:syyNu24Ps8V1+L5I2+gOH4Iwd/u
Malware Config
Signatures
-
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" 96715942.exe Key created \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection 96715942.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" 96715942.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" 96715942.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" 96715942.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" 96715942.exe -
Executes dropped EXE 4 IoCs
pid Process 924 un731868.exe 832 96715942.exe 1484 96715942.exe 464 rk028513.exe -
Loads dropped DLL 10 IoCs
pid Process 2036 c19a69cf76117d64b6a17d16fe5be6f59e19154bf577aec3037fd6ddf0ccd78b.exe 924 un731868.exe 924 un731868.exe 924 un731868.exe 832 96715942.exe 832 96715942.exe 1484 96715942.exe 924 un731868.exe 924 un731868.exe 464 rk028513.exe -
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Features 96715942.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0" 96715942.exe -
Adds Run key to start application 2 TTPs 4 IoCs
description ioc Process Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce c19a69cf76117d64b6a17d16fe5be6f59e19154bf577aec3037fd6ddf0ccd78b.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" c19a69cf76117d64b6a17d16fe5be6f59e19154bf577aec3037fd6ddf0ccd78b.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce un731868.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" un731868.exe -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 832 set thread context of 1484 832 96715942.exe 30 -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 1484 96715942.exe 1484 96715942.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 1484 96715942.exe Token: SeDebugPrivilege 464 rk028513.exe -
Suspicious use of WriteProcessMemory 34 IoCs
description pid Process procid_target PID 2036 wrote to memory of 924 2036 c19a69cf76117d64b6a17d16fe5be6f59e19154bf577aec3037fd6ddf0ccd78b.exe 28 PID 2036 wrote to memory of 924 2036 c19a69cf76117d64b6a17d16fe5be6f59e19154bf577aec3037fd6ddf0ccd78b.exe 28 PID 2036 wrote to memory of 924 2036 c19a69cf76117d64b6a17d16fe5be6f59e19154bf577aec3037fd6ddf0ccd78b.exe 28 PID 2036 wrote to memory of 924 2036 c19a69cf76117d64b6a17d16fe5be6f59e19154bf577aec3037fd6ddf0ccd78b.exe 28 PID 2036 wrote to memory of 924 2036 c19a69cf76117d64b6a17d16fe5be6f59e19154bf577aec3037fd6ddf0ccd78b.exe 28 PID 2036 wrote to memory of 924 2036 c19a69cf76117d64b6a17d16fe5be6f59e19154bf577aec3037fd6ddf0ccd78b.exe 28 PID 2036 wrote to memory of 924 2036 c19a69cf76117d64b6a17d16fe5be6f59e19154bf577aec3037fd6ddf0ccd78b.exe 28 PID 924 wrote to memory of 832 924 un731868.exe 29 PID 924 wrote to memory of 832 924 un731868.exe 29 PID 924 wrote to memory of 832 924 un731868.exe 29 PID 924 wrote to memory of 832 924 un731868.exe 29 PID 924 wrote to memory of 832 924 un731868.exe 29 PID 924 wrote to memory of 832 924 un731868.exe 29 PID 924 wrote to memory of 832 924 un731868.exe 29 PID 832 wrote to memory of 1484 832 96715942.exe 30 PID 832 wrote to memory of 1484 832 96715942.exe 30 PID 832 wrote to memory of 1484 832 96715942.exe 30 PID 832 wrote to memory of 1484 832 96715942.exe 30 PID 832 wrote to memory of 1484 832 96715942.exe 30 PID 832 wrote to memory of 1484 832 96715942.exe 30 PID 832 wrote to memory of 1484 832 96715942.exe 30 PID 832 wrote to memory of 1484 832 96715942.exe 30 PID 832 wrote to memory of 1484 832 96715942.exe 30 PID 832 wrote to memory of 1484 832 96715942.exe 30 PID 832 wrote to memory of 1484 832 96715942.exe 30 PID 832 wrote to memory of 1484 832 96715942.exe 30 PID 832 wrote to memory of 1484 832 96715942.exe 30 PID 924 wrote to memory of 464 924 un731868.exe 31 PID 924 wrote to memory of 464 924 un731868.exe 31 PID 924 wrote to memory of 464 924 un731868.exe 31 PID 924 wrote to memory of 464 924 un731868.exe 31 PID 924 wrote to memory of 464 924 un731868.exe 31 PID 924 wrote to memory of 464 924 un731868.exe 31 PID 924 wrote to memory of 464 924 un731868.exe 31
Processes
-
C:\Users\Admin\AppData\Local\Temp\c19a69cf76117d64b6a17d16fe5be6f59e19154bf577aec3037fd6ddf0ccd78b.exe"C:\Users\Admin\AppData\Local\Temp\c19a69cf76117d64b6a17d16fe5be6f59e19154bf577aec3037fd6ddf0ccd78b.exe"1⤵
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:2036 -
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un731868.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un731868.exe2⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:924 -
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\96715942.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\96715942.exe3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:832 -
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\96715942.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\96715942.exe4⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Loads dropped DLL
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1484
-
-
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\rk028513.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\rk028513.exe3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
PID:464
-
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
536KB
MD58d7151b7987e84c4ff650608c2331179
SHA1bf5e510285f7f374fab00d96b5ace05119fab1bc
SHA2567c351767f3ac837f9b6349826604450e59f5ccac3bf841a0137572a5cc8198d5
SHA512f390d41bd4e70e3ad344daf58d5e3687fa2eb1ab0959c9511798d7d2c34d3d0b9bf18bb50b8d6677ece7335439641f61850f36448027440909e39a30241f24fd
-
Filesize
536KB
MD58d7151b7987e84c4ff650608c2331179
SHA1bf5e510285f7f374fab00d96b5ace05119fab1bc
SHA2567c351767f3ac837f9b6349826604450e59f5ccac3bf841a0137572a5cc8198d5
SHA512f390d41bd4e70e3ad344daf58d5e3687fa2eb1ab0959c9511798d7d2c34d3d0b9bf18bb50b8d6677ece7335439641f61850f36448027440909e39a30241f24fd
-
Filesize
259KB
MD5a874c986f4befc7997c0be41e738ee4e
SHA1736dbf14102b3955cec6b0df6d58e9f051ddfea4
SHA25603b88f25d34568f1cb49a1ddc4a2fe2a062b7ea34e13f0e598ff0b31fa5e106a
SHA512e8510424a4ff7bf9065b761f444dabb191896134024808ef4949c9bb42e2957ce2ef7a251e7421f48db159eb95c065a32ac14339580f52344452c9f7a8d6b73a
-
Filesize
259KB
MD5a874c986f4befc7997c0be41e738ee4e
SHA1736dbf14102b3955cec6b0df6d58e9f051ddfea4
SHA25603b88f25d34568f1cb49a1ddc4a2fe2a062b7ea34e13f0e598ff0b31fa5e106a
SHA512e8510424a4ff7bf9065b761f444dabb191896134024808ef4949c9bb42e2957ce2ef7a251e7421f48db159eb95c065a32ac14339580f52344452c9f7a8d6b73a
-
Filesize
259KB
MD5a874c986f4befc7997c0be41e738ee4e
SHA1736dbf14102b3955cec6b0df6d58e9f051ddfea4
SHA25603b88f25d34568f1cb49a1ddc4a2fe2a062b7ea34e13f0e598ff0b31fa5e106a
SHA512e8510424a4ff7bf9065b761f444dabb191896134024808ef4949c9bb42e2957ce2ef7a251e7421f48db159eb95c065a32ac14339580f52344452c9f7a8d6b73a
-
Filesize
259KB
MD5a874c986f4befc7997c0be41e738ee4e
SHA1736dbf14102b3955cec6b0df6d58e9f051ddfea4
SHA25603b88f25d34568f1cb49a1ddc4a2fe2a062b7ea34e13f0e598ff0b31fa5e106a
SHA512e8510424a4ff7bf9065b761f444dabb191896134024808ef4949c9bb42e2957ce2ef7a251e7421f48db159eb95c065a32ac14339580f52344452c9f7a8d6b73a
-
Filesize
341KB
MD5886cb657b55fed44cd34c8b5b6e7b74c
SHA136d4c23c84ec0cfe699cb331e44895aa6343af00
SHA256a4a6c7c331d54ea0d8ead1512207af70dce3f115826782397d9b703d9b9eceab
SHA51288e23fbcf3d8cdadd053451f08e32e87a86ab9424388c320601358740736fc9cfd652c0ab53927d0c9d58d2ec8dad0c279adff3ec47581923cc9c77f25a06b91
-
Filesize
341KB
MD5886cb657b55fed44cd34c8b5b6e7b74c
SHA136d4c23c84ec0cfe699cb331e44895aa6343af00
SHA256a4a6c7c331d54ea0d8ead1512207af70dce3f115826782397d9b703d9b9eceab
SHA51288e23fbcf3d8cdadd053451f08e32e87a86ab9424388c320601358740736fc9cfd652c0ab53927d0c9d58d2ec8dad0c279adff3ec47581923cc9c77f25a06b91
-
Filesize
341KB
MD5886cb657b55fed44cd34c8b5b6e7b74c
SHA136d4c23c84ec0cfe699cb331e44895aa6343af00
SHA256a4a6c7c331d54ea0d8ead1512207af70dce3f115826782397d9b703d9b9eceab
SHA51288e23fbcf3d8cdadd053451f08e32e87a86ab9424388c320601358740736fc9cfd652c0ab53927d0c9d58d2ec8dad0c279adff3ec47581923cc9c77f25a06b91
-
Filesize
536KB
MD58d7151b7987e84c4ff650608c2331179
SHA1bf5e510285f7f374fab00d96b5ace05119fab1bc
SHA2567c351767f3ac837f9b6349826604450e59f5ccac3bf841a0137572a5cc8198d5
SHA512f390d41bd4e70e3ad344daf58d5e3687fa2eb1ab0959c9511798d7d2c34d3d0b9bf18bb50b8d6677ece7335439641f61850f36448027440909e39a30241f24fd
-
Filesize
536KB
MD58d7151b7987e84c4ff650608c2331179
SHA1bf5e510285f7f374fab00d96b5ace05119fab1bc
SHA2567c351767f3ac837f9b6349826604450e59f5ccac3bf841a0137572a5cc8198d5
SHA512f390d41bd4e70e3ad344daf58d5e3687fa2eb1ab0959c9511798d7d2c34d3d0b9bf18bb50b8d6677ece7335439641f61850f36448027440909e39a30241f24fd
-
Filesize
259KB
MD5a874c986f4befc7997c0be41e738ee4e
SHA1736dbf14102b3955cec6b0df6d58e9f051ddfea4
SHA25603b88f25d34568f1cb49a1ddc4a2fe2a062b7ea34e13f0e598ff0b31fa5e106a
SHA512e8510424a4ff7bf9065b761f444dabb191896134024808ef4949c9bb42e2957ce2ef7a251e7421f48db159eb95c065a32ac14339580f52344452c9f7a8d6b73a
-
Filesize
259KB
MD5a874c986f4befc7997c0be41e738ee4e
SHA1736dbf14102b3955cec6b0df6d58e9f051ddfea4
SHA25603b88f25d34568f1cb49a1ddc4a2fe2a062b7ea34e13f0e598ff0b31fa5e106a
SHA512e8510424a4ff7bf9065b761f444dabb191896134024808ef4949c9bb42e2957ce2ef7a251e7421f48db159eb95c065a32ac14339580f52344452c9f7a8d6b73a
-
Filesize
259KB
MD5a874c986f4befc7997c0be41e738ee4e
SHA1736dbf14102b3955cec6b0df6d58e9f051ddfea4
SHA25603b88f25d34568f1cb49a1ddc4a2fe2a062b7ea34e13f0e598ff0b31fa5e106a
SHA512e8510424a4ff7bf9065b761f444dabb191896134024808ef4949c9bb42e2957ce2ef7a251e7421f48db159eb95c065a32ac14339580f52344452c9f7a8d6b73a
-
Filesize
259KB
MD5a874c986f4befc7997c0be41e738ee4e
SHA1736dbf14102b3955cec6b0df6d58e9f051ddfea4
SHA25603b88f25d34568f1cb49a1ddc4a2fe2a062b7ea34e13f0e598ff0b31fa5e106a
SHA512e8510424a4ff7bf9065b761f444dabb191896134024808ef4949c9bb42e2957ce2ef7a251e7421f48db159eb95c065a32ac14339580f52344452c9f7a8d6b73a
-
Filesize
259KB
MD5a874c986f4befc7997c0be41e738ee4e
SHA1736dbf14102b3955cec6b0df6d58e9f051ddfea4
SHA25603b88f25d34568f1cb49a1ddc4a2fe2a062b7ea34e13f0e598ff0b31fa5e106a
SHA512e8510424a4ff7bf9065b761f444dabb191896134024808ef4949c9bb42e2957ce2ef7a251e7421f48db159eb95c065a32ac14339580f52344452c9f7a8d6b73a
-
Filesize
341KB
MD5886cb657b55fed44cd34c8b5b6e7b74c
SHA136d4c23c84ec0cfe699cb331e44895aa6343af00
SHA256a4a6c7c331d54ea0d8ead1512207af70dce3f115826782397d9b703d9b9eceab
SHA51288e23fbcf3d8cdadd053451f08e32e87a86ab9424388c320601358740736fc9cfd652c0ab53927d0c9d58d2ec8dad0c279adff3ec47581923cc9c77f25a06b91
-
Filesize
341KB
MD5886cb657b55fed44cd34c8b5b6e7b74c
SHA136d4c23c84ec0cfe699cb331e44895aa6343af00
SHA256a4a6c7c331d54ea0d8ead1512207af70dce3f115826782397d9b703d9b9eceab
SHA51288e23fbcf3d8cdadd053451f08e32e87a86ab9424388c320601358740736fc9cfd652c0ab53927d0c9d58d2ec8dad0c279adff3ec47581923cc9c77f25a06b91
-
Filesize
341KB
MD5886cb657b55fed44cd34c8b5b6e7b74c
SHA136d4c23c84ec0cfe699cb331e44895aa6343af00
SHA256a4a6c7c331d54ea0d8ead1512207af70dce3f115826782397d9b703d9b9eceab
SHA51288e23fbcf3d8cdadd053451f08e32e87a86ab9424388c320601358740736fc9cfd652c0ab53927d0c9d58d2ec8dad0c279adff3ec47581923cc9c77f25a06b91