Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    145s
  • max time network
    157s
  • platform
    windows7_x64
  • resource
    win7-20230220-en
  • resource tags

    arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
  • submitted
    05/05/2023, 19:25

General

  • Target

    c19a69cf76117d64b6a17d16fe5be6f59e19154bf577aec3037fd6ddf0ccd78b.exe

  • Size

    691KB

  • MD5

    14323b95a1c2c784f36f833c811ceea1

  • SHA1

    7e8e378645bb44620ee875c5214bdfd0267c74cd

  • SHA256

    c19a69cf76117d64b6a17d16fe5be6f59e19154bf577aec3037fd6ddf0ccd78b

  • SHA512

    35fd892795fb1674a66191d0f9d1728bb0766587921bfd77c8413b187a130cebe9a92690f75d7631daa2f10862cf86ebb3b372aa66c885acd57424d65a3c01a1

  • SSDEEP

    12288:sy90HNE/SkBw74Ps8VuwdAPZRHrrQ0vPQ2+m1Of/46twd22u:syyNu24Ps8V1+L5I2+gOH4Iwd/u

Malware Config

Signatures

  • Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs
  • Executes dropped EXE 4 IoCs
  • Loads dropped DLL 10 IoCs
  • Windows security modification 2 TTPs 2 IoCs
  • Adds Run key to start application 2 TTPs 4 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 34 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\c19a69cf76117d64b6a17d16fe5be6f59e19154bf577aec3037fd6ddf0ccd78b.exe
    "C:\Users\Admin\AppData\Local\Temp\c19a69cf76117d64b6a17d16fe5be6f59e19154bf577aec3037fd6ddf0ccd78b.exe"
    1⤵
    • Loads dropped DLL
    • Adds Run key to start application
    • Suspicious use of WriteProcessMemory
    PID:2036
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un731868.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un731868.exe
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Adds Run key to start application
      • Suspicious use of WriteProcessMemory
      PID:924
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\96715942.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\96715942.exe
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Suspicious use of SetThreadContext
        • Suspicious use of WriteProcessMemory
        PID:832
        • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\96715942.exe
          C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\96715942.exe
          4⤵
          • Modifies Windows Defender Real-time Protection settings
          • Executes dropped EXE
          • Loads dropped DLL
          • Windows security modification
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:1484
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\rk028513.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\rk028513.exe
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Suspicious use of AdjustPrivilegeToken
        PID:464

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un731868.exe

    Filesize

    536KB

    MD5

    8d7151b7987e84c4ff650608c2331179

    SHA1

    bf5e510285f7f374fab00d96b5ace05119fab1bc

    SHA256

    7c351767f3ac837f9b6349826604450e59f5ccac3bf841a0137572a5cc8198d5

    SHA512

    f390d41bd4e70e3ad344daf58d5e3687fa2eb1ab0959c9511798d7d2c34d3d0b9bf18bb50b8d6677ece7335439641f61850f36448027440909e39a30241f24fd

  • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un731868.exe

    Filesize

    536KB

    MD5

    8d7151b7987e84c4ff650608c2331179

    SHA1

    bf5e510285f7f374fab00d96b5ace05119fab1bc

    SHA256

    7c351767f3ac837f9b6349826604450e59f5ccac3bf841a0137572a5cc8198d5

    SHA512

    f390d41bd4e70e3ad344daf58d5e3687fa2eb1ab0959c9511798d7d2c34d3d0b9bf18bb50b8d6677ece7335439641f61850f36448027440909e39a30241f24fd

  • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\96715942.exe

    Filesize

    259KB

    MD5

    a874c986f4befc7997c0be41e738ee4e

    SHA1

    736dbf14102b3955cec6b0df6d58e9f051ddfea4

    SHA256

    03b88f25d34568f1cb49a1ddc4a2fe2a062b7ea34e13f0e598ff0b31fa5e106a

    SHA512

    e8510424a4ff7bf9065b761f444dabb191896134024808ef4949c9bb42e2957ce2ef7a251e7421f48db159eb95c065a32ac14339580f52344452c9f7a8d6b73a

  • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\96715942.exe

    Filesize

    259KB

    MD5

    a874c986f4befc7997c0be41e738ee4e

    SHA1

    736dbf14102b3955cec6b0df6d58e9f051ddfea4

    SHA256

    03b88f25d34568f1cb49a1ddc4a2fe2a062b7ea34e13f0e598ff0b31fa5e106a

    SHA512

    e8510424a4ff7bf9065b761f444dabb191896134024808ef4949c9bb42e2957ce2ef7a251e7421f48db159eb95c065a32ac14339580f52344452c9f7a8d6b73a

  • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\96715942.exe

    Filesize

    259KB

    MD5

    a874c986f4befc7997c0be41e738ee4e

    SHA1

    736dbf14102b3955cec6b0df6d58e9f051ddfea4

    SHA256

    03b88f25d34568f1cb49a1ddc4a2fe2a062b7ea34e13f0e598ff0b31fa5e106a

    SHA512

    e8510424a4ff7bf9065b761f444dabb191896134024808ef4949c9bb42e2957ce2ef7a251e7421f48db159eb95c065a32ac14339580f52344452c9f7a8d6b73a

  • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\96715942.exe

    Filesize

    259KB

    MD5

    a874c986f4befc7997c0be41e738ee4e

    SHA1

    736dbf14102b3955cec6b0df6d58e9f051ddfea4

    SHA256

    03b88f25d34568f1cb49a1ddc4a2fe2a062b7ea34e13f0e598ff0b31fa5e106a

    SHA512

    e8510424a4ff7bf9065b761f444dabb191896134024808ef4949c9bb42e2957ce2ef7a251e7421f48db159eb95c065a32ac14339580f52344452c9f7a8d6b73a

  • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\rk028513.exe

    Filesize

    341KB

    MD5

    886cb657b55fed44cd34c8b5b6e7b74c

    SHA1

    36d4c23c84ec0cfe699cb331e44895aa6343af00

    SHA256

    a4a6c7c331d54ea0d8ead1512207af70dce3f115826782397d9b703d9b9eceab

    SHA512

    88e23fbcf3d8cdadd053451f08e32e87a86ab9424388c320601358740736fc9cfd652c0ab53927d0c9d58d2ec8dad0c279adff3ec47581923cc9c77f25a06b91

  • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\rk028513.exe

    Filesize

    341KB

    MD5

    886cb657b55fed44cd34c8b5b6e7b74c

    SHA1

    36d4c23c84ec0cfe699cb331e44895aa6343af00

    SHA256

    a4a6c7c331d54ea0d8ead1512207af70dce3f115826782397d9b703d9b9eceab

    SHA512

    88e23fbcf3d8cdadd053451f08e32e87a86ab9424388c320601358740736fc9cfd652c0ab53927d0c9d58d2ec8dad0c279adff3ec47581923cc9c77f25a06b91

  • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\rk028513.exe

    Filesize

    341KB

    MD5

    886cb657b55fed44cd34c8b5b6e7b74c

    SHA1

    36d4c23c84ec0cfe699cb331e44895aa6343af00

    SHA256

    a4a6c7c331d54ea0d8ead1512207af70dce3f115826782397d9b703d9b9eceab

    SHA512

    88e23fbcf3d8cdadd053451f08e32e87a86ab9424388c320601358740736fc9cfd652c0ab53927d0c9d58d2ec8dad0c279adff3ec47581923cc9c77f25a06b91

  • \Users\Admin\AppData\Local\Temp\IXP000.TMP\un731868.exe

    Filesize

    536KB

    MD5

    8d7151b7987e84c4ff650608c2331179

    SHA1

    bf5e510285f7f374fab00d96b5ace05119fab1bc

    SHA256

    7c351767f3ac837f9b6349826604450e59f5ccac3bf841a0137572a5cc8198d5

    SHA512

    f390d41bd4e70e3ad344daf58d5e3687fa2eb1ab0959c9511798d7d2c34d3d0b9bf18bb50b8d6677ece7335439641f61850f36448027440909e39a30241f24fd

  • \Users\Admin\AppData\Local\Temp\IXP000.TMP\un731868.exe

    Filesize

    536KB

    MD5

    8d7151b7987e84c4ff650608c2331179

    SHA1

    bf5e510285f7f374fab00d96b5ace05119fab1bc

    SHA256

    7c351767f3ac837f9b6349826604450e59f5ccac3bf841a0137572a5cc8198d5

    SHA512

    f390d41bd4e70e3ad344daf58d5e3687fa2eb1ab0959c9511798d7d2c34d3d0b9bf18bb50b8d6677ece7335439641f61850f36448027440909e39a30241f24fd

  • \Users\Admin\AppData\Local\Temp\IXP001.TMP\96715942.exe

    Filesize

    259KB

    MD5

    a874c986f4befc7997c0be41e738ee4e

    SHA1

    736dbf14102b3955cec6b0df6d58e9f051ddfea4

    SHA256

    03b88f25d34568f1cb49a1ddc4a2fe2a062b7ea34e13f0e598ff0b31fa5e106a

    SHA512

    e8510424a4ff7bf9065b761f444dabb191896134024808ef4949c9bb42e2957ce2ef7a251e7421f48db159eb95c065a32ac14339580f52344452c9f7a8d6b73a

  • \Users\Admin\AppData\Local\Temp\IXP001.TMP\96715942.exe

    Filesize

    259KB

    MD5

    a874c986f4befc7997c0be41e738ee4e

    SHA1

    736dbf14102b3955cec6b0df6d58e9f051ddfea4

    SHA256

    03b88f25d34568f1cb49a1ddc4a2fe2a062b7ea34e13f0e598ff0b31fa5e106a

    SHA512

    e8510424a4ff7bf9065b761f444dabb191896134024808ef4949c9bb42e2957ce2ef7a251e7421f48db159eb95c065a32ac14339580f52344452c9f7a8d6b73a

  • \Users\Admin\AppData\Local\Temp\IXP001.TMP\96715942.exe

    Filesize

    259KB

    MD5

    a874c986f4befc7997c0be41e738ee4e

    SHA1

    736dbf14102b3955cec6b0df6d58e9f051ddfea4

    SHA256

    03b88f25d34568f1cb49a1ddc4a2fe2a062b7ea34e13f0e598ff0b31fa5e106a

    SHA512

    e8510424a4ff7bf9065b761f444dabb191896134024808ef4949c9bb42e2957ce2ef7a251e7421f48db159eb95c065a32ac14339580f52344452c9f7a8d6b73a

  • \Users\Admin\AppData\Local\Temp\IXP001.TMP\96715942.exe

    Filesize

    259KB

    MD5

    a874c986f4befc7997c0be41e738ee4e

    SHA1

    736dbf14102b3955cec6b0df6d58e9f051ddfea4

    SHA256

    03b88f25d34568f1cb49a1ddc4a2fe2a062b7ea34e13f0e598ff0b31fa5e106a

    SHA512

    e8510424a4ff7bf9065b761f444dabb191896134024808ef4949c9bb42e2957ce2ef7a251e7421f48db159eb95c065a32ac14339580f52344452c9f7a8d6b73a

  • \Users\Admin\AppData\Local\Temp\IXP001.TMP\96715942.exe

    Filesize

    259KB

    MD5

    a874c986f4befc7997c0be41e738ee4e

    SHA1

    736dbf14102b3955cec6b0df6d58e9f051ddfea4

    SHA256

    03b88f25d34568f1cb49a1ddc4a2fe2a062b7ea34e13f0e598ff0b31fa5e106a

    SHA512

    e8510424a4ff7bf9065b761f444dabb191896134024808ef4949c9bb42e2957ce2ef7a251e7421f48db159eb95c065a32ac14339580f52344452c9f7a8d6b73a

  • \Users\Admin\AppData\Local\Temp\IXP001.TMP\rk028513.exe

    Filesize

    341KB

    MD5

    886cb657b55fed44cd34c8b5b6e7b74c

    SHA1

    36d4c23c84ec0cfe699cb331e44895aa6343af00

    SHA256

    a4a6c7c331d54ea0d8ead1512207af70dce3f115826782397d9b703d9b9eceab

    SHA512

    88e23fbcf3d8cdadd053451f08e32e87a86ab9424388c320601358740736fc9cfd652c0ab53927d0c9d58d2ec8dad0c279adff3ec47581923cc9c77f25a06b91

  • \Users\Admin\AppData\Local\Temp\IXP001.TMP\rk028513.exe

    Filesize

    341KB

    MD5

    886cb657b55fed44cd34c8b5b6e7b74c

    SHA1

    36d4c23c84ec0cfe699cb331e44895aa6343af00

    SHA256

    a4a6c7c331d54ea0d8ead1512207af70dce3f115826782397d9b703d9b9eceab

    SHA512

    88e23fbcf3d8cdadd053451f08e32e87a86ab9424388c320601358740736fc9cfd652c0ab53927d0c9d58d2ec8dad0c279adff3ec47581923cc9c77f25a06b91

  • \Users\Admin\AppData\Local\Temp\IXP001.TMP\rk028513.exe

    Filesize

    341KB

    MD5

    886cb657b55fed44cd34c8b5b6e7b74c

    SHA1

    36d4c23c84ec0cfe699cb331e44895aa6343af00

    SHA256

    a4a6c7c331d54ea0d8ead1512207af70dce3f115826782397d9b703d9b9eceab

    SHA512

    88e23fbcf3d8cdadd053451f08e32e87a86ab9424388c320601358740736fc9cfd652c0ab53927d0c9d58d2ec8dad0c279adff3ec47581923cc9c77f25a06b91

  • memory/464-139-0x0000000000B40000-0x0000000000B75000-memory.dmp

    Filesize

    212KB

  • memory/464-153-0x0000000000B40000-0x0000000000B75000-memory.dmp

    Filesize

    212KB

  • memory/464-935-0x0000000004C00000-0x0000000004C40000-memory.dmp

    Filesize

    256KB

  • memory/464-930-0x0000000004C00000-0x0000000004C40000-memory.dmp

    Filesize

    256KB

  • memory/464-733-0x0000000004C00000-0x0000000004C40000-memory.dmp

    Filesize

    256KB

  • memory/464-731-0x0000000000310000-0x0000000000356000-memory.dmp

    Filesize

    280KB

  • memory/464-161-0x0000000000B40000-0x0000000000B75000-memory.dmp

    Filesize

    212KB

  • memory/464-155-0x0000000000B40000-0x0000000000B75000-memory.dmp

    Filesize

    212KB

  • memory/464-159-0x0000000000B40000-0x0000000000B75000-memory.dmp

    Filesize

    212KB

  • memory/464-157-0x0000000000B40000-0x0000000000B75000-memory.dmp

    Filesize

    212KB

  • memory/464-151-0x0000000000B40000-0x0000000000B75000-memory.dmp

    Filesize

    212KB

  • memory/464-130-0x0000000000630000-0x000000000066C000-memory.dmp

    Filesize

    240KB

  • memory/464-131-0x0000000000B40000-0x0000000000B7A000-memory.dmp

    Filesize

    232KB

  • memory/464-149-0x0000000000B40000-0x0000000000B75000-memory.dmp

    Filesize

    212KB

  • memory/464-145-0x0000000000B40000-0x0000000000B75000-memory.dmp

    Filesize

    212KB

  • memory/464-147-0x0000000000B40000-0x0000000000B75000-memory.dmp

    Filesize

    212KB

  • memory/464-143-0x0000000000B40000-0x0000000000B75000-memory.dmp

    Filesize

    212KB

  • memory/464-141-0x0000000000B40000-0x0000000000B75000-memory.dmp

    Filesize

    212KB

  • memory/464-137-0x0000000000B40000-0x0000000000B75000-memory.dmp

    Filesize

    212KB

  • memory/464-135-0x0000000000B40000-0x0000000000B75000-memory.dmp

    Filesize

    212KB

  • memory/464-133-0x0000000000B40000-0x0000000000B75000-memory.dmp

    Filesize

    212KB

  • memory/464-132-0x0000000000B40000-0x0000000000B75000-memory.dmp

    Filesize

    212KB

  • memory/832-82-0x00000000003D0000-0x00000000003FE000-memory.dmp

    Filesize

    184KB

  • memory/1484-109-0x0000000000B80000-0x0000000000B93000-memory.dmp

    Filesize

    76KB

  • memory/1484-113-0x0000000000B80000-0x0000000000B93000-memory.dmp

    Filesize

    76KB

  • memory/1484-128-0x00000000048F0000-0x0000000004930000-memory.dmp

    Filesize

    256KB

  • memory/1484-127-0x0000000000B80000-0x0000000000B93000-memory.dmp

    Filesize

    76KB

  • memory/1484-125-0x0000000000B80000-0x0000000000B93000-memory.dmp

    Filesize

    76KB

  • memory/1484-123-0x0000000000B80000-0x0000000000B93000-memory.dmp

    Filesize

    76KB

  • memory/1484-79-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

    Filesize

    4KB

  • memory/1484-121-0x0000000000B80000-0x0000000000B93000-memory.dmp

    Filesize

    76KB

  • memory/1484-119-0x0000000000B80000-0x0000000000B93000-memory.dmp

    Filesize

    76KB

  • memory/1484-117-0x0000000000B80000-0x0000000000B93000-memory.dmp

    Filesize

    76KB

  • memory/1484-115-0x0000000000B80000-0x0000000000B93000-memory.dmp

    Filesize

    76KB

  • memory/1484-129-0x00000000048F0000-0x0000000004930000-memory.dmp

    Filesize

    256KB

  • memory/1484-111-0x0000000000B80000-0x0000000000B93000-memory.dmp

    Filesize

    76KB

  • memory/1484-107-0x0000000000B80000-0x0000000000B93000-memory.dmp

    Filesize

    76KB

  • memory/1484-105-0x0000000000B80000-0x0000000000B93000-memory.dmp

    Filesize

    76KB

  • memory/1484-103-0x0000000000B80000-0x0000000000B93000-memory.dmp

    Filesize

    76KB

  • memory/1484-101-0x0000000000B80000-0x0000000000B93000-memory.dmp

    Filesize

    76KB

  • memory/1484-100-0x0000000000B80000-0x0000000000B93000-memory.dmp

    Filesize

    76KB

  • memory/1484-99-0x0000000000B80000-0x0000000000B98000-memory.dmp

    Filesize

    96KB

  • memory/1484-98-0x0000000000A40000-0x0000000000A5A000-memory.dmp

    Filesize

    104KB

  • memory/1484-97-0x0000000000400000-0x0000000000430000-memory.dmp

    Filesize

    192KB

  • memory/1484-80-0x0000000000400000-0x0000000000430000-memory.dmp

    Filesize

    192KB

  • memory/1484-933-0x0000000000400000-0x0000000000430000-memory.dmp

    Filesize

    192KB

  • memory/1484-84-0x0000000000400000-0x0000000000430000-memory.dmp

    Filesize

    192KB