Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    151s
  • max time network
    156s
  • platform
    windows7_x64
  • resource
    win7-20230220-en
  • resource tags

    arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
  • submitted
    05/05/2023, 19:59

General

  • Target

    dbd9066bc8a1c5a15986e9eea7cb2a866a5eab54078247ec0d6eb28e440e1643.exe

  • Size

    690KB

  • MD5

    00cfa935e1f3d8f6908394aa7e4f0d1b

  • SHA1

    9923a91b0f7e63a49919004f4ad41ec53b194898

  • SHA256

    dbd9066bc8a1c5a15986e9eea7cb2a866a5eab54078247ec0d6eb28e440e1643

  • SHA512

    cb4a9c0cc480d08277147f23190919d83b5ff46365fc6274903292bbb26fd9eba822929b9564c5a4320a509c84e7b6b011c667d703490699e70d3c3a9aaef65a

  • SSDEEP

    12288:7y90kyLaEtZ98UMF4TjkfRkiuB84bGgniN1mgXE6yNdBLf:7y3U98HFgGRWB84aN7+Lf

Malware Config

Signatures

  • Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs
  • Executes dropped EXE 3 IoCs
  • Loads dropped DLL 8 IoCs
  • Windows security modification 2 TTPs 2 IoCs
  • Adds Run key to start application 2 TTPs 4 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 21 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\dbd9066bc8a1c5a15986e9eea7cb2a866a5eab54078247ec0d6eb28e440e1643.exe
    "C:\Users\Admin\AppData\Local\Temp\dbd9066bc8a1c5a15986e9eea7cb2a866a5eab54078247ec0d6eb28e440e1643.exe"
    1⤵
    • Loads dropped DLL
    • Adds Run key to start application
    • Suspicious use of WriteProcessMemory
    PID:1512
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un387279.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un387279.exe
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Adds Run key to start application
      • Suspicious use of WriteProcessMemory
      PID:1672
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\48225604.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\48225604.exe
        3⤵
        • Modifies Windows Defender Real-time Protection settings
        • Executes dropped EXE
        • Loads dropped DLL
        • Windows security modification
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:1388
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\rk462972.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\rk462972.exe
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Suspicious use of AdjustPrivilegeToken
        PID:916

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un387279.exe

    Filesize

    536KB

    MD5

    ea2eedcb44a2458016f322aea377d348

    SHA1

    c832581e0a3467813ce85cf2d9dfb985351368d0

    SHA256

    768115576168dec02ae6c7565384b82161b4908130d7463e2047eb561f0bd78c

    SHA512

    168850465ba0efcb547afd2759dcf755f60a8d0d36d72680e9b69517677ad1bfe88e0c96fa5f3d9406719b87eda9e9a569afb31b43e2de4153ac5c4ec0e19baa

  • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un387279.exe

    Filesize

    536KB

    MD5

    ea2eedcb44a2458016f322aea377d348

    SHA1

    c832581e0a3467813ce85cf2d9dfb985351368d0

    SHA256

    768115576168dec02ae6c7565384b82161b4908130d7463e2047eb561f0bd78c

    SHA512

    168850465ba0efcb547afd2759dcf755f60a8d0d36d72680e9b69517677ad1bfe88e0c96fa5f3d9406719b87eda9e9a569afb31b43e2de4153ac5c4ec0e19baa

  • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\48225604.exe

    Filesize

    258KB

    MD5

    c98580790ed4b813cef3355fc63b57ba

    SHA1

    8bfeea54109d30d5171abec7c1604f5fa36a958b

    SHA256

    9b222804e2d805b64db13d9cf8baaa658a44fe830336fae5fd0ce455c9e57fd0

    SHA512

    962946757db26857e2e8c70a1c822c1dcda5a6f4953176d32561ad27cfef699346c92826a692b203f4ae67dcad5f43f64e575d7437b257560612a7dec069490c

  • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\48225604.exe

    Filesize

    258KB

    MD5

    c98580790ed4b813cef3355fc63b57ba

    SHA1

    8bfeea54109d30d5171abec7c1604f5fa36a958b

    SHA256

    9b222804e2d805b64db13d9cf8baaa658a44fe830336fae5fd0ce455c9e57fd0

    SHA512

    962946757db26857e2e8c70a1c822c1dcda5a6f4953176d32561ad27cfef699346c92826a692b203f4ae67dcad5f43f64e575d7437b257560612a7dec069490c

  • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\48225604.exe

    Filesize

    258KB

    MD5

    c98580790ed4b813cef3355fc63b57ba

    SHA1

    8bfeea54109d30d5171abec7c1604f5fa36a958b

    SHA256

    9b222804e2d805b64db13d9cf8baaa658a44fe830336fae5fd0ce455c9e57fd0

    SHA512

    962946757db26857e2e8c70a1c822c1dcda5a6f4953176d32561ad27cfef699346c92826a692b203f4ae67dcad5f43f64e575d7437b257560612a7dec069490c

  • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\rk462972.exe

    Filesize

    341KB

    MD5

    c89e5faadd68d16103ef7decffd06e07

    SHA1

    92ea11a3380a0b955d8cb798aeaabaf7e44c6bcf

    SHA256

    bfabf63cdcd7f88f339721af88cbd2c426fa15940a016d3a0b252862867214d9

    SHA512

    cfe6b76cec8339d0d5fb4d7177e503bcfd51e7cd3bc6e469af81ad5f1685561745a5213f0d94bb190fe0a6ffa3dce37b06552ec94a66261100aab074b60fd97b

  • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\rk462972.exe

    Filesize

    341KB

    MD5

    c89e5faadd68d16103ef7decffd06e07

    SHA1

    92ea11a3380a0b955d8cb798aeaabaf7e44c6bcf

    SHA256

    bfabf63cdcd7f88f339721af88cbd2c426fa15940a016d3a0b252862867214d9

    SHA512

    cfe6b76cec8339d0d5fb4d7177e503bcfd51e7cd3bc6e469af81ad5f1685561745a5213f0d94bb190fe0a6ffa3dce37b06552ec94a66261100aab074b60fd97b

  • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\rk462972.exe

    Filesize

    341KB

    MD5

    c89e5faadd68d16103ef7decffd06e07

    SHA1

    92ea11a3380a0b955d8cb798aeaabaf7e44c6bcf

    SHA256

    bfabf63cdcd7f88f339721af88cbd2c426fa15940a016d3a0b252862867214d9

    SHA512

    cfe6b76cec8339d0d5fb4d7177e503bcfd51e7cd3bc6e469af81ad5f1685561745a5213f0d94bb190fe0a6ffa3dce37b06552ec94a66261100aab074b60fd97b

  • \Users\Admin\AppData\Local\Temp\IXP000.TMP\un387279.exe

    Filesize

    536KB

    MD5

    ea2eedcb44a2458016f322aea377d348

    SHA1

    c832581e0a3467813ce85cf2d9dfb985351368d0

    SHA256

    768115576168dec02ae6c7565384b82161b4908130d7463e2047eb561f0bd78c

    SHA512

    168850465ba0efcb547afd2759dcf755f60a8d0d36d72680e9b69517677ad1bfe88e0c96fa5f3d9406719b87eda9e9a569afb31b43e2de4153ac5c4ec0e19baa

  • \Users\Admin\AppData\Local\Temp\IXP000.TMP\un387279.exe

    Filesize

    536KB

    MD5

    ea2eedcb44a2458016f322aea377d348

    SHA1

    c832581e0a3467813ce85cf2d9dfb985351368d0

    SHA256

    768115576168dec02ae6c7565384b82161b4908130d7463e2047eb561f0bd78c

    SHA512

    168850465ba0efcb547afd2759dcf755f60a8d0d36d72680e9b69517677ad1bfe88e0c96fa5f3d9406719b87eda9e9a569afb31b43e2de4153ac5c4ec0e19baa

  • \Users\Admin\AppData\Local\Temp\IXP001.TMP\48225604.exe

    Filesize

    258KB

    MD5

    c98580790ed4b813cef3355fc63b57ba

    SHA1

    8bfeea54109d30d5171abec7c1604f5fa36a958b

    SHA256

    9b222804e2d805b64db13d9cf8baaa658a44fe830336fae5fd0ce455c9e57fd0

    SHA512

    962946757db26857e2e8c70a1c822c1dcda5a6f4953176d32561ad27cfef699346c92826a692b203f4ae67dcad5f43f64e575d7437b257560612a7dec069490c

  • \Users\Admin\AppData\Local\Temp\IXP001.TMP\48225604.exe

    Filesize

    258KB

    MD5

    c98580790ed4b813cef3355fc63b57ba

    SHA1

    8bfeea54109d30d5171abec7c1604f5fa36a958b

    SHA256

    9b222804e2d805b64db13d9cf8baaa658a44fe830336fae5fd0ce455c9e57fd0

    SHA512

    962946757db26857e2e8c70a1c822c1dcda5a6f4953176d32561ad27cfef699346c92826a692b203f4ae67dcad5f43f64e575d7437b257560612a7dec069490c

  • \Users\Admin\AppData\Local\Temp\IXP001.TMP\48225604.exe

    Filesize

    258KB

    MD5

    c98580790ed4b813cef3355fc63b57ba

    SHA1

    8bfeea54109d30d5171abec7c1604f5fa36a958b

    SHA256

    9b222804e2d805b64db13d9cf8baaa658a44fe830336fae5fd0ce455c9e57fd0

    SHA512

    962946757db26857e2e8c70a1c822c1dcda5a6f4953176d32561ad27cfef699346c92826a692b203f4ae67dcad5f43f64e575d7437b257560612a7dec069490c

  • \Users\Admin\AppData\Local\Temp\IXP001.TMP\rk462972.exe

    Filesize

    341KB

    MD5

    c89e5faadd68d16103ef7decffd06e07

    SHA1

    92ea11a3380a0b955d8cb798aeaabaf7e44c6bcf

    SHA256

    bfabf63cdcd7f88f339721af88cbd2c426fa15940a016d3a0b252862867214d9

    SHA512

    cfe6b76cec8339d0d5fb4d7177e503bcfd51e7cd3bc6e469af81ad5f1685561745a5213f0d94bb190fe0a6ffa3dce37b06552ec94a66261100aab074b60fd97b

  • \Users\Admin\AppData\Local\Temp\IXP001.TMP\rk462972.exe

    Filesize

    341KB

    MD5

    c89e5faadd68d16103ef7decffd06e07

    SHA1

    92ea11a3380a0b955d8cb798aeaabaf7e44c6bcf

    SHA256

    bfabf63cdcd7f88f339721af88cbd2c426fa15940a016d3a0b252862867214d9

    SHA512

    cfe6b76cec8339d0d5fb4d7177e503bcfd51e7cd3bc6e469af81ad5f1685561745a5213f0d94bb190fe0a6ffa3dce37b06552ec94a66261100aab074b60fd97b

  • \Users\Admin\AppData\Local\Temp\IXP001.TMP\rk462972.exe

    Filesize

    341KB

    MD5

    c89e5faadd68d16103ef7decffd06e07

    SHA1

    92ea11a3380a0b955d8cb798aeaabaf7e44c6bcf

    SHA256

    bfabf63cdcd7f88f339721af88cbd2c426fa15940a016d3a0b252862867214d9

    SHA512

    cfe6b76cec8339d0d5fb4d7177e503bcfd51e7cd3bc6e469af81ad5f1685561745a5213f0d94bb190fe0a6ffa3dce37b06552ec94a66261100aab074b60fd97b

  • memory/916-148-0x00000000020A0000-0x00000000020D5000-memory.dmp

    Filesize

    212KB

  • memory/916-133-0x0000000004B00000-0x0000000004B40000-memory.dmp

    Filesize

    256KB

  • memory/916-154-0x00000000020A0000-0x00000000020D5000-memory.dmp

    Filesize

    212KB

  • memory/916-150-0x00000000020A0000-0x00000000020D5000-memory.dmp

    Filesize

    212KB

  • memory/916-129-0x00000000020A0000-0x00000000020D5000-memory.dmp

    Filesize

    212KB

  • memory/916-146-0x00000000020A0000-0x00000000020D5000-memory.dmp

    Filesize

    212KB

  • memory/916-144-0x00000000020A0000-0x00000000020D5000-memory.dmp

    Filesize

    212KB

  • memory/916-142-0x00000000020A0000-0x00000000020D5000-memory.dmp

    Filesize

    212KB

  • memory/916-140-0x00000000020A0000-0x00000000020D5000-memory.dmp

    Filesize

    212KB

  • memory/916-138-0x00000000020A0000-0x00000000020D5000-memory.dmp

    Filesize

    212KB

  • memory/916-136-0x00000000020A0000-0x00000000020D5000-memory.dmp

    Filesize

    212KB

  • memory/916-135-0x0000000004B00000-0x0000000004B40000-memory.dmp

    Filesize

    256KB

  • memory/916-132-0x00000000020A0000-0x00000000020D5000-memory.dmp

    Filesize

    212KB

  • memory/916-156-0x00000000020A0000-0x00000000020D5000-memory.dmp

    Filesize

    212KB

  • memory/916-131-0x0000000000260000-0x00000000002A6000-memory.dmp

    Filesize

    280KB

  • memory/916-152-0x00000000020A0000-0x00000000020D5000-memory.dmp

    Filesize

    212KB

  • memory/916-158-0x00000000020A0000-0x00000000020D5000-memory.dmp

    Filesize

    212KB

  • memory/916-160-0x00000000020A0000-0x00000000020D5000-memory.dmp

    Filesize

    212KB

  • memory/916-919-0x0000000004B00000-0x0000000004B40000-memory.dmp

    Filesize

    256KB

  • memory/916-921-0x0000000004B00000-0x0000000004B40000-memory.dmp

    Filesize

    256KB

  • memory/916-923-0x0000000004B00000-0x0000000004B40000-memory.dmp

    Filesize

    256KB

  • memory/916-122-0x0000000002060000-0x000000000209C000-memory.dmp

    Filesize

    240KB

  • memory/916-123-0x00000000020A0000-0x00000000020DA000-memory.dmp

    Filesize

    232KB

  • memory/916-125-0x00000000020A0000-0x00000000020D5000-memory.dmp

    Filesize

    212KB

  • memory/916-124-0x00000000020A0000-0x00000000020D5000-memory.dmp

    Filesize

    212KB

  • memory/916-127-0x00000000020A0000-0x00000000020D5000-memory.dmp

    Filesize

    212KB

  • memory/1388-85-0x0000000002140000-0x0000000002153000-memory.dmp

    Filesize

    76KB

  • memory/1388-111-0x0000000000400000-0x0000000000455000-memory.dmp

    Filesize

    340KB

  • memory/1388-110-0x0000000000400000-0x0000000000455000-memory.dmp

    Filesize

    340KB

  • memory/1388-103-0x0000000002140000-0x0000000002153000-memory.dmp

    Filesize

    76KB

  • memory/1388-105-0x0000000002140000-0x0000000002153000-memory.dmp

    Filesize

    76KB

  • memory/1388-109-0x0000000002140000-0x0000000002153000-memory.dmp

    Filesize

    76KB

  • memory/1388-107-0x0000000002140000-0x0000000002153000-memory.dmp

    Filesize

    76KB

  • memory/1388-102-0x0000000004B80000-0x0000000004BC0000-memory.dmp

    Filesize

    256KB

  • memory/1388-101-0x00000000002D0000-0x00000000002FD000-memory.dmp

    Filesize

    180KB

  • memory/1388-93-0x0000000002140000-0x0000000002153000-memory.dmp

    Filesize

    76KB

  • memory/1388-95-0x0000000002140000-0x0000000002153000-memory.dmp

    Filesize

    76KB

  • memory/1388-97-0x0000000002140000-0x0000000002153000-memory.dmp

    Filesize

    76KB

  • memory/1388-99-0x0000000002140000-0x0000000002153000-memory.dmp

    Filesize

    76KB

  • memory/1388-91-0x0000000002140000-0x0000000002153000-memory.dmp

    Filesize

    76KB

  • memory/1388-89-0x0000000002140000-0x0000000002153000-memory.dmp

    Filesize

    76KB

  • memory/1388-87-0x0000000002140000-0x0000000002153000-memory.dmp

    Filesize

    76KB

  • memory/1388-83-0x0000000002140000-0x0000000002153000-memory.dmp

    Filesize

    76KB

  • memory/1388-81-0x0000000002140000-0x0000000002153000-memory.dmp

    Filesize

    76KB

  • memory/1388-80-0x0000000002140000-0x0000000002153000-memory.dmp

    Filesize

    76KB

  • memory/1388-79-0x0000000002140000-0x0000000002158000-memory.dmp

    Filesize

    96KB

  • memory/1388-78-0x00000000006F0000-0x000000000070A000-memory.dmp

    Filesize

    104KB