Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
151s -
max time network
156s -
platform
windows7_x64 -
resource
win7-20230220-en -
resource tags
arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system -
submitted
05/05/2023, 19:59
Static task
static1
Behavioral task
behavioral1
Sample
dbd9066bc8a1c5a15986e9eea7cb2a866a5eab54078247ec0d6eb28e440e1643.exe
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
dbd9066bc8a1c5a15986e9eea7cb2a866a5eab54078247ec0d6eb28e440e1643.exe
Resource
win10v2004-20230220-en
General
-
Target
dbd9066bc8a1c5a15986e9eea7cb2a866a5eab54078247ec0d6eb28e440e1643.exe
-
Size
690KB
-
MD5
00cfa935e1f3d8f6908394aa7e4f0d1b
-
SHA1
9923a91b0f7e63a49919004f4ad41ec53b194898
-
SHA256
dbd9066bc8a1c5a15986e9eea7cb2a866a5eab54078247ec0d6eb28e440e1643
-
SHA512
cb4a9c0cc480d08277147f23190919d83b5ff46365fc6274903292bbb26fd9eba822929b9564c5a4320a509c84e7b6b011c667d703490699e70d3c3a9aaef65a
-
SSDEEP
12288:7y90kyLaEtZ98UMF4TjkfRkiuB84bGgniN1mgXE6yNdBLf:7y3U98HFgGRWB84aN7+Lf
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection 48225604.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" 48225604.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" 48225604.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" 48225604.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" 48225604.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" 48225604.exe -
Executes dropped EXE 3 IoCs
pid Process 1672 un387279.exe 1388 48225604.exe 916 rk462972.exe -
Loads dropped DLL 8 IoCs
pid Process 1512 dbd9066bc8a1c5a15986e9eea7cb2a866a5eab54078247ec0d6eb28e440e1643.exe 1672 un387279.exe 1672 un387279.exe 1672 un387279.exe 1388 48225604.exe 1672 un387279.exe 1672 un387279.exe 916 rk462972.exe -
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Features 48225604.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0" 48225604.exe -
Adds Run key to start application 2 TTPs 4 IoCs
description ioc Process Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce dbd9066bc8a1c5a15986e9eea7cb2a866a5eab54078247ec0d6eb28e440e1643.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" dbd9066bc8a1c5a15986e9eea7cb2a866a5eab54078247ec0d6eb28e440e1643.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce un387279.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" un387279.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 1388 48225604.exe 1388 48225604.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 1388 48225604.exe Token: SeDebugPrivilege 916 rk462972.exe -
Suspicious use of WriteProcessMemory 21 IoCs
description pid Process procid_target PID 1512 wrote to memory of 1672 1512 dbd9066bc8a1c5a15986e9eea7cb2a866a5eab54078247ec0d6eb28e440e1643.exe 27 PID 1512 wrote to memory of 1672 1512 dbd9066bc8a1c5a15986e9eea7cb2a866a5eab54078247ec0d6eb28e440e1643.exe 27 PID 1512 wrote to memory of 1672 1512 dbd9066bc8a1c5a15986e9eea7cb2a866a5eab54078247ec0d6eb28e440e1643.exe 27 PID 1512 wrote to memory of 1672 1512 dbd9066bc8a1c5a15986e9eea7cb2a866a5eab54078247ec0d6eb28e440e1643.exe 27 PID 1512 wrote to memory of 1672 1512 dbd9066bc8a1c5a15986e9eea7cb2a866a5eab54078247ec0d6eb28e440e1643.exe 27 PID 1512 wrote to memory of 1672 1512 dbd9066bc8a1c5a15986e9eea7cb2a866a5eab54078247ec0d6eb28e440e1643.exe 27 PID 1512 wrote to memory of 1672 1512 dbd9066bc8a1c5a15986e9eea7cb2a866a5eab54078247ec0d6eb28e440e1643.exe 27 PID 1672 wrote to memory of 1388 1672 un387279.exe 28 PID 1672 wrote to memory of 1388 1672 un387279.exe 28 PID 1672 wrote to memory of 1388 1672 un387279.exe 28 PID 1672 wrote to memory of 1388 1672 un387279.exe 28 PID 1672 wrote to memory of 1388 1672 un387279.exe 28 PID 1672 wrote to memory of 1388 1672 un387279.exe 28 PID 1672 wrote to memory of 1388 1672 un387279.exe 28 PID 1672 wrote to memory of 916 1672 un387279.exe 29 PID 1672 wrote to memory of 916 1672 un387279.exe 29 PID 1672 wrote to memory of 916 1672 un387279.exe 29 PID 1672 wrote to memory of 916 1672 un387279.exe 29 PID 1672 wrote to memory of 916 1672 un387279.exe 29 PID 1672 wrote to memory of 916 1672 un387279.exe 29 PID 1672 wrote to memory of 916 1672 un387279.exe 29
Processes
-
C:\Users\Admin\AppData\Local\Temp\dbd9066bc8a1c5a15986e9eea7cb2a866a5eab54078247ec0d6eb28e440e1643.exe"C:\Users\Admin\AppData\Local\Temp\dbd9066bc8a1c5a15986e9eea7cb2a866a5eab54078247ec0d6eb28e440e1643.exe"1⤵
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:1512 -
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un387279.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un387279.exe2⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:1672 -
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\48225604.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\48225604.exe3⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Loads dropped DLL
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1388
-
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\rk462972.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\rk462972.exe3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
PID:916
-
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
536KB
MD5ea2eedcb44a2458016f322aea377d348
SHA1c832581e0a3467813ce85cf2d9dfb985351368d0
SHA256768115576168dec02ae6c7565384b82161b4908130d7463e2047eb561f0bd78c
SHA512168850465ba0efcb547afd2759dcf755f60a8d0d36d72680e9b69517677ad1bfe88e0c96fa5f3d9406719b87eda9e9a569afb31b43e2de4153ac5c4ec0e19baa
-
Filesize
536KB
MD5ea2eedcb44a2458016f322aea377d348
SHA1c832581e0a3467813ce85cf2d9dfb985351368d0
SHA256768115576168dec02ae6c7565384b82161b4908130d7463e2047eb561f0bd78c
SHA512168850465ba0efcb547afd2759dcf755f60a8d0d36d72680e9b69517677ad1bfe88e0c96fa5f3d9406719b87eda9e9a569afb31b43e2de4153ac5c4ec0e19baa
-
Filesize
258KB
MD5c98580790ed4b813cef3355fc63b57ba
SHA18bfeea54109d30d5171abec7c1604f5fa36a958b
SHA2569b222804e2d805b64db13d9cf8baaa658a44fe830336fae5fd0ce455c9e57fd0
SHA512962946757db26857e2e8c70a1c822c1dcda5a6f4953176d32561ad27cfef699346c92826a692b203f4ae67dcad5f43f64e575d7437b257560612a7dec069490c
-
Filesize
258KB
MD5c98580790ed4b813cef3355fc63b57ba
SHA18bfeea54109d30d5171abec7c1604f5fa36a958b
SHA2569b222804e2d805b64db13d9cf8baaa658a44fe830336fae5fd0ce455c9e57fd0
SHA512962946757db26857e2e8c70a1c822c1dcda5a6f4953176d32561ad27cfef699346c92826a692b203f4ae67dcad5f43f64e575d7437b257560612a7dec069490c
-
Filesize
258KB
MD5c98580790ed4b813cef3355fc63b57ba
SHA18bfeea54109d30d5171abec7c1604f5fa36a958b
SHA2569b222804e2d805b64db13d9cf8baaa658a44fe830336fae5fd0ce455c9e57fd0
SHA512962946757db26857e2e8c70a1c822c1dcda5a6f4953176d32561ad27cfef699346c92826a692b203f4ae67dcad5f43f64e575d7437b257560612a7dec069490c
-
Filesize
341KB
MD5c89e5faadd68d16103ef7decffd06e07
SHA192ea11a3380a0b955d8cb798aeaabaf7e44c6bcf
SHA256bfabf63cdcd7f88f339721af88cbd2c426fa15940a016d3a0b252862867214d9
SHA512cfe6b76cec8339d0d5fb4d7177e503bcfd51e7cd3bc6e469af81ad5f1685561745a5213f0d94bb190fe0a6ffa3dce37b06552ec94a66261100aab074b60fd97b
-
Filesize
341KB
MD5c89e5faadd68d16103ef7decffd06e07
SHA192ea11a3380a0b955d8cb798aeaabaf7e44c6bcf
SHA256bfabf63cdcd7f88f339721af88cbd2c426fa15940a016d3a0b252862867214d9
SHA512cfe6b76cec8339d0d5fb4d7177e503bcfd51e7cd3bc6e469af81ad5f1685561745a5213f0d94bb190fe0a6ffa3dce37b06552ec94a66261100aab074b60fd97b
-
Filesize
341KB
MD5c89e5faadd68d16103ef7decffd06e07
SHA192ea11a3380a0b955d8cb798aeaabaf7e44c6bcf
SHA256bfabf63cdcd7f88f339721af88cbd2c426fa15940a016d3a0b252862867214d9
SHA512cfe6b76cec8339d0d5fb4d7177e503bcfd51e7cd3bc6e469af81ad5f1685561745a5213f0d94bb190fe0a6ffa3dce37b06552ec94a66261100aab074b60fd97b
-
Filesize
536KB
MD5ea2eedcb44a2458016f322aea377d348
SHA1c832581e0a3467813ce85cf2d9dfb985351368d0
SHA256768115576168dec02ae6c7565384b82161b4908130d7463e2047eb561f0bd78c
SHA512168850465ba0efcb547afd2759dcf755f60a8d0d36d72680e9b69517677ad1bfe88e0c96fa5f3d9406719b87eda9e9a569afb31b43e2de4153ac5c4ec0e19baa
-
Filesize
536KB
MD5ea2eedcb44a2458016f322aea377d348
SHA1c832581e0a3467813ce85cf2d9dfb985351368d0
SHA256768115576168dec02ae6c7565384b82161b4908130d7463e2047eb561f0bd78c
SHA512168850465ba0efcb547afd2759dcf755f60a8d0d36d72680e9b69517677ad1bfe88e0c96fa5f3d9406719b87eda9e9a569afb31b43e2de4153ac5c4ec0e19baa
-
Filesize
258KB
MD5c98580790ed4b813cef3355fc63b57ba
SHA18bfeea54109d30d5171abec7c1604f5fa36a958b
SHA2569b222804e2d805b64db13d9cf8baaa658a44fe830336fae5fd0ce455c9e57fd0
SHA512962946757db26857e2e8c70a1c822c1dcda5a6f4953176d32561ad27cfef699346c92826a692b203f4ae67dcad5f43f64e575d7437b257560612a7dec069490c
-
Filesize
258KB
MD5c98580790ed4b813cef3355fc63b57ba
SHA18bfeea54109d30d5171abec7c1604f5fa36a958b
SHA2569b222804e2d805b64db13d9cf8baaa658a44fe830336fae5fd0ce455c9e57fd0
SHA512962946757db26857e2e8c70a1c822c1dcda5a6f4953176d32561ad27cfef699346c92826a692b203f4ae67dcad5f43f64e575d7437b257560612a7dec069490c
-
Filesize
258KB
MD5c98580790ed4b813cef3355fc63b57ba
SHA18bfeea54109d30d5171abec7c1604f5fa36a958b
SHA2569b222804e2d805b64db13d9cf8baaa658a44fe830336fae5fd0ce455c9e57fd0
SHA512962946757db26857e2e8c70a1c822c1dcda5a6f4953176d32561ad27cfef699346c92826a692b203f4ae67dcad5f43f64e575d7437b257560612a7dec069490c
-
Filesize
341KB
MD5c89e5faadd68d16103ef7decffd06e07
SHA192ea11a3380a0b955d8cb798aeaabaf7e44c6bcf
SHA256bfabf63cdcd7f88f339721af88cbd2c426fa15940a016d3a0b252862867214d9
SHA512cfe6b76cec8339d0d5fb4d7177e503bcfd51e7cd3bc6e469af81ad5f1685561745a5213f0d94bb190fe0a6ffa3dce37b06552ec94a66261100aab074b60fd97b
-
Filesize
341KB
MD5c89e5faadd68d16103ef7decffd06e07
SHA192ea11a3380a0b955d8cb798aeaabaf7e44c6bcf
SHA256bfabf63cdcd7f88f339721af88cbd2c426fa15940a016d3a0b252862867214d9
SHA512cfe6b76cec8339d0d5fb4d7177e503bcfd51e7cd3bc6e469af81ad5f1685561745a5213f0d94bb190fe0a6ffa3dce37b06552ec94a66261100aab074b60fd97b
-
Filesize
341KB
MD5c89e5faadd68d16103ef7decffd06e07
SHA192ea11a3380a0b955d8cb798aeaabaf7e44c6bcf
SHA256bfabf63cdcd7f88f339721af88cbd2c426fa15940a016d3a0b252862867214d9
SHA512cfe6b76cec8339d0d5fb4d7177e503bcfd51e7cd3bc6e469af81ad5f1685561745a5213f0d94bb190fe0a6ffa3dce37b06552ec94a66261100aab074b60fd97b