Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
182s -
max time network
199s -
platform
windows7_x64 -
resource
win7-20230220-en -
resource tags
arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system -
submitted
06/05/2023, 21:30
Static task
static1
Behavioral task
behavioral1
Sample
3ed5abdf67304313b3f5ea78b98989c167625626de2561545f1beb0e90429abd.exe
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
3ed5abdf67304313b3f5ea78b98989c167625626de2561545f1beb0e90429abd.exe
Resource
win10v2004-20230220-en
General
-
Target
3ed5abdf67304313b3f5ea78b98989c167625626de2561545f1beb0e90429abd.exe
-
Size
562KB
-
MD5
e98081e91340b5cc4caaa48877cf20e7
-
SHA1
1328e5ac751e7ba38c3f4f0c5a67b2014db72353
-
SHA256
3ed5abdf67304313b3f5ea78b98989c167625626de2561545f1beb0e90429abd
-
SHA512
76b5b812e1aafcacc2f3f8338a910a144c065209d2f624a3f59d42e372875fc5e35f4aba197fa79e0b7b2e85a01a6e207d175fe2b7a3863060dfc7d5fbaace6d
-
SSDEEP
12288:Cy90BTyDVWsynjx0LwEqagoSSIg7FDDxgHayNJ:Cybwsynjx0oaLSfgnGHayT
Malware Config
Signatures
-
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" 02066801.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" 02066801.exe Key created \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection 02066801.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" 02066801.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" 02066801.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" 02066801.exe -
Executes dropped EXE 3 IoCs
pid Process 1520 st481813.exe 468 02066801.exe 520 kp796796.exe -
Loads dropped DLL 6 IoCs
pid Process 1808 3ed5abdf67304313b3f5ea78b98989c167625626de2561545f1beb0e90429abd.exe 1520 st481813.exe 1520 st481813.exe 1520 st481813.exe 1520 st481813.exe 520 kp796796.exe -
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features 02066801.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0" 02066801.exe -
Adds Run key to start application 2 TTPs 4 IoCs
description ioc Process Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce st481813.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" st481813.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce 3ed5abdf67304313b3f5ea78b98989c167625626de2561545f1beb0e90429abd.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" 3ed5abdf67304313b3f5ea78b98989c167625626de2561545f1beb0e90429abd.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 468 02066801.exe 468 02066801.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 468 02066801.exe Token: SeDebugPrivilege 520 kp796796.exe -
Suspicious use of WriteProcessMemory 21 IoCs
description pid Process procid_target PID 1808 wrote to memory of 1520 1808 3ed5abdf67304313b3f5ea78b98989c167625626de2561545f1beb0e90429abd.exe 28 PID 1808 wrote to memory of 1520 1808 3ed5abdf67304313b3f5ea78b98989c167625626de2561545f1beb0e90429abd.exe 28 PID 1808 wrote to memory of 1520 1808 3ed5abdf67304313b3f5ea78b98989c167625626de2561545f1beb0e90429abd.exe 28 PID 1808 wrote to memory of 1520 1808 3ed5abdf67304313b3f5ea78b98989c167625626de2561545f1beb0e90429abd.exe 28 PID 1808 wrote to memory of 1520 1808 3ed5abdf67304313b3f5ea78b98989c167625626de2561545f1beb0e90429abd.exe 28 PID 1808 wrote to memory of 1520 1808 3ed5abdf67304313b3f5ea78b98989c167625626de2561545f1beb0e90429abd.exe 28 PID 1808 wrote to memory of 1520 1808 3ed5abdf67304313b3f5ea78b98989c167625626de2561545f1beb0e90429abd.exe 28 PID 1520 wrote to memory of 468 1520 st481813.exe 29 PID 1520 wrote to memory of 468 1520 st481813.exe 29 PID 1520 wrote to memory of 468 1520 st481813.exe 29 PID 1520 wrote to memory of 468 1520 st481813.exe 29 PID 1520 wrote to memory of 468 1520 st481813.exe 29 PID 1520 wrote to memory of 468 1520 st481813.exe 29 PID 1520 wrote to memory of 468 1520 st481813.exe 29 PID 1520 wrote to memory of 520 1520 st481813.exe 30 PID 1520 wrote to memory of 520 1520 st481813.exe 30 PID 1520 wrote to memory of 520 1520 st481813.exe 30 PID 1520 wrote to memory of 520 1520 st481813.exe 30 PID 1520 wrote to memory of 520 1520 st481813.exe 30 PID 1520 wrote to memory of 520 1520 st481813.exe 30 PID 1520 wrote to memory of 520 1520 st481813.exe 30
Processes
-
C:\Users\Admin\AppData\Local\Temp\3ed5abdf67304313b3f5ea78b98989c167625626de2561545f1beb0e90429abd.exe"C:\Users\Admin\AppData\Local\Temp\3ed5abdf67304313b3f5ea78b98989c167625626de2561545f1beb0e90429abd.exe"1⤵
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:1808 -
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\st481813.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\st481813.exe2⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:1520 -
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\02066801.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\02066801.exe3⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:468
-
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\kp796796.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\kp796796.exe3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
PID:520
-
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
408KB
MD5d075f20ce4530356727a30450b5a1ded
SHA13406c849d200c1ec024deb597cd3b3716675647f
SHA256df7626b8100f94147bc73f441e68d3c5368193f9290581527a8514066332e5ea
SHA5129e847d02534d2c5c841aab964df635a6c6e64281b42b2ce6f0cf52195ee47320670f3b6b0be633792d2bef785210b87211ad0446c437e06569931a9980cf1aa0
-
Filesize
408KB
MD5d075f20ce4530356727a30450b5a1ded
SHA13406c849d200c1ec024deb597cd3b3716675647f
SHA256df7626b8100f94147bc73f441e68d3c5368193f9290581527a8514066332e5ea
SHA5129e847d02534d2c5c841aab964df635a6c6e64281b42b2ce6f0cf52195ee47320670f3b6b0be633792d2bef785210b87211ad0446c437e06569931a9980cf1aa0
-
Filesize
11KB
MD57e93bacbbc33e6652e147e7fe07572a0
SHA1421a7167da01c8da4dc4d5234ca3dd84e319e762
SHA256850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38
SHA512250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91
-
Filesize
11KB
MD57e93bacbbc33e6652e147e7fe07572a0
SHA1421a7167da01c8da4dc4d5234ca3dd84e319e762
SHA256850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38
SHA512250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91
-
Filesize
360KB
MD50bb22334ea9e431a054065d58b3fc055
SHA18d2b6e4db43234309bc23af2d87f29a64eafa768
SHA256a4eca3b9251218fc5b4f0cfbfcb88da5ee46c68cf7da5bdc8924f3b5a3a740a1
SHA512ec656d61f8f0fae1e9c18e2b9521309e1f4f4f3c8b140526ab6a56216ad48451fc230d46969bcb292f4d3465327ca3b05b36b26bc99bf9f40089d8c14f6ebf86
-
Filesize
360KB
MD50bb22334ea9e431a054065d58b3fc055
SHA18d2b6e4db43234309bc23af2d87f29a64eafa768
SHA256a4eca3b9251218fc5b4f0cfbfcb88da5ee46c68cf7da5bdc8924f3b5a3a740a1
SHA512ec656d61f8f0fae1e9c18e2b9521309e1f4f4f3c8b140526ab6a56216ad48451fc230d46969bcb292f4d3465327ca3b05b36b26bc99bf9f40089d8c14f6ebf86
-
Filesize
360KB
MD50bb22334ea9e431a054065d58b3fc055
SHA18d2b6e4db43234309bc23af2d87f29a64eafa768
SHA256a4eca3b9251218fc5b4f0cfbfcb88da5ee46c68cf7da5bdc8924f3b5a3a740a1
SHA512ec656d61f8f0fae1e9c18e2b9521309e1f4f4f3c8b140526ab6a56216ad48451fc230d46969bcb292f4d3465327ca3b05b36b26bc99bf9f40089d8c14f6ebf86
-
Filesize
408KB
MD5d075f20ce4530356727a30450b5a1ded
SHA13406c849d200c1ec024deb597cd3b3716675647f
SHA256df7626b8100f94147bc73f441e68d3c5368193f9290581527a8514066332e5ea
SHA5129e847d02534d2c5c841aab964df635a6c6e64281b42b2ce6f0cf52195ee47320670f3b6b0be633792d2bef785210b87211ad0446c437e06569931a9980cf1aa0
-
Filesize
408KB
MD5d075f20ce4530356727a30450b5a1ded
SHA13406c849d200c1ec024deb597cd3b3716675647f
SHA256df7626b8100f94147bc73f441e68d3c5368193f9290581527a8514066332e5ea
SHA5129e847d02534d2c5c841aab964df635a6c6e64281b42b2ce6f0cf52195ee47320670f3b6b0be633792d2bef785210b87211ad0446c437e06569931a9980cf1aa0
-
Filesize
11KB
MD57e93bacbbc33e6652e147e7fe07572a0
SHA1421a7167da01c8da4dc4d5234ca3dd84e319e762
SHA256850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38
SHA512250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91
-
Filesize
360KB
MD50bb22334ea9e431a054065d58b3fc055
SHA18d2b6e4db43234309bc23af2d87f29a64eafa768
SHA256a4eca3b9251218fc5b4f0cfbfcb88da5ee46c68cf7da5bdc8924f3b5a3a740a1
SHA512ec656d61f8f0fae1e9c18e2b9521309e1f4f4f3c8b140526ab6a56216ad48451fc230d46969bcb292f4d3465327ca3b05b36b26bc99bf9f40089d8c14f6ebf86
-
Filesize
360KB
MD50bb22334ea9e431a054065d58b3fc055
SHA18d2b6e4db43234309bc23af2d87f29a64eafa768
SHA256a4eca3b9251218fc5b4f0cfbfcb88da5ee46c68cf7da5bdc8924f3b5a3a740a1
SHA512ec656d61f8f0fae1e9c18e2b9521309e1f4f4f3c8b140526ab6a56216ad48451fc230d46969bcb292f4d3465327ca3b05b36b26bc99bf9f40089d8c14f6ebf86
-
Filesize
360KB
MD50bb22334ea9e431a054065d58b3fc055
SHA18d2b6e4db43234309bc23af2d87f29a64eafa768
SHA256a4eca3b9251218fc5b4f0cfbfcb88da5ee46c68cf7da5bdc8924f3b5a3a740a1
SHA512ec656d61f8f0fae1e9c18e2b9521309e1f4f4f3c8b140526ab6a56216ad48451fc230d46969bcb292f4d3465327ca3b05b36b26bc99bf9f40089d8c14f6ebf86