Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    148s
  • max time network
    153s
  • platform
    windows7_x64
  • resource
    win7-20230220-en
  • resource tags

    arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
  • submitted
    06/05/2023, 21:52

General

  • Target

    50409bbf2696d231f352a1a1c517196f9030e0f4e8b9a3698141a838b81bd78b.exe

  • Size

    690KB

  • MD5

    2db13383df88cddde2b8d7a2f9e9378a

  • SHA1

    9a482506a699339250c832fc3636697040a7b77f

  • SHA256

    50409bbf2696d231f352a1a1c517196f9030e0f4e8b9a3698141a838b81bd78b

  • SHA512

    00fbe2a8b74bfec01cd9997d624a9ab89fdc5bdecbe63c0277aeaff57ad9ed547e82d8cb975576b0f20d2fe58c5d05c7a247fc7f83a4d711d0a1bd169bf1dee3

  • SSDEEP

    12288:/y90uQpuxOE4ELPcPj3jqkfRkVP1Jr+s9P+LMGXniNom2k+lrIVR:/yEsJhoTjqGRuSsoONHUra

Malware Config

Signatures

  • Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs
  • Executes dropped EXE 3 IoCs
  • Loads dropped DLL 8 IoCs
  • Windows security modification 2 TTPs 2 IoCs
  • Adds Run key to start application 2 TTPs 4 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 21 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\50409bbf2696d231f352a1a1c517196f9030e0f4e8b9a3698141a838b81bd78b.exe
    "C:\Users\Admin\AppData\Local\Temp\50409bbf2696d231f352a1a1c517196f9030e0f4e8b9a3698141a838b81bd78b.exe"
    1⤵
    • Loads dropped DLL
    • Adds Run key to start application
    • Suspicious use of WriteProcessMemory
    PID:1520
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un738470.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un738470.exe
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Adds Run key to start application
      • Suspicious use of WriteProcessMemory
      PID:908
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\04730777.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\04730777.exe
        3⤵
        • Modifies Windows Defender Real-time Protection settings
        • Executes dropped EXE
        • Loads dropped DLL
        • Windows security modification
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:1044
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\rk837966.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\rk837966.exe
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Suspicious use of AdjustPrivilegeToken
        PID:1248

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un738470.exe

    Filesize

    536KB

    MD5

    39a2ae7955df9d9f31dd64f4a2658ad6

    SHA1

    c1739805734774871582917e465e65134ba500ef

    SHA256

    a9f98f2b765d3adbed9ac08b80da1edc11f5733d6793f640e5ea9cda812c4e8c

    SHA512

    a1afee22fa3f5836e4a331043dcb50af1f0a9508baf1bc427fef1d69781d367546fa24a9d56f1912abe54891e7e5ab3b491256d100b415565c66e1f6c14ebdb8

  • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un738470.exe

    Filesize

    536KB

    MD5

    39a2ae7955df9d9f31dd64f4a2658ad6

    SHA1

    c1739805734774871582917e465e65134ba500ef

    SHA256

    a9f98f2b765d3adbed9ac08b80da1edc11f5733d6793f640e5ea9cda812c4e8c

    SHA512

    a1afee22fa3f5836e4a331043dcb50af1f0a9508baf1bc427fef1d69781d367546fa24a9d56f1912abe54891e7e5ab3b491256d100b415565c66e1f6c14ebdb8

  • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\04730777.exe

    Filesize

    258KB

    MD5

    b5fdf24a9e7eaf585c081960b8240458

    SHA1

    8b17be5797391c97909b9622ddcd1486193cab55

    SHA256

    fbb53a4cd704ff34b81b9def0da4e6b014fb90b0b56a61f151c30bee002b7bda

    SHA512

    765e9774df21fac1b58cdfa00d189800e03c7e7be62e033d52be1b356ce488040e14b1fb9e0e3f3ca484b1c0fc841e467de624befbd343e0df7ee73b3a7503b1

  • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\04730777.exe

    Filesize

    258KB

    MD5

    b5fdf24a9e7eaf585c081960b8240458

    SHA1

    8b17be5797391c97909b9622ddcd1486193cab55

    SHA256

    fbb53a4cd704ff34b81b9def0da4e6b014fb90b0b56a61f151c30bee002b7bda

    SHA512

    765e9774df21fac1b58cdfa00d189800e03c7e7be62e033d52be1b356ce488040e14b1fb9e0e3f3ca484b1c0fc841e467de624befbd343e0df7ee73b3a7503b1

  • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\04730777.exe

    Filesize

    258KB

    MD5

    b5fdf24a9e7eaf585c081960b8240458

    SHA1

    8b17be5797391c97909b9622ddcd1486193cab55

    SHA256

    fbb53a4cd704ff34b81b9def0da4e6b014fb90b0b56a61f151c30bee002b7bda

    SHA512

    765e9774df21fac1b58cdfa00d189800e03c7e7be62e033d52be1b356ce488040e14b1fb9e0e3f3ca484b1c0fc841e467de624befbd343e0df7ee73b3a7503b1

  • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\rk837966.exe

    Filesize

    341KB

    MD5

    061550f87d822e0717a1ca8f0e4b3ef0

    SHA1

    df757e025f786db975891a92a5bc70f96275c47d

    SHA256

    9782370baea374f43a3df3491babbe10b4421cbeca3d2c475957e1da9d26a529

    SHA512

    4970becb8ce833f27285fc4dcbcada69ceb2f81937b3a598fb786a4d643897043d565d41e3b3f2ae69ca751da1416bd66db46d206cf317cad75db95ceb32bc30

  • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\rk837966.exe

    Filesize

    341KB

    MD5

    061550f87d822e0717a1ca8f0e4b3ef0

    SHA1

    df757e025f786db975891a92a5bc70f96275c47d

    SHA256

    9782370baea374f43a3df3491babbe10b4421cbeca3d2c475957e1da9d26a529

    SHA512

    4970becb8ce833f27285fc4dcbcada69ceb2f81937b3a598fb786a4d643897043d565d41e3b3f2ae69ca751da1416bd66db46d206cf317cad75db95ceb32bc30

  • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\rk837966.exe

    Filesize

    341KB

    MD5

    061550f87d822e0717a1ca8f0e4b3ef0

    SHA1

    df757e025f786db975891a92a5bc70f96275c47d

    SHA256

    9782370baea374f43a3df3491babbe10b4421cbeca3d2c475957e1da9d26a529

    SHA512

    4970becb8ce833f27285fc4dcbcada69ceb2f81937b3a598fb786a4d643897043d565d41e3b3f2ae69ca751da1416bd66db46d206cf317cad75db95ceb32bc30

  • \Users\Admin\AppData\Local\Temp\IXP000.TMP\un738470.exe

    Filesize

    536KB

    MD5

    39a2ae7955df9d9f31dd64f4a2658ad6

    SHA1

    c1739805734774871582917e465e65134ba500ef

    SHA256

    a9f98f2b765d3adbed9ac08b80da1edc11f5733d6793f640e5ea9cda812c4e8c

    SHA512

    a1afee22fa3f5836e4a331043dcb50af1f0a9508baf1bc427fef1d69781d367546fa24a9d56f1912abe54891e7e5ab3b491256d100b415565c66e1f6c14ebdb8

  • \Users\Admin\AppData\Local\Temp\IXP000.TMP\un738470.exe

    Filesize

    536KB

    MD5

    39a2ae7955df9d9f31dd64f4a2658ad6

    SHA1

    c1739805734774871582917e465e65134ba500ef

    SHA256

    a9f98f2b765d3adbed9ac08b80da1edc11f5733d6793f640e5ea9cda812c4e8c

    SHA512

    a1afee22fa3f5836e4a331043dcb50af1f0a9508baf1bc427fef1d69781d367546fa24a9d56f1912abe54891e7e5ab3b491256d100b415565c66e1f6c14ebdb8

  • \Users\Admin\AppData\Local\Temp\IXP001.TMP\04730777.exe

    Filesize

    258KB

    MD5

    b5fdf24a9e7eaf585c081960b8240458

    SHA1

    8b17be5797391c97909b9622ddcd1486193cab55

    SHA256

    fbb53a4cd704ff34b81b9def0da4e6b014fb90b0b56a61f151c30bee002b7bda

    SHA512

    765e9774df21fac1b58cdfa00d189800e03c7e7be62e033d52be1b356ce488040e14b1fb9e0e3f3ca484b1c0fc841e467de624befbd343e0df7ee73b3a7503b1

  • \Users\Admin\AppData\Local\Temp\IXP001.TMP\04730777.exe

    Filesize

    258KB

    MD5

    b5fdf24a9e7eaf585c081960b8240458

    SHA1

    8b17be5797391c97909b9622ddcd1486193cab55

    SHA256

    fbb53a4cd704ff34b81b9def0da4e6b014fb90b0b56a61f151c30bee002b7bda

    SHA512

    765e9774df21fac1b58cdfa00d189800e03c7e7be62e033d52be1b356ce488040e14b1fb9e0e3f3ca484b1c0fc841e467de624befbd343e0df7ee73b3a7503b1

  • \Users\Admin\AppData\Local\Temp\IXP001.TMP\04730777.exe

    Filesize

    258KB

    MD5

    b5fdf24a9e7eaf585c081960b8240458

    SHA1

    8b17be5797391c97909b9622ddcd1486193cab55

    SHA256

    fbb53a4cd704ff34b81b9def0da4e6b014fb90b0b56a61f151c30bee002b7bda

    SHA512

    765e9774df21fac1b58cdfa00d189800e03c7e7be62e033d52be1b356ce488040e14b1fb9e0e3f3ca484b1c0fc841e467de624befbd343e0df7ee73b3a7503b1

  • \Users\Admin\AppData\Local\Temp\IXP001.TMP\rk837966.exe

    Filesize

    341KB

    MD5

    061550f87d822e0717a1ca8f0e4b3ef0

    SHA1

    df757e025f786db975891a92a5bc70f96275c47d

    SHA256

    9782370baea374f43a3df3491babbe10b4421cbeca3d2c475957e1da9d26a529

    SHA512

    4970becb8ce833f27285fc4dcbcada69ceb2f81937b3a598fb786a4d643897043d565d41e3b3f2ae69ca751da1416bd66db46d206cf317cad75db95ceb32bc30

  • \Users\Admin\AppData\Local\Temp\IXP001.TMP\rk837966.exe

    Filesize

    341KB

    MD5

    061550f87d822e0717a1ca8f0e4b3ef0

    SHA1

    df757e025f786db975891a92a5bc70f96275c47d

    SHA256

    9782370baea374f43a3df3491babbe10b4421cbeca3d2c475957e1da9d26a529

    SHA512

    4970becb8ce833f27285fc4dcbcada69ceb2f81937b3a598fb786a4d643897043d565d41e3b3f2ae69ca751da1416bd66db46d206cf317cad75db95ceb32bc30

  • \Users\Admin\AppData\Local\Temp\IXP001.TMP\rk837966.exe

    Filesize

    341KB

    MD5

    061550f87d822e0717a1ca8f0e4b3ef0

    SHA1

    df757e025f786db975891a92a5bc70f96275c47d

    SHA256

    9782370baea374f43a3df3491babbe10b4421cbeca3d2c475957e1da9d26a529

    SHA512

    4970becb8ce833f27285fc4dcbcada69ceb2f81937b3a598fb786a4d643897043d565d41e3b3f2ae69ca751da1416bd66db46d206cf317cad75db95ceb32bc30

  • memory/1044-110-0x0000000000400000-0x0000000000455000-memory.dmp

    Filesize

    340KB

  • memory/1044-89-0x00000000020B0000-0x00000000020C3000-memory.dmp

    Filesize

    76KB

  • memory/1044-91-0x00000000020B0000-0x00000000020C3000-memory.dmp

    Filesize

    76KB

  • memory/1044-93-0x00000000020B0000-0x00000000020C3000-memory.dmp

    Filesize

    76KB

  • memory/1044-95-0x00000000020B0000-0x00000000020C3000-memory.dmp

    Filesize

    76KB

  • memory/1044-97-0x00000000020B0000-0x00000000020C3000-memory.dmp

    Filesize

    76KB

  • memory/1044-99-0x00000000020B0000-0x00000000020C3000-memory.dmp

    Filesize

    76KB

  • memory/1044-101-0x00000000020B0000-0x00000000020C3000-memory.dmp

    Filesize

    76KB

  • memory/1044-103-0x00000000020B0000-0x00000000020C3000-memory.dmp

    Filesize

    76KB

  • memory/1044-107-0x00000000020B0000-0x00000000020C3000-memory.dmp

    Filesize

    76KB

  • memory/1044-105-0x00000000020B0000-0x00000000020C3000-memory.dmp

    Filesize

    76KB

  • memory/1044-108-0x00000000002A0000-0x00000000002CD000-memory.dmp

    Filesize

    180KB

  • memory/1044-109-0x00000000048E0000-0x0000000004920000-memory.dmp

    Filesize

    256KB

  • memory/1044-87-0x00000000020B0000-0x00000000020C3000-memory.dmp

    Filesize

    76KB

  • memory/1044-113-0x0000000000400000-0x0000000000455000-memory.dmp

    Filesize

    340KB

  • memory/1044-85-0x00000000020B0000-0x00000000020C3000-memory.dmp

    Filesize

    76KB

  • memory/1044-83-0x00000000020B0000-0x00000000020C3000-memory.dmp

    Filesize

    76KB

  • memory/1044-81-0x00000000020B0000-0x00000000020C3000-memory.dmp

    Filesize

    76KB

  • memory/1044-80-0x00000000020B0000-0x00000000020C3000-memory.dmp

    Filesize

    76KB

  • memory/1044-79-0x00000000020B0000-0x00000000020C8000-memory.dmp

    Filesize

    96KB

  • memory/1044-78-0x0000000001F40000-0x0000000001F5A000-memory.dmp

    Filesize

    104KB

  • memory/1248-126-0x0000000000290000-0x00000000002D6000-memory.dmp

    Filesize

    280KB

  • memory/1248-141-0x0000000002130000-0x0000000002165000-memory.dmp

    Filesize

    212KB

  • memory/1248-124-0x0000000000A70000-0x0000000000AAC000-memory.dmp

    Filesize

    240KB

  • memory/1248-127-0x0000000004C30000-0x0000000004C70000-memory.dmp

    Filesize

    256KB

  • memory/1248-128-0x0000000002130000-0x0000000002165000-memory.dmp

    Filesize

    212KB

  • memory/1248-129-0x0000000002130000-0x0000000002165000-memory.dmp

    Filesize

    212KB

  • memory/1248-131-0x0000000002130000-0x0000000002165000-memory.dmp

    Filesize

    212KB

  • memory/1248-133-0x0000000002130000-0x0000000002165000-memory.dmp

    Filesize

    212KB

  • memory/1248-135-0x0000000002130000-0x0000000002165000-memory.dmp

    Filesize

    212KB

  • memory/1248-137-0x0000000002130000-0x0000000002165000-memory.dmp

    Filesize

    212KB

  • memory/1248-139-0x0000000002130000-0x0000000002165000-memory.dmp

    Filesize

    212KB

  • memory/1248-125-0x0000000002130000-0x000000000216A000-memory.dmp

    Filesize

    232KB

  • memory/1248-143-0x0000000002130000-0x0000000002165000-memory.dmp

    Filesize

    212KB

  • memory/1248-145-0x0000000002130000-0x0000000002165000-memory.dmp

    Filesize

    212KB

  • memory/1248-147-0x0000000002130000-0x0000000002165000-memory.dmp

    Filesize

    212KB

  • memory/1248-149-0x0000000002130000-0x0000000002165000-memory.dmp

    Filesize

    212KB

  • memory/1248-151-0x0000000002130000-0x0000000002165000-memory.dmp

    Filesize

    212KB

  • memory/1248-153-0x0000000002130000-0x0000000002165000-memory.dmp

    Filesize

    212KB

  • memory/1248-155-0x0000000002130000-0x0000000002165000-memory.dmp

    Filesize

    212KB

  • memory/1248-157-0x0000000002130000-0x0000000002165000-memory.dmp

    Filesize

    212KB

  • memory/1248-159-0x0000000002130000-0x0000000002165000-memory.dmp

    Filesize

    212KB

  • memory/1248-920-0x0000000004C30000-0x0000000004C70000-memory.dmp

    Filesize

    256KB

  • memory/1248-922-0x0000000004C30000-0x0000000004C70000-memory.dmp

    Filesize

    256KB

  • memory/1248-924-0x0000000004C30000-0x0000000004C70000-memory.dmp

    Filesize

    256KB