Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    151s
  • max time network
    156s
  • platform
    windows7_x64
  • resource
    win7-20230220-en
  • resource tags

    arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
  • submitted
    06/05/2023, 21:57

General

  • Target

    543ab68b1c5fce8df32ebb02dcd900640cb27b668bfb625502cf08de87217362.exe

  • Size

    690KB

  • MD5

    f0c7cd4460a3b7348cfdc30280f86d83

  • SHA1

    322bcd748f0d54ac2e17eb115ebd74d62b7d3f71

  • SHA256

    543ab68b1c5fce8df32ebb02dcd900640cb27b668bfb625502cf08de87217362

  • SHA512

    6493463afb574586411d80eda07a8ed0e99afc032c1477497fb175139617b894029a615f4f64408bec9bde1abbcb75ed6ec042de825623a977e6b7f6cd635989

  • SSDEEP

    12288:zy90z7fXrWmm6RlMIQDgXxMIcRIO/QxDTT8WNzOvfV0f:zyaXrWL6Rl4sNcsxDTTxNSCf

Malware Config

Signatures

  • Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs
  • Executes dropped EXE 3 IoCs
  • Loads dropped DLL 8 IoCs
  • Windows security modification 2 TTPs 2 IoCs
  • Adds Run key to start application 2 TTPs 4 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 21 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\543ab68b1c5fce8df32ebb02dcd900640cb27b668bfb625502cf08de87217362.exe
    "C:\Users\Admin\AppData\Local\Temp\543ab68b1c5fce8df32ebb02dcd900640cb27b668bfb625502cf08de87217362.exe"
    1⤵
    • Loads dropped DLL
    • Adds Run key to start application
    • Suspicious use of WriteProcessMemory
    PID:1084
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un404914.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un404914.exe
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Adds Run key to start application
      • Suspicious use of WriteProcessMemory
      PID:2024
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\99460676.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\99460676.exe
        3⤵
        • Modifies Windows Defender Real-time Protection settings
        • Executes dropped EXE
        • Loads dropped DLL
        • Windows security modification
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:1296
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\rk643771.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\rk643771.exe
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Suspicious use of AdjustPrivilegeToken
        PID:940

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un404914.exe

    Filesize

    536KB

    MD5

    1fac8401900d1073942473422a13ce73

    SHA1

    2107b2442619d14db6d9402287b1af87da89e4fb

    SHA256

    149b061432fb6ce4ad435e36826d9edbf42af2c10c6d9dd2ad3e917c0849acb6

    SHA512

    db61da7aad22360dd360a3a0bedc3c83fe18c01f0e4432d16bf4bebe7656053e1e3cb4ea5089650dcd18eddb765acf21290317fadcd825c8b28396ed73dee865

  • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un404914.exe

    Filesize

    536KB

    MD5

    1fac8401900d1073942473422a13ce73

    SHA1

    2107b2442619d14db6d9402287b1af87da89e4fb

    SHA256

    149b061432fb6ce4ad435e36826d9edbf42af2c10c6d9dd2ad3e917c0849acb6

    SHA512

    db61da7aad22360dd360a3a0bedc3c83fe18c01f0e4432d16bf4bebe7656053e1e3cb4ea5089650dcd18eddb765acf21290317fadcd825c8b28396ed73dee865

  • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\99460676.exe

    Filesize

    259KB

    MD5

    f61893cc078c077e01b6d57875896e7b

    SHA1

    c1a978f44fc0a97dab5dfb857c3e30b5d8371827

    SHA256

    ec20e19320faf045b6e71036a8d7e9722ccb3bcc5ee64e0722e9eab22f14e1ad

    SHA512

    2be84ddef93d499e23588617c4267b1488ccb7bb8fde5c85869bef120c91b1051fe666c28df4b466abc5e37159ef9d6adf0f17bb67540d3a0c0d7c1b82480bea

  • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\99460676.exe

    Filesize

    259KB

    MD5

    f61893cc078c077e01b6d57875896e7b

    SHA1

    c1a978f44fc0a97dab5dfb857c3e30b5d8371827

    SHA256

    ec20e19320faf045b6e71036a8d7e9722ccb3bcc5ee64e0722e9eab22f14e1ad

    SHA512

    2be84ddef93d499e23588617c4267b1488ccb7bb8fde5c85869bef120c91b1051fe666c28df4b466abc5e37159ef9d6adf0f17bb67540d3a0c0d7c1b82480bea

  • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\99460676.exe

    Filesize

    259KB

    MD5

    f61893cc078c077e01b6d57875896e7b

    SHA1

    c1a978f44fc0a97dab5dfb857c3e30b5d8371827

    SHA256

    ec20e19320faf045b6e71036a8d7e9722ccb3bcc5ee64e0722e9eab22f14e1ad

    SHA512

    2be84ddef93d499e23588617c4267b1488ccb7bb8fde5c85869bef120c91b1051fe666c28df4b466abc5e37159ef9d6adf0f17bb67540d3a0c0d7c1b82480bea

  • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\rk643771.exe

    Filesize

    342KB

    MD5

    54788af31813c06410ee6f6096fe8bcd

    SHA1

    2d65f80e18c7b645c64f8cad06195fba7e20b834

    SHA256

    a162e6edf7956289cda2bd07e1f15491beb15b7ef56c0f9bbae2ad5dd6200568

    SHA512

    9a0a49e97e870810c9e2df28b52677b331f28eda9251e532548f3e7cdf079d2e15f304df17a9222bb27da90d5b011227def60ad17d2a605270b8041c93a25a38

  • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\rk643771.exe

    Filesize

    342KB

    MD5

    54788af31813c06410ee6f6096fe8bcd

    SHA1

    2d65f80e18c7b645c64f8cad06195fba7e20b834

    SHA256

    a162e6edf7956289cda2bd07e1f15491beb15b7ef56c0f9bbae2ad5dd6200568

    SHA512

    9a0a49e97e870810c9e2df28b52677b331f28eda9251e532548f3e7cdf079d2e15f304df17a9222bb27da90d5b011227def60ad17d2a605270b8041c93a25a38

  • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\rk643771.exe

    Filesize

    342KB

    MD5

    54788af31813c06410ee6f6096fe8bcd

    SHA1

    2d65f80e18c7b645c64f8cad06195fba7e20b834

    SHA256

    a162e6edf7956289cda2bd07e1f15491beb15b7ef56c0f9bbae2ad5dd6200568

    SHA512

    9a0a49e97e870810c9e2df28b52677b331f28eda9251e532548f3e7cdf079d2e15f304df17a9222bb27da90d5b011227def60ad17d2a605270b8041c93a25a38

  • \Users\Admin\AppData\Local\Temp\IXP000.TMP\un404914.exe

    Filesize

    536KB

    MD5

    1fac8401900d1073942473422a13ce73

    SHA1

    2107b2442619d14db6d9402287b1af87da89e4fb

    SHA256

    149b061432fb6ce4ad435e36826d9edbf42af2c10c6d9dd2ad3e917c0849acb6

    SHA512

    db61da7aad22360dd360a3a0bedc3c83fe18c01f0e4432d16bf4bebe7656053e1e3cb4ea5089650dcd18eddb765acf21290317fadcd825c8b28396ed73dee865

  • \Users\Admin\AppData\Local\Temp\IXP000.TMP\un404914.exe

    Filesize

    536KB

    MD5

    1fac8401900d1073942473422a13ce73

    SHA1

    2107b2442619d14db6d9402287b1af87da89e4fb

    SHA256

    149b061432fb6ce4ad435e36826d9edbf42af2c10c6d9dd2ad3e917c0849acb6

    SHA512

    db61da7aad22360dd360a3a0bedc3c83fe18c01f0e4432d16bf4bebe7656053e1e3cb4ea5089650dcd18eddb765acf21290317fadcd825c8b28396ed73dee865

  • \Users\Admin\AppData\Local\Temp\IXP001.TMP\99460676.exe

    Filesize

    259KB

    MD5

    f61893cc078c077e01b6d57875896e7b

    SHA1

    c1a978f44fc0a97dab5dfb857c3e30b5d8371827

    SHA256

    ec20e19320faf045b6e71036a8d7e9722ccb3bcc5ee64e0722e9eab22f14e1ad

    SHA512

    2be84ddef93d499e23588617c4267b1488ccb7bb8fde5c85869bef120c91b1051fe666c28df4b466abc5e37159ef9d6adf0f17bb67540d3a0c0d7c1b82480bea

  • \Users\Admin\AppData\Local\Temp\IXP001.TMP\99460676.exe

    Filesize

    259KB

    MD5

    f61893cc078c077e01b6d57875896e7b

    SHA1

    c1a978f44fc0a97dab5dfb857c3e30b5d8371827

    SHA256

    ec20e19320faf045b6e71036a8d7e9722ccb3bcc5ee64e0722e9eab22f14e1ad

    SHA512

    2be84ddef93d499e23588617c4267b1488ccb7bb8fde5c85869bef120c91b1051fe666c28df4b466abc5e37159ef9d6adf0f17bb67540d3a0c0d7c1b82480bea

  • \Users\Admin\AppData\Local\Temp\IXP001.TMP\99460676.exe

    Filesize

    259KB

    MD5

    f61893cc078c077e01b6d57875896e7b

    SHA1

    c1a978f44fc0a97dab5dfb857c3e30b5d8371827

    SHA256

    ec20e19320faf045b6e71036a8d7e9722ccb3bcc5ee64e0722e9eab22f14e1ad

    SHA512

    2be84ddef93d499e23588617c4267b1488ccb7bb8fde5c85869bef120c91b1051fe666c28df4b466abc5e37159ef9d6adf0f17bb67540d3a0c0d7c1b82480bea

  • \Users\Admin\AppData\Local\Temp\IXP001.TMP\rk643771.exe

    Filesize

    342KB

    MD5

    54788af31813c06410ee6f6096fe8bcd

    SHA1

    2d65f80e18c7b645c64f8cad06195fba7e20b834

    SHA256

    a162e6edf7956289cda2bd07e1f15491beb15b7ef56c0f9bbae2ad5dd6200568

    SHA512

    9a0a49e97e870810c9e2df28b52677b331f28eda9251e532548f3e7cdf079d2e15f304df17a9222bb27da90d5b011227def60ad17d2a605270b8041c93a25a38

  • \Users\Admin\AppData\Local\Temp\IXP001.TMP\rk643771.exe

    Filesize

    342KB

    MD5

    54788af31813c06410ee6f6096fe8bcd

    SHA1

    2d65f80e18c7b645c64f8cad06195fba7e20b834

    SHA256

    a162e6edf7956289cda2bd07e1f15491beb15b7ef56c0f9bbae2ad5dd6200568

    SHA512

    9a0a49e97e870810c9e2df28b52677b331f28eda9251e532548f3e7cdf079d2e15f304df17a9222bb27da90d5b011227def60ad17d2a605270b8041c93a25a38

  • \Users\Admin\AppData\Local\Temp\IXP001.TMP\rk643771.exe

    Filesize

    342KB

    MD5

    54788af31813c06410ee6f6096fe8bcd

    SHA1

    2d65f80e18c7b645c64f8cad06195fba7e20b834

    SHA256

    a162e6edf7956289cda2bd07e1f15491beb15b7ef56c0f9bbae2ad5dd6200568

    SHA512

    9a0a49e97e870810c9e2df28b52677b331f28eda9251e532548f3e7cdf079d2e15f304df17a9222bb27da90d5b011227def60ad17d2a605270b8041c93a25a38

  • memory/940-140-0x0000000002260000-0x0000000002295000-memory.dmp

    Filesize

    212KB

  • memory/940-150-0x0000000002260000-0x0000000002295000-memory.dmp

    Filesize

    212KB

  • memory/940-926-0x0000000004AC0000-0x0000000004B00000-memory.dmp

    Filesize

    256KB

  • memory/940-924-0x0000000004AC0000-0x0000000004B00000-memory.dmp

    Filesize

    256KB

  • memory/940-923-0x0000000004AC0000-0x0000000004B00000-memory.dmp

    Filesize

    256KB

  • memory/940-921-0x0000000004AC0000-0x0000000004B00000-memory.dmp

    Filesize

    256KB

  • memory/940-281-0x0000000004AC0000-0x0000000004B00000-memory.dmp

    Filesize

    256KB

  • memory/940-279-0x0000000004AC0000-0x0000000004B00000-memory.dmp

    Filesize

    256KB

  • memory/940-277-0x0000000004AC0000-0x0000000004B00000-memory.dmp

    Filesize

    256KB

  • memory/940-275-0x00000000002D0000-0x0000000000316000-memory.dmp

    Filesize

    280KB

  • memory/940-158-0x0000000002260000-0x0000000002295000-memory.dmp

    Filesize

    212KB

  • memory/940-156-0x0000000002260000-0x0000000002295000-memory.dmp

    Filesize

    212KB

  • memory/940-154-0x0000000002260000-0x0000000002295000-memory.dmp

    Filesize

    212KB

  • memory/940-152-0x0000000002260000-0x0000000002295000-memory.dmp

    Filesize

    212KB

  • memory/940-148-0x0000000002260000-0x0000000002295000-memory.dmp

    Filesize

    212KB

  • memory/940-146-0x0000000002260000-0x0000000002295000-memory.dmp

    Filesize

    212KB

  • memory/940-144-0x0000000002260000-0x0000000002295000-memory.dmp

    Filesize

    212KB

  • memory/940-142-0x0000000002260000-0x0000000002295000-memory.dmp

    Filesize

    212KB

  • memory/940-138-0x0000000002260000-0x0000000002295000-memory.dmp

    Filesize

    212KB

  • memory/940-136-0x0000000002260000-0x0000000002295000-memory.dmp

    Filesize

    212KB

  • memory/940-134-0x0000000002260000-0x0000000002295000-memory.dmp

    Filesize

    212KB

  • memory/940-132-0x0000000002260000-0x0000000002295000-memory.dmp

    Filesize

    212KB

  • memory/940-123-0x0000000002060000-0x000000000209C000-memory.dmp

    Filesize

    240KB

  • memory/940-124-0x0000000002260000-0x000000000229A000-memory.dmp

    Filesize

    232KB

  • memory/940-125-0x0000000002260000-0x0000000002295000-memory.dmp

    Filesize

    212KB

  • memory/940-126-0x0000000002260000-0x0000000002295000-memory.dmp

    Filesize

    212KB

  • memory/940-128-0x0000000002260000-0x0000000002295000-memory.dmp

    Filesize

    212KB

  • memory/940-130-0x0000000002260000-0x0000000002295000-memory.dmp

    Filesize

    212KB

  • memory/1296-109-0x0000000004D40000-0x0000000004D80000-memory.dmp

    Filesize

    256KB

  • memory/1296-110-0x0000000004D40000-0x0000000004D80000-memory.dmp

    Filesize

    256KB

  • memory/1296-81-0x0000000000B30000-0x0000000000B43000-memory.dmp

    Filesize

    76KB

  • memory/1296-82-0x0000000000B30000-0x0000000000B43000-memory.dmp

    Filesize

    76KB

  • memory/1296-78-0x0000000000280000-0x00000000002AD000-memory.dmp

    Filesize

    180KB

  • memory/1296-84-0x0000000000B30000-0x0000000000B43000-memory.dmp

    Filesize

    76KB

  • memory/1296-86-0x0000000000B30000-0x0000000000B43000-memory.dmp

    Filesize

    76KB

  • memory/1296-112-0x0000000000400000-0x0000000000455000-memory.dmp

    Filesize

    340KB

  • memory/1296-111-0x0000000000400000-0x0000000000455000-memory.dmp

    Filesize

    340KB

  • memory/1296-108-0x0000000000B30000-0x0000000000B43000-memory.dmp

    Filesize

    76KB

  • memory/1296-80-0x0000000000B30000-0x0000000000B48000-memory.dmp

    Filesize

    96KB

  • memory/1296-79-0x0000000000B10000-0x0000000000B2A000-memory.dmp

    Filesize

    104KB

  • memory/1296-88-0x0000000000B30000-0x0000000000B43000-memory.dmp

    Filesize

    76KB

  • memory/1296-104-0x0000000000B30000-0x0000000000B43000-memory.dmp

    Filesize

    76KB

  • memory/1296-106-0x0000000000B30000-0x0000000000B43000-memory.dmp

    Filesize

    76KB

  • memory/1296-100-0x0000000000B30000-0x0000000000B43000-memory.dmp

    Filesize

    76KB

  • memory/1296-102-0x0000000000B30000-0x0000000000B43000-memory.dmp

    Filesize

    76KB

  • memory/1296-98-0x0000000000B30000-0x0000000000B43000-memory.dmp

    Filesize

    76KB

  • memory/1296-96-0x0000000000B30000-0x0000000000B43000-memory.dmp

    Filesize

    76KB

  • memory/1296-94-0x0000000000B30000-0x0000000000B43000-memory.dmp

    Filesize

    76KB

  • memory/1296-92-0x0000000000B30000-0x0000000000B43000-memory.dmp

    Filesize

    76KB

  • memory/1296-90-0x0000000000B30000-0x0000000000B43000-memory.dmp

    Filesize

    76KB