Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    147s
  • max time network
    155s
  • platform
    windows7_x64
  • resource
    win7-20230220-en
  • resource tags

    arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
  • submitted
    06/05/2023, 22:01

General

  • Target

    576b363c58966498acde28dd962e65af53ae0555d8b7903807c826864e399c59.exe

  • Size

    562KB

  • MD5

    6d88965f4484398951970344837363f8

  • SHA1

    fec55bcf9c071c6a38d6a8eabafb39fb5dc654d4

  • SHA256

    576b363c58966498acde28dd962e65af53ae0555d8b7903807c826864e399c59

  • SHA512

    54263ba5c9da5f4456a5d2baf1f9f3781ab84c681e04942233c90cfd4f398061592cb0f40e7e1fdc12fa94389a62745c48032a30a26569c852a367f4f1941896

  • SSDEEP

    12288:Hy90SyDk5J4dZz/AmaLEOkoVsoFzI/7KJDhSgi:HyVygfw/YQVE/FM2Z7i

Malware Config

Signatures

  • Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs
  • Executes dropped EXE 3 IoCs
  • Loads dropped DLL 6 IoCs
  • Windows security modification 2 TTPs 2 IoCs
  • Adds Run key to start application 2 TTPs 4 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 21 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\576b363c58966498acde28dd962e65af53ae0555d8b7903807c826864e399c59.exe
    "C:\Users\Admin\AppData\Local\Temp\576b363c58966498acde28dd962e65af53ae0555d8b7903807c826864e399c59.exe"
    1⤵
    • Loads dropped DLL
    • Adds Run key to start application
    • Suspicious use of WriteProcessMemory
    PID:1528
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\st673337.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\st673337.exe
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Adds Run key to start application
      • Suspicious use of WriteProcessMemory
      PID:908
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\84334617.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\84334617.exe
        3⤵
        • Modifies Windows Defender Real-time Protection settings
        • Executes dropped EXE
        • Windows security modification
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:1044
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\kp678488.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\kp678488.exe
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Suspicious use of AdjustPrivilegeToken
        PID:268

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\st673337.exe

    Filesize

    408KB

    MD5

    b0f544026ac1efb4e78fdf207e92f70b

    SHA1

    374b036579ea74abf7d436ff017ef432fdeb3587

    SHA256

    852e829a51ac10ebce3052da7db8c6fcd4582b34dcd320e875863898236ac8fe

    SHA512

    761abfe3732c5638d9963f83b0d2c27c890f6d2876d952443cc8b05bc56678d5bd9d51eb69d5b67c567d0cf8a6e6a8d8c54f54c1922b6667006ae37b421c87b2

  • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\st673337.exe

    Filesize

    408KB

    MD5

    b0f544026ac1efb4e78fdf207e92f70b

    SHA1

    374b036579ea74abf7d436ff017ef432fdeb3587

    SHA256

    852e829a51ac10ebce3052da7db8c6fcd4582b34dcd320e875863898236ac8fe

    SHA512

    761abfe3732c5638d9963f83b0d2c27c890f6d2876d952443cc8b05bc56678d5bd9d51eb69d5b67c567d0cf8a6e6a8d8c54f54c1922b6667006ae37b421c87b2

  • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\84334617.exe

    Filesize

    11KB

    MD5

    7e93bacbbc33e6652e147e7fe07572a0

    SHA1

    421a7167da01c8da4dc4d5234ca3dd84e319e762

    SHA256

    850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38

    SHA512

    250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91

  • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\84334617.exe

    Filesize

    11KB

    MD5

    7e93bacbbc33e6652e147e7fe07572a0

    SHA1

    421a7167da01c8da4dc4d5234ca3dd84e319e762

    SHA256

    850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38

    SHA512

    250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91

  • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\kp678488.exe

    Filesize

    360KB

    MD5

    2a5caeeded3331a633e4e2a282ebb4a0

    SHA1

    ec5d990bf6c4afe4908f87588311631b0629f72f

    SHA256

    2441bbdc3404d50081578b810e2335e7ba50a6e4991051dacb71cf32847c35e3

    SHA512

    006d83f4ab9f6eded3eccb1f2d9ca651cf69861f2c78bbf8bef3f4ba6927197391707455eab4fab63c68dc933341806a2b649bf218bb5e2b19f7260ac85c1c7a

  • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\kp678488.exe

    Filesize

    360KB

    MD5

    2a5caeeded3331a633e4e2a282ebb4a0

    SHA1

    ec5d990bf6c4afe4908f87588311631b0629f72f

    SHA256

    2441bbdc3404d50081578b810e2335e7ba50a6e4991051dacb71cf32847c35e3

    SHA512

    006d83f4ab9f6eded3eccb1f2d9ca651cf69861f2c78bbf8bef3f4ba6927197391707455eab4fab63c68dc933341806a2b649bf218bb5e2b19f7260ac85c1c7a

  • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\kp678488.exe

    Filesize

    360KB

    MD5

    2a5caeeded3331a633e4e2a282ebb4a0

    SHA1

    ec5d990bf6c4afe4908f87588311631b0629f72f

    SHA256

    2441bbdc3404d50081578b810e2335e7ba50a6e4991051dacb71cf32847c35e3

    SHA512

    006d83f4ab9f6eded3eccb1f2d9ca651cf69861f2c78bbf8bef3f4ba6927197391707455eab4fab63c68dc933341806a2b649bf218bb5e2b19f7260ac85c1c7a

  • \Users\Admin\AppData\Local\Temp\IXP000.TMP\st673337.exe

    Filesize

    408KB

    MD5

    b0f544026ac1efb4e78fdf207e92f70b

    SHA1

    374b036579ea74abf7d436ff017ef432fdeb3587

    SHA256

    852e829a51ac10ebce3052da7db8c6fcd4582b34dcd320e875863898236ac8fe

    SHA512

    761abfe3732c5638d9963f83b0d2c27c890f6d2876d952443cc8b05bc56678d5bd9d51eb69d5b67c567d0cf8a6e6a8d8c54f54c1922b6667006ae37b421c87b2

  • \Users\Admin\AppData\Local\Temp\IXP000.TMP\st673337.exe

    Filesize

    408KB

    MD5

    b0f544026ac1efb4e78fdf207e92f70b

    SHA1

    374b036579ea74abf7d436ff017ef432fdeb3587

    SHA256

    852e829a51ac10ebce3052da7db8c6fcd4582b34dcd320e875863898236ac8fe

    SHA512

    761abfe3732c5638d9963f83b0d2c27c890f6d2876d952443cc8b05bc56678d5bd9d51eb69d5b67c567d0cf8a6e6a8d8c54f54c1922b6667006ae37b421c87b2

  • \Users\Admin\AppData\Local\Temp\IXP001.TMP\84334617.exe

    Filesize

    11KB

    MD5

    7e93bacbbc33e6652e147e7fe07572a0

    SHA1

    421a7167da01c8da4dc4d5234ca3dd84e319e762

    SHA256

    850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38

    SHA512

    250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91

  • \Users\Admin\AppData\Local\Temp\IXP001.TMP\kp678488.exe

    Filesize

    360KB

    MD5

    2a5caeeded3331a633e4e2a282ebb4a0

    SHA1

    ec5d990bf6c4afe4908f87588311631b0629f72f

    SHA256

    2441bbdc3404d50081578b810e2335e7ba50a6e4991051dacb71cf32847c35e3

    SHA512

    006d83f4ab9f6eded3eccb1f2d9ca651cf69861f2c78bbf8bef3f4ba6927197391707455eab4fab63c68dc933341806a2b649bf218bb5e2b19f7260ac85c1c7a

  • \Users\Admin\AppData\Local\Temp\IXP001.TMP\kp678488.exe

    Filesize

    360KB

    MD5

    2a5caeeded3331a633e4e2a282ebb4a0

    SHA1

    ec5d990bf6c4afe4908f87588311631b0629f72f

    SHA256

    2441bbdc3404d50081578b810e2335e7ba50a6e4991051dacb71cf32847c35e3

    SHA512

    006d83f4ab9f6eded3eccb1f2d9ca651cf69861f2c78bbf8bef3f4ba6927197391707455eab4fab63c68dc933341806a2b649bf218bb5e2b19f7260ac85c1c7a

  • \Users\Admin\AppData\Local\Temp\IXP001.TMP\kp678488.exe

    Filesize

    360KB

    MD5

    2a5caeeded3331a633e4e2a282ebb4a0

    SHA1

    ec5d990bf6c4afe4908f87588311631b0629f72f

    SHA256

    2441bbdc3404d50081578b810e2335e7ba50a6e4991051dacb71cf32847c35e3

    SHA512

    006d83f4ab9f6eded3eccb1f2d9ca651cf69861f2c78bbf8bef3f4ba6927197391707455eab4fab63c68dc933341806a2b649bf218bb5e2b19f7260ac85c1c7a

  • memory/268-102-0x00000000032E0000-0x0000000003315000-memory.dmp

    Filesize

    212KB

  • memory/268-120-0x00000000032E0000-0x0000000003315000-memory.dmp

    Filesize

    212KB

  • memory/268-84-0x00000000032E0000-0x000000000331A000-memory.dmp

    Filesize

    232KB

  • memory/268-85-0x00000000032E0000-0x0000000003315000-memory.dmp

    Filesize

    212KB

  • memory/268-86-0x00000000032E0000-0x0000000003315000-memory.dmp

    Filesize

    212KB

  • memory/268-88-0x00000000032E0000-0x0000000003315000-memory.dmp

    Filesize

    212KB

  • memory/268-90-0x00000000032E0000-0x0000000003315000-memory.dmp

    Filesize

    212KB

  • memory/268-94-0x00000000032E0000-0x0000000003315000-memory.dmp

    Filesize

    212KB

  • memory/268-96-0x00000000032E0000-0x0000000003315000-memory.dmp

    Filesize

    212KB

  • memory/268-92-0x00000000032E0000-0x0000000003315000-memory.dmp

    Filesize

    212KB

  • memory/268-98-0x00000000032E0000-0x0000000003315000-memory.dmp

    Filesize

    212KB

  • memory/268-106-0x00000000032E0000-0x0000000003315000-memory.dmp

    Filesize

    212KB

  • memory/268-104-0x00000000032E0000-0x0000000003315000-memory.dmp

    Filesize

    212KB

  • memory/268-884-0x0000000007190000-0x00000000071D0000-memory.dmp

    Filesize

    256KB

  • memory/268-100-0x00000000032E0000-0x0000000003315000-memory.dmp

    Filesize

    212KB

  • memory/268-108-0x00000000032E0000-0x0000000003315000-memory.dmp

    Filesize

    212KB

  • memory/268-110-0x00000000032E0000-0x0000000003315000-memory.dmp

    Filesize

    212KB

  • memory/268-112-0x00000000032E0000-0x0000000003315000-memory.dmp

    Filesize

    212KB

  • memory/268-114-0x00000000032E0000-0x0000000003315000-memory.dmp

    Filesize

    212KB

  • memory/268-116-0x00000000032E0000-0x0000000003315000-memory.dmp

    Filesize

    212KB

  • memory/268-118-0x00000000032E0000-0x0000000003315000-memory.dmp

    Filesize

    212KB

  • memory/268-83-0x0000000003200000-0x000000000323C000-memory.dmp

    Filesize

    240KB

  • memory/268-122-0x00000000032E0000-0x0000000003315000-memory.dmp

    Filesize

    212KB

  • memory/268-124-0x00000000032E0000-0x0000000003315000-memory.dmp

    Filesize

    212KB

  • memory/268-126-0x00000000032E0000-0x0000000003315000-memory.dmp

    Filesize

    212KB

  • memory/268-128-0x00000000032E0000-0x0000000003315000-memory.dmp

    Filesize

    212KB

  • memory/268-130-0x00000000032E0000-0x0000000003315000-memory.dmp

    Filesize

    212KB

  • memory/268-132-0x00000000032E0000-0x0000000003315000-memory.dmp

    Filesize

    212KB

  • memory/268-135-0x00000000032E0000-0x0000000003315000-memory.dmp

    Filesize

    212KB

  • memory/268-134-0x0000000000340000-0x0000000000386000-memory.dmp

    Filesize

    280KB

  • memory/268-136-0x0000000007190000-0x00000000071D0000-memory.dmp

    Filesize

    256KB

  • memory/268-139-0x00000000032E0000-0x0000000003315000-memory.dmp

    Filesize

    212KB

  • memory/268-138-0x0000000007190000-0x00000000071D0000-memory.dmp

    Filesize

    256KB

  • memory/268-141-0x00000000032E0000-0x0000000003315000-memory.dmp

    Filesize

    212KB

  • memory/268-143-0x00000000032E0000-0x0000000003315000-memory.dmp

    Filesize

    212KB

  • memory/268-145-0x00000000032E0000-0x0000000003315000-memory.dmp

    Filesize

    212KB

  • memory/268-147-0x00000000032E0000-0x0000000003315000-memory.dmp

    Filesize

    212KB

  • memory/268-149-0x00000000032E0000-0x0000000003315000-memory.dmp

    Filesize

    212KB

  • memory/268-151-0x00000000032E0000-0x0000000003315000-memory.dmp

    Filesize

    212KB

  • memory/268-880-0x0000000007190000-0x00000000071D0000-memory.dmp

    Filesize

    256KB

  • memory/268-882-0x0000000007190000-0x00000000071D0000-memory.dmp

    Filesize

    256KB

  • memory/1044-72-0x00000000002E0000-0x00000000002EA000-memory.dmp

    Filesize

    40KB