Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    147s
  • max time network
    150s
  • platform
    windows7_x64
  • resource
    win7-20230220-en
  • resource tags

    arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
  • submitted
    06/05/2023, 22:26

General

  • Target

    6e3eebd9d6a0e53094f95b2029a6384727555b13ee0c59a057928d6018dc4113.exe

  • Size

    746KB

  • MD5

    d183bc9483a7ec12de8f2cb69970caaf

  • SHA1

    bc03c966cb9c0c6b67470b9f96e9b32bede5baf8

  • SHA256

    6e3eebd9d6a0e53094f95b2029a6384727555b13ee0c59a057928d6018dc4113

  • SHA512

    f3fff1b785a9cccfdc91721671304f6eb1dcf68271f7b905783b86a4b4fac7509cc1dc9225d3d0c137b252f06c52fc56a656911421f6513c5b556ba06fb02cc4

  • SSDEEP

    12288:Ty90UocgjXqtikQCcjvsEyVadGB9HSuPZn5RN6JlD4nNPhEhdgak:Ty9MnLsEfGB9HSIR5/egNPhEhk

Malware Config

Signatures

  • Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs
  • Executes dropped EXE 3 IoCs
  • Loads dropped DLL 8 IoCs
  • Windows security modification 2 TTPs 2 IoCs
  • Adds Run key to start application 2 TTPs 4 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 21 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\6e3eebd9d6a0e53094f95b2029a6384727555b13ee0c59a057928d6018dc4113.exe
    "C:\Users\Admin\AppData\Local\Temp\6e3eebd9d6a0e53094f95b2029a6384727555b13ee0c59a057928d6018dc4113.exe"
    1⤵
    • Loads dropped DLL
    • Adds Run key to start application
    • Suspicious use of WriteProcessMemory
    PID:1220
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un770582.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un770582.exe
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Adds Run key to start application
      • Suspicious use of WriteProcessMemory
      PID:1672
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\90416643.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\90416643.exe
        3⤵
        • Modifies Windows Defender Real-time Protection settings
        • Executes dropped EXE
        • Loads dropped DLL
        • Windows security modification
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:1428
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\rk085069.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\rk085069.exe
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Suspicious use of AdjustPrivilegeToken
        PID:556

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un770582.exe

    Filesize

    592KB

    MD5

    53b92ed577466e6a642d9d33b16d907f

    SHA1

    df0e86a4e15fb200a7f5b2088a05f41ae5ef1880

    SHA256

    d8171ae70ff0b9d31b4639fcc3133478a7506ac45974a2fd8222f9732e85f172

    SHA512

    84a1fc996b6996b33dbb97306e6aa00e109b023df2780d56a26757d1504ce771b704ec1dfa713c53473326dddcc405f1193e18bbeaa1829cacd264ccfb0d564e

  • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un770582.exe

    Filesize

    592KB

    MD5

    53b92ed577466e6a642d9d33b16d907f

    SHA1

    df0e86a4e15fb200a7f5b2088a05f41ae5ef1880

    SHA256

    d8171ae70ff0b9d31b4639fcc3133478a7506ac45974a2fd8222f9732e85f172

    SHA512

    84a1fc996b6996b33dbb97306e6aa00e109b023df2780d56a26757d1504ce771b704ec1dfa713c53473326dddcc405f1193e18bbeaa1829cacd264ccfb0d564e

  • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\90416643.exe

    Filesize

    377KB

    MD5

    e89018d24e0e3266dc15a5a50ddcfe55

    SHA1

    2b3a21da39b6febb466cfe947f290fa4902f7359

    SHA256

    8b8cfd970fead813049abdac74ed3ef66fe7dddd983816898bb977350d1c1592

    SHA512

    8a32fc82562f1d16b364cc5692cf9972b0e27af0d1226ba555545360a12c211a10b1f84da567bc0d4844296315920df25b94df85081bc076cc3e0fafe5bb0dd6

  • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\90416643.exe

    Filesize

    377KB

    MD5

    e89018d24e0e3266dc15a5a50ddcfe55

    SHA1

    2b3a21da39b6febb466cfe947f290fa4902f7359

    SHA256

    8b8cfd970fead813049abdac74ed3ef66fe7dddd983816898bb977350d1c1592

    SHA512

    8a32fc82562f1d16b364cc5692cf9972b0e27af0d1226ba555545360a12c211a10b1f84da567bc0d4844296315920df25b94df85081bc076cc3e0fafe5bb0dd6

  • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\90416643.exe

    Filesize

    377KB

    MD5

    e89018d24e0e3266dc15a5a50ddcfe55

    SHA1

    2b3a21da39b6febb466cfe947f290fa4902f7359

    SHA256

    8b8cfd970fead813049abdac74ed3ef66fe7dddd983816898bb977350d1c1592

    SHA512

    8a32fc82562f1d16b364cc5692cf9972b0e27af0d1226ba555545360a12c211a10b1f84da567bc0d4844296315920df25b94df85081bc076cc3e0fafe5bb0dd6

  • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\rk085069.exe

    Filesize

    459KB

    MD5

    53edd6b08f2c312735b59eb48f99e1a2

    SHA1

    49157b5324220d33e031ba7c3d0a04dd5b66f5ac

    SHA256

    0c0242fc83e6d4fec9e8f76cacc3ca3fa792a86a398d503eb361bef1ce8fc0c6

    SHA512

    a5f7da3a79b69a5c08e95d5688b66b4fc469ad3457a2c2dad446a2e72133d0fa78c6a17092c6b8752056094640df49544b2b650d4041a7640a39cb2c31ab0240

  • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\rk085069.exe

    Filesize

    459KB

    MD5

    53edd6b08f2c312735b59eb48f99e1a2

    SHA1

    49157b5324220d33e031ba7c3d0a04dd5b66f5ac

    SHA256

    0c0242fc83e6d4fec9e8f76cacc3ca3fa792a86a398d503eb361bef1ce8fc0c6

    SHA512

    a5f7da3a79b69a5c08e95d5688b66b4fc469ad3457a2c2dad446a2e72133d0fa78c6a17092c6b8752056094640df49544b2b650d4041a7640a39cb2c31ab0240

  • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\rk085069.exe

    Filesize

    459KB

    MD5

    53edd6b08f2c312735b59eb48f99e1a2

    SHA1

    49157b5324220d33e031ba7c3d0a04dd5b66f5ac

    SHA256

    0c0242fc83e6d4fec9e8f76cacc3ca3fa792a86a398d503eb361bef1ce8fc0c6

    SHA512

    a5f7da3a79b69a5c08e95d5688b66b4fc469ad3457a2c2dad446a2e72133d0fa78c6a17092c6b8752056094640df49544b2b650d4041a7640a39cb2c31ab0240

  • \Users\Admin\AppData\Local\Temp\IXP000.TMP\un770582.exe

    Filesize

    592KB

    MD5

    53b92ed577466e6a642d9d33b16d907f

    SHA1

    df0e86a4e15fb200a7f5b2088a05f41ae5ef1880

    SHA256

    d8171ae70ff0b9d31b4639fcc3133478a7506ac45974a2fd8222f9732e85f172

    SHA512

    84a1fc996b6996b33dbb97306e6aa00e109b023df2780d56a26757d1504ce771b704ec1dfa713c53473326dddcc405f1193e18bbeaa1829cacd264ccfb0d564e

  • \Users\Admin\AppData\Local\Temp\IXP000.TMP\un770582.exe

    Filesize

    592KB

    MD5

    53b92ed577466e6a642d9d33b16d907f

    SHA1

    df0e86a4e15fb200a7f5b2088a05f41ae5ef1880

    SHA256

    d8171ae70ff0b9d31b4639fcc3133478a7506ac45974a2fd8222f9732e85f172

    SHA512

    84a1fc996b6996b33dbb97306e6aa00e109b023df2780d56a26757d1504ce771b704ec1dfa713c53473326dddcc405f1193e18bbeaa1829cacd264ccfb0d564e

  • \Users\Admin\AppData\Local\Temp\IXP001.TMP\90416643.exe

    Filesize

    377KB

    MD5

    e89018d24e0e3266dc15a5a50ddcfe55

    SHA1

    2b3a21da39b6febb466cfe947f290fa4902f7359

    SHA256

    8b8cfd970fead813049abdac74ed3ef66fe7dddd983816898bb977350d1c1592

    SHA512

    8a32fc82562f1d16b364cc5692cf9972b0e27af0d1226ba555545360a12c211a10b1f84da567bc0d4844296315920df25b94df85081bc076cc3e0fafe5bb0dd6

  • \Users\Admin\AppData\Local\Temp\IXP001.TMP\90416643.exe

    Filesize

    377KB

    MD5

    e89018d24e0e3266dc15a5a50ddcfe55

    SHA1

    2b3a21da39b6febb466cfe947f290fa4902f7359

    SHA256

    8b8cfd970fead813049abdac74ed3ef66fe7dddd983816898bb977350d1c1592

    SHA512

    8a32fc82562f1d16b364cc5692cf9972b0e27af0d1226ba555545360a12c211a10b1f84da567bc0d4844296315920df25b94df85081bc076cc3e0fafe5bb0dd6

  • \Users\Admin\AppData\Local\Temp\IXP001.TMP\90416643.exe

    Filesize

    377KB

    MD5

    e89018d24e0e3266dc15a5a50ddcfe55

    SHA1

    2b3a21da39b6febb466cfe947f290fa4902f7359

    SHA256

    8b8cfd970fead813049abdac74ed3ef66fe7dddd983816898bb977350d1c1592

    SHA512

    8a32fc82562f1d16b364cc5692cf9972b0e27af0d1226ba555545360a12c211a10b1f84da567bc0d4844296315920df25b94df85081bc076cc3e0fafe5bb0dd6

  • \Users\Admin\AppData\Local\Temp\IXP001.TMP\rk085069.exe

    Filesize

    459KB

    MD5

    53edd6b08f2c312735b59eb48f99e1a2

    SHA1

    49157b5324220d33e031ba7c3d0a04dd5b66f5ac

    SHA256

    0c0242fc83e6d4fec9e8f76cacc3ca3fa792a86a398d503eb361bef1ce8fc0c6

    SHA512

    a5f7da3a79b69a5c08e95d5688b66b4fc469ad3457a2c2dad446a2e72133d0fa78c6a17092c6b8752056094640df49544b2b650d4041a7640a39cb2c31ab0240

  • \Users\Admin\AppData\Local\Temp\IXP001.TMP\rk085069.exe

    Filesize

    459KB

    MD5

    53edd6b08f2c312735b59eb48f99e1a2

    SHA1

    49157b5324220d33e031ba7c3d0a04dd5b66f5ac

    SHA256

    0c0242fc83e6d4fec9e8f76cacc3ca3fa792a86a398d503eb361bef1ce8fc0c6

    SHA512

    a5f7da3a79b69a5c08e95d5688b66b4fc469ad3457a2c2dad446a2e72133d0fa78c6a17092c6b8752056094640df49544b2b650d4041a7640a39cb2c31ab0240

  • \Users\Admin\AppData\Local\Temp\IXP001.TMP\rk085069.exe

    Filesize

    459KB

    MD5

    53edd6b08f2c312735b59eb48f99e1a2

    SHA1

    49157b5324220d33e031ba7c3d0a04dd5b66f5ac

    SHA256

    0c0242fc83e6d4fec9e8f76cacc3ca3fa792a86a398d503eb361bef1ce8fc0c6

    SHA512

    a5f7da3a79b69a5c08e95d5688b66b4fc469ad3457a2c2dad446a2e72133d0fa78c6a17092c6b8752056094640df49544b2b650d4041a7640a39cb2c31ab0240

  • memory/556-140-0x0000000002500000-0x0000000002535000-memory.dmp

    Filesize

    212KB

  • memory/556-144-0x0000000002500000-0x0000000002535000-memory.dmp

    Filesize

    212KB

  • memory/556-924-0x0000000004EB0000-0x0000000004EF0000-memory.dmp

    Filesize

    256KB

  • memory/556-922-0x0000000004EB0000-0x0000000004EF0000-memory.dmp

    Filesize

    256KB

  • memory/556-920-0x0000000004EB0000-0x0000000004EF0000-memory.dmp

    Filesize

    256KB

  • memory/556-196-0x0000000004EB0000-0x0000000004EF0000-memory.dmp

    Filesize

    256KB

  • memory/556-194-0x0000000004EB0000-0x0000000004EF0000-memory.dmp

    Filesize

    256KB

  • memory/556-193-0x0000000000820000-0x0000000000866000-memory.dmp

    Filesize

    280KB

  • memory/556-158-0x0000000002500000-0x0000000002535000-memory.dmp

    Filesize

    212KB

  • memory/556-156-0x0000000002500000-0x0000000002535000-memory.dmp

    Filesize

    212KB

  • memory/556-154-0x0000000002500000-0x0000000002535000-memory.dmp

    Filesize

    212KB

  • memory/556-152-0x0000000002500000-0x0000000002535000-memory.dmp

    Filesize

    212KB

  • memory/556-150-0x0000000002500000-0x0000000002535000-memory.dmp

    Filesize

    212KB

  • memory/556-148-0x0000000002500000-0x0000000002535000-memory.dmp

    Filesize

    212KB

  • memory/556-146-0x0000000002500000-0x0000000002535000-memory.dmp

    Filesize

    212KB

  • memory/556-142-0x0000000002500000-0x0000000002535000-memory.dmp

    Filesize

    212KB

  • memory/556-138-0x0000000002500000-0x0000000002535000-memory.dmp

    Filesize

    212KB

  • memory/556-136-0x0000000002500000-0x0000000002535000-memory.dmp

    Filesize

    212KB

  • memory/556-134-0x0000000002500000-0x0000000002535000-memory.dmp

    Filesize

    212KB

  • memory/556-132-0x0000000002500000-0x0000000002535000-memory.dmp

    Filesize

    212KB

  • memory/556-130-0x0000000002500000-0x0000000002535000-memory.dmp

    Filesize

    212KB

  • memory/556-128-0x0000000002500000-0x0000000002535000-memory.dmp

    Filesize

    212KB

  • memory/556-123-0x00000000024C0000-0x00000000024FC000-memory.dmp

    Filesize

    240KB

  • memory/556-124-0x0000000002500000-0x000000000253A000-memory.dmp

    Filesize

    232KB

  • memory/556-125-0x0000000002500000-0x0000000002535000-memory.dmp

    Filesize

    212KB

  • memory/556-126-0x0000000002500000-0x0000000002535000-memory.dmp

    Filesize

    212KB

  • memory/1428-108-0x0000000002470000-0x0000000002482000-memory.dmp

    Filesize

    72KB

  • memory/1428-110-0x0000000002470000-0x0000000002482000-memory.dmp

    Filesize

    72KB

  • memory/1428-81-0x0000000004F30000-0x0000000004F70000-memory.dmp

    Filesize

    256KB

  • memory/1428-82-0x0000000004F30000-0x0000000004F70000-memory.dmp

    Filesize

    256KB

  • memory/1428-84-0x0000000002470000-0x0000000002482000-memory.dmp

    Filesize

    72KB

  • memory/1428-83-0x0000000002470000-0x0000000002482000-memory.dmp

    Filesize

    72KB

  • memory/1428-78-0x0000000002260000-0x000000000227A000-memory.dmp

    Filesize

    104KB

  • memory/1428-112-0x0000000000400000-0x0000000000803000-memory.dmp

    Filesize

    4.0MB

  • memory/1428-86-0x0000000002470000-0x0000000002482000-memory.dmp

    Filesize

    72KB

  • memory/1428-104-0x0000000002470000-0x0000000002482000-memory.dmp

    Filesize

    72KB

  • memory/1428-80-0x0000000000270000-0x000000000029D000-memory.dmp

    Filesize

    180KB

  • memory/1428-79-0x0000000002470000-0x0000000002488000-memory.dmp

    Filesize

    96KB

  • memory/1428-111-0x0000000000400000-0x0000000000803000-memory.dmp

    Filesize

    4.0MB

  • memory/1428-106-0x0000000002470000-0x0000000002482000-memory.dmp

    Filesize

    72KB

  • memory/1428-100-0x0000000002470000-0x0000000002482000-memory.dmp

    Filesize

    72KB

  • memory/1428-102-0x0000000002470000-0x0000000002482000-memory.dmp

    Filesize

    72KB

  • memory/1428-96-0x0000000002470000-0x0000000002482000-memory.dmp

    Filesize

    72KB

  • memory/1428-98-0x0000000002470000-0x0000000002482000-memory.dmp

    Filesize

    72KB

  • memory/1428-92-0x0000000002470000-0x0000000002482000-memory.dmp

    Filesize

    72KB

  • memory/1428-94-0x0000000002470000-0x0000000002482000-memory.dmp

    Filesize

    72KB

  • memory/1428-90-0x0000000002470000-0x0000000002482000-memory.dmp

    Filesize

    72KB

  • memory/1428-88-0x0000000002470000-0x0000000002482000-memory.dmp

    Filesize

    72KB