Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
147s -
max time network
150s -
platform
windows7_x64 -
resource
win7-20230220-en -
resource tags
arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system -
submitted
06/05/2023, 22:26
Static task
static1
Behavioral task
behavioral1
Sample
6e3eebd9d6a0e53094f95b2029a6384727555b13ee0c59a057928d6018dc4113.exe
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
6e3eebd9d6a0e53094f95b2029a6384727555b13ee0c59a057928d6018dc4113.exe
Resource
win10v2004-20230220-en
General
-
Target
6e3eebd9d6a0e53094f95b2029a6384727555b13ee0c59a057928d6018dc4113.exe
-
Size
746KB
-
MD5
d183bc9483a7ec12de8f2cb69970caaf
-
SHA1
bc03c966cb9c0c6b67470b9f96e9b32bede5baf8
-
SHA256
6e3eebd9d6a0e53094f95b2029a6384727555b13ee0c59a057928d6018dc4113
-
SHA512
f3fff1b785a9cccfdc91721671304f6eb1dcf68271f7b905783b86a4b4fac7509cc1dc9225d3d0c137b252f06c52fc56a656911421f6513c5b556ba06fb02cc4
-
SSDEEP
12288:Ty90UocgjXqtikQCcjvsEyVadGB9HSuPZn5RN6JlD4nNPhEhdgak:Ty9MnLsEfGB9HSIR5/egNPhEhk
Malware Config
Signatures
-
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" 90416643.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" 90416643.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" 90416643.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" 90416643.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" 90416643.exe Key created \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection 90416643.exe -
Executes dropped EXE 3 IoCs
pid Process 1672 un770582.exe 1428 90416643.exe 556 rk085069.exe -
Loads dropped DLL 8 IoCs
pid Process 1220 6e3eebd9d6a0e53094f95b2029a6384727555b13ee0c59a057928d6018dc4113.exe 1672 un770582.exe 1672 un770582.exe 1672 un770582.exe 1428 90416643.exe 1672 un770582.exe 1672 un770582.exe 556 rk085069.exe -
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Features 90416643.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0" 90416643.exe -
Adds Run key to start application 2 TTPs 4 IoCs
description ioc Process Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce un770582.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" un770582.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce 6e3eebd9d6a0e53094f95b2029a6384727555b13ee0c59a057928d6018dc4113.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" 6e3eebd9d6a0e53094f95b2029a6384727555b13ee0c59a057928d6018dc4113.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 1428 90416643.exe 1428 90416643.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 1428 90416643.exe Token: SeDebugPrivilege 556 rk085069.exe -
Suspicious use of WriteProcessMemory 21 IoCs
description pid Process procid_target PID 1220 wrote to memory of 1672 1220 6e3eebd9d6a0e53094f95b2029a6384727555b13ee0c59a057928d6018dc4113.exe 27 PID 1220 wrote to memory of 1672 1220 6e3eebd9d6a0e53094f95b2029a6384727555b13ee0c59a057928d6018dc4113.exe 27 PID 1220 wrote to memory of 1672 1220 6e3eebd9d6a0e53094f95b2029a6384727555b13ee0c59a057928d6018dc4113.exe 27 PID 1220 wrote to memory of 1672 1220 6e3eebd9d6a0e53094f95b2029a6384727555b13ee0c59a057928d6018dc4113.exe 27 PID 1220 wrote to memory of 1672 1220 6e3eebd9d6a0e53094f95b2029a6384727555b13ee0c59a057928d6018dc4113.exe 27 PID 1220 wrote to memory of 1672 1220 6e3eebd9d6a0e53094f95b2029a6384727555b13ee0c59a057928d6018dc4113.exe 27 PID 1220 wrote to memory of 1672 1220 6e3eebd9d6a0e53094f95b2029a6384727555b13ee0c59a057928d6018dc4113.exe 27 PID 1672 wrote to memory of 1428 1672 un770582.exe 28 PID 1672 wrote to memory of 1428 1672 un770582.exe 28 PID 1672 wrote to memory of 1428 1672 un770582.exe 28 PID 1672 wrote to memory of 1428 1672 un770582.exe 28 PID 1672 wrote to memory of 1428 1672 un770582.exe 28 PID 1672 wrote to memory of 1428 1672 un770582.exe 28 PID 1672 wrote to memory of 1428 1672 un770582.exe 28 PID 1672 wrote to memory of 556 1672 un770582.exe 29 PID 1672 wrote to memory of 556 1672 un770582.exe 29 PID 1672 wrote to memory of 556 1672 un770582.exe 29 PID 1672 wrote to memory of 556 1672 un770582.exe 29 PID 1672 wrote to memory of 556 1672 un770582.exe 29 PID 1672 wrote to memory of 556 1672 un770582.exe 29 PID 1672 wrote to memory of 556 1672 un770582.exe 29
Processes
-
C:\Users\Admin\AppData\Local\Temp\6e3eebd9d6a0e53094f95b2029a6384727555b13ee0c59a057928d6018dc4113.exe"C:\Users\Admin\AppData\Local\Temp\6e3eebd9d6a0e53094f95b2029a6384727555b13ee0c59a057928d6018dc4113.exe"1⤵
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:1220 -
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un770582.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un770582.exe2⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:1672 -
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\90416643.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\90416643.exe3⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Loads dropped DLL
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1428
-
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\rk085069.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\rk085069.exe3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
PID:556
-
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
592KB
MD553b92ed577466e6a642d9d33b16d907f
SHA1df0e86a4e15fb200a7f5b2088a05f41ae5ef1880
SHA256d8171ae70ff0b9d31b4639fcc3133478a7506ac45974a2fd8222f9732e85f172
SHA51284a1fc996b6996b33dbb97306e6aa00e109b023df2780d56a26757d1504ce771b704ec1dfa713c53473326dddcc405f1193e18bbeaa1829cacd264ccfb0d564e
-
Filesize
592KB
MD553b92ed577466e6a642d9d33b16d907f
SHA1df0e86a4e15fb200a7f5b2088a05f41ae5ef1880
SHA256d8171ae70ff0b9d31b4639fcc3133478a7506ac45974a2fd8222f9732e85f172
SHA51284a1fc996b6996b33dbb97306e6aa00e109b023df2780d56a26757d1504ce771b704ec1dfa713c53473326dddcc405f1193e18bbeaa1829cacd264ccfb0d564e
-
Filesize
377KB
MD5e89018d24e0e3266dc15a5a50ddcfe55
SHA12b3a21da39b6febb466cfe947f290fa4902f7359
SHA2568b8cfd970fead813049abdac74ed3ef66fe7dddd983816898bb977350d1c1592
SHA5128a32fc82562f1d16b364cc5692cf9972b0e27af0d1226ba555545360a12c211a10b1f84da567bc0d4844296315920df25b94df85081bc076cc3e0fafe5bb0dd6
-
Filesize
377KB
MD5e89018d24e0e3266dc15a5a50ddcfe55
SHA12b3a21da39b6febb466cfe947f290fa4902f7359
SHA2568b8cfd970fead813049abdac74ed3ef66fe7dddd983816898bb977350d1c1592
SHA5128a32fc82562f1d16b364cc5692cf9972b0e27af0d1226ba555545360a12c211a10b1f84da567bc0d4844296315920df25b94df85081bc076cc3e0fafe5bb0dd6
-
Filesize
377KB
MD5e89018d24e0e3266dc15a5a50ddcfe55
SHA12b3a21da39b6febb466cfe947f290fa4902f7359
SHA2568b8cfd970fead813049abdac74ed3ef66fe7dddd983816898bb977350d1c1592
SHA5128a32fc82562f1d16b364cc5692cf9972b0e27af0d1226ba555545360a12c211a10b1f84da567bc0d4844296315920df25b94df85081bc076cc3e0fafe5bb0dd6
-
Filesize
459KB
MD553edd6b08f2c312735b59eb48f99e1a2
SHA149157b5324220d33e031ba7c3d0a04dd5b66f5ac
SHA2560c0242fc83e6d4fec9e8f76cacc3ca3fa792a86a398d503eb361bef1ce8fc0c6
SHA512a5f7da3a79b69a5c08e95d5688b66b4fc469ad3457a2c2dad446a2e72133d0fa78c6a17092c6b8752056094640df49544b2b650d4041a7640a39cb2c31ab0240
-
Filesize
459KB
MD553edd6b08f2c312735b59eb48f99e1a2
SHA149157b5324220d33e031ba7c3d0a04dd5b66f5ac
SHA2560c0242fc83e6d4fec9e8f76cacc3ca3fa792a86a398d503eb361bef1ce8fc0c6
SHA512a5f7da3a79b69a5c08e95d5688b66b4fc469ad3457a2c2dad446a2e72133d0fa78c6a17092c6b8752056094640df49544b2b650d4041a7640a39cb2c31ab0240
-
Filesize
459KB
MD553edd6b08f2c312735b59eb48f99e1a2
SHA149157b5324220d33e031ba7c3d0a04dd5b66f5ac
SHA2560c0242fc83e6d4fec9e8f76cacc3ca3fa792a86a398d503eb361bef1ce8fc0c6
SHA512a5f7da3a79b69a5c08e95d5688b66b4fc469ad3457a2c2dad446a2e72133d0fa78c6a17092c6b8752056094640df49544b2b650d4041a7640a39cb2c31ab0240
-
Filesize
592KB
MD553b92ed577466e6a642d9d33b16d907f
SHA1df0e86a4e15fb200a7f5b2088a05f41ae5ef1880
SHA256d8171ae70ff0b9d31b4639fcc3133478a7506ac45974a2fd8222f9732e85f172
SHA51284a1fc996b6996b33dbb97306e6aa00e109b023df2780d56a26757d1504ce771b704ec1dfa713c53473326dddcc405f1193e18bbeaa1829cacd264ccfb0d564e
-
Filesize
592KB
MD553b92ed577466e6a642d9d33b16d907f
SHA1df0e86a4e15fb200a7f5b2088a05f41ae5ef1880
SHA256d8171ae70ff0b9d31b4639fcc3133478a7506ac45974a2fd8222f9732e85f172
SHA51284a1fc996b6996b33dbb97306e6aa00e109b023df2780d56a26757d1504ce771b704ec1dfa713c53473326dddcc405f1193e18bbeaa1829cacd264ccfb0d564e
-
Filesize
377KB
MD5e89018d24e0e3266dc15a5a50ddcfe55
SHA12b3a21da39b6febb466cfe947f290fa4902f7359
SHA2568b8cfd970fead813049abdac74ed3ef66fe7dddd983816898bb977350d1c1592
SHA5128a32fc82562f1d16b364cc5692cf9972b0e27af0d1226ba555545360a12c211a10b1f84da567bc0d4844296315920df25b94df85081bc076cc3e0fafe5bb0dd6
-
Filesize
377KB
MD5e89018d24e0e3266dc15a5a50ddcfe55
SHA12b3a21da39b6febb466cfe947f290fa4902f7359
SHA2568b8cfd970fead813049abdac74ed3ef66fe7dddd983816898bb977350d1c1592
SHA5128a32fc82562f1d16b364cc5692cf9972b0e27af0d1226ba555545360a12c211a10b1f84da567bc0d4844296315920df25b94df85081bc076cc3e0fafe5bb0dd6
-
Filesize
377KB
MD5e89018d24e0e3266dc15a5a50ddcfe55
SHA12b3a21da39b6febb466cfe947f290fa4902f7359
SHA2568b8cfd970fead813049abdac74ed3ef66fe7dddd983816898bb977350d1c1592
SHA5128a32fc82562f1d16b364cc5692cf9972b0e27af0d1226ba555545360a12c211a10b1f84da567bc0d4844296315920df25b94df85081bc076cc3e0fafe5bb0dd6
-
Filesize
459KB
MD553edd6b08f2c312735b59eb48f99e1a2
SHA149157b5324220d33e031ba7c3d0a04dd5b66f5ac
SHA2560c0242fc83e6d4fec9e8f76cacc3ca3fa792a86a398d503eb361bef1ce8fc0c6
SHA512a5f7da3a79b69a5c08e95d5688b66b4fc469ad3457a2c2dad446a2e72133d0fa78c6a17092c6b8752056094640df49544b2b650d4041a7640a39cb2c31ab0240
-
Filesize
459KB
MD553edd6b08f2c312735b59eb48f99e1a2
SHA149157b5324220d33e031ba7c3d0a04dd5b66f5ac
SHA2560c0242fc83e6d4fec9e8f76cacc3ca3fa792a86a398d503eb361bef1ce8fc0c6
SHA512a5f7da3a79b69a5c08e95d5688b66b4fc469ad3457a2c2dad446a2e72133d0fa78c6a17092c6b8752056094640df49544b2b650d4041a7640a39cb2c31ab0240
-
Filesize
459KB
MD553edd6b08f2c312735b59eb48f99e1a2
SHA149157b5324220d33e031ba7c3d0a04dd5b66f5ac
SHA2560c0242fc83e6d4fec9e8f76cacc3ca3fa792a86a398d503eb361bef1ce8fc0c6
SHA512a5f7da3a79b69a5c08e95d5688b66b4fc469ad3457a2c2dad446a2e72133d0fa78c6a17092c6b8752056094640df49544b2b650d4041a7640a39cb2c31ab0240