Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    149s
  • max time network
    150s
  • platform
    windows7_x64
  • resource
    win7-20230220-en
  • resource tags

    arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
  • submitted
    06/05/2023, 22:33

General

  • Target

    00e3ef79b707b0e6f1390a2b1b866c41a7035bb87bddc5af92dc696391da7851.exe

  • Size

    998KB

  • MD5

    e117a2b9a45d4662173700af9f362061

  • SHA1

    d9ed5a4fec5d1619768aa9a515076c5bb5a0526f

  • SHA256

    00e3ef79b707b0e6f1390a2b1b866c41a7035bb87bddc5af92dc696391da7851

  • SHA512

    e5e5715955297d674b32b9939bdc93d73f5260896a8580894e5a7dfd65a2af1895b96b4744b8aa46c309dd8a410d037c3c507292622af13db02b52f8cb641117

  • SSDEEP

    24576:UyUN+sJ9fZ45YsldeutPRU4CHc5yFl40:jE+Eb45YsjhtPA85

Malware Config

Signatures

  • Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs
  • Executes dropped EXE 4 IoCs
  • Loads dropped DLL 10 IoCs
  • Windows security modification 2 TTPs 2 IoCs
  • Adds Run key to start application 2 TTPs 6 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 28 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\00e3ef79b707b0e6f1390a2b1b866c41a7035bb87bddc5af92dc696391da7851.exe
    "C:\Users\Admin\AppData\Local\Temp\00e3ef79b707b0e6f1390a2b1b866c41a7035bb87bddc5af92dc696391da7851.exe"
    1⤵
    • Loads dropped DLL
    • Adds Run key to start application
    • Suspicious use of WriteProcessMemory
    PID:1232
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\On089268.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\On089268.exe
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Adds Run key to start application
      • Suspicious use of WriteProcessMemory
      PID:1620
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\nL512125.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\nL512125.exe
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Adds Run key to start application
        • Suspicious use of WriteProcessMemory
        PID:108
        • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\135164559.exe
          C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\135164559.exe
          4⤵
          • Modifies Windows Defender Real-time Protection settings
          • Executes dropped EXE
          • Loads dropped DLL
          • Windows security modification
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:660
        • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\217184863.exe
          C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\217184863.exe
          4⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • Suspicious use of AdjustPrivilegeToken
          PID:984

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\On089268.exe

    Filesize

    769KB

    MD5

    86d4ee8201163b6593a72795161ab9c5

    SHA1

    4cded56f44b1b626451c908e50055d4b8c872537

    SHA256

    4cc9b96c93f52a437fd73d1d87d598a2d0d7beac029484733352f88ac51a12f1

    SHA512

    f9ea74aea761945c9ecfdaf5ebd0406ccca5747d75b2c85aca2be430b2f0b46c9f421051e423bc956f16f3a6bd28142b0579c10eae9a99e796a670187f1b983d

  • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\On089268.exe

    Filesize

    769KB

    MD5

    86d4ee8201163b6593a72795161ab9c5

    SHA1

    4cded56f44b1b626451c908e50055d4b8c872537

    SHA256

    4cc9b96c93f52a437fd73d1d87d598a2d0d7beac029484733352f88ac51a12f1

    SHA512

    f9ea74aea761945c9ecfdaf5ebd0406ccca5747d75b2c85aca2be430b2f0b46c9f421051e423bc956f16f3a6bd28142b0579c10eae9a99e796a670187f1b983d

  • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\nL512125.exe

    Filesize

    597KB

    MD5

    dabd1253e492dbec394f5fa5b17fa0a3

    SHA1

    8090fdca77797e2595e9d0988bf6d116a67634be

    SHA256

    32e77216214464f473a4edb0c2b1ffd176e4bb1535af7cb91374f67ac2b18721

    SHA512

    b82bd7eb4848a448d2388da570949af0a1d1f2682af03e119825c68be73931eb3d522170327e07a8773394282eac2156d7c72d5f754ab619b9df3b0aa5507708

  • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\nL512125.exe

    Filesize

    597KB

    MD5

    dabd1253e492dbec394f5fa5b17fa0a3

    SHA1

    8090fdca77797e2595e9d0988bf6d116a67634be

    SHA256

    32e77216214464f473a4edb0c2b1ffd176e4bb1535af7cb91374f67ac2b18721

    SHA512

    b82bd7eb4848a448d2388da570949af0a1d1f2682af03e119825c68be73931eb3d522170327e07a8773394282eac2156d7c72d5f754ab619b9df3b0aa5507708

  • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\135164559.exe

    Filesize

    390KB

    MD5

    4b120f5da98b13dce4a2f6b2c0e3d146

    SHA1

    4698a756543b0a1e16d6154a6b615b1ea12dc21e

    SHA256

    83edaee5bc61ceb729da5bd97490e93b232962179af2db18a692e5a3c5eea7ff

    SHA512

    ce3796736b50c8cd4be18704f00a93f3042396310f35c01c45943b4127e822948b85c6ecff95001c318345886cc3c54a3a97fb9b136047241f0ccc17a888ff25

  • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\135164559.exe

    Filesize

    390KB

    MD5

    4b120f5da98b13dce4a2f6b2c0e3d146

    SHA1

    4698a756543b0a1e16d6154a6b615b1ea12dc21e

    SHA256

    83edaee5bc61ceb729da5bd97490e93b232962179af2db18a692e5a3c5eea7ff

    SHA512

    ce3796736b50c8cd4be18704f00a93f3042396310f35c01c45943b4127e822948b85c6ecff95001c318345886cc3c54a3a97fb9b136047241f0ccc17a888ff25

  • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\135164559.exe

    Filesize

    390KB

    MD5

    4b120f5da98b13dce4a2f6b2c0e3d146

    SHA1

    4698a756543b0a1e16d6154a6b615b1ea12dc21e

    SHA256

    83edaee5bc61ceb729da5bd97490e93b232962179af2db18a692e5a3c5eea7ff

    SHA512

    ce3796736b50c8cd4be18704f00a93f3042396310f35c01c45943b4127e822948b85c6ecff95001c318345886cc3c54a3a97fb9b136047241f0ccc17a888ff25

  • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\217184863.exe

    Filesize

    473KB

    MD5

    fda72bc28d66f7a712b27e768602b0b4

    SHA1

    77704544b3c1cf1fa1d62eb585ee69538d65a914

    SHA256

    5e902aed75445514c77fc20f0b49e1bfc207e09da2a72a505ba0ae0955b53012

    SHA512

    cf1d8887433066b7744fb51aaea36e2c0eb7440b3cfab279de82439165ee496529b1599304538f873a35862d1bd5581080ec25c4c503715c4fc3f015144181e8

  • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\217184863.exe

    Filesize

    473KB

    MD5

    fda72bc28d66f7a712b27e768602b0b4

    SHA1

    77704544b3c1cf1fa1d62eb585ee69538d65a914

    SHA256

    5e902aed75445514c77fc20f0b49e1bfc207e09da2a72a505ba0ae0955b53012

    SHA512

    cf1d8887433066b7744fb51aaea36e2c0eb7440b3cfab279de82439165ee496529b1599304538f873a35862d1bd5581080ec25c4c503715c4fc3f015144181e8

  • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\217184863.exe

    Filesize

    473KB

    MD5

    fda72bc28d66f7a712b27e768602b0b4

    SHA1

    77704544b3c1cf1fa1d62eb585ee69538d65a914

    SHA256

    5e902aed75445514c77fc20f0b49e1bfc207e09da2a72a505ba0ae0955b53012

    SHA512

    cf1d8887433066b7744fb51aaea36e2c0eb7440b3cfab279de82439165ee496529b1599304538f873a35862d1bd5581080ec25c4c503715c4fc3f015144181e8

  • \Users\Admin\AppData\Local\Temp\IXP000.TMP\On089268.exe

    Filesize

    769KB

    MD5

    86d4ee8201163b6593a72795161ab9c5

    SHA1

    4cded56f44b1b626451c908e50055d4b8c872537

    SHA256

    4cc9b96c93f52a437fd73d1d87d598a2d0d7beac029484733352f88ac51a12f1

    SHA512

    f9ea74aea761945c9ecfdaf5ebd0406ccca5747d75b2c85aca2be430b2f0b46c9f421051e423bc956f16f3a6bd28142b0579c10eae9a99e796a670187f1b983d

  • \Users\Admin\AppData\Local\Temp\IXP000.TMP\On089268.exe

    Filesize

    769KB

    MD5

    86d4ee8201163b6593a72795161ab9c5

    SHA1

    4cded56f44b1b626451c908e50055d4b8c872537

    SHA256

    4cc9b96c93f52a437fd73d1d87d598a2d0d7beac029484733352f88ac51a12f1

    SHA512

    f9ea74aea761945c9ecfdaf5ebd0406ccca5747d75b2c85aca2be430b2f0b46c9f421051e423bc956f16f3a6bd28142b0579c10eae9a99e796a670187f1b983d

  • \Users\Admin\AppData\Local\Temp\IXP001.TMP\nL512125.exe

    Filesize

    597KB

    MD5

    dabd1253e492dbec394f5fa5b17fa0a3

    SHA1

    8090fdca77797e2595e9d0988bf6d116a67634be

    SHA256

    32e77216214464f473a4edb0c2b1ffd176e4bb1535af7cb91374f67ac2b18721

    SHA512

    b82bd7eb4848a448d2388da570949af0a1d1f2682af03e119825c68be73931eb3d522170327e07a8773394282eac2156d7c72d5f754ab619b9df3b0aa5507708

  • \Users\Admin\AppData\Local\Temp\IXP001.TMP\nL512125.exe

    Filesize

    597KB

    MD5

    dabd1253e492dbec394f5fa5b17fa0a3

    SHA1

    8090fdca77797e2595e9d0988bf6d116a67634be

    SHA256

    32e77216214464f473a4edb0c2b1ffd176e4bb1535af7cb91374f67ac2b18721

    SHA512

    b82bd7eb4848a448d2388da570949af0a1d1f2682af03e119825c68be73931eb3d522170327e07a8773394282eac2156d7c72d5f754ab619b9df3b0aa5507708

  • \Users\Admin\AppData\Local\Temp\IXP002.TMP\135164559.exe

    Filesize

    390KB

    MD5

    4b120f5da98b13dce4a2f6b2c0e3d146

    SHA1

    4698a756543b0a1e16d6154a6b615b1ea12dc21e

    SHA256

    83edaee5bc61ceb729da5bd97490e93b232962179af2db18a692e5a3c5eea7ff

    SHA512

    ce3796736b50c8cd4be18704f00a93f3042396310f35c01c45943b4127e822948b85c6ecff95001c318345886cc3c54a3a97fb9b136047241f0ccc17a888ff25

  • \Users\Admin\AppData\Local\Temp\IXP002.TMP\135164559.exe

    Filesize

    390KB

    MD5

    4b120f5da98b13dce4a2f6b2c0e3d146

    SHA1

    4698a756543b0a1e16d6154a6b615b1ea12dc21e

    SHA256

    83edaee5bc61ceb729da5bd97490e93b232962179af2db18a692e5a3c5eea7ff

    SHA512

    ce3796736b50c8cd4be18704f00a93f3042396310f35c01c45943b4127e822948b85c6ecff95001c318345886cc3c54a3a97fb9b136047241f0ccc17a888ff25

  • \Users\Admin\AppData\Local\Temp\IXP002.TMP\135164559.exe

    Filesize

    390KB

    MD5

    4b120f5da98b13dce4a2f6b2c0e3d146

    SHA1

    4698a756543b0a1e16d6154a6b615b1ea12dc21e

    SHA256

    83edaee5bc61ceb729da5bd97490e93b232962179af2db18a692e5a3c5eea7ff

    SHA512

    ce3796736b50c8cd4be18704f00a93f3042396310f35c01c45943b4127e822948b85c6ecff95001c318345886cc3c54a3a97fb9b136047241f0ccc17a888ff25

  • \Users\Admin\AppData\Local\Temp\IXP002.TMP\217184863.exe

    Filesize

    473KB

    MD5

    fda72bc28d66f7a712b27e768602b0b4

    SHA1

    77704544b3c1cf1fa1d62eb585ee69538d65a914

    SHA256

    5e902aed75445514c77fc20f0b49e1bfc207e09da2a72a505ba0ae0955b53012

    SHA512

    cf1d8887433066b7744fb51aaea36e2c0eb7440b3cfab279de82439165ee496529b1599304538f873a35862d1bd5581080ec25c4c503715c4fc3f015144181e8

  • \Users\Admin\AppData\Local\Temp\IXP002.TMP\217184863.exe

    Filesize

    473KB

    MD5

    fda72bc28d66f7a712b27e768602b0b4

    SHA1

    77704544b3c1cf1fa1d62eb585ee69538d65a914

    SHA256

    5e902aed75445514c77fc20f0b49e1bfc207e09da2a72a505ba0ae0955b53012

    SHA512

    cf1d8887433066b7744fb51aaea36e2c0eb7440b3cfab279de82439165ee496529b1599304538f873a35862d1bd5581080ec25c4c503715c4fc3f015144181e8

  • \Users\Admin\AppData\Local\Temp\IXP002.TMP\217184863.exe

    Filesize

    473KB

    MD5

    fda72bc28d66f7a712b27e768602b0b4

    SHA1

    77704544b3c1cf1fa1d62eb585ee69538d65a914

    SHA256

    5e902aed75445514c77fc20f0b49e1bfc207e09da2a72a505ba0ae0955b53012

    SHA512

    cf1d8887433066b7744fb51aaea36e2c0eb7440b3cfab279de82439165ee496529b1599304538f873a35862d1bd5581080ec25c4c503715c4fc3f015144181e8

  • memory/660-121-0x0000000000400000-0x0000000000807000-memory.dmp

    Filesize

    4.0MB

  • memory/660-107-0x0000000002210000-0x0000000002222000-memory.dmp

    Filesize

    72KB

  • memory/660-105-0x0000000002210000-0x0000000002222000-memory.dmp

    Filesize

    72KB

  • memory/660-103-0x0000000002210000-0x0000000002222000-memory.dmp

    Filesize

    72KB

  • memory/660-101-0x0000000002210000-0x0000000002222000-memory.dmp

    Filesize

    72KB

  • memory/660-99-0x0000000002210000-0x0000000002222000-memory.dmp

    Filesize

    72KB

  • memory/660-109-0x0000000002210000-0x0000000002222000-memory.dmp

    Filesize

    72KB

  • memory/660-111-0x0000000002210000-0x0000000002222000-memory.dmp

    Filesize

    72KB

  • memory/660-113-0x0000000002210000-0x0000000002222000-memory.dmp

    Filesize

    72KB

  • memory/660-117-0x0000000002210000-0x0000000002222000-memory.dmp

    Filesize

    72KB

  • memory/660-115-0x0000000002210000-0x0000000002222000-memory.dmp

    Filesize

    72KB

  • memory/660-118-0x00000000002E0000-0x000000000030D000-memory.dmp

    Filesize

    180KB

  • memory/660-119-0x0000000004FB0000-0x0000000004FF0000-memory.dmp

    Filesize

    256KB

  • memory/660-120-0x0000000004FB0000-0x0000000004FF0000-memory.dmp

    Filesize

    256KB

  • memory/660-97-0x0000000002210000-0x0000000002222000-memory.dmp

    Filesize

    72KB

  • memory/660-122-0x0000000000400000-0x0000000000807000-memory.dmp

    Filesize

    4.0MB

  • memory/660-95-0x0000000002210000-0x0000000002222000-memory.dmp

    Filesize

    72KB

  • memory/660-93-0x0000000002210000-0x0000000002222000-memory.dmp

    Filesize

    72KB

  • memory/660-91-0x0000000002210000-0x0000000002222000-memory.dmp

    Filesize

    72KB

  • memory/660-90-0x0000000002210000-0x0000000002222000-memory.dmp

    Filesize

    72KB

  • memory/660-89-0x0000000002210000-0x0000000002228000-memory.dmp

    Filesize

    96KB

  • memory/660-88-0x0000000000850000-0x000000000086A000-memory.dmp

    Filesize

    104KB

  • memory/984-135-0x0000000000CD0000-0x0000000000D16000-memory.dmp

    Filesize

    280KB

  • memory/984-154-0x0000000002630000-0x0000000002665000-memory.dmp

    Filesize

    212KB

  • memory/984-136-0x0000000004DE0000-0x0000000004E20000-memory.dmp

    Filesize

    256KB

  • memory/984-133-0x00000000025F0000-0x000000000262C000-memory.dmp

    Filesize

    240KB

  • memory/984-138-0x0000000002630000-0x0000000002665000-memory.dmp

    Filesize

    212KB

  • memory/984-137-0x0000000004DE0000-0x0000000004E20000-memory.dmp

    Filesize

    256KB

  • memory/984-139-0x0000000002630000-0x0000000002665000-memory.dmp

    Filesize

    212KB

  • memory/984-140-0x0000000004DE0000-0x0000000004E20000-memory.dmp

    Filesize

    256KB

  • memory/984-142-0x0000000002630000-0x0000000002665000-memory.dmp

    Filesize

    212KB

  • memory/984-144-0x0000000002630000-0x0000000002665000-memory.dmp

    Filesize

    212KB

  • memory/984-146-0x0000000002630000-0x0000000002665000-memory.dmp

    Filesize

    212KB

  • memory/984-148-0x0000000002630000-0x0000000002665000-memory.dmp

    Filesize

    212KB

  • memory/984-150-0x0000000002630000-0x0000000002665000-memory.dmp

    Filesize

    212KB

  • memory/984-134-0x0000000002630000-0x000000000266A000-memory.dmp

    Filesize

    232KB

  • memory/984-152-0x0000000002630000-0x0000000002665000-memory.dmp

    Filesize

    212KB

  • memory/984-158-0x0000000002630000-0x0000000002665000-memory.dmp

    Filesize

    212KB

  • memory/984-156-0x0000000002630000-0x0000000002665000-memory.dmp

    Filesize

    212KB

  • memory/984-162-0x0000000002630000-0x0000000002665000-memory.dmp

    Filesize

    212KB

  • memory/984-160-0x0000000002630000-0x0000000002665000-memory.dmp

    Filesize

    212KB

  • memory/984-164-0x0000000002630000-0x0000000002665000-memory.dmp

    Filesize

    212KB

  • memory/984-166-0x0000000002630000-0x0000000002665000-memory.dmp

    Filesize

    212KB

  • memory/984-168-0x0000000002630000-0x0000000002665000-memory.dmp

    Filesize

    212KB

  • memory/984-170-0x0000000002630000-0x0000000002665000-memory.dmp

    Filesize

    212KB

  • memory/984-172-0x0000000002630000-0x0000000002665000-memory.dmp

    Filesize

    212KB

  • memory/984-931-0x0000000004DE0000-0x0000000004E20000-memory.dmp

    Filesize

    256KB

  • memory/984-933-0x0000000004DE0000-0x0000000004E20000-memory.dmp

    Filesize

    256KB

  • memory/984-935-0x0000000004DE0000-0x0000000004E20000-memory.dmp

    Filesize

    256KB