Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Resubmissions
06/05/2023, 03:34
230506-d4318sab4x 806/05/2023, 03:31
230506-d24jzsfh36 1006/05/2023, 03:27
230506-dz82paab2z 1006/05/2023, 03:16
230506-dsqlrsaa71 10Analysis
-
max time kernel
131s -
max time network
144s -
platform
windows7_x64 -
resource
win7-20230220-en -
resource tags
arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system -
submitted
06/05/2023, 03:27
Static task
static1
Behavioral task
behavioral1
Sample
c6326212f846c43fd017ae3ecd6e7f4d.zip
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
c6326212f846c43fd017ae3ecd6e7f4d.zip
Resource
win10v2004-20230221-en
Behavioral task
behavioral3
Sample
00f0216950a0e1670937a7e76d2328226792363edc980aedda2de8722ace0896.exe
Resource
win7-20230220-en
Behavioral task
behavioral4
Sample
00f0216950a0e1670937a7e76d2328226792363edc980aedda2de8722ace0896.exe
Resource
win10v2004-20230220-en
General
-
Target
00f0216950a0e1670937a7e76d2328226792363edc980aedda2de8722ace0896.exe
-
Size
1.3MB
-
MD5
c6326212f846c43fd017ae3ecd6e7f4d
-
SHA1
c92d9d6a4df83cd701ab170209a3af9d381ca928
-
SHA256
00f0216950a0e1670937a7e76d2328226792363edc980aedda2de8722ace0896
-
SHA512
fd0d59818687ecebec17820d63bcb61c0e0a4a5253899439e311e0f431234abf22f22cfc88de7801e5c5d95392b9da1e331bf43cfc15a406381fb4b02cbb6268
-
SSDEEP
24576:1yV1s8yRxwV7JGccW9Uan8Ax+dAuQ52W0oIw0A8IZ:Q3s8yRUJGccYUa/yV8x0oIwE
Malware Config
Signatures
-
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" n8400605.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" n8400605.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" n8400605.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" n8400605.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" n8400605.exe Key created \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection n8400605.exe -
Executes dropped EXE 5 IoCs
pid Process 612 z2782167.exe 436 z0741032.exe 1488 z9472836.exe 872 n8400605.exe 1360 o8123542.exe -
Loads dropped DLL 11 IoCs
pid Process 2044 00f0216950a0e1670937a7e76d2328226792363edc980aedda2de8722ace0896.exe 612 z2782167.exe 612 z2782167.exe 436 z0741032.exe 436 z0741032.exe 1488 z9472836.exe 1488 z9472836.exe 1488 z9472836.exe 872 n8400605.exe 1488 z9472836.exe 1360 o8123542.exe -
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Features n8400605.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0" n8400605.exe -
Adds Run key to start application 2 TTPs 8 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" 00f0216950a0e1670937a7e76d2328226792363edc980aedda2de8722ace0896.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce z2782167.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" z2782167.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce z0741032.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\"" z0741032.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce z9472836.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup3 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP003.TMP\\\"" z9472836.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce 00f0216950a0e1670937a7e76d2328226792363edc980aedda2de8722ace0896.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 872 n8400605.exe 872 n8400605.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 872 n8400605.exe -
Suspicious use of WriteProcessMemory 35 IoCs
description pid Process procid_target PID 2044 wrote to memory of 612 2044 00f0216950a0e1670937a7e76d2328226792363edc980aedda2de8722ace0896.exe 28 PID 2044 wrote to memory of 612 2044 00f0216950a0e1670937a7e76d2328226792363edc980aedda2de8722ace0896.exe 28 PID 2044 wrote to memory of 612 2044 00f0216950a0e1670937a7e76d2328226792363edc980aedda2de8722ace0896.exe 28 PID 2044 wrote to memory of 612 2044 00f0216950a0e1670937a7e76d2328226792363edc980aedda2de8722ace0896.exe 28 PID 2044 wrote to memory of 612 2044 00f0216950a0e1670937a7e76d2328226792363edc980aedda2de8722ace0896.exe 28 PID 2044 wrote to memory of 612 2044 00f0216950a0e1670937a7e76d2328226792363edc980aedda2de8722ace0896.exe 28 PID 2044 wrote to memory of 612 2044 00f0216950a0e1670937a7e76d2328226792363edc980aedda2de8722ace0896.exe 28 PID 612 wrote to memory of 436 612 z2782167.exe 29 PID 612 wrote to memory of 436 612 z2782167.exe 29 PID 612 wrote to memory of 436 612 z2782167.exe 29 PID 612 wrote to memory of 436 612 z2782167.exe 29 PID 612 wrote to memory of 436 612 z2782167.exe 29 PID 612 wrote to memory of 436 612 z2782167.exe 29 PID 612 wrote to memory of 436 612 z2782167.exe 29 PID 436 wrote to memory of 1488 436 z0741032.exe 30 PID 436 wrote to memory of 1488 436 z0741032.exe 30 PID 436 wrote to memory of 1488 436 z0741032.exe 30 PID 436 wrote to memory of 1488 436 z0741032.exe 30 PID 436 wrote to memory of 1488 436 z0741032.exe 30 PID 436 wrote to memory of 1488 436 z0741032.exe 30 PID 436 wrote to memory of 1488 436 z0741032.exe 30 PID 1488 wrote to memory of 872 1488 z9472836.exe 31 PID 1488 wrote to memory of 872 1488 z9472836.exe 31 PID 1488 wrote to memory of 872 1488 z9472836.exe 31 PID 1488 wrote to memory of 872 1488 z9472836.exe 31 PID 1488 wrote to memory of 872 1488 z9472836.exe 31 PID 1488 wrote to memory of 872 1488 z9472836.exe 31 PID 1488 wrote to memory of 872 1488 z9472836.exe 31 PID 1488 wrote to memory of 1360 1488 z9472836.exe 32 PID 1488 wrote to memory of 1360 1488 z9472836.exe 32 PID 1488 wrote to memory of 1360 1488 z9472836.exe 32 PID 1488 wrote to memory of 1360 1488 z9472836.exe 32 PID 1488 wrote to memory of 1360 1488 z9472836.exe 32 PID 1488 wrote to memory of 1360 1488 z9472836.exe 32 PID 1488 wrote to memory of 1360 1488 z9472836.exe 32
Processes
-
C:\Users\Admin\AppData\Local\Temp\00f0216950a0e1670937a7e76d2328226792363edc980aedda2de8722ace0896.exe"C:\Users\Admin\AppData\Local\Temp\00f0216950a0e1670937a7e76d2328226792363edc980aedda2de8722ace0896.exe"1⤵
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:2044 -
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z2782167.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z2782167.exe2⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:612 -
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z0741032.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z0741032.exe3⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:436 -
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\z9472836.exeC:\Users\Admin\AppData\Local\Temp\IXP002.TMP\z9472836.exe4⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:1488 -
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\n8400605.exeC:\Users\Admin\AppData\Local\Temp\IXP003.TMP\n8400605.exe5⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Loads dropped DLL
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:872
-
-
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\o8123542.exeC:\Users\Admin\AppData\Local\Temp\IXP003.TMP\o8123542.exe5⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1360
-
-
-
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.1MB
MD56de3329e4817473b6b8ac62a3c5c6b59
SHA1382b23d4ca29863993d5f932820053c66737b020
SHA25640f8b276607d020b68b7b72a119cdd1fbb3d69e059156954a7f739b8fcfa0ed5
SHA5129efd59bcf78e22e00f4fbd69b87a3f4b946de2281713f0893f11c233b1515d3a3e23ecb13a1ffed5a773451d602bdb87652c2d75b5ca0d3f658cd84c03faa021
-
Filesize
1.1MB
MD56de3329e4817473b6b8ac62a3c5c6b59
SHA1382b23d4ca29863993d5f932820053c66737b020
SHA25640f8b276607d020b68b7b72a119cdd1fbb3d69e059156954a7f739b8fcfa0ed5
SHA5129efd59bcf78e22e00f4fbd69b87a3f4b946de2281713f0893f11c233b1515d3a3e23ecb13a1ffed5a773451d602bdb87652c2d75b5ca0d3f658cd84c03faa021
-
Filesize
621KB
MD53730c6ca253a6bec0c560547d29950c9
SHA15bbab824cb4d766eb38d5e847d5ff38cd1a06ab3
SHA2562ede7db066aea98b9ab440bcf3459df99a732f2a7f4006e1109a18a98acafefd
SHA512d04ba71401db9e415206ccdbd92ca3211f10c052ecda7e76948ebacf0c06d0f2336fe2cf7c767e780b5903516168a7390671b60624ab5fc984ae302bddcd4203
-
Filesize
621KB
MD53730c6ca253a6bec0c560547d29950c9
SHA15bbab824cb4d766eb38d5e847d5ff38cd1a06ab3
SHA2562ede7db066aea98b9ab440bcf3459df99a732f2a7f4006e1109a18a98acafefd
SHA512d04ba71401db9e415206ccdbd92ca3211f10c052ecda7e76948ebacf0c06d0f2336fe2cf7c767e780b5903516168a7390671b60624ab5fc984ae302bddcd4203
-
Filesize
417KB
MD5fee3ee82da864a63149dcad7ae84dd08
SHA19b5d6a19607bc51e2d30280412214995afbbfccf
SHA2566dd292c345cc87952f5c7e8022b1fdc63314b7ae8763a0a2f785ea7d811c5996
SHA512fda497744fe1e9cb343822fed06548f9c052e071bbfae19f9eb34f47c97513edb080cf49712d313b7d9033fa25de8d74fe8d61519de94e243c23c1f5ec70a26d
-
Filesize
417KB
MD5fee3ee82da864a63149dcad7ae84dd08
SHA19b5d6a19607bc51e2d30280412214995afbbfccf
SHA2566dd292c345cc87952f5c7e8022b1fdc63314b7ae8763a0a2f785ea7d811c5996
SHA512fda497744fe1e9cb343822fed06548f9c052e071bbfae19f9eb34f47c97513edb080cf49712d313b7d9033fa25de8d74fe8d61519de94e243c23c1f5ec70a26d
-
Filesize
360KB
MD57ee65377a741d142faa2f927f6aa78bb
SHA1c07e33ef45490ba4937e308c513558c717ae76ca
SHA256cc4eb5b47d66e17b9ea66334f826e6121d501e994380b0ce150b8ec27eb9bb29
SHA512870a30536148ebf0614d5a870a00b5bb1e137cad428c66f1908f65f65104964dfc70e9b8425785b8de0fb6da5312a4002001bf0df147c6f7bf6c9122004d3c9f
-
Filesize
360KB
MD57ee65377a741d142faa2f927f6aa78bb
SHA1c07e33ef45490ba4937e308c513558c717ae76ca
SHA256cc4eb5b47d66e17b9ea66334f826e6121d501e994380b0ce150b8ec27eb9bb29
SHA512870a30536148ebf0614d5a870a00b5bb1e137cad428c66f1908f65f65104964dfc70e9b8425785b8de0fb6da5312a4002001bf0df147c6f7bf6c9122004d3c9f
-
Filesize
360KB
MD57ee65377a741d142faa2f927f6aa78bb
SHA1c07e33ef45490ba4937e308c513558c717ae76ca
SHA256cc4eb5b47d66e17b9ea66334f826e6121d501e994380b0ce150b8ec27eb9bb29
SHA512870a30536148ebf0614d5a870a00b5bb1e137cad428c66f1908f65f65104964dfc70e9b8425785b8de0fb6da5312a4002001bf0df147c6f7bf6c9122004d3c9f
-
Filesize
136KB
MD5cc60cb4f3504297fed428ecbf5f17f66
SHA12bc25e3901a136be933cd3e2ba32c0b4cdc99982
SHA2569759986068c7f098c6a5e1b48ca54696f3c2a819fd8837cc3e41337ea1355bef
SHA51289ede7e141763644ff05d4f0949ec2e28b8161fd0ddeadbea2f9daeb83d72edf5a604c56703118b4869d07f1c40626b5da23488c2f48fddbcc1df19dddae86de
-
Filesize
136KB
MD5cc60cb4f3504297fed428ecbf5f17f66
SHA12bc25e3901a136be933cd3e2ba32c0b4cdc99982
SHA2569759986068c7f098c6a5e1b48ca54696f3c2a819fd8837cc3e41337ea1355bef
SHA51289ede7e141763644ff05d4f0949ec2e28b8161fd0ddeadbea2f9daeb83d72edf5a604c56703118b4869d07f1c40626b5da23488c2f48fddbcc1df19dddae86de
-
Filesize
1.1MB
MD56de3329e4817473b6b8ac62a3c5c6b59
SHA1382b23d4ca29863993d5f932820053c66737b020
SHA25640f8b276607d020b68b7b72a119cdd1fbb3d69e059156954a7f739b8fcfa0ed5
SHA5129efd59bcf78e22e00f4fbd69b87a3f4b946de2281713f0893f11c233b1515d3a3e23ecb13a1ffed5a773451d602bdb87652c2d75b5ca0d3f658cd84c03faa021
-
Filesize
1.1MB
MD56de3329e4817473b6b8ac62a3c5c6b59
SHA1382b23d4ca29863993d5f932820053c66737b020
SHA25640f8b276607d020b68b7b72a119cdd1fbb3d69e059156954a7f739b8fcfa0ed5
SHA5129efd59bcf78e22e00f4fbd69b87a3f4b946de2281713f0893f11c233b1515d3a3e23ecb13a1ffed5a773451d602bdb87652c2d75b5ca0d3f658cd84c03faa021
-
Filesize
621KB
MD53730c6ca253a6bec0c560547d29950c9
SHA15bbab824cb4d766eb38d5e847d5ff38cd1a06ab3
SHA2562ede7db066aea98b9ab440bcf3459df99a732f2a7f4006e1109a18a98acafefd
SHA512d04ba71401db9e415206ccdbd92ca3211f10c052ecda7e76948ebacf0c06d0f2336fe2cf7c767e780b5903516168a7390671b60624ab5fc984ae302bddcd4203
-
Filesize
621KB
MD53730c6ca253a6bec0c560547d29950c9
SHA15bbab824cb4d766eb38d5e847d5ff38cd1a06ab3
SHA2562ede7db066aea98b9ab440bcf3459df99a732f2a7f4006e1109a18a98acafefd
SHA512d04ba71401db9e415206ccdbd92ca3211f10c052ecda7e76948ebacf0c06d0f2336fe2cf7c767e780b5903516168a7390671b60624ab5fc984ae302bddcd4203
-
Filesize
417KB
MD5fee3ee82da864a63149dcad7ae84dd08
SHA19b5d6a19607bc51e2d30280412214995afbbfccf
SHA2566dd292c345cc87952f5c7e8022b1fdc63314b7ae8763a0a2f785ea7d811c5996
SHA512fda497744fe1e9cb343822fed06548f9c052e071bbfae19f9eb34f47c97513edb080cf49712d313b7d9033fa25de8d74fe8d61519de94e243c23c1f5ec70a26d
-
Filesize
417KB
MD5fee3ee82da864a63149dcad7ae84dd08
SHA19b5d6a19607bc51e2d30280412214995afbbfccf
SHA2566dd292c345cc87952f5c7e8022b1fdc63314b7ae8763a0a2f785ea7d811c5996
SHA512fda497744fe1e9cb343822fed06548f9c052e071bbfae19f9eb34f47c97513edb080cf49712d313b7d9033fa25de8d74fe8d61519de94e243c23c1f5ec70a26d
-
Filesize
360KB
MD57ee65377a741d142faa2f927f6aa78bb
SHA1c07e33ef45490ba4937e308c513558c717ae76ca
SHA256cc4eb5b47d66e17b9ea66334f826e6121d501e994380b0ce150b8ec27eb9bb29
SHA512870a30536148ebf0614d5a870a00b5bb1e137cad428c66f1908f65f65104964dfc70e9b8425785b8de0fb6da5312a4002001bf0df147c6f7bf6c9122004d3c9f
-
Filesize
360KB
MD57ee65377a741d142faa2f927f6aa78bb
SHA1c07e33ef45490ba4937e308c513558c717ae76ca
SHA256cc4eb5b47d66e17b9ea66334f826e6121d501e994380b0ce150b8ec27eb9bb29
SHA512870a30536148ebf0614d5a870a00b5bb1e137cad428c66f1908f65f65104964dfc70e9b8425785b8de0fb6da5312a4002001bf0df147c6f7bf6c9122004d3c9f
-
Filesize
360KB
MD57ee65377a741d142faa2f927f6aa78bb
SHA1c07e33ef45490ba4937e308c513558c717ae76ca
SHA256cc4eb5b47d66e17b9ea66334f826e6121d501e994380b0ce150b8ec27eb9bb29
SHA512870a30536148ebf0614d5a870a00b5bb1e137cad428c66f1908f65f65104964dfc70e9b8425785b8de0fb6da5312a4002001bf0df147c6f7bf6c9122004d3c9f
-
Filesize
136KB
MD5cc60cb4f3504297fed428ecbf5f17f66
SHA12bc25e3901a136be933cd3e2ba32c0b4cdc99982
SHA2569759986068c7f098c6a5e1b48ca54696f3c2a819fd8837cc3e41337ea1355bef
SHA51289ede7e141763644ff05d4f0949ec2e28b8161fd0ddeadbea2f9daeb83d72edf5a604c56703118b4869d07f1c40626b5da23488c2f48fddbcc1df19dddae86de
-
Filesize
136KB
MD5cc60cb4f3504297fed428ecbf5f17f66
SHA12bc25e3901a136be933cd3e2ba32c0b4cdc99982
SHA2569759986068c7f098c6a5e1b48ca54696f3c2a819fd8837cc3e41337ea1355bef
SHA51289ede7e141763644ff05d4f0949ec2e28b8161fd0ddeadbea2f9daeb83d72edf5a604c56703118b4869d07f1c40626b5da23488c2f48fddbcc1df19dddae86de