Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
158s -
max time network
162s -
platform
windows7_x64 -
resource
win7-20230220-en -
resource tags
arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system -
submitted
06/05/2023, 20:18
Static task
static1
Behavioral task
behavioral1
Sample
06963107e2991f18b4ee70d8bcad3b3ef13166c1b1ee34993cba2208f7834d96.exe
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
06963107e2991f18b4ee70d8bcad3b3ef13166c1b1ee34993cba2208f7834d96.exe
Resource
win10v2004-20230220-en
General
-
Target
06963107e2991f18b4ee70d8bcad3b3ef13166c1b1ee34993cba2208f7834d96.exe
-
Size
746KB
-
MD5
6d42a5aa78213429190d0a0934dc6b24
-
SHA1
fd3d8d238440a2fab9cb6d5a9a93c741e1f2d8bf
-
SHA256
06963107e2991f18b4ee70d8bcad3b3ef13166c1b1ee34993cba2208f7834d96
-
SHA512
b9722189ee2d67791996c6cfb182a52189c186b65e78df82ae9b4209faad150a9c41cc006dbd889a6d339fbbe18c3e216828dad963f66d53f9fc864431def0f6
-
SSDEEP
12288:9y90WArweOkO4mzxdXHxmGtHwSONtTEFNgxGuaq9jcBtgXPl8iVuGf4fBV25rW:9ymkMSzjBftHwSONtTEFNg7kgXNFVlMt
Malware Config
Signatures
-
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" 53478779.exe Key created \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection 53478779.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" 53478779.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" 53478779.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" 53478779.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" 53478779.exe -
Executes dropped EXE 3 IoCs
pid Process 1652 un093638.exe 472 53478779.exe 1548 rk374421.exe -
Loads dropped DLL 8 IoCs
pid Process 1636 06963107e2991f18b4ee70d8bcad3b3ef13166c1b1ee34993cba2208f7834d96.exe 1652 un093638.exe 1652 un093638.exe 1652 un093638.exe 472 53478779.exe 1652 un093638.exe 1652 un093638.exe 1548 rk374421.exe -
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Features 53478779.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0" 53478779.exe -
Adds Run key to start application 2 TTPs 4 IoCs
description ioc Process Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce 06963107e2991f18b4ee70d8bcad3b3ef13166c1b1ee34993cba2208f7834d96.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" 06963107e2991f18b4ee70d8bcad3b3ef13166c1b1ee34993cba2208f7834d96.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce un093638.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" un093638.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 472 53478779.exe 472 53478779.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 472 53478779.exe Token: SeDebugPrivilege 1548 rk374421.exe -
Suspicious use of WriteProcessMemory 21 IoCs
description pid Process procid_target PID 1636 wrote to memory of 1652 1636 06963107e2991f18b4ee70d8bcad3b3ef13166c1b1ee34993cba2208f7834d96.exe 28 PID 1636 wrote to memory of 1652 1636 06963107e2991f18b4ee70d8bcad3b3ef13166c1b1ee34993cba2208f7834d96.exe 28 PID 1636 wrote to memory of 1652 1636 06963107e2991f18b4ee70d8bcad3b3ef13166c1b1ee34993cba2208f7834d96.exe 28 PID 1636 wrote to memory of 1652 1636 06963107e2991f18b4ee70d8bcad3b3ef13166c1b1ee34993cba2208f7834d96.exe 28 PID 1636 wrote to memory of 1652 1636 06963107e2991f18b4ee70d8bcad3b3ef13166c1b1ee34993cba2208f7834d96.exe 28 PID 1636 wrote to memory of 1652 1636 06963107e2991f18b4ee70d8bcad3b3ef13166c1b1ee34993cba2208f7834d96.exe 28 PID 1636 wrote to memory of 1652 1636 06963107e2991f18b4ee70d8bcad3b3ef13166c1b1ee34993cba2208f7834d96.exe 28 PID 1652 wrote to memory of 472 1652 un093638.exe 29 PID 1652 wrote to memory of 472 1652 un093638.exe 29 PID 1652 wrote to memory of 472 1652 un093638.exe 29 PID 1652 wrote to memory of 472 1652 un093638.exe 29 PID 1652 wrote to memory of 472 1652 un093638.exe 29 PID 1652 wrote to memory of 472 1652 un093638.exe 29 PID 1652 wrote to memory of 472 1652 un093638.exe 29 PID 1652 wrote to memory of 1548 1652 un093638.exe 30 PID 1652 wrote to memory of 1548 1652 un093638.exe 30 PID 1652 wrote to memory of 1548 1652 un093638.exe 30 PID 1652 wrote to memory of 1548 1652 un093638.exe 30 PID 1652 wrote to memory of 1548 1652 un093638.exe 30 PID 1652 wrote to memory of 1548 1652 un093638.exe 30 PID 1652 wrote to memory of 1548 1652 un093638.exe 30
Processes
-
C:\Users\Admin\AppData\Local\Temp\06963107e2991f18b4ee70d8bcad3b3ef13166c1b1ee34993cba2208f7834d96.exe"C:\Users\Admin\AppData\Local\Temp\06963107e2991f18b4ee70d8bcad3b3ef13166c1b1ee34993cba2208f7834d96.exe"1⤵
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:1636 -
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un093638.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un093638.exe2⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:1652 -
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\53478779.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\53478779.exe3⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Loads dropped DLL
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:472
-
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\rk374421.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\rk374421.exe3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
PID:1548
-
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
591KB
MD524b1cd9c4ccc60ba3566beccb1109306
SHA1dd3caaa312cf66ac02419e6e88ac54e0453e6d47
SHA256383e66da59f46ff6d582429855628930413245a1272de94c178d93512d3b6a5a
SHA512d2f9bdf2c2a6628b504eb83506f36ca4e60c2b53c3c5b8440322cf192dfcc3356ec9a2358f3c5cb6a4457699630426050c7f299e228978279c13fd1a555f3abd
-
Filesize
591KB
MD524b1cd9c4ccc60ba3566beccb1109306
SHA1dd3caaa312cf66ac02419e6e88ac54e0453e6d47
SHA256383e66da59f46ff6d582429855628930413245a1272de94c178d93512d3b6a5a
SHA512d2f9bdf2c2a6628b504eb83506f36ca4e60c2b53c3c5b8440322cf192dfcc3356ec9a2358f3c5cb6a4457699630426050c7f299e228978279c13fd1a555f3abd
-
Filesize
376KB
MD5d20bd233473781a8759e9b4ea94e8a16
SHA18f93c9514cdc77d6124c180e2f1fe16f97fe43d9
SHA2565193247b883b1d5d4b6f03348186d926ab7ffe4f931db76c8d5699cda0e92740
SHA512a1b0d44fac8fd6c439c8e6a3426cb0f21327323fb8646b4feeb6faa7c935a079c8bc82c9ede31b0df4b9a457da46cdacd640217108ac04de5648ee312755676c
-
Filesize
376KB
MD5d20bd233473781a8759e9b4ea94e8a16
SHA18f93c9514cdc77d6124c180e2f1fe16f97fe43d9
SHA2565193247b883b1d5d4b6f03348186d926ab7ffe4f931db76c8d5699cda0e92740
SHA512a1b0d44fac8fd6c439c8e6a3426cb0f21327323fb8646b4feeb6faa7c935a079c8bc82c9ede31b0df4b9a457da46cdacd640217108ac04de5648ee312755676c
-
Filesize
376KB
MD5d20bd233473781a8759e9b4ea94e8a16
SHA18f93c9514cdc77d6124c180e2f1fe16f97fe43d9
SHA2565193247b883b1d5d4b6f03348186d926ab7ffe4f931db76c8d5699cda0e92740
SHA512a1b0d44fac8fd6c439c8e6a3426cb0f21327323fb8646b4feeb6faa7c935a079c8bc82c9ede31b0df4b9a457da46cdacd640217108ac04de5648ee312755676c
-
Filesize
459KB
MD5ad973c92036e4c84e4f20035e8892c2a
SHA1eee57cdf949ebf435a5427ed79992e676979ef49
SHA256c8daa664653aa59954af42734fcf66e8635172b09a02ec38960239960e509fb2
SHA51294a4cdd400a459c8af02c700f3133b865eea8b61c8c3fc3f48152396977907dd9578ac6e31817d0c4ca3f002a3cf20c5c5204a96e487d6b52b1833d4db19be6d
-
Filesize
459KB
MD5ad973c92036e4c84e4f20035e8892c2a
SHA1eee57cdf949ebf435a5427ed79992e676979ef49
SHA256c8daa664653aa59954af42734fcf66e8635172b09a02ec38960239960e509fb2
SHA51294a4cdd400a459c8af02c700f3133b865eea8b61c8c3fc3f48152396977907dd9578ac6e31817d0c4ca3f002a3cf20c5c5204a96e487d6b52b1833d4db19be6d
-
Filesize
459KB
MD5ad973c92036e4c84e4f20035e8892c2a
SHA1eee57cdf949ebf435a5427ed79992e676979ef49
SHA256c8daa664653aa59954af42734fcf66e8635172b09a02ec38960239960e509fb2
SHA51294a4cdd400a459c8af02c700f3133b865eea8b61c8c3fc3f48152396977907dd9578ac6e31817d0c4ca3f002a3cf20c5c5204a96e487d6b52b1833d4db19be6d
-
Filesize
591KB
MD524b1cd9c4ccc60ba3566beccb1109306
SHA1dd3caaa312cf66ac02419e6e88ac54e0453e6d47
SHA256383e66da59f46ff6d582429855628930413245a1272de94c178d93512d3b6a5a
SHA512d2f9bdf2c2a6628b504eb83506f36ca4e60c2b53c3c5b8440322cf192dfcc3356ec9a2358f3c5cb6a4457699630426050c7f299e228978279c13fd1a555f3abd
-
Filesize
591KB
MD524b1cd9c4ccc60ba3566beccb1109306
SHA1dd3caaa312cf66ac02419e6e88ac54e0453e6d47
SHA256383e66da59f46ff6d582429855628930413245a1272de94c178d93512d3b6a5a
SHA512d2f9bdf2c2a6628b504eb83506f36ca4e60c2b53c3c5b8440322cf192dfcc3356ec9a2358f3c5cb6a4457699630426050c7f299e228978279c13fd1a555f3abd
-
Filesize
376KB
MD5d20bd233473781a8759e9b4ea94e8a16
SHA18f93c9514cdc77d6124c180e2f1fe16f97fe43d9
SHA2565193247b883b1d5d4b6f03348186d926ab7ffe4f931db76c8d5699cda0e92740
SHA512a1b0d44fac8fd6c439c8e6a3426cb0f21327323fb8646b4feeb6faa7c935a079c8bc82c9ede31b0df4b9a457da46cdacd640217108ac04de5648ee312755676c
-
Filesize
376KB
MD5d20bd233473781a8759e9b4ea94e8a16
SHA18f93c9514cdc77d6124c180e2f1fe16f97fe43d9
SHA2565193247b883b1d5d4b6f03348186d926ab7ffe4f931db76c8d5699cda0e92740
SHA512a1b0d44fac8fd6c439c8e6a3426cb0f21327323fb8646b4feeb6faa7c935a079c8bc82c9ede31b0df4b9a457da46cdacd640217108ac04de5648ee312755676c
-
Filesize
376KB
MD5d20bd233473781a8759e9b4ea94e8a16
SHA18f93c9514cdc77d6124c180e2f1fe16f97fe43d9
SHA2565193247b883b1d5d4b6f03348186d926ab7ffe4f931db76c8d5699cda0e92740
SHA512a1b0d44fac8fd6c439c8e6a3426cb0f21327323fb8646b4feeb6faa7c935a079c8bc82c9ede31b0df4b9a457da46cdacd640217108ac04de5648ee312755676c
-
Filesize
459KB
MD5ad973c92036e4c84e4f20035e8892c2a
SHA1eee57cdf949ebf435a5427ed79992e676979ef49
SHA256c8daa664653aa59954af42734fcf66e8635172b09a02ec38960239960e509fb2
SHA51294a4cdd400a459c8af02c700f3133b865eea8b61c8c3fc3f48152396977907dd9578ac6e31817d0c4ca3f002a3cf20c5c5204a96e487d6b52b1833d4db19be6d
-
Filesize
459KB
MD5ad973c92036e4c84e4f20035e8892c2a
SHA1eee57cdf949ebf435a5427ed79992e676979ef49
SHA256c8daa664653aa59954af42734fcf66e8635172b09a02ec38960239960e509fb2
SHA51294a4cdd400a459c8af02c700f3133b865eea8b61c8c3fc3f48152396977907dd9578ac6e31817d0c4ca3f002a3cf20c5c5204a96e487d6b52b1833d4db19be6d
-
Filesize
459KB
MD5ad973c92036e4c84e4f20035e8892c2a
SHA1eee57cdf949ebf435a5427ed79992e676979ef49
SHA256c8daa664653aa59954af42734fcf66e8635172b09a02ec38960239960e509fb2
SHA51294a4cdd400a459c8af02c700f3133b865eea8b61c8c3fc3f48152396977907dd9578ac6e31817d0c4ca3f002a3cf20c5c5204a96e487d6b52b1833d4db19be6d