Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    150s
  • max time network
    163s
  • platform
    windows7_x64
  • resource
    win7-20230220-en
  • resource tags

    arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
  • submitted
    06/05/2023, 20:26

General

  • Target

    0c83d34866f2e054f9a3ea83a151c7690912c7f4c23456b19f823731e792e644.exe

  • Size

    479KB

  • MD5

    140b9e67950841c067eb2a8f8fe02202

  • SHA1

    cf178a7343d98a11fc295259e0425f94abe34623

  • SHA256

    0c83d34866f2e054f9a3ea83a151c7690912c7f4c23456b19f823731e792e644

  • SHA512

    264c8591aec72531d268463ccf353c9402cf019f32c8cdbdc39645be93f5ac948bfe9cde2f5ff08762479e69a0f707c85cb8571d02dd7a8e42659e931005525f

  • SSDEEP

    12288:nMr1y90pQ0iBaYdVuUi0jSz7krY3lfG793LkoNn:iy+xwVuDz3krYfo1Nn

Malware Config

Signatures

  • Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs
  • Executes dropped EXE 3 IoCs
  • Loads dropped DLL 6 IoCs
  • Windows security modification 2 TTPs 2 IoCs
  • Adds Run key to start application 2 TTPs 4 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 21 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\0c83d34866f2e054f9a3ea83a151c7690912c7f4c23456b19f823731e792e644.exe
    "C:\Users\Admin\AppData\Local\Temp\0c83d34866f2e054f9a3ea83a151c7690912c7f4c23456b19f823731e792e644.exe"
    1⤵
    • Loads dropped DLL
    • Adds Run key to start application
    • Suspicious use of WriteProcessMemory
    PID:780
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v2632185.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v2632185.exe
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Adds Run key to start application
      • Suspicious use of WriteProcessMemory
      PID:1036
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\a7246049.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\a7246049.exe
        3⤵
        • Modifies Windows Defender Real-time Protection settings
        • Executes dropped EXE
        • Loads dropped DLL
        • Windows security modification
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:1692
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\b8064723.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\b8064723.exe
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        PID:1096

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v2632185.exe

    Filesize

    307KB

    MD5

    4008520dcfd72d8702b37b1bb7b315e2

    SHA1

    678e58514f491ffdbfc19f05b40b9e37f0ccdb37

    SHA256

    4ce94f69982c5e74853264b37cb5fd8dd5be396b4d3d8cf83615328227a67abc

    SHA512

    bf3134116bf2c36a64f07f25a390cd8c2230b40620df829c0b5d7fa5b4ea56e9ee2f2234843dcd6f9bd4f1d6d5899b03ea919061db4094727de3f1a8cddeae72

  • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v2632185.exe

    Filesize

    307KB

    MD5

    4008520dcfd72d8702b37b1bb7b315e2

    SHA1

    678e58514f491ffdbfc19f05b40b9e37f0ccdb37

    SHA256

    4ce94f69982c5e74853264b37cb5fd8dd5be396b4d3d8cf83615328227a67abc

    SHA512

    bf3134116bf2c36a64f07f25a390cd8c2230b40620df829c0b5d7fa5b4ea56e9ee2f2234843dcd6f9bd4f1d6d5899b03ea919061db4094727de3f1a8cddeae72

  • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\a7246049.exe

    Filesize

    175KB

    MD5

    9ea43a43f05412e93846db9dfce88ece

    SHA1

    c38ed27bedb056a3bff94c72d781c9ff73e5d0e2

    SHA256

    1bf268f59657e57973763ae7ef37b5ce310b808200782de92bf10933cb081f29

    SHA512

    4f821e5ee7bc92dbc7f9fd74dfcdab09905baaff561702cac134d091711beab78a2b741f865cdae157e546963a102b65b6528f2e4b62e7e5c95b9a2070fd329f

  • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\a7246049.exe

    Filesize

    175KB

    MD5

    9ea43a43f05412e93846db9dfce88ece

    SHA1

    c38ed27bedb056a3bff94c72d781c9ff73e5d0e2

    SHA256

    1bf268f59657e57973763ae7ef37b5ce310b808200782de92bf10933cb081f29

    SHA512

    4f821e5ee7bc92dbc7f9fd74dfcdab09905baaff561702cac134d091711beab78a2b741f865cdae157e546963a102b65b6528f2e4b62e7e5c95b9a2070fd329f

  • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\b8064723.exe

    Filesize

    136KB

    MD5

    b1bb33212306a82fed180c6e3ee9d6a3

    SHA1

    7ad6e0c0a37014754fab46ed8f82f43824913d3c

    SHA256

    d98b098c5bdcf8011bd44182d92249e6787fadc598216f96a8a0ad9cf84c81a9

    SHA512

    f1786fff7fe68948bed9f1735511517c935051cba5372b79694a12476dfa711de3a10b15ed1cc2eaf2a2b0bb2d76b407a9eeaf692e8e47ce95aaea4a574317e2

  • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\b8064723.exe

    Filesize

    136KB

    MD5

    b1bb33212306a82fed180c6e3ee9d6a3

    SHA1

    7ad6e0c0a37014754fab46ed8f82f43824913d3c

    SHA256

    d98b098c5bdcf8011bd44182d92249e6787fadc598216f96a8a0ad9cf84c81a9

    SHA512

    f1786fff7fe68948bed9f1735511517c935051cba5372b79694a12476dfa711de3a10b15ed1cc2eaf2a2b0bb2d76b407a9eeaf692e8e47ce95aaea4a574317e2

  • \Users\Admin\AppData\Local\Temp\IXP000.TMP\v2632185.exe

    Filesize

    307KB

    MD5

    4008520dcfd72d8702b37b1bb7b315e2

    SHA1

    678e58514f491ffdbfc19f05b40b9e37f0ccdb37

    SHA256

    4ce94f69982c5e74853264b37cb5fd8dd5be396b4d3d8cf83615328227a67abc

    SHA512

    bf3134116bf2c36a64f07f25a390cd8c2230b40620df829c0b5d7fa5b4ea56e9ee2f2234843dcd6f9bd4f1d6d5899b03ea919061db4094727de3f1a8cddeae72

  • \Users\Admin\AppData\Local\Temp\IXP000.TMP\v2632185.exe

    Filesize

    307KB

    MD5

    4008520dcfd72d8702b37b1bb7b315e2

    SHA1

    678e58514f491ffdbfc19f05b40b9e37f0ccdb37

    SHA256

    4ce94f69982c5e74853264b37cb5fd8dd5be396b4d3d8cf83615328227a67abc

    SHA512

    bf3134116bf2c36a64f07f25a390cd8c2230b40620df829c0b5d7fa5b4ea56e9ee2f2234843dcd6f9bd4f1d6d5899b03ea919061db4094727de3f1a8cddeae72

  • \Users\Admin\AppData\Local\Temp\IXP001.TMP\a7246049.exe

    Filesize

    175KB

    MD5

    9ea43a43f05412e93846db9dfce88ece

    SHA1

    c38ed27bedb056a3bff94c72d781c9ff73e5d0e2

    SHA256

    1bf268f59657e57973763ae7ef37b5ce310b808200782de92bf10933cb081f29

    SHA512

    4f821e5ee7bc92dbc7f9fd74dfcdab09905baaff561702cac134d091711beab78a2b741f865cdae157e546963a102b65b6528f2e4b62e7e5c95b9a2070fd329f

  • \Users\Admin\AppData\Local\Temp\IXP001.TMP\a7246049.exe

    Filesize

    175KB

    MD5

    9ea43a43f05412e93846db9dfce88ece

    SHA1

    c38ed27bedb056a3bff94c72d781c9ff73e5d0e2

    SHA256

    1bf268f59657e57973763ae7ef37b5ce310b808200782de92bf10933cb081f29

    SHA512

    4f821e5ee7bc92dbc7f9fd74dfcdab09905baaff561702cac134d091711beab78a2b741f865cdae157e546963a102b65b6528f2e4b62e7e5c95b9a2070fd329f

  • \Users\Admin\AppData\Local\Temp\IXP001.TMP\b8064723.exe

    Filesize

    136KB

    MD5

    b1bb33212306a82fed180c6e3ee9d6a3

    SHA1

    7ad6e0c0a37014754fab46ed8f82f43824913d3c

    SHA256

    d98b098c5bdcf8011bd44182d92249e6787fadc598216f96a8a0ad9cf84c81a9

    SHA512

    f1786fff7fe68948bed9f1735511517c935051cba5372b79694a12476dfa711de3a10b15ed1cc2eaf2a2b0bb2d76b407a9eeaf692e8e47ce95aaea4a574317e2

  • \Users\Admin\AppData\Local\Temp\IXP001.TMP\b8064723.exe

    Filesize

    136KB

    MD5

    b1bb33212306a82fed180c6e3ee9d6a3

    SHA1

    7ad6e0c0a37014754fab46ed8f82f43824913d3c

    SHA256

    d98b098c5bdcf8011bd44182d92249e6787fadc598216f96a8a0ad9cf84c81a9

    SHA512

    f1786fff7fe68948bed9f1735511517c935051cba5372b79694a12476dfa711de3a10b15ed1cc2eaf2a2b0bb2d76b407a9eeaf692e8e47ce95aaea4a574317e2

  • memory/1096-112-0x0000000000370000-0x0000000000398000-memory.dmp

    Filesize

    160KB

  • memory/1096-113-0x00000000005D0000-0x0000000000610000-memory.dmp

    Filesize

    256KB

  • memory/1096-114-0x00000000005D0000-0x0000000000610000-memory.dmp

    Filesize

    256KB

  • memory/1692-85-0x0000000000500000-0x0000000000512000-memory.dmp

    Filesize

    72KB

  • memory/1692-103-0x0000000000500000-0x0000000000512000-memory.dmp

    Filesize

    72KB

  • memory/1692-91-0x0000000000500000-0x0000000000512000-memory.dmp

    Filesize

    72KB

  • memory/1692-89-0x0000000000500000-0x0000000000512000-memory.dmp

    Filesize

    72KB

  • memory/1692-93-0x0000000000500000-0x0000000000512000-memory.dmp

    Filesize

    72KB

  • memory/1692-97-0x0000000000500000-0x0000000000512000-memory.dmp

    Filesize

    72KB

  • memory/1692-95-0x0000000000500000-0x0000000000512000-memory.dmp

    Filesize

    72KB

  • memory/1692-99-0x0000000000500000-0x0000000000512000-memory.dmp

    Filesize

    72KB

  • memory/1692-101-0x0000000000500000-0x0000000000512000-memory.dmp

    Filesize

    72KB

  • memory/1692-87-0x0000000000500000-0x0000000000512000-memory.dmp

    Filesize

    72KB

  • memory/1692-104-0x0000000004A20000-0x0000000004A60000-memory.dmp

    Filesize

    256KB

  • memory/1692-105-0x0000000004A20000-0x0000000004A60000-memory.dmp

    Filesize

    256KB

  • memory/1692-81-0x0000000000500000-0x0000000000512000-memory.dmp

    Filesize

    72KB

  • memory/1692-83-0x0000000000500000-0x0000000000512000-memory.dmp

    Filesize

    72KB

  • memory/1692-79-0x0000000000500000-0x0000000000512000-memory.dmp

    Filesize

    72KB

  • memory/1692-77-0x0000000000500000-0x0000000000512000-memory.dmp

    Filesize

    72KB

  • memory/1692-76-0x0000000000500000-0x0000000000512000-memory.dmp

    Filesize

    72KB

  • memory/1692-75-0x0000000000500000-0x0000000000518000-memory.dmp

    Filesize

    96KB

  • memory/1692-74-0x0000000000480000-0x000000000049A000-memory.dmp

    Filesize

    104KB