Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
144s -
max time network
171s -
platform
windows7_x64 -
resource
win7-20230220-en -
resource tags
arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system -
submitted
06/05/2023, 21:12
Static task
static1
Behavioral task
behavioral1
Sample
302194ebde87a29004db7110ed3d44d2df485125376e9c49660089397933b981.exe
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
302194ebde87a29004db7110ed3d44d2df485125376e9c49660089397933b981.exe
Resource
win10v2004-20230220-en
General
-
Target
302194ebde87a29004db7110ed3d44d2df485125376e9c49660089397933b981.exe
-
Size
752KB
-
MD5
1a19b9ee8370cd15514ed2b65076c96a
-
SHA1
99ddc12f7c68d0192e08583b0d610b6d4e959e79
-
SHA256
302194ebde87a29004db7110ed3d44d2df485125376e9c49660089397933b981
-
SHA512
f5a47a403d12a86ddf9256dd91cea074898f929bf65ce405ae6c4ff7421af5fac811446132226088d60dc0850079769885f3f5ce3b78e6d750328af1dd153c14
-
SSDEEP
12288:Zy908FlsPgv88KPOOD/by6TjYW/8xd3UDWb6VvqmIXk:ZyxwDpDWUD/ulUSC1IXk
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection 13179686.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" 13179686.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" 13179686.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" 13179686.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" 13179686.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" 13179686.exe -
Executes dropped EXE 3 IoCs
pid Process 1528 un094195.exe 792 13179686.exe 1352 rk893147.exe -
Loads dropped DLL 8 IoCs
pid Process 1700 302194ebde87a29004db7110ed3d44d2df485125376e9c49660089397933b981.exe 1528 un094195.exe 1528 un094195.exe 1528 un094195.exe 792 13179686.exe 1528 un094195.exe 1528 un094195.exe 1352 rk893147.exe -
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Features 13179686.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0" 13179686.exe -
Adds Run key to start application 2 TTPs 4 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" un094195.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce 302194ebde87a29004db7110ed3d44d2df485125376e9c49660089397933b981.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" 302194ebde87a29004db7110ed3d44d2df485125376e9c49660089397933b981.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce un094195.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 792 13179686.exe 792 13179686.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 792 13179686.exe Token: SeDebugPrivilege 1352 rk893147.exe -
Suspicious use of WriteProcessMemory 21 IoCs
description pid Process procid_target PID 1700 wrote to memory of 1528 1700 302194ebde87a29004db7110ed3d44d2df485125376e9c49660089397933b981.exe 28 PID 1700 wrote to memory of 1528 1700 302194ebde87a29004db7110ed3d44d2df485125376e9c49660089397933b981.exe 28 PID 1700 wrote to memory of 1528 1700 302194ebde87a29004db7110ed3d44d2df485125376e9c49660089397933b981.exe 28 PID 1700 wrote to memory of 1528 1700 302194ebde87a29004db7110ed3d44d2df485125376e9c49660089397933b981.exe 28 PID 1700 wrote to memory of 1528 1700 302194ebde87a29004db7110ed3d44d2df485125376e9c49660089397933b981.exe 28 PID 1700 wrote to memory of 1528 1700 302194ebde87a29004db7110ed3d44d2df485125376e9c49660089397933b981.exe 28 PID 1700 wrote to memory of 1528 1700 302194ebde87a29004db7110ed3d44d2df485125376e9c49660089397933b981.exe 28 PID 1528 wrote to memory of 792 1528 un094195.exe 29 PID 1528 wrote to memory of 792 1528 un094195.exe 29 PID 1528 wrote to memory of 792 1528 un094195.exe 29 PID 1528 wrote to memory of 792 1528 un094195.exe 29 PID 1528 wrote to memory of 792 1528 un094195.exe 29 PID 1528 wrote to memory of 792 1528 un094195.exe 29 PID 1528 wrote to memory of 792 1528 un094195.exe 29 PID 1528 wrote to memory of 1352 1528 un094195.exe 30 PID 1528 wrote to memory of 1352 1528 un094195.exe 30 PID 1528 wrote to memory of 1352 1528 un094195.exe 30 PID 1528 wrote to memory of 1352 1528 un094195.exe 30 PID 1528 wrote to memory of 1352 1528 un094195.exe 30 PID 1528 wrote to memory of 1352 1528 un094195.exe 30 PID 1528 wrote to memory of 1352 1528 un094195.exe 30
Processes
-
C:\Users\Admin\AppData\Local\Temp\302194ebde87a29004db7110ed3d44d2df485125376e9c49660089397933b981.exe"C:\Users\Admin\AppData\Local\Temp\302194ebde87a29004db7110ed3d44d2df485125376e9c49660089397933b981.exe"1⤵
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:1700 -
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un094195.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un094195.exe2⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:1528 -
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\13179686.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\13179686.exe3⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Loads dropped DLL
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:792
-
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\rk893147.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\rk893147.exe3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
PID:1352
-
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
598KB
MD5886e7db6d7a14d54c6f3897477e93bce
SHA1be925507a98efb55c249080703c1cf19160b2d78
SHA2563135a788c38231d250ded397b21acc789edaf5165ce1d3cd7f1a2d5b4d1a1fb3
SHA512e9fb0a32d89a39ef6458a7ba952259363434fcd35ba39cdd0d89d14daa9985c697c3edf9b0980afbf8bccc165457dc9ea9fc138d8f08b5b561e9e4da4d5409b4
-
Filesize
598KB
MD5886e7db6d7a14d54c6f3897477e93bce
SHA1be925507a98efb55c249080703c1cf19160b2d78
SHA2563135a788c38231d250ded397b21acc789edaf5165ce1d3cd7f1a2d5b4d1a1fb3
SHA512e9fb0a32d89a39ef6458a7ba952259363434fcd35ba39cdd0d89d14daa9985c697c3edf9b0980afbf8bccc165457dc9ea9fc138d8f08b5b561e9e4da4d5409b4
-
Filesize
390KB
MD5da4166b115f8db259cecd2611c885b9c
SHA1c26941e5277cada45a97fdc77f7f6506adea2b9e
SHA2561c6497d891af5e005e7131c93a030d23cc79d5a57d8a14edb5573a6272d1da3b
SHA5128779cba80921051cab681d6200516d08119a0a3142b6a36aaf14da8f382b1dbc516e7335e94c8957a8396e27601ef63fe6d0cc48768db3fb6720180c9afeccff
-
Filesize
390KB
MD5da4166b115f8db259cecd2611c885b9c
SHA1c26941e5277cada45a97fdc77f7f6506adea2b9e
SHA2561c6497d891af5e005e7131c93a030d23cc79d5a57d8a14edb5573a6272d1da3b
SHA5128779cba80921051cab681d6200516d08119a0a3142b6a36aaf14da8f382b1dbc516e7335e94c8957a8396e27601ef63fe6d0cc48768db3fb6720180c9afeccff
-
Filesize
390KB
MD5da4166b115f8db259cecd2611c885b9c
SHA1c26941e5277cada45a97fdc77f7f6506adea2b9e
SHA2561c6497d891af5e005e7131c93a030d23cc79d5a57d8a14edb5573a6272d1da3b
SHA5128779cba80921051cab681d6200516d08119a0a3142b6a36aaf14da8f382b1dbc516e7335e94c8957a8396e27601ef63fe6d0cc48768db3fb6720180c9afeccff
-
Filesize
473KB
MD5c24647c0d2fda2faa8c2c0ffa43d7f59
SHA15c7265a6b6309c9a16ee6e940303921e11b5b63b
SHA2568e6cc0d0c0904e620895aba2f381aa48ef1dfea7cbe6bf3f8aebb51b46bcdceb
SHA5128df1339bf8529e1bc04efdc8b0ccded85f5c6cf9b74cb639797a2df7da39ae163204930c2c806fca4e434c345e17442cb9fe8795e1135e44d0124a9ba6e1fd86
-
Filesize
473KB
MD5c24647c0d2fda2faa8c2c0ffa43d7f59
SHA15c7265a6b6309c9a16ee6e940303921e11b5b63b
SHA2568e6cc0d0c0904e620895aba2f381aa48ef1dfea7cbe6bf3f8aebb51b46bcdceb
SHA5128df1339bf8529e1bc04efdc8b0ccded85f5c6cf9b74cb639797a2df7da39ae163204930c2c806fca4e434c345e17442cb9fe8795e1135e44d0124a9ba6e1fd86
-
Filesize
473KB
MD5c24647c0d2fda2faa8c2c0ffa43d7f59
SHA15c7265a6b6309c9a16ee6e940303921e11b5b63b
SHA2568e6cc0d0c0904e620895aba2f381aa48ef1dfea7cbe6bf3f8aebb51b46bcdceb
SHA5128df1339bf8529e1bc04efdc8b0ccded85f5c6cf9b74cb639797a2df7da39ae163204930c2c806fca4e434c345e17442cb9fe8795e1135e44d0124a9ba6e1fd86
-
Filesize
598KB
MD5886e7db6d7a14d54c6f3897477e93bce
SHA1be925507a98efb55c249080703c1cf19160b2d78
SHA2563135a788c38231d250ded397b21acc789edaf5165ce1d3cd7f1a2d5b4d1a1fb3
SHA512e9fb0a32d89a39ef6458a7ba952259363434fcd35ba39cdd0d89d14daa9985c697c3edf9b0980afbf8bccc165457dc9ea9fc138d8f08b5b561e9e4da4d5409b4
-
Filesize
598KB
MD5886e7db6d7a14d54c6f3897477e93bce
SHA1be925507a98efb55c249080703c1cf19160b2d78
SHA2563135a788c38231d250ded397b21acc789edaf5165ce1d3cd7f1a2d5b4d1a1fb3
SHA512e9fb0a32d89a39ef6458a7ba952259363434fcd35ba39cdd0d89d14daa9985c697c3edf9b0980afbf8bccc165457dc9ea9fc138d8f08b5b561e9e4da4d5409b4
-
Filesize
390KB
MD5da4166b115f8db259cecd2611c885b9c
SHA1c26941e5277cada45a97fdc77f7f6506adea2b9e
SHA2561c6497d891af5e005e7131c93a030d23cc79d5a57d8a14edb5573a6272d1da3b
SHA5128779cba80921051cab681d6200516d08119a0a3142b6a36aaf14da8f382b1dbc516e7335e94c8957a8396e27601ef63fe6d0cc48768db3fb6720180c9afeccff
-
Filesize
390KB
MD5da4166b115f8db259cecd2611c885b9c
SHA1c26941e5277cada45a97fdc77f7f6506adea2b9e
SHA2561c6497d891af5e005e7131c93a030d23cc79d5a57d8a14edb5573a6272d1da3b
SHA5128779cba80921051cab681d6200516d08119a0a3142b6a36aaf14da8f382b1dbc516e7335e94c8957a8396e27601ef63fe6d0cc48768db3fb6720180c9afeccff
-
Filesize
390KB
MD5da4166b115f8db259cecd2611c885b9c
SHA1c26941e5277cada45a97fdc77f7f6506adea2b9e
SHA2561c6497d891af5e005e7131c93a030d23cc79d5a57d8a14edb5573a6272d1da3b
SHA5128779cba80921051cab681d6200516d08119a0a3142b6a36aaf14da8f382b1dbc516e7335e94c8957a8396e27601ef63fe6d0cc48768db3fb6720180c9afeccff
-
Filesize
473KB
MD5c24647c0d2fda2faa8c2c0ffa43d7f59
SHA15c7265a6b6309c9a16ee6e940303921e11b5b63b
SHA2568e6cc0d0c0904e620895aba2f381aa48ef1dfea7cbe6bf3f8aebb51b46bcdceb
SHA5128df1339bf8529e1bc04efdc8b0ccded85f5c6cf9b74cb639797a2df7da39ae163204930c2c806fca4e434c345e17442cb9fe8795e1135e44d0124a9ba6e1fd86
-
Filesize
473KB
MD5c24647c0d2fda2faa8c2c0ffa43d7f59
SHA15c7265a6b6309c9a16ee6e940303921e11b5b63b
SHA2568e6cc0d0c0904e620895aba2f381aa48ef1dfea7cbe6bf3f8aebb51b46bcdceb
SHA5128df1339bf8529e1bc04efdc8b0ccded85f5c6cf9b74cb639797a2df7da39ae163204930c2c806fca4e434c345e17442cb9fe8795e1135e44d0124a9ba6e1fd86
-
Filesize
473KB
MD5c24647c0d2fda2faa8c2c0ffa43d7f59
SHA15c7265a6b6309c9a16ee6e940303921e11b5b63b
SHA2568e6cc0d0c0904e620895aba2f381aa48ef1dfea7cbe6bf3f8aebb51b46bcdceb
SHA5128df1339bf8529e1bc04efdc8b0ccded85f5c6cf9b74cb639797a2df7da39ae163204930c2c806fca4e434c345e17442cb9fe8795e1135e44d0124a9ba6e1fd86