Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
151s -
max time network
157s -
platform
windows7_x64 -
resource
win7-20230220-en -
resource tags
arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system -
submitted
06/05/2023, 21:20
Static task
static1
Behavioral task
behavioral1
Sample
36651de7a4d7ab0b0b0ccdb3d109d6774d61fda49f90803520cfb129bdea6c73.exe
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
36651de7a4d7ab0b0b0ccdb3d109d6774d61fda49f90803520cfb129bdea6c73.exe
Resource
win10v2004-20230220-en
General
-
Target
36651de7a4d7ab0b0b0ccdb3d109d6774d61fda49f90803520cfb129bdea6c73.exe
-
Size
480KB
-
MD5
abdaf8c4d1ca10508f21f22884488fcc
-
SHA1
dbc1180675603091a1be4f77e4e7dfe63c4beb14
-
SHA256
36651de7a4d7ab0b0b0ccdb3d109d6774d61fda49f90803520cfb129bdea6c73
-
SHA512
c8f53b5dbf44fe9d4eb9277365f1a1d05a53c4019a0072da13b29c496b58da2b755ff794d95f8dba07b30688df34c92f8775a8e10fa33655f36a9f57555e3e9e
-
SSDEEP
12288:3Mr1y90vNzCUjEuLVACmVOb/nAJYAiWD:2y+McmwbHaD
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection a1930753.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" a1930753.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" a1930753.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" a1930753.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" a1930753.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" a1930753.exe -
Executes dropped EXE 3 IoCs
pid Process 1996 v8053191.exe 556 a1930753.exe 2024 b9140976.exe -
Loads dropped DLL 6 IoCs
pid Process 2028 36651de7a4d7ab0b0b0ccdb3d109d6774d61fda49f90803520cfb129bdea6c73.exe 1996 v8053191.exe 1996 v8053191.exe 556 a1930753.exe 1996 v8053191.exe 2024 b9140976.exe -
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Features a1930753.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0" a1930753.exe -
Adds Run key to start application 2 TTPs 4 IoCs
description ioc Process Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce 36651de7a4d7ab0b0b0ccdb3d109d6774d61fda49f90803520cfb129bdea6c73.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" 36651de7a4d7ab0b0b0ccdb3d109d6774d61fda49f90803520cfb129bdea6c73.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce v8053191.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" v8053191.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 556 a1930753.exe 556 a1930753.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 556 a1930753.exe -
Suspicious use of WriteProcessMemory 21 IoCs
description pid Process procid_target PID 2028 wrote to memory of 1996 2028 36651de7a4d7ab0b0b0ccdb3d109d6774d61fda49f90803520cfb129bdea6c73.exe 28 PID 2028 wrote to memory of 1996 2028 36651de7a4d7ab0b0b0ccdb3d109d6774d61fda49f90803520cfb129bdea6c73.exe 28 PID 2028 wrote to memory of 1996 2028 36651de7a4d7ab0b0b0ccdb3d109d6774d61fda49f90803520cfb129bdea6c73.exe 28 PID 2028 wrote to memory of 1996 2028 36651de7a4d7ab0b0b0ccdb3d109d6774d61fda49f90803520cfb129bdea6c73.exe 28 PID 2028 wrote to memory of 1996 2028 36651de7a4d7ab0b0b0ccdb3d109d6774d61fda49f90803520cfb129bdea6c73.exe 28 PID 2028 wrote to memory of 1996 2028 36651de7a4d7ab0b0b0ccdb3d109d6774d61fda49f90803520cfb129bdea6c73.exe 28 PID 2028 wrote to memory of 1996 2028 36651de7a4d7ab0b0b0ccdb3d109d6774d61fda49f90803520cfb129bdea6c73.exe 28 PID 1996 wrote to memory of 556 1996 v8053191.exe 29 PID 1996 wrote to memory of 556 1996 v8053191.exe 29 PID 1996 wrote to memory of 556 1996 v8053191.exe 29 PID 1996 wrote to memory of 556 1996 v8053191.exe 29 PID 1996 wrote to memory of 556 1996 v8053191.exe 29 PID 1996 wrote to memory of 556 1996 v8053191.exe 29 PID 1996 wrote to memory of 556 1996 v8053191.exe 29 PID 1996 wrote to memory of 2024 1996 v8053191.exe 30 PID 1996 wrote to memory of 2024 1996 v8053191.exe 30 PID 1996 wrote to memory of 2024 1996 v8053191.exe 30 PID 1996 wrote to memory of 2024 1996 v8053191.exe 30 PID 1996 wrote to memory of 2024 1996 v8053191.exe 30 PID 1996 wrote to memory of 2024 1996 v8053191.exe 30 PID 1996 wrote to memory of 2024 1996 v8053191.exe 30
Processes
-
C:\Users\Admin\AppData\Local\Temp\36651de7a4d7ab0b0b0ccdb3d109d6774d61fda49f90803520cfb129bdea6c73.exe"C:\Users\Admin\AppData\Local\Temp\36651de7a4d7ab0b0b0ccdb3d109d6774d61fda49f90803520cfb129bdea6c73.exe"1⤵
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:2028 -
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v8053191.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v8053191.exe2⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:1996 -
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\a1930753.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\a1930753.exe3⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Loads dropped DLL
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:556
-
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\b9140976.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\b9140976.exe3⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2024
-
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
308KB
MD50456c4a2743c0b4b70436d66acb6fafc
SHA12fe54f7fe9dbaa2bfafb992cfdc23ca1db8cbb9b
SHA25685abb191c0b0ab003e04a18b196727815730ea6ba5f3837ca77d85d1075de753
SHA512ded2e7321abcbf1952d86831c8667946250138e457eb13b75b62f9c7320874488a0757b220961838dff8022ba73e02f5f4e13870b7548faf387a6cd6839daae1
-
Filesize
308KB
MD50456c4a2743c0b4b70436d66acb6fafc
SHA12fe54f7fe9dbaa2bfafb992cfdc23ca1db8cbb9b
SHA25685abb191c0b0ab003e04a18b196727815730ea6ba5f3837ca77d85d1075de753
SHA512ded2e7321abcbf1952d86831c8667946250138e457eb13b75b62f9c7320874488a0757b220961838dff8022ba73e02f5f4e13870b7548faf387a6cd6839daae1
-
Filesize
175KB
MD5a86edf98e8646e918ddeb2347d5abe71
SHA14c8a75109439bb30ec42cd0f692f1d3573a02af4
SHA25602d589929e8427fd3e3da6617a40435d4d9a558a2febffdda8f2353ed78d87e6
SHA512b15239ceea3e47ec253e796d76ccc25dbe8535cb0b299aa3f3c90bca076e4a4f7edb54f514b6b4aa6cc8d1cc3847b13e6f5e5906aa227d46d5c9546ed4ab232d
-
Filesize
175KB
MD5a86edf98e8646e918ddeb2347d5abe71
SHA14c8a75109439bb30ec42cd0f692f1d3573a02af4
SHA25602d589929e8427fd3e3da6617a40435d4d9a558a2febffdda8f2353ed78d87e6
SHA512b15239ceea3e47ec253e796d76ccc25dbe8535cb0b299aa3f3c90bca076e4a4f7edb54f514b6b4aa6cc8d1cc3847b13e6f5e5906aa227d46d5c9546ed4ab232d
-
Filesize
136KB
MD5b176745ada22706c1f962c44e8bfcecf
SHA1e76138730934459fd138732cb215fee3a36c3a21
SHA256bf6543dbe1b7d0456589d3345e83dffd985be78becb31edc238668a0ae68b2ba
SHA512a7ee2fbb0bd0a7a61f927607c0e61493d636bfb223ad67c96f79f711ca12088df59e054d8a0d76175a0453846bc7c9a43fcf1b0755116d7c97b2374b37af3549
-
Filesize
136KB
MD5b176745ada22706c1f962c44e8bfcecf
SHA1e76138730934459fd138732cb215fee3a36c3a21
SHA256bf6543dbe1b7d0456589d3345e83dffd985be78becb31edc238668a0ae68b2ba
SHA512a7ee2fbb0bd0a7a61f927607c0e61493d636bfb223ad67c96f79f711ca12088df59e054d8a0d76175a0453846bc7c9a43fcf1b0755116d7c97b2374b37af3549
-
Filesize
308KB
MD50456c4a2743c0b4b70436d66acb6fafc
SHA12fe54f7fe9dbaa2bfafb992cfdc23ca1db8cbb9b
SHA25685abb191c0b0ab003e04a18b196727815730ea6ba5f3837ca77d85d1075de753
SHA512ded2e7321abcbf1952d86831c8667946250138e457eb13b75b62f9c7320874488a0757b220961838dff8022ba73e02f5f4e13870b7548faf387a6cd6839daae1
-
Filesize
308KB
MD50456c4a2743c0b4b70436d66acb6fafc
SHA12fe54f7fe9dbaa2bfafb992cfdc23ca1db8cbb9b
SHA25685abb191c0b0ab003e04a18b196727815730ea6ba5f3837ca77d85d1075de753
SHA512ded2e7321abcbf1952d86831c8667946250138e457eb13b75b62f9c7320874488a0757b220961838dff8022ba73e02f5f4e13870b7548faf387a6cd6839daae1
-
Filesize
175KB
MD5a86edf98e8646e918ddeb2347d5abe71
SHA14c8a75109439bb30ec42cd0f692f1d3573a02af4
SHA25602d589929e8427fd3e3da6617a40435d4d9a558a2febffdda8f2353ed78d87e6
SHA512b15239ceea3e47ec253e796d76ccc25dbe8535cb0b299aa3f3c90bca076e4a4f7edb54f514b6b4aa6cc8d1cc3847b13e6f5e5906aa227d46d5c9546ed4ab232d
-
Filesize
175KB
MD5a86edf98e8646e918ddeb2347d5abe71
SHA14c8a75109439bb30ec42cd0f692f1d3573a02af4
SHA25602d589929e8427fd3e3da6617a40435d4d9a558a2febffdda8f2353ed78d87e6
SHA512b15239ceea3e47ec253e796d76ccc25dbe8535cb0b299aa3f3c90bca076e4a4f7edb54f514b6b4aa6cc8d1cc3847b13e6f5e5906aa227d46d5c9546ed4ab232d
-
Filesize
136KB
MD5b176745ada22706c1f962c44e8bfcecf
SHA1e76138730934459fd138732cb215fee3a36c3a21
SHA256bf6543dbe1b7d0456589d3345e83dffd985be78becb31edc238668a0ae68b2ba
SHA512a7ee2fbb0bd0a7a61f927607c0e61493d636bfb223ad67c96f79f711ca12088df59e054d8a0d76175a0453846bc7c9a43fcf1b0755116d7c97b2374b37af3549
-
Filesize
136KB
MD5b176745ada22706c1f962c44e8bfcecf
SHA1e76138730934459fd138732cb215fee3a36c3a21
SHA256bf6543dbe1b7d0456589d3345e83dffd985be78becb31edc238668a0ae68b2ba
SHA512a7ee2fbb0bd0a7a61f927607c0e61493d636bfb223ad67c96f79f711ca12088df59e054d8a0d76175a0453846bc7c9a43fcf1b0755116d7c97b2374b37af3549