Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    151s
  • max time network
    157s
  • platform
    windows7_x64
  • resource
    win7-20230220-en
  • resource tags

    arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
  • submitted
    06/05/2023, 21:20

General

  • Target

    36651de7a4d7ab0b0b0ccdb3d109d6774d61fda49f90803520cfb129bdea6c73.exe

  • Size

    480KB

  • MD5

    abdaf8c4d1ca10508f21f22884488fcc

  • SHA1

    dbc1180675603091a1be4f77e4e7dfe63c4beb14

  • SHA256

    36651de7a4d7ab0b0b0ccdb3d109d6774d61fda49f90803520cfb129bdea6c73

  • SHA512

    c8f53b5dbf44fe9d4eb9277365f1a1d05a53c4019a0072da13b29c496b58da2b755ff794d95f8dba07b30688df34c92f8775a8e10fa33655f36a9f57555e3e9e

  • SSDEEP

    12288:3Mr1y90vNzCUjEuLVACmVOb/nAJYAiWD:2y+McmwbHaD

Malware Config

Signatures

  • Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs
  • Executes dropped EXE 3 IoCs
  • Loads dropped DLL 6 IoCs
  • Windows security modification 2 TTPs 2 IoCs
  • Adds Run key to start application 2 TTPs 4 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 21 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\36651de7a4d7ab0b0b0ccdb3d109d6774d61fda49f90803520cfb129bdea6c73.exe
    "C:\Users\Admin\AppData\Local\Temp\36651de7a4d7ab0b0b0ccdb3d109d6774d61fda49f90803520cfb129bdea6c73.exe"
    1⤵
    • Loads dropped DLL
    • Adds Run key to start application
    • Suspicious use of WriteProcessMemory
    PID:2028
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v8053191.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v8053191.exe
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Adds Run key to start application
      • Suspicious use of WriteProcessMemory
      PID:1996
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\a1930753.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\a1930753.exe
        3⤵
        • Modifies Windows Defender Real-time Protection settings
        • Executes dropped EXE
        • Loads dropped DLL
        • Windows security modification
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:556
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\b9140976.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\b9140976.exe
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        PID:2024

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v8053191.exe

    Filesize

    308KB

    MD5

    0456c4a2743c0b4b70436d66acb6fafc

    SHA1

    2fe54f7fe9dbaa2bfafb992cfdc23ca1db8cbb9b

    SHA256

    85abb191c0b0ab003e04a18b196727815730ea6ba5f3837ca77d85d1075de753

    SHA512

    ded2e7321abcbf1952d86831c8667946250138e457eb13b75b62f9c7320874488a0757b220961838dff8022ba73e02f5f4e13870b7548faf387a6cd6839daae1

  • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v8053191.exe

    Filesize

    308KB

    MD5

    0456c4a2743c0b4b70436d66acb6fafc

    SHA1

    2fe54f7fe9dbaa2bfafb992cfdc23ca1db8cbb9b

    SHA256

    85abb191c0b0ab003e04a18b196727815730ea6ba5f3837ca77d85d1075de753

    SHA512

    ded2e7321abcbf1952d86831c8667946250138e457eb13b75b62f9c7320874488a0757b220961838dff8022ba73e02f5f4e13870b7548faf387a6cd6839daae1

  • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\a1930753.exe

    Filesize

    175KB

    MD5

    a86edf98e8646e918ddeb2347d5abe71

    SHA1

    4c8a75109439bb30ec42cd0f692f1d3573a02af4

    SHA256

    02d589929e8427fd3e3da6617a40435d4d9a558a2febffdda8f2353ed78d87e6

    SHA512

    b15239ceea3e47ec253e796d76ccc25dbe8535cb0b299aa3f3c90bca076e4a4f7edb54f514b6b4aa6cc8d1cc3847b13e6f5e5906aa227d46d5c9546ed4ab232d

  • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\a1930753.exe

    Filesize

    175KB

    MD5

    a86edf98e8646e918ddeb2347d5abe71

    SHA1

    4c8a75109439bb30ec42cd0f692f1d3573a02af4

    SHA256

    02d589929e8427fd3e3da6617a40435d4d9a558a2febffdda8f2353ed78d87e6

    SHA512

    b15239ceea3e47ec253e796d76ccc25dbe8535cb0b299aa3f3c90bca076e4a4f7edb54f514b6b4aa6cc8d1cc3847b13e6f5e5906aa227d46d5c9546ed4ab232d

  • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\b9140976.exe

    Filesize

    136KB

    MD5

    b176745ada22706c1f962c44e8bfcecf

    SHA1

    e76138730934459fd138732cb215fee3a36c3a21

    SHA256

    bf6543dbe1b7d0456589d3345e83dffd985be78becb31edc238668a0ae68b2ba

    SHA512

    a7ee2fbb0bd0a7a61f927607c0e61493d636bfb223ad67c96f79f711ca12088df59e054d8a0d76175a0453846bc7c9a43fcf1b0755116d7c97b2374b37af3549

  • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\b9140976.exe

    Filesize

    136KB

    MD5

    b176745ada22706c1f962c44e8bfcecf

    SHA1

    e76138730934459fd138732cb215fee3a36c3a21

    SHA256

    bf6543dbe1b7d0456589d3345e83dffd985be78becb31edc238668a0ae68b2ba

    SHA512

    a7ee2fbb0bd0a7a61f927607c0e61493d636bfb223ad67c96f79f711ca12088df59e054d8a0d76175a0453846bc7c9a43fcf1b0755116d7c97b2374b37af3549

  • \Users\Admin\AppData\Local\Temp\IXP000.TMP\v8053191.exe

    Filesize

    308KB

    MD5

    0456c4a2743c0b4b70436d66acb6fafc

    SHA1

    2fe54f7fe9dbaa2bfafb992cfdc23ca1db8cbb9b

    SHA256

    85abb191c0b0ab003e04a18b196727815730ea6ba5f3837ca77d85d1075de753

    SHA512

    ded2e7321abcbf1952d86831c8667946250138e457eb13b75b62f9c7320874488a0757b220961838dff8022ba73e02f5f4e13870b7548faf387a6cd6839daae1

  • \Users\Admin\AppData\Local\Temp\IXP000.TMP\v8053191.exe

    Filesize

    308KB

    MD5

    0456c4a2743c0b4b70436d66acb6fafc

    SHA1

    2fe54f7fe9dbaa2bfafb992cfdc23ca1db8cbb9b

    SHA256

    85abb191c0b0ab003e04a18b196727815730ea6ba5f3837ca77d85d1075de753

    SHA512

    ded2e7321abcbf1952d86831c8667946250138e457eb13b75b62f9c7320874488a0757b220961838dff8022ba73e02f5f4e13870b7548faf387a6cd6839daae1

  • \Users\Admin\AppData\Local\Temp\IXP001.TMP\a1930753.exe

    Filesize

    175KB

    MD5

    a86edf98e8646e918ddeb2347d5abe71

    SHA1

    4c8a75109439bb30ec42cd0f692f1d3573a02af4

    SHA256

    02d589929e8427fd3e3da6617a40435d4d9a558a2febffdda8f2353ed78d87e6

    SHA512

    b15239ceea3e47ec253e796d76ccc25dbe8535cb0b299aa3f3c90bca076e4a4f7edb54f514b6b4aa6cc8d1cc3847b13e6f5e5906aa227d46d5c9546ed4ab232d

  • \Users\Admin\AppData\Local\Temp\IXP001.TMP\a1930753.exe

    Filesize

    175KB

    MD5

    a86edf98e8646e918ddeb2347d5abe71

    SHA1

    4c8a75109439bb30ec42cd0f692f1d3573a02af4

    SHA256

    02d589929e8427fd3e3da6617a40435d4d9a558a2febffdda8f2353ed78d87e6

    SHA512

    b15239ceea3e47ec253e796d76ccc25dbe8535cb0b299aa3f3c90bca076e4a4f7edb54f514b6b4aa6cc8d1cc3847b13e6f5e5906aa227d46d5c9546ed4ab232d

  • \Users\Admin\AppData\Local\Temp\IXP001.TMP\b9140976.exe

    Filesize

    136KB

    MD5

    b176745ada22706c1f962c44e8bfcecf

    SHA1

    e76138730934459fd138732cb215fee3a36c3a21

    SHA256

    bf6543dbe1b7d0456589d3345e83dffd985be78becb31edc238668a0ae68b2ba

    SHA512

    a7ee2fbb0bd0a7a61f927607c0e61493d636bfb223ad67c96f79f711ca12088df59e054d8a0d76175a0453846bc7c9a43fcf1b0755116d7c97b2374b37af3549

  • \Users\Admin\AppData\Local\Temp\IXP001.TMP\b9140976.exe

    Filesize

    136KB

    MD5

    b176745ada22706c1f962c44e8bfcecf

    SHA1

    e76138730934459fd138732cb215fee3a36c3a21

    SHA256

    bf6543dbe1b7d0456589d3345e83dffd985be78becb31edc238668a0ae68b2ba

    SHA512

    a7ee2fbb0bd0a7a61f927607c0e61493d636bfb223ad67c96f79f711ca12088df59e054d8a0d76175a0453846bc7c9a43fcf1b0755116d7c97b2374b37af3549

  • memory/556-99-0x0000000000640000-0x0000000000652000-memory.dmp

    Filesize

    72KB

  • memory/556-81-0x0000000000640000-0x0000000000652000-memory.dmp

    Filesize

    72KB

  • memory/556-101-0x0000000000640000-0x0000000000652000-memory.dmp

    Filesize

    72KB

  • memory/556-103-0x0000000000640000-0x0000000000652000-memory.dmp

    Filesize

    72KB

  • memory/556-83-0x0000000000640000-0x0000000000652000-memory.dmp

    Filesize

    72KB

  • memory/556-97-0x0000000000640000-0x0000000000652000-memory.dmp

    Filesize

    72KB

  • memory/556-95-0x0000000000640000-0x0000000000652000-memory.dmp

    Filesize

    72KB

  • memory/556-91-0x0000000000640000-0x0000000000652000-memory.dmp

    Filesize

    72KB

  • memory/556-89-0x0000000000640000-0x0000000000652000-memory.dmp

    Filesize

    72KB

  • memory/556-87-0x0000000000640000-0x0000000000652000-memory.dmp

    Filesize

    72KB

  • memory/556-85-0x0000000000640000-0x0000000000652000-memory.dmp

    Filesize

    72KB

  • memory/556-93-0x0000000000640000-0x0000000000652000-memory.dmp

    Filesize

    72KB

  • memory/556-79-0x0000000000640000-0x0000000000652000-memory.dmp

    Filesize

    72KB

  • memory/556-104-0x0000000004A90000-0x0000000004AD0000-memory.dmp

    Filesize

    256KB

  • memory/556-77-0x0000000000640000-0x0000000000652000-memory.dmp

    Filesize

    72KB

  • memory/556-76-0x0000000000640000-0x0000000000652000-memory.dmp

    Filesize

    72KB

  • memory/556-75-0x0000000000640000-0x0000000000658000-memory.dmp

    Filesize

    96KB

  • memory/556-74-0x0000000000470000-0x000000000048A000-memory.dmp

    Filesize

    104KB

  • memory/2024-111-0x0000000000960000-0x0000000000988000-memory.dmp

    Filesize

    160KB

  • memory/2024-112-0x0000000000C90000-0x0000000000CD0000-memory.dmp

    Filesize

    256KB

  • memory/2024-113-0x0000000000C90000-0x0000000000CD0000-memory.dmp

    Filesize

    256KB