Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
186s -
max time network
207s -
platform
windows7_x64 -
resource
win7-20230220-en -
resource tags
arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system -
submitted
06/05/2023, 20:41
Static task
static1
Behavioral task
behavioral1
Sample
1878c5846243e1c022e9573f86b201075f754485ca088cafe82c68e5cb0d0a83.exe
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
1878c5846243e1c022e9573f86b201075f754485ca088cafe82c68e5cb0d0a83.exe
Resource
win10v2004-20230220-en
General
-
Target
1878c5846243e1c022e9573f86b201075f754485ca088cafe82c68e5cb0d0a83.exe
-
Size
953KB
-
MD5
1ac40e0d36dc7065321c4d70e7eab611
-
SHA1
eaddc404b94d1e70eaf406a2926737bc954e8f18
-
SHA256
1878c5846243e1c022e9573f86b201075f754485ca088cafe82c68e5cb0d0a83
-
SHA512
ed60f4e92925e54613c94be59c71d47f7292c19cfeca43d2c3779bda32a565c9bba5700daf346aa893352f0fcf017d5b1d95c8c74b1a9ceaf2014d9e7de43524
-
SSDEEP
24576:uyXoPQviI+0RlWjw2M6as84MzCZAwIe1XkLCIeB:9Xz+0RQjw1sawIeUCI
Malware Config
Signatures
-
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" v6745zE.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" v6745zE.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" v6745zE.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" v6745zE.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" v6745zE.exe Key created \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection v6745zE.exe -
Executes dropped EXE 4 IoCs
pid Process 868 za186811.exe 1856 za290863.exe 1448 v6745zE.exe 1440 w32gQ36.exe -
Loads dropped DLL 10 IoCs
pid Process 1560 1878c5846243e1c022e9573f86b201075f754485ca088cafe82c68e5cb0d0a83.exe 868 za186811.exe 868 za186811.exe 1856 za290863.exe 1856 za290863.exe 1856 za290863.exe 1448 v6745zE.exe 1856 za290863.exe 1856 za290863.exe 1440 w32gQ36.exe -
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Features v6745zE.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0" v6745zE.exe -
Adds Run key to start application 2 TTPs 6 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" 1878c5846243e1c022e9573f86b201075f754485ca088cafe82c68e5cb0d0a83.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce za186811.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" za186811.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce za290863.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\"" za290863.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce 1878c5846243e1c022e9573f86b201075f754485ca088cafe82c68e5cb0d0a83.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 1448 v6745zE.exe 1448 v6745zE.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 1448 v6745zE.exe Token: SeDebugPrivilege 1440 w32gQ36.exe -
Suspicious use of WriteProcessMemory 28 IoCs
description pid Process procid_target PID 1560 wrote to memory of 868 1560 1878c5846243e1c022e9573f86b201075f754485ca088cafe82c68e5cb0d0a83.exe 27 PID 1560 wrote to memory of 868 1560 1878c5846243e1c022e9573f86b201075f754485ca088cafe82c68e5cb0d0a83.exe 27 PID 1560 wrote to memory of 868 1560 1878c5846243e1c022e9573f86b201075f754485ca088cafe82c68e5cb0d0a83.exe 27 PID 1560 wrote to memory of 868 1560 1878c5846243e1c022e9573f86b201075f754485ca088cafe82c68e5cb0d0a83.exe 27 PID 1560 wrote to memory of 868 1560 1878c5846243e1c022e9573f86b201075f754485ca088cafe82c68e5cb0d0a83.exe 27 PID 1560 wrote to memory of 868 1560 1878c5846243e1c022e9573f86b201075f754485ca088cafe82c68e5cb0d0a83.exe 27 PID 1560 wrote to memory of 868 1560 1878c5846243e1c022e9573f86b201075f754485ca088cafe82c68e5cb0d0a83.exe 27 PID 868 wrote to memory of 1856 868 za186811.exe 28 PID 868 wrote to memory of 1856 868 za186811.exe 28 PID 868 wrote to memory of 1856 868 za186811.exe 28 PID 868 wrote to memory of 1856 868 za186811.exe 28 PID 868 wrote to memory of 1856 868 za186811.exe 28 PID 868 wrote to memory of 1856 868 za186811.exe 28 PID 868 wrote to memory of 1856 868 za186811.exe 28 PID 1856 wrote to memory of 1448 1856 za290863.exe 29 PID 1856 wrote to memory of 1448 1856 za290863.exe 29 PID 1856 wrote to memory of 1448 1856 za290863.exe 29 PID 1856 wrote to memory of 1448 1856 za290863.exe 29 PID 1856 wrote to memory of 1448 1856 za290863.exe 29 PID 1856 wrote to memory of 1448 1856 za290863.exe 29 PID 1856 wrote to memory of 1448 1856 za290863.exe 29 PID 1856 wrote to memory of 1440 1856 za290863.exe 30 PID 1856 wrote to memory of 1440 1856 za290863.exe 30 PID 1856 wrote to memory of 1440 1856 za290863.exe 30 PID 1856 wrote to memory of 1440 1856 za290863.exe 30 PID 1856 wrote to memory of 1440 1856 za290863.exe 30 PID 1856 wrote to memory of 1440 1856 za290863.exe 30 PID 1856 wrote to memory of 1440 1856 za290863.exe 30
Processes
-
C:\Users\Admin\AppData\Local\Temp\1878c5846243e1c022e9573f86b201075f754485ca088cafe82c68e5cb0d0a83.exe"C:\Users\Admin\AppData\Local\Temp\1878c5846243e1c022e9573f86b201075f754485ca088cafe82c68e5cb0d0a83.exe"1⤵
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:1560 -
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\za186811.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\za186811.exe2⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:868 -
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\za290863.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\za290863.exe3⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:1856 -
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\v6745zE.exeC:\Users\Admin\AppData\Local\Temp\IXP002.TMP\v6745zE.exe4⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Loads dropped DLL
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1448
-
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\w32gQ36.exeC:\Users\Admin\AppData\Local\Temp\IXP002.TMP\w32gQ36.exe4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
PID:1440
-
-
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
732KB
MD5063f8163d3c057628ffb5ac79050f305
SHA105c50fc9969d6c5efd20a2ec981c3fd2f4d807b6
SHA256eb6e5addd46fe16b1f036f06feeec4c61bdd29add3abad14d3e4204fa9ddd4dc
SHA5122cfaf914099cd2cc39783689a67e566aa836546182f177cda291362d8ce142f302c1a1b57179efffd9cc2198544ac4ea8b1f43148153654e7bc8dbfd41ed4bd1
-
Filesize
732KB
MD5063f8163d3c057628ffb5ac79050f305
SHA105c50fc9969d6c5efd20a2ec981c3fd2f4d807b6
SHA256eb6e5addd46fe16b1f036f06feeec4c61bdd29add3abad14d3e4204fa9ddd4dc
SHA5122cfaf914099cd2cc39783689a67e566aa836546182f177cda291362d8ce142f302c1a1b57179efffd9cc2198544ac4ea8b1f43148153654e7bc8dbfd41ed4bd1
-
Filesize
550KB
MD52bfa7c23a3766e21ff06910e00e6fdfb
SHA1f2ed149cc5e460cdffd749a8cb361c2f8afe92de
SHA25657fef41914e6262fa1c5641de0d89eac1973c4c3b0d0f8582932434795dd1e51
SHA51274e3d3dd7c0356f6ae906e654643ed5fd62c0781a2acc26d76657ac0864581be149a183053d90e34bde1f0c31ba38756902cbf194ad13273dd8f1bf0f5cb8c4e
-
Filesize
550KB
MD52bfa7c23a3766e21ff06910e00e6fdfb
SHA1f2ed149cc5e460cdffd749a8cb361c2f8afe92de
SHA25657fef41914e6262fa1c5641de0d89eac1973c4c3b0d0f8582932434795dd1e51
SHA51274e3d3dd7c0356f6ae906e654643ed5fd62c0781a2acc26d76657ac0864581be149a183053d90e34bde1f0c31ba38756902cbf194ad13273dd8f1bf0f5cb8c4e
-
Filesize
278KB
MD54df8915919be80bf5568575d2848da9a
SHA13c30784d303de10c8dcdf6b7d7086d3c0ac2c925
SHA256b5727071b04ca7f2fdbbcf54ffa7c039a5745fd458dfae95cd3b18bb9d214001
SHA512e3474fb441811662d927e8cbb805a532de4c557f9dc8362e7285ec0998f26da6c236114e23417a263e4fe4d062f41b64f774335b5cc5665ea2d929d76ff1d1b0
-
Filesize
278KB
MD54df8915919be80bf5568575d2848da9a
SHA13c30784d303de10c8dcdf6b7d7086d3c0ac2c925
SHA256b5727071b04ca7f2fdbbcf54ffa7c039a5745fd458dfae95cd3b18bb9d214001
SHA512e3474fb441811662d927e8cbb805a532de4c557f9dc8362e7285ec0998f26da6c236114e23417a263e4fe4d062f41b64f774335b5cc5665ea2d929d76ff1d1b0
-
Filesize
278KB
MD54df8915919be80bf5568575d2848da9a
SHA13c30784d303de10c8dcdf6b7d7086d3c0ac2c925
SHA256b5727071b04ca7f2fdbbcf54ffa7c039a5745fd458dfae95cd3b18bb9d214001
SHA512e3474fb441811662d927e8cbb805a532de4c557f9dc8362e7285ec0998f26da6c236114e23417a263e4fe4d062f41b64f774335b5cc5665ea2d929d76ff1d1b0
-
Filesize
361KB
MD55aa9b2adb31bfa6b41f4e56648ba4612
SHA1f4cb22a4d43a428cb0dd51ecee4ac800873e0183
SHA2568718e5a496f663072e934264058d277872f10f7acc3f40ca87dbc6dc8cb5d5f7
SHA512de16e045e1ce27dfc68d146b0b24f28d19e49d1309fbf7df31bac4a48e96322e1d0bfc641a7865a00e26a04be509579f2eb446960a5c1c02fcfb55f9bf36b1f4
-
Filesize
361KB
MD55aa9b2adb31bfa6b41f4e56648ba4612
SHA1f4cb22a4d43a428cb0dd51ecee4ac800873e0183
SHA2568718e5a496f663072e934264058d277872f10f7acc3f40ca87dbc6dc8cb5d5f7
SHA512de16e045e1ce27dfc68d146b0b24f28d19e49d1309fbf7df31bac4a48e96322e1d0bfc641a7865a00e26a04be509579f2eb446960a5c1c02fcfb55f9bf36b1f4
-
Filesize
361KB
MD55aa9b2adb31bfa6b41f4e56648ba4612
SHA1f4cb22a4d43a428cb0dd51ecee4ac800873e0183
SHA2568718e5a496f663072e934264058d277872f10f7acc3f40ca87dbc6dc8cb5d5f7
SHA512de16e045e1ce27dfc68d146b0b24f28d19e49d1309fbf7df31bac4a48e96322e1d0bfc641a7865a00e26a04be509579f2eb446960a5c1c02fcfb55f9bf36b1f4
-
Filesize
732KB
MD5063f8163d3c057628ffb5ac79050f305
SHA105c50fc9969d6c5efd20a2ec981c3fd2f4d807b6
SHA256eb6e5addd46fe16b1f036f06feeec4c61bdd29add3abad14d3e4204fa9ddd4dc
SHA5122cfaf914099cd2cc39783689a67e566aa836546182f177cda291362d8ce142f302c1a1b57179efffd9cc2198544ac4ea8b1f43148153654e7bc8dbfd41ed4bd1
-
Filesize
732KB
MD5063f8163d3c057628ffb5ac79050f305
SHA105c50fc9969d6c5efd20a2ec981c3fd2f4d807b6
SHA256eb6e5addd46fe16b1f036f06feeec4c61bdd29add3abad14d3e4204fa9ddd4dc
SHA5122cfaf914099cd2cc39783689a67e566aa836546182f177cda291362d8ce142f302c1a1b57179efffd9cc2198544ac4ea8b1f43148153654e7bc8dbfd41ed4bd1
-
Filesize
550KB
MD52bfa7c23a3766e21ff06910e00e6fdfb
SHA1f2ed149cc5e460cdffd749a8cb361c2f8afe92de
SHA25657fef41914e6262fa1c5641de0d89eac1973c4c3b0d0f8582932434795dd1e51
SHA51274e3d3dd7c0356f6ae906e654643ed5fd62c0781a2acc26d76657ac0864581be149a183053d90e34bde1f0c31ba38756902cbf194ad13273dd8f1bf0f5cb8c4e
-
Filesize
550KB
MD52bfa7c23a3766e21ff06910e00e6fdfb
SHA1f2ed149cc5e460cdffd749a8cb361c2f8afe92de
SHA25657fef41914e6262fa1c5641de0d89eac1973c4c3b0d0f8582932434795dd1e51
SHA51274e3d3dd7c0356f6ae906e654643ed5fd62c0781a2acc26d76657ac0864581be149a183053d90e34bde1f0c31ba38756902cbf194ad13273dd8f1bf0f5cb8c4e
-
Filesize
278KB
MD54df8915919be80bf5568575d2848da9a
SHA13c30784d303de10c8dcdf6b7d7086d3c0ac2c925
SHA256b5727071b04ca7f2fdbbcf54ffa7c039a5745fd458dfae95cd3b18bb9d214001
SHA512e3474fb441811662d927e8cbb805a532de4c557f9dc8362e7285ec0998f26da6c236114e23417a263e4fe4d062f41b64f774335b5cc5665ea2d929d76ff1d1b0
-
Filesize
278KB
MD54df8915919be80bf5568575d2848da9a
SHA13c30784d303de10c8dcdf6b7d7086d3c0ac2c925
SHA256b5727071b04ca7f2fdbbcf54ffa7c039a5745fd458dfae95cd3b18bb9d214001
SHA512e3474fb441811662d927e8cbb805a532de4c557f9dc8362e7285ec0998f26da6c236114e23417a263e4fe4d062f41b64f774335b5cc5665ea2d929d76ff1d1b0
-
Filesize
278KB
MD54df8915919be80bf5568575d2848da9a
SHA13c30784d303de10c8dcdf6b7d7086d3c0ac2c925
SHA256b5727071b04ca7f2fdbbcf54ffa7c039a5745fd458dfae95cd3b18bb9d214001
SHA512e3474fb441811662d927e8cbb805a532de4c557f9dc8362e7285ec0998f26da6c236114e23417a263e4fe4d062f41b64f774335b5cc5665ea2d929d76ff1d1b0
-
Filesize
361KB
MD55aa9b2adb31bfa6b41f4e56648ba4612
SHA1f4cb22a4d43a428cb0dd51ecee4ac800873e0183
SHA2568718e5a496f663072e934264058d277872f10f7acc3f40ca87dbc6dc8cb5d5f7
SHA512de16e045e1ce27dfc68d146b0b24f28d19e49d1309fbf7df31bac4a48e96322e1d0bfc641a7865a00e26a04be509579f2eb446960a5c1c02fcfb55f9bf36b1f4
-
Filesize
361KB
MD55aa9b2adb31bfa6b41f4e56648ba4612
SHA1f4cb22a4d43a428cb0dd51ecee4ac800873e0183
SHA2568718e5a496f663072e934264058d277872f10f7acc3f40ca87dbc6dc8cb5d5f7
SHA512de16e045e1ce27dfc68d146b0b24f28d19e49d1309fbf7df31bac4a48e96322e1d0bfc641a7865a00e26a04be509579f2eb446960a5c1c02fcfb55f9bf36b1f4
-
Filesize
361KB
MD55aa9b2adb31bfa6b41f4e56648ba4612
SHA1f4cb22a4d43a428cb0dd51ecee4ac800873e0183
SHA2568718e5a496f663072e934264058d277872f10f7acc3f40ca87dbc6dc8cb5d5f7
SHA512de16e045e1ce27dfc68d146b0b24f28d19e49d1309fbf7df31bac4a48e96322e1d0bfc641a7865a00e26a04be509579f2eb446960a5c1c02fcfb55f9bf36b1f4