Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    151s
  • max time network
    195s
  • platform
    windows7_x64
  • resource
    win7-20230220-en
  • resource tags

    arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
  • submitted
    06/05/2023, 20:49

General

  • Target

    1d9a6cde7f7b13c4eea0be144fb489df29f05597afa59cd00e643097c71947c4.exe

  • Size

    705KB

  • MD5

    b9a0ecd9c9b3489dce22313b82a83ac9

  • SHA1

    73aa4c938bbfa44a4d276cd6ec3dba46a70e66b8

  • SHA256

    1d9a6cde7f7b13c4eea0be144fb489df29f05597afa59cd00e643097c71947c4

  • SHA512

    a721b25316c3cbe71cad2341fcc891a2ffb46f41ac31e9f8642424ebca392177a41f550969b13f25566683dc98dcdc44d41e3fd64b0b7ebc309445773880f51b

  • SSDEEP

    12288:Xyy90qxKp3rFSzr5l0PfcX7wRs3NynfCw+hOWlL1KR:CyLg9FSzriEw2Fjl2

Malware Config

Signatures

  • Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs
  • Executes dropped EXE 3 IoCs
  • Loads dropped DLL 8 IoCs
  • Windows security modification 2 TTPs 2 IoCs
  • Adds Run key to start application 2 TTPs 4 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 21 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\1d9a6cde7f7b13c4eea0be144fb489df29f05597afa59cd00e643097c71947c4.exe
    "C:\Users\Admin\AppData\Local\Temp\1d9a6cde7f7b13c4eea0be144fb489df29f05597afa59cd00e643097c71947c4.exe"
    1⤵
    • Loads dropped DLL
    • Adds Run key to start application
    • Suspicious use of WriteProcessMemory
    PID:1752
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un629439.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un629439.exe
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Adds Run key to start application
      • Suspicious use of WriteProcessMemory
      PID:1368
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\29082602.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\29082602.exe
        3⤵
        • Modifies Windows Defender Real-time Protection settings
        • Executes dropped EXE
        • Loads dropped DLL
        • Windows security modification
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:984
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\rk142080.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\rk142080.exe
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Suspicious use of AdjustPrivilegeToken
        PID:832

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un629439.exe

    Filesize

    550KB

    MD5

    4d4ccef9b9505b34c4b6aab97d6de487

    SHA1

    6d5d2862b078aa65ab5995493f75fe13eb01d8c1

    SHA256

    9db414aaa07f790f0bfcec8edc5f376cd1a4102c51bd722199ef741eab37f799

    SHA512

    55f75c226527104efd116905bf54a7ec3f4368d87a3fdc3aa7a9dd42f2b8c72ddf4cd2b5a97b350bbebde112372f7f1034ea7d3c698d609b915dd11d3a90d97b

  • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un629439.exe

    Filesize

    550KB

    MD5

    4d4ccef9b9505b34c4b6aab97d6de487

    SHA1

    6d5d2862b078aa65ab5995493f75fe13eb01d8c1

    SHA256

    9db414aaa07f790f0bfcec8edc5f376cd1a4102c51bd722199ef741eab37f799

    SHA512

    55f75c226527104efd116905bf54a7ec3f4368d87a3fdc3aa7a9dd42f2b8c72ddf4cd2b5a97b350bbebde112372f7f1034ea7d3c698d609b915dd11d3a90d97b

  • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\29082602.exe

    Filesize

    282KB

    MD5

    c543a71fc67060abd0d9ba070d32e649

    SHA1

    27cece25199d6855fb3dec437a15129f59783156

    SHA256

    4c2f2ad7f8b71019528a5ad0c5fd7b079f23545e2d4b0195245968ead0a9b5ae

    SHA512

    d92aeb10dfa9a231286060b49586f4452a173e5f0a2fe8f88c7a4668a9d9425a0eb42397c0944cf6bcd97ee0550acf816d47560ae1604e773db4496b4c2db0bd

  • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\29082602.exe

    Filesize

    282KB

    MD5

    c543a71fc67060abd0d9ba070d32e649

    SHA1

    27cece25199d6855fb3dec437a15129f59783156

    SHA256

    4c2f2ad7f8b71019528a5ad0c5fd7b079f23545e2d4b0195245968ead0a9b5ae

    SHA512

    d92aeb10dfa9a231286060b49586f4452a173e5f0a2fe8f88c7a4668a9d9425a0eb42397c0944cf6bcd97ee0550acf816d47560ae1604e773db4496b4c2db0bd

  • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\29082602.exe

    Filesize

    282KB

    MD5

    c543a71fc67060abd0d9ba070d32e649

    SHA1

    27cece25199d6855fb3dec437a15129f59783156

    SHA256

    4c2f2ad7f8b71019528a5ad0c5fd7b079f23545e2d4b0195245968ead0a9b5ae

    SHA512

    d92aeb10dfa9a231286060b49586f4452a173e5f0a2fe8f88c7a4668a9d9425a0eb42397c0944cf6bcd97ee0550acf816d47560ae1604e773db4496b4c2db0bd

  • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\rk142080.exe

    Filesize

    366KB

    MD5

    6b6244fc13c08db86b27cfcc9aa11c7f

    SHA1

    67a4a19d5915377d1e69a536cf4642e9acc47930

    SHA256

    bfc5477671421692a8bb1210c3c09580b675646b330859889cde269862d47955

    SHA512

    f25a0e898389bd294ba7fc69da367ccd28f460874719db063e698557e2a2ac02b41cc7e5ebfdfb07b1bfdb5e34ec590667a0b0baa624f606e6d2c92ea77430f7

  • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\rk142080.exe

    Filesize

    366KB

    MD5

    6b6244fc13c08db86b27cfcc9aa11c7f

    SHA1

    67a4a19d5915377d1e69a536cf4642e9acc47930

    SHA256

    bfc5477671421692a8bb1210c3c09580b675646b330859889cde269862d47955

    SHA512

    f25a0e898389bd294ba7fc69da367ccd28f460874719db063e698557e2a2ac02b41cc7e5ebfdfb07b1bfdb5e34ec590667a0b0baa624f606e6d2c92ea77430f7

  • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\rk142080.exe

    Filesize

    366KB

    MD5

    6b6244fc13c08db86b27cfcc9aa11c7f

    SHA1

    67a4a19d5915377d1e69a536cf4642e9acc47930

    SHA256

    bfc5477671421692a8bb1210c3c09580b675646b330859889cde269862d47955

    SHA512

    f25a0e898389bd294ba7fc69da367ccd28f460874719db063e698557e2a2ac02b41cc7e5ebfdfb07b1bfdb5e34ec590667a0b0baa624f606e6d2c92ea77430f7

  • \Users\Admin\AppData\Local\Temp\IXP000.TMP\un629439.exe

    Filesize

    550KB

    MD5

    4d4ccef9b9505b34c4b6aab97d6de487

    SHA1

    6d5d2862b078aa65ab5995493f75fe13eb01d8c1

    SHA256

    9db414aaa07f790f0bfcec8edc5f376cd1a4102c51bd722199ef741eab37f799

    SHA512

    55f75c226527104efd116905bf54a7ec3f4368d87a3fdc3aa7a9dd42f2b8c72ddf4cd2b5a97b350bbebde112372f7f1034ea7d3c698d609b915dd11d3a90d97b

  • \Users\Admin\AppData\Local\Temp\IXP000.TMP\un629439.exe

    Filesize

    550KB

    MD5

    4d4ccef9b9505b34c4b6aab97d6de487

    SHA1

    6d5d2862b078aa65ab5995493f75fe13eb01d8c1

    SHA256

    9db414aaa07f790f0bfcec8edc5f376cd1a4102c51bd722199ef741eab37f799

    SHA512

    55f75c226527104efd116905bf54a7ec3f4368d87a3fdc3aa7a9dd42f2b8c72ddf4cd2b5a97b350bbebde112372f7f1034ea7d3c698d609b915dd11d3a90d97b

  • \Users\Admin\AppData\Local\Temp\IXP001.TMP\29082602.exe

    Filesize

    282KB

    MD5

    c543a71fc67060abd0d9ba070d32e649

    SHA1

    27cece25199d6855fb3dec437a15129f59783156

    SHA256

    4c2f2ad7f8b71019528a5ad0c5fd7b079f23545e2d4b0195245968ead0a9b5ae

    SHA512

    d92aeb10dfa9a231286060b49586f4452a173e5f0a2fe8f88c7a4668a9d9425a0eb42397c0944cf6bcd97ee0550acf816d47560ae1604e773db4496b4c2db0bd

  • \Users\Admin\AppData\Local\Temp\IXP001.TMP\29082602.exe

    Filesize

    282KB

    MD5

    c543a71fc67060abd0d9ba070d32e649

    SHA1

    27cece25199d6855fb3dec437a15129f59783156

    SHA256

    4c2f2ad7f8b71019528a5ad0c5fd7b079f23545e2d4b0195245968ead0a9b5ae

    SHA512

    d92aeb10dfa9a231286060b49586f4452a173e5f0a2fe8f88c7a4668a9d9425a0eb42397c0944cf6bcd97ee0550acf816d47560ae1604e773db4496b4c2db0bd

  • \Users\Admin\AppData\Local\Temp\IXP001.TMP\29082602.exe

    Filesize

    282KB

    MD5

    c543a71fc67060abd0d9ba070d32e649

    SHA1

    27cece25199d6855fb3dec437a15129f59783156

    SHA256

    4c2f2ad7f8b71019528a5ad0c5fd7b079f23545e2d4b0195245968ead0a9b5ae

    SHA512

    d92aeb10dfa9a231286060b49586f4452a173e5f0a2fe8f88c7a4668a9d9425a0eb42397c0944cf6bcd97ee0550acf816d47560ae1604e773db4496b4c2db0bd

  • \Users\Admin\AppData\Local\Temp\IXP001.TMP\rk142080.exe

    Filesize

    366KB

    MD5

    6b6244fc13c08db86b27cfcc9aa11c7f

    SHA1

    67a4a19d5915377d1e69a536cf4642e9acc47930

    SHA256

    bfc5477671421692a8bb1210c3c09580b675646b330859889cde269862d47955

    SHA512

    f25a0e898389bd294ba7fc69da367ccd28f460874719db063e698557e2a2ac02b41cc7e5ebfdfb07b1bfdb5e34ec590667a0b0baa624f606e6d2c92ea77430f7

  • \Users\Admin\AppData\Local\Temp\IXP001.TMP\rk142080.exe

    Filesize

    366KB

    MD5

    6b6244fc13c08db86b27cfcc9aa11c7f

    SHA1

    67a4a19d5915377d1e69a536cf4642e9acc47930

    SHA256

    bfc5477671421692a8bb1210c3c09580b675646b330859889cde269862d47955

    SHA512

    f25a0e898389bd294ba7fc69da367ccd28f460874719db063e698557e2a2ac02b41cc7e5ebfdfb07b1bfdb5e34ec590667a0b0baa624f606e6d2c92ea77430f7

  • \Users\Admin\AppData\Local\Temp\IXP001.TMP\rk142080.exe

    Filesize

    366KB

    MD5

    6b6244fc13c08db86b27cfcc9aa11c7f

    SHA1

    67a4a19d5915377d1e69a536cf4642e9acc47930

    SHA256

    bfc5477671421692a8bb1210c3c09580b675646b330859889cde269862d47955

    SHA512

    f25a0e898389bd294ba7fc69da367ccd28f460874719db063e698557e2a2ac02b41cc7e5ebfdfb07b1bfdb5e34ec590667a0b0baa624f606e6d2c92ea77430f7

  • memory/832-148-0x0000000002170000-0x00000000021A5000-memory.dmp

    Filesize

    212KB

  • memory/832-130-0x0000000002170000-0x00000000021A5000-memory.dmp

    Filesize

    212KB

  • memory/832-152-0x0000000002170000-0x00000000021A5000-memory.dmp

    Filesize

    212KB

  • memory/832-150-0x0000000002170000-0x00000000021A5000-memory.dmp

    Filesize

    212KB

  • memory/832-128-0x0000000004B10000-0x0000000004B50000-memory.dmp

    Filesize

    256KB

  • memory/832-146-0x0000000002170000-0x00000000021A5000-memory.dmp

    Filesize

    212KB

  • memory/832-144-0x0000000002170000-0x00000000021A5000-memory.dmp

    Filesize

    212KB

  • memory/832-142-0x0000000002170000-0x00000000021A5000-memory.dmp

    Filesize

    212KB

  • memory/832-140-0x0000000002170000-0x00000000021A5000-memory.dmp

    Filesize

    212KB

  • memory/832-138-0x0000000002170000-0x00000000021A5000-memory.dmp

    Filesize

    212KB

  • memory/832-136-0x0000000002170000-0x00000000021A5000-memory.dmp

    Filesize

    212KB

  • memory/832-134-0x0000000002170000-0x00000000021A5000-memory.dmp

    Filesize

    212KB

  • memory/832-132-0x0000000002170000-0x00000000021A5000-memory.dmp

    Filesize

    212KB

  • memory/832-156-0x0000000002170000-0x00000000021A5000-memory.dmp

    Filesize

    212KB

  • memory/832-129-0x0000000002170000-0x00000000021A5000-memory.dmp

    Filesize

    212KB

  • memory/832-154-0x0000000002170000-0x00000000021A5000-memory.dmp

    Filesize

    212KB

  • memory/832-158-0x0000000002170000-0x00000000021A5000-memory.dmp

    Filesize

    212KB

  • memory/832-160-0x0000000002170000-0x00000000021A5000-memory.dmp

    Filesize

    212KB

  • memory/832-921-0x0000000004B10000-0x0000000004B50000-memory.dmp

    Filesize

    256KB

  • memory/832-923-0x0000000004B10000-0x0000000004B50000-memory.dmp

    Filesize

    256KB

  • memory/832-925-0x0000000004B10000-0x0000000004B50000-memory.dmp

    Filesize

    256KB

  • memory/832-124-0x0000000002110000-0x000000000214C000-memory.dmp

    Filesize

    240KB

  • memory/832-125-0x0000000002170000-0x00000000021AA000-memory.dmp

    Filesize

    232KB

  • memory/832-126-0x0000000000280000-0x00000000002C6000-memory.dmp

    Filesize

    280KB

  • memory/832-127-0x0000000004B10000-0x0000000004B50000-memory.dmp

    Filesize

    256KB

  • memory/984-85-0x0000000000850000-0x0000000000863000-memory.dmp

    Filesize

    76KB

  • memory/984-113-0x0000000000400000-0x000000000045A000-memory.dmp

    Filesize

    360KB

  • memory/984-110-0x0000000000400000-0x000000000045A000-memory.dmp

    Filesize

    360KB

  • memory/984-108-0x0000000000240000-0x000000000026D000-memory.dmp

    Filesize

    180KB

  • memory/984-109-0x0000000000AD0000-0x0000000000B10000-memory.dmp

    Filesize

    256KB

  • memory/984-107-0x0000000000850000-0x0000000000863000-memory.dmp

    Filesize

    76KB

  • memory/984-105-0x0000000000850000-0x0000000000863000-memory.dmp

    Filesize

    76KB

  • memory/984-103-0x0000000000850000-0x0000000000863000-memory.dmp

    Filesize

    76KB

  • memory/984-101-0x0000000000850000-0x0000000000863000-memory.dmp

    Filesize

    76KB

  • memory/984-99-0x0000000000850000-0x0000000000863000-memory.dmp

    Filesize

    76KB

  • memory/984-97-0x0000000000850000-0x0000000000863000-memory.dmp

    Filesize

    76KB

  • memory/984-95-0x0000000000850000-0x0000000000863000-memory.dmp

    Filesize

    76KB

  • memory/984-93-0x0000000000850000-0x0000000000863000-memory.dmp

    Filesize

    76KB

  • memory/984-91-0x0000000000850000-0x0000000000863000-memory.dmp

    Filesize

    76KB

  • memory/984-89-0x0000000000850000-0x0000000000863000-memory.dmp

    Filesize

    76KB

  • memory/984-87-0x0000000000850000-0x0000000000863000-memory.dmp

    Filesize

    76KB

  • memory/984-83-0x0000000000850000-0x0000000000863000-memory.dmp

    Filesize

    76KB

  • memory/984-81-0x0000000000850000-0x0000000000863000-memory.dmp

    Filesize

    76KB

  • memory/984-80-0x0000000000850000-0x0000000000863000-memory.dmp

    Filesize

    76KB

  • memory/984-79-0x0000000000850000-0x0000000000868000-memory.dmp

    Filesize

    96KB

  • memory/984-78-0x00000000005F0000-0x000000000060A000-memory.dmp

    Filesize

    104KB