Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
151s -
max time network
195s -
platform
windows7_x64 -
resource
win7-20230220-en -
resource tags
arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system -
submitted
06/05/2023, 20:49
Static task
static1
Behavioral task
behavioral1
Sample
1d9a6cde7f7b13c4eea0be144fb489df29f05597afa59cd00e643097c71947c4.exe
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
1d9a6cde7f7b13c4eea0be144fb489df29f05597afa59cd00e643097c71947c4.exe
Resource
win10v2004-20230220-en
General
-
Target
1d9a6cde7f7b13c4eea0be144fb489df29f05597afa59cd00e643097c71947c4.exe
-
Size
705KB
-
MD5
b9a0ecd9c9b3489dce22313b82a83ac9
-
SHA1
73aa4c938bbfa44a4d276cd6ec3dba46a70e66b8
-
SHA256
1d9a6cde7f7b13c4eea0be144fb489df29f05597afa59cd00e643097c71947c4
-
SHA512
a721b25316c3cbe71cad2341fcc891a2ffb46f41ac31e9f8642424ebca392177a41f550969b13f25566683dc98dcdc44d41e3fd64b0b7ebc309445773880f51b
-
SSDEEP
12288:Xyy90qxKp3rFSzr5l0PfcX7wRs3NynfCw+hOWlL1KR:CyLg9FSzriEw2Fjl2
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection 29082602.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" 29082602.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" 29082602.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" 29082602.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" 29082602.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" 29082602.exe -
Executes dropped EXE 3 IoCs
pid Process 1368 un629439.exe 984 29082602.exe 832 rk142080.exe -
Loads dropped DLL 8 IoCs
pid Process 1752 1d9a6cde7f7b13c4eea0be144fb489df29f05597afa59cd00e643097c71947c4.exe 1368 un629439.exe 1368 un629439.exe 1368 un629439.exe 984 29082602.exe 1368 un629439.exe 1368 un629439.exe 832 rk142080.exe -
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Features 29082602.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0" 29082602.exe -
Adds Run key to start application 2 TTPs 4 IoCs
description ioc Process Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce 1d9a6cde7f7b13c4eea0be144fb489df29f05597afa59cd00e643097c71947c4.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" 1d9a6cde7f7b13c4eea0be144fb489df29f05597afa59cd00e643097c71947c4.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce un629439.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" un629439.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 984 29082602.exe 984 29082602.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 984 29082602.exe Token: SeDebugPrivilege 832 rk142080.exe -
Suspicious use of WriteProcessMemory 21 IoCs
description pid Process procid_target PID 1752 wrote to memory of 1368 1752 1d9a6cde7f7b13c4eea0be144fb489df29f05597afa59cd00e643097c71947c4.exe 28 PID 1752 wrote to memory of 1368 1752 1d9a6cde7f7b13c4eea0be144fb489df29f05597afa59cd00e643097c71947c4.exe 28 PID 1752 wrote to memory of 1368 1752 1d9a6cde7f7b13c4eea0be144fb489df29f05597afa59cd00e643097c71947c4.exe 28 PID 1752 wrote to memory of 1368 1752 1d9a6cde7f7b13c4eea0be144fb489df29f05597afa59cd00e643097c71947c4.exe 28 PID 1752 wrote to memory of 1368 1752 1d9a6cde7f7b13c4eea0be144fb489df29f05597afa59cd00e643097c71947c4.exe 28 PID 1752 wrote to memory of 1368 1752 1d9a6cde7f7b13c4eea0be144fb489df29f05597afa59cd00e643097c71947c4.exe 28 PID 1752 wrote to memory of 1368 1752 1d9a6cde7f7b13c4eea0be144fb489df29f05597afa59cd00e643097c71947c4.exe 28 PID 1368 wrote to memory of 984 1368 un629439.exe 29 PID 1368 wrote to memory of 984 1368 un629439.exe 29 PID 1368 wrote to memory of 984 1368 un629439.exe 29 PID 1368 wrote to memory of 984 1368 un629439.exe 29 PID 1368 wrote to memory of 984 1368 un629439.exe 29 PID 1368 wrote to memory of 984 1368 un629439.exe 29 PID 1368 wrote to memory of 984 1368 un629439.exe 29 PID 1368 wrote to memory of 832 1368 un629439.exe 30 PID 1368 wrote to memory of 832 1368 un629439.exe 30 PID 1368 wrote to memory of 832 1368 un629439.exe 30 PID 1368 wrote to memory of 832 1368 un629439.exe 30 PID 1368 wrote to memory of 832 1368 un629439.exe 30 PID 1368 wrote to memory of 832 1368 un629439.exe 30 PID 1368 wrote to memory of 832 1368 un629439.exe 30
Processes
-
C:\Users\Admin\AppData\Local\Temp\1d9a6cde7f7b13c4eea0be144fb489df29f05597afa59cd00e643097c71947c4.exe"C:\Users\Admin\AppData\Local\Temp\1d9a6cde7f7b13c4eea0be144fb489df29f05597afa59cd00e643097c71947c4.exe"1⤵
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:1752 -
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un629439.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un629439.exe2⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:1368 -
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\29082602.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\29082602.exe3⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Loads dropped DLL
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:984
-
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\rk142080.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\rk142080.exe3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
PID:832
-
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
550KB
MD54d4ccef9b9505b34c4b6aab97d6de487
SHA16d5d2862b078aa65ab5995493f75fe13eb01d8c1
SHA2569db414aaa07f790f0bfcec8edc5f376cd1a4102c51bd722199ef741eab37f799
SHA51255f75c226527104efd116905bf54a7ec3f4368d87a3fdc3aa7a9dd42f2b8c72ddf4cd2b5a97b350bbebde112372f7f1034ea7d3c698d609b915dd11d3a90d97b
-
Filesize
550KB
MD54d4ccef9b9505b34c4b6aab97d6de487
SHA16d5d2862b078aa65ab5995493f75fe13eb01d8c1
SHA2569db414aaa07f790f0bfcec8edc5f376cd1a4102c51bd722199ef741eab37f799
SHA51255f75c226527104efd116905bf54a7ec3f4368d87a3fdc3aa7a9dd42f2b8c72ddf4cd2b5a97b350bbebde112372f7f1034ea7d3c698d609b915dd11d3a90d97b
-
Filesize
282KB
MD5c543a71fc67060abd0d9ba070d32e649
SHA127cece25199d6855fb3dec437a15129f59783156
SHA2564c2f2ad7f8b71019528a5ad0c5fd7b079f23545e2d4b0195245968ead0a9b5ae
SHA512d92aeb10dfa9a231286060b49586f4452a173e5f0a2fe8f88c7a4668a9d9425a0eb42397c0944cf6bcd97ee0550acf816d47560ae1604e773db4496b4c2db0bd
-
Filesize
282KB
MD5c543a71fc67060abd0d9ba070d32e649
SHA127cece25199d6855fb3dec437a15129f59783156
SHA2564c2f2ad7f8b71019528a5ad0c5fd7b079f23545e2d4b0195245968ead0a9b5ae
SHA512d92aeb10dfa9a231286060b49586f4452a173e5f0a2fe8f88c7a4668a9d9425a0eb42397c0944cf6bcd97ee0550acf816d47560ae1604e773db4496b4c2db0bd
-
Filesize
282KB
MD5c543a71fc67060abd0d9ba070d32e649
SHA127cece25199d6855fb3dec437a15129f59783156
SHA2564c2f2ad7f8b71019528a5ad0c5fd7b079f23545e2d4b0195245968ead0a9b5ae
SHA512d92aeb10dfa9a231286060b49586f4452a173e5f0a2fe8f88c7a4668a9d9425a0eb42397c0944cf6bcd97ee0550acf816d47560ae1604e773db4496b4c2db0bd
-
Filesize
366KB
MD56b6244fc13c08db86b27cfcc9aa11c7f
SHA167a4a19d5915377d1e69a536cf4642e9acc47930
SHA256bfc5477671421692a8bb1210c3c09580b675646b330859889cde269862d47955
SHA512f25a0e898389bd294ba7fc69da367ccd28f460874719db063e698557e2a2ac02b41cc7e5ebfdfb07b1bfdb5e34ec590667a0b0baa624f606e6d2c92ea77430f7
-
Filesize
366KB
MD56b6244fc13c08db86b27cfcc9aa11c7f
SHA167a4a19d5915377d1e69a536cf4642e9acc47930
SHA256bfc5477671421692a8bb1210c3c09580b675646b330859889cde269862d47955
SHA512f25a0e898389bd294ba7fc69da367ccd28f460874719db063e698557e2a2ac02b41cc7e5ebfdfb07b1bfdb5e34ec590667a0b0baa624f606e6d2c92ea77430f7
-
Filesize
366KB
MD56b6244fc13c08db86b27cfcc9aa11c7f
SHA167a4a19d5915377d1e69a536cf4642e9acc47930
SHA256bfc5477671421692a8bb1210c3c09580b675646b330859889cde269862d47955
SHA512f25a0e898389bd294ba7fc69da367ccd28f460874719db063e698557e2a2ac02b41cc7e5ebfdfb07b1bfdb5e34ec590667a0b0baa624f606e6d2c92ea77430f7
-
Filesize
550KB
MD54d4ccef9b9505b34c4b6aab97d6de487
SHA16d5d2862b078aa65ab5995493f75fe13eb01d8c1
SHA2569db414aaa07f790f0bfcec8edc5f376cd1a4102c51bd722199ef741eab37f799
SHA51255f75c226527104efd116905bf54a7ec3f4368d87a3fdc3aa7a9dd42f2b8c72ddf4cd2b5a97b350bbebde112372f7f1034ea7d3c698d609b915dd11d3a90d97b
-
Filesize
550KB
MD54d4ccef9b9505b34c4b6aab97d6de487
SHA16d5d2862b078aa65ab5995493f75fe13eb01d8c1
SHA2569db414aaa07f790f0bfcec8edc5f376cd1a4102c51bd722199ef741eab37f799
SHA51255f75c226527104efd116905bf54a7ec3f4368d87a3fdc3aa7a9dd42f2b8c72ddf4cd2b5a97b350bbebde112372f7f1034ea7d3c698d609b915dd11d3a90d97b
-
Filesize
282KB
MD5c543a71fc67060abd0d9ba070d32e649
SHA127cece25199d6855fb3dec437a15129f59783156
SHA2564c2f2ad7f8b71019528a5ad0c5fd7b079f23545e2d4b0195245968ead0a9b5ae
SHA512d92aeb10dfa9a231286060b49586f4452a173e5f0a2fe8f88c7a4668a9d9425a0eb42397c0944cf6bcd97ee0550acf816d47560ae1604e773db4496b4c2db0bd
-
Filesize
282KB
MD5c543a71fc67060abd0d9ba070d32e649
SHA127cece25199d6855fb3dec437a15129f59783156
SHA2564c2f2ad7f8b71019528a5ad0c5fd7b079f23545e2d4b0195245968ead0a9b5ae
SHA512d92aeb10dfa9a231286060b49586f4452a173e5f0a2fe8f88c7a4668a9d9425a0eb42397c0944cf6bcd97ee0550acf816d47560ae1604e773db4496b4c2db0bd
-
Filesize
282KB
MD5c543a71fc67060abd0d9ba070d32e649
SHA127cece25199d6855fb3dec437a15129f59783156
SHA2564c2f2ad7f8b71019528a5ad0c5fd7b079f23545e2d4b0195245968ead0a9b5ae
SHA512d92aeb10dfa9a231286060b49586f4452a173e5f0a2fe8f88c7a4668a9d9425a0eb42397c0944cf6bcd97ee0550acf816d47560ae1604e773db4496b4c2db0bd
-
Filesize
366KB
MD56b6244fc13c08db86b27cfcc9aa11c7f
SHA167a4a19d5915377d1e69a536cf4642e9acc47930
SHA256bfc5477671421692a8bb1210c3c09580b675646b330859889cde269862d47955
SHA512f25a0e898389bd294ba7fc69da367ccd28f460874719db063e698557e2a2ac02b41cc7e5ebfdfb07b1bfdb5e34ec590667a0b0baa624f606e6d2c92ea77430f7
-
Filesize
366KB
MD56b6244fc13c08db86b27cfcc9aa11c7f
SHA167a4a19d5915377d1e69a536cf4642e9acc47930
SHA256bfc5477671421692a8bb1210c3c09580b675646b330859889cde269862d47955
SHA512f25a0e898389bd294ba7fc69da367ccd28f460874719db063e698557e2a2ac02b41cc7e5ebfdfb07b1bfdb5e34ec590667a0b0baa624f606e6d2c92ea77430f7
-
Filesize
366KB
MD56b6244fc13c08db86b27cfcc9aa11c7f
SHA167a4a19d5915377d1e69a536cf4642e9acc47930
SHA256bfc5477671421692a8bb1210c3c09580b675646b330859889cde269862d47955
SHA512f25a0e898389bd294ba7fc69da367ccd28f460874719db063e698557e2a2ac02b41cc7e5ebfdfb07b1bfdb5e34ec590667a0b0baa624f606e6d2c92ea77430f7