Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
143s -
max time network
151s -
platform
windows7_x64 -
resource
win7-20230220-en -
resource tags
arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system -
submitted
06/05/2023, 20:48
Static task
static1
Behavioral task
behavioral1
Sample
1ceb0fa1c52b3c56e438f441c30f53652374fb49683356172398459844d4ba14.exe
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
1ceb0fa1c52b3c56e438f441c30f53652374fb49683356172398459844d4ba14.exe
Resource
win10v2004-20230220-en
General
-
Target
1ceb0fa1c52b3c56e438f441c30f53652374fb49683356172398459844d4ba14.exe
-
Size
1.0MB
-
MD5
61e12c04cd825276b1ee0ab3ea0dd061
-
SHA1
499e8003ddac5a8601960051e97a19ae119c0ba4
-
SHA256
1ceb0fa1c52b3c56e438f441c30f53652374fb49683356172398459844d4ba14
-
SHA512
d64693643fbde638ca6921a519e7915e436f36525f6e1dbeda1aaaae19a35dabf75a2040390afe575fe9ab19c4d08bcd7fd273a3c13841ae411ab1c8d020e0d5
-
SSDEEP
24576:dqw0OA/oz/04YtRHw/tOWaqbkCimjVkaHtSv8I+h:n0Obw4Yt6OQlimjV3tSvc
Malware Config
Signatures
-
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" 165807817.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" 165807817.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" 165807817.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" 165807817.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" 165807817.exe Key created \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection 165807817.exe -
Executes dropped EXE 4 IoCs
pid Process 1964 RH367262.exe 1164 tN982758.exe 672 165807817.exe 1944 239426835.exe -
Loads dropped DLL 10 IoCs
pid Process 1980 1ceb0fa1c52b3c56e438f441c30f53652374fb49683356172398459844d4ba14.exe 1964 RH367262.exe 1964 RH367262.exe 1164 tN982758.exe 1164 tN982758.exe 1164 tN982758.exe 672 165807817.exe 1164 tN982758.exe 1164 tN982758.exe 1944 239426835.exe -
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Features 165807817.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0" 165807817.exe -
Adds Run key to start application 2 TTPs 6 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" RH367262.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce tN982758.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\"" tN982758.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce 1ceb0fa1c52b3c56e438f441c30f53652374fb49683356172398459844d4ba14.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" 1ceb0fa1c52b3c56e438f441c30f53652374fb49683356172398459844d4ba14.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce RH367262.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 672 165807817.exe 672 165807817.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 672 165807817.exe Token: SeDebugPrivilege 1944 239426835.exe -
Suspicious use of WriteProcessMemory 28 IoCs
description pid Process procid_target PID 1980 wrote to memory of 1964 1980 1ceb0fa1c52b3c56e438f441c30f53652374fb49683356172398459844d4ba14.exe 27 PID 1980 wrote to memory of 1964 1980 1ceb0fa1c52b3c56e438f441c30f53652374fb49683356172398459844d4ba14.exe 27 PID 1980 wrote to memory of 1964 1980 1ceb0fa1c52b3c56e438f441c30f53652374fb49683356172398459844d4ba14.exe 27 PID 1980 wrote to memory of 1964 1980 1ceb0fa1c52b3c56e438f441c30f53652374fb49683356172398459844d4ba14.exe 27 PID 1980 wrote to memory of 1964 1980 1ceb0fa1c52b3c56e438f441c30f53652374fb49683356172398459844d4ba14.exe 27 PID 1980 wrote to memory of 1964 1980 1ceb0fa1c52b3c56e438f441c30f53652374fb49683356172398459844d4ba14.exe 27 PID 1980 wrote to memory of 1964 1980 1ceb0fa1c52b3c56e438f441c30f53652374fb49683356172398459844d4ba14.exe 27 PID 1964 wrote to memory of 1164 1964 RH367262.exe 28 PID 1964 wrote to memory of 1164 1964 RH367262.exe 28 PID 1964 wrote to memory of 1164 1964 RH367262.exe 28 PID 1964 wrote to memory of 1164 1964 RH367262.exe 28 PID 1964 wrote to memory of 1164 1964 RH367262.exe 28 PID 1964 wrote to memory of 1164 1964 RH367262.exe 28 PID 1964 wrote to memory of 1164 1964 RH367262.exe 28 PID 1164 wrote to memory of 672 1164 tN982758.exe 29 PID 1164 wrote to memory of 672 1164 tN982758.exe 29 PID 1164 wrote to memory of 672 1164 tN982758.exe 29 PID 1164 wrote to memory of 672 1164 tN982758.exe 29 PID 1164 wrote to memory of 672 1164 tN982758.exe 29 PID 1164 wrote to memory of 672 1164 tN982758.exe 29 PID 1164 wrote to memory of 672 1164 tN982758.exe 29 PID 1164 wrote to memory of 1944 1164 tN982758.exe 30 PID 1164 wrote to memory of 1944 1164 tN982758.exe 30 PID 1164 wrote to memory of 1944 1164 tN982758.exe 30 PID 1164 wrote to memory of 1944 1164 tN982758.exe 30 PID 1164 wrote to memory of 1944 1164 tN982758.exe 30 PID 1164 wrote to memory of 1944 1164 tN982758.exe 30 PID 1164 wrote to memory of 1944 1164 tN982758.exe 30
Processes
-
C:\Users\Admin\AppData\Local\Temp\1ceb0fa1c52b3c56e438f441c30f53652374fb49683356172398459844d4ba14.exe"C:\Users\Admin\AppData\Local\Temp\1ceb0fa1c52b3c56e438f441c30f53652374fb49683356172398459844d4ba14.exe"1⤵
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:1980 -
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\RH367262.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\RH367262.exe2⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:1964 -
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\tN982758.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\tN982758.exe3⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:1164 -
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\165807817.exeC:\Users\Admin\AppData\Local\Temp\IXP002.TMP\165807817.exe4⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Loads dropped DLL
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:672
-
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\239426835.exeC:\Users\Admin\AppData\Local\Temp\IXP002.TMP\239426835.exe4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
PID:1944
-
-
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
717KB
MD56ea5a9e290d0a1ef10cd5f050c45960d
SHA1105218e552f598f1bada53e7d9bc09ff942f3ea0
SHA256ff6349dc771ae1bde50b9dff52c83a2fa6c8109a7b59d8b115e61a5c727c61b8
SHA512fe22652f82b4a0847112e837177856721574b67e0cc884f1a9e039aab168184bd22106195c1f674d4d1e76e1802ae1a543dd2c8e4538671c8173a37d80c56010
-
Filesize
717KB
MD56ea5a9e290d0a1ef10cd5f050c45960d
SHA1105218e552f598f1bada53e7d9bc09ff942f3ea0
SHA256ff6349dc771ae1bde50b9dff52c83a2fa6c8109a7b59d8b115e61a5c727c61b8
SHA512fe22652f82b4a0847112e837177856721574b67e0cc884f1a9e039aab168184bd22106195c1f674d4d1e76e1802ae1a543dd2c8e4538671c8173a37d80c56010
-
Filesize
546KB
MD5ebc7cbd237ed6075ccdf012a337fc0c3
SHA11e5ead87e2855eb0f85e60091eff248eed1d278b
SHA256eb61c6866c4e74a63d94584c22e159b3f40c6b992b8d0808b1cc8e7b840cec01
SHA51241782344787dc74995d6be3af3b9ae4f2735a4bc666817876370824cdc11a257832354151e71c986a8f21116dd8fd3281c8add5cd33902d91388bddbe568e3a3
-
Filesize
546KB
MD5ebc7cbd237ed6075ccdf012a337fc0c3
SHA11e5ead87e2855eb0f85e60091eff248eed1d278b
SHA256eb61c6866c4e74a63d94584c22e159b3f40c6b992b8d0808b1cc8e7b840cec01
SHA51241782344787dc74995d6be3af3b9ae4f2735a4bc666817876370824cdc11a257832354151e71c986a8f21116dd8fd3281c8add5cd33902d91388bddbe568e3a3
-
Filesize
269KB
MD53e393e838fd8e093bc6f75a67b6aa133
SHA1e61b14e8866a88b9a513aef484c1930ee5ae7682
SHA256861d4773a6b3ad6000e847c1a6d26aa639d7f2b3a1c7e7ee34b10fff4e7191de
SHA512dbc7676578d0b4c3e703cb4061b2bb61e603fdfe03adfb3e72d665c5d0878872e7ce62df23d272e73cadb3822de250d1e81d70b4c77c19b8b13d502da77007a4
-
Filesize
269KB
MD53e393e838fd8e093bc6f75a67b6aa133
SHA1e61b14e8866a88b9a513aef484c1930ee5ae7682
SHA256861d4773a6b3ad6000e847c1a6d26aa639d7f2b3a1c7e7ee34b10fff4e7191de
SHA512dbc7676578d0b4c3e703cb4061b2bb61e603fdfe03adfb3e72d665c5d0878872e7ce62df23d272e73cadb3822de250d1e81d70b4c77c19b8b13d502da77007a4
-
Filesize
269KB
MD53e393e838fd8e093bc6f75a67b6aa133
SHA1e61b14e8866a88b9a513aef484c1930ee5ae7682
SHA256861d4773a6b3ad6000e847c1a6d26aa639d7f2b3a1c7e7ee34b10fff4e7191de
SHA512dbc7676578d0b4c3e703cb4061b2bb61e603fdfe03adfb3e72d665c5d0878872e7ce62df23d272e73cadb3822de250d1e81d70b4c77c19b8b13d502da77007a4
-
Filesize
353KB
MD5ccd062ab23586df59d24e355985014cb
SHA1acd43763c57c23cc50c45cc06e214bd0c5f95388
SHA2562f86ec37281d45fe3248d6b3195143fa727916355534aad60b81a0145fc66b99
SHA5129b9799c7fd853c86377510003a81b8438ab809d78cdcaa55adf18249360542eca169994f1d5830bc67705ab443e7cc67e7ec9c1bb39cd973e52bb3b4291ed5ac
-
Filesize
353KB
MD5ccd062ab23586df59d24e355985014cb
SHA1acd43763c57c23cc50c45cc06e214bd0c5f95388
SHA2562f86ec37281d45fe3248d6b3195143fa727916355534aad60b81a0145fc66b99
SHA5129b9799c7fd853c86377510003a81b8438ab809d78cdcaa55adf18249360542eca169994f1d5830bc67705ab443e7cc67e7ec9c1bb39cd973e52bb3b4291ed5ac
-
Filesize
353KB
MD5ccd062ab23586df59d24e355985014cb
SHA1acd43763c57c23cc50c45cc06e214bd0c5f95388
SHA2562f86ec37281d45fe3248d6b3195143fa727916355534aad60b81a0145fc66b99
SHA5129b9799c7fd853c86377510003a81b8438ab809d78cdcaa55adf18249360542eca169994f1d5830bc67705ab443e7cc67e7ec9c1bb39cd973e52bb3b4291ed5ac
-
Filesize
717KB
MD56ea5a9e290d0a1ef10cd5f050c45960d
SHA1105218e552f598f1bada53e7d9bc09ff942f3ea0
SHA256ff6349dc771ae1bde50b9dff52c83a2fa6c8109a7b59d8b115e61a5c727c61b8
SHA512fe22652f82b4a0847112e837177856721574b67e0cc884f1a9e039aab168184bd22106195c1f674d4d1e76e1802ae1a543dd2c8e4538671c8173a37d80c56010
-
Filesize
717KB
MD56ea5a9e290d0a1ef10cd5f050c45960d
SHA1105218e552f598f1bada53e7d9bc09ff942f3ea0
SHA256ff6349dc771ae1bde50b9dff52c83a2fa6c8109a7b59d8b115e61a5c727c61b8
SHA512fe22652f82b4a0847112e837177856721574b67e0cc884f1a9e039aab168184bd22106195c1f674d4d1e76e1802ae1a543dd2c8e4538671c8173a37d80c56010
-
Filesize
546KB
MD5ebc7cbd237ed6075ccdf012a337fc0c3
SHA11e5ead87e2855eb0f85e60091eff248eed1d278b
SHA256eb61c6866c4e74a63d94584c22e159b3f40c6b992b8d0808b1cc8e7b840cec01
SHA51241782344787dc74995d6be3af3b9ae4f2735a4bc666817876370824cdc11a257832354151e71c986a8f21116dd8fd3281c8add5cd33902d91388bddbe568e3a3
-
Filesize
546KB
MD5ebc7cbd237ed6075ccdf012a337fc0c3
SHA11e5ead87e2855eb0f85e60091eff248eed1d278b
SHA256eb61c6866c4e74a63d94584c22e159b3f40c6b992b8d0808b1cc8e7b840cec01
SHA51241782344787dc74995d6be3af3b9ae4f2735a4bc666817876370824cdc11a257832354151e71c986a8f21116dd8fd3281c8add5cd33902d91388bddbe568e3a3
-
Filesize
269KB
MD53e393e838fd8e093bc6f75a67b6aa133
SHA1e61b14e8866a88b9a513aef484c1930ee5ae7682
SHA256861d4773a6b3ad6000e847c1a6d26aa639d7f2b3a1c7e7ee34b10fff4e7191de
SHA512dbc7676578d0b4c3e703cb4061b2bb61e603fdfe03adfb3e72d665c5d0878872e7ce62df23d272e73cadb3822de250d1e81d70b4c77c19b8b13d502da77007a4
-
Filesize
269KB
MD53e393e838fd8e093bc6f75a67b6aa133
SHA1e61b14e8866a88b9a513aef484c1930ee5ae7682
SHA256861d4773a6b3ad6000e847c1a6d26aa639d7f2b3a1c7e7ee34b10fff4e7191de
SHA512dbc7676578d0b4c3e703cb4061b2bb61e603fdfe03adfb3e72d665c5d0878872e7ce62df23d272e73cadb3822de250d1e81d70b4c77c19b8b13d502da77007a4
-
Filesize
269KB
MD53e393e838fd8e093bc6f75a67b6aa133
SHA1e61b14e8866a88b9a513aef484c1930ee5ae7682
SHA256861d4773a6b3ad6000e847c1a6d26aa639d7f2b3a1c7e7ee34b10fff4e7191de
SHA512dbc7676578d0b4c3e703cb4061b2bb61e603fdfe03adfb3e72d665c5d0878872e7ce62df23d272e73cadb3822de250d1e81d70b4c77c19b8b13d502da77007a4
-
Filesize
353KB
MD5ccd062ab23586df59d24e355985014cb
SHA1acd43763c57c23cc50c45cc06e214bd0c5f95388
SHA2562f86ec37281d45fe3248d6b3195143fa727916355534aad60b81a0145fc66b99
SHA5129b9799c7fd853c86377510003a81b8438ab809d78cdcaa55adf18249360542eca169994f1d5830bc67705ab443e7cc67e7ec9c1bb39cd973e52bb3b4291ed5ac
-
Filesize
353KB
MD5ccd062ab23586df59d24e355985014cb
SHA1acd43763c57c23cc50c45cc06e214bd0c5f95388
SHA2562f86ec37281d45fe3248d6b3195143fa727916355534aad60b81a0145fc66b99
SHA5129b9799c7fd853c86377510003a81b8438ab809d78cdcaa55adf18249360542eca169994f1d5830bc67705ab443e7cc67e7ec9c1bb39cd973e52bb3b4291ed5ac
-
Filesize
353KB
MD5ccd062ab23586df59d24e355985014cb
SHA1acd43763c57c23cc50c45cc06e214bd0c5f95388
SHA2562f86ec37281d45fe3248d6b3195143fa727916355534aad60b81a0145fc66b99
SHA5129b9799c7fd853c86377510003a81b8438ab809d78cdcaa55adf18249360542eca169994f1d5830bc67705ab443e7cc67e7ec9c1bb39cd973e52bb3b4291ed5ac