Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    143s
  • max time network
    151s
  • platform
    windows7_x64
  • resource
    win7-20230220-en
  • resource tags

    arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
  • submitted
    06/05/2023, 20:48

General

  • Target

    1ceb0fa1c52b3c56e438f441c30f53652374fb49683356172398459844d4ba14.exe

  • Size

    1.0MB

  • MD5

    61e12c04cd825276b1ee0ab3ea0dd061

  • SHA1

    499e8003ddac5a8601960051e97a19ae119c0ba4

  • SHA256

    1ceb0fa1c52b3c56e438f441c30f53652374fb49683356172398459844d4ba14

  • SHA512

    d64693643fbde638ca6921a519e7915e436f36525f6e1dbeda1aaaae19a35dabf75a2040390afe575fe9ab19c4d08bcd7fd273a3c13841ae411ab1c8d020e0d5

  • SSDEEP

    24576:dqw0OA/oz/04YtRHw/tOWaqbkCimjVkaHtSv8I+h:n0Obw4Yt6OQlimjV3tSvc

Malware Config

Signatures

  • Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs
  • Executes dropped EXE 4 IoCs
  • Loads dropped DLL 10 IoCs
  • Windows security modification 2 TTPs 2 IoCs
  • Adds Run key to start application 2 TTPs 6 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 28 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\1ceb0fa1c52b3c56e438f441c30f53652374fb49683356172398459844d4ba14.exe
    "C:\Users\Admin\AppData\Local\Temp\1ceb0fa1c52b3c56e438f441c30f53652374fb49683356172398459844d4ba14.exe"
    1⤵
    • Loads dropped DLL
    • Adds Run key to start application
    • Suspicious use of WriteProcessMemory
    PID:1980
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\RH367262.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\RH367262.exe
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Adds Run key to start application
      • Suspicious use of WriteProcessMemory
      PID:1964
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\tN982758.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\tN982758.exe
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Adds Run key to start application
        • Suspicious use of WriteProcessMemory
        PID:1164
        • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\165807817.exe
          C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\165807817.exe
          4⤵
          • Modifies Windows Defender Real-time Protection settings
          • Executes dropped EXE
          • Loads dropped DLL
          • Windows security modification
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:672
        • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\239426835.exe
          C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\239426835.exe
          4⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • Suspicious use of AdjustPrivilegeToken
          PID:1944

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\RH367262.exe

    Filesize

    717KB

    MD5

    6ea5a9e290d0a1ef10cd5f050c45960d

    SHA1

    105218e552f598f1bada53e7d9bc09ff942f3ea0

    SHA256

    ff6349dc771ae1bde50b9dff52c83a2fa6c8109a7b59d8b115e61a5c727c61b8

    SHA512

    fe22652f82b4a0847112e837177856721574b67e0cc884f1a9e039aab168184bd22106195c1f674d4d1e76e1802ae1a543dd2c8e4538671c8173a37d80c56010

  • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\RH367262.exe

    Filesize

    717KB

    MD5

    6ea5a9e290d0a1ef10cd5f050c45960d

    SHA1

    105218e552f598f1bada53e7d9bc09ff942f3ea0

    SHA256

    ff6349dc771ae1bde50b9dff52c83a2fa6c8109a7b59d8b115e61a5c727c61b8

    SHA512

    fe22652f82b4a0847112e837177856721574b67e0cc884f1a9e039aab168184bd22106195c1f674d4d1e76e1802ae1a543dd2c8e4538671c8173a37d80c56010

  • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\tN982758.exe

    Filesize

    546KB

    MD5

    ebc7cbd237ed6075ccdf012a337fc0c3

    SHA1

    1e5ead87e2855eb0f85e60091eff248eed1d278b

    SHA256

    eb61c6866c4e74a63d94584c22e159b3f40c6b992b8d0808b1cc8e7b840cec01

    SHA512

    41782344787dc74995d6be3af3b9ae4f2735a4bc666817876370824cdc11a257832354151e71c986a8f21116dd8fd3281c8add5cd33902d91388bddbe568e3a3

  • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\tN982758.exe

    Filesize

    546KB

    MD5

    ebc7cbd237ed6075ccdf012a337fc0c3

    SHA1

    1e5ead87e2855eb0f85e60091eff248eed1d278b

    SHA256

    eb61c6866c4e74a63d94584c22e159b3f40c6b992b8d0808b1cc8e7b840cec01

    SHA512

    41782344787dc74995d6be3af3b9ae4f2735a4bc666817876370824cdc11a257832354151e71c986a8f21116dd8fd3281c8add5cd33902d91388bddbe568e3a3

  • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\165807817.exe

    Filesize

    269KB

    MD5

    3e393e838fd8e093bc6f75a67b6aa133

    SHA1

    e61b14e8866a88b9a513aef484c1930ee5ae7682

    SHA256

    861d4773a6b3ad6000e847c1a6d26aa639d7f2b3a1c7e7ee34b10fff4e7191de

    SHA512

    dbc7676578d0b4c3e703cb4061b2bb61e603fdfe03adfb3e72d665c5d0878872e7ce62df23d272e73cadb3822de250d1e81d70b4c77c19b8b13d502da77007a4

  • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\165807817.exe

    Filesize

    269KB

    MD5

    3e393e838fd8e093bc6f75a67b6aa133

    SHA1

    e61b14e8866a88b9a513aef484c1930ee5ae7682

    SHA256

    861d4773a6b3ad6000e847c1a6d26aa639d7f2b3a1c7e7ee34b10fff4e7191de

    SHA512

    dbc7676578d0b4c3e703cb4061b2bb61e603fdfe03adfb3e72d665c5d0878872e7ce62df23d272e73cadb3822de250d1e81d70b4c77c19b8b13d502da77007a4

  • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\165807817.exe

    Filesize

    269KB

    MD5

    3e393e838fd8e093bc6f75a67b6aa133

    SHA1

    e61b14e8866a88b9a513aef484c1930ee5ae7682

    SHA256

    861d4773a6b3ad6000e847c1a6d26aa639d7f2b3a1c7e7ee34b10fff4e7191de

    SHA512

    dbc7676578d0b4c3e703cb4061b2bb61e603fdfe03adfb3e72d665c5d0878872e7ce62df23d272e73cadb3822de250d1e81d70b4c77c19b8b13d502da77007a4

  • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\239426835.exe

    Filesize

    353KB

    MD5

    ccd062ab23586df59d24e355985014cb

    SHA1

    acd43763c57c23cc50c45cc06e214bd0c5f95388

    SHA256

    2f86ec37281d45fe3248d6b3195143fa727916355534aad60b81a0145fc66b99

    SHA512

    9b9799c7fd853c86377510003a81b8438ab809d78cdcaa55adf18249360542eca169994f1d5830bc67705ab443e7cc67e7ec9c1bb39cd973e52bb3b4291ed5ac

  • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\239426835.exe

    Filesize

    353KB

    MD5

    ccd062ab23586df59d24e355985014cb

    SHA1

    acd43763c57c23cc50c45cc06e214bd0c5f95388

    SHA256

    2f86ec37281d45fe3248d6b3195143fa727916355534aad60b81a0145fc66b99

    SHA512

    9b9799c7fd853c86377510003a81b8438ab809d78cdcaa55adf18249360542eca169994f1d5830bc67705ab443e7cc67e7ec9c1bb39cd973e52bb3b4291ed5ac

  • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\239426835.exe

    Filesize

    353KB

    MD5

    ccd062ab23586df59d24e355985014cb

    SHA1

    acd43763c57c23cc50c45cc06e214bd0c5f95388

    SHA256

    2f86ec37281d45fe3248d6b3195143fa727916355534aad60b81a0145fc66b99

    SHA512

    9b9799c7fd853c86377510003a81b8438ab809d78cdcaa55adf18249360542eca169994f1d5830bc67705ab443e7cc67e7ec9c1bb39cd973e52bb3b4291ed5ac

  • \Users\Admin\AppData\Local\Temp\IXP000.TMP\RH367262.exe

    Filesize

    717KB

    MD5

    6ea5a9e290d0a1ef10cd5f050c45960d

    SHA1

    105218e552f598f1bada53e7d9bc09ff942f3ea0

    SHA256

    ff6349dc771ae1bde50b9dff52c83a2fa6c8109a7b59d8b115e61a5c727c61b8

    SHA512

    fe22652f82b4a0847112e837177856721574b67e0cc884f1a9e039aab168184bd22106195c1f674d4d1e76e1802ae1a543dd2c8e4538671c8173a37d80c56010

  • \Users\Admin\AppData\Local\Temp\IXP000.TMP\RH367262.exe

    Filesize

    717KB

    MD5

    6ea5a9e290d0a1ef10cd5f050c45960d

    SHA1

    105218e552f598f1bada53e7d9bc09ff942f3ea0

    SHA256

    ff6349dc771ae1bde50b9dff52c83a2fa6c8109a7b59d8b115e61a5c727c61b8

    SHA512

    fe22652f82b4a0847112e837177856721574b67e0cc884f1a9e039aab168184bd22106195c1f674d4d1e76e1802ae1a543dd2c8e4538671c8173a37d80c56010

  • \Users\Admin\AppData\Local\Temp\IXP001.TMP\tN982758.exe

    Filesize

    546KB

    MD5

    ebc7cbd237ed6075ccdf012a337fc0c3

    SHA1

    1e5ead87e2855eb0f85e60091eff248eed1d278b

    SHA256

    eb61c6866c4e74a63d94584c22e159b3f40c6b992b8d0808b1cc8e7b840cec01

    SHA512

    41782344787dc74995d6be3af3b9ae4f2735a4bc666817876370824cdc11a257832354151e71c986a8f21116dd8fd3281c8add5cd33902d91388bddbe568e3a3

  • \Users\Admin\AppData\Local\Temp\IXP001.TMP\tN982758.exe

    Filesize

    546KB

    MD5

    ebc7cbd237ed6075ccdf012a337fc0c3

    SHA1

    1e5ead87e2855eb0f85e60091eff248eed1d278b

    SHA256

    eb61c6866c4e74a63d94584c22e159b3f40c6b992b8d0808b1cc8e7b840cec01

    SHA512

    41782344787dc74995d6be3af3b9ae4f2735a4bc666817876370824cdc11a257832354151e71c986a8f21116dd8fd3281c8add5cd33902d91388bddbe568e3a3

  • \Users\Admin\AppData\Local\Temp\IXP002.TMP\165807817.exe

    Filesize

    269KB

    MD5

    3e393e838fd8e093bc6f75a67b6aa133

    SHA1

    e61b14e8866a88b9a513aef484c1930ee5ae7682

    SHA256

    861d4773a6b3ad6000e847c1a6d26aa639d7f2b3a1c7e7ee34b10fff4e7191de

    SHA512

    dbc7676578d0b4c3e703cb4061b2bb61e603fdfe03adfb3e72d665c5d0878872e7ce62df23d272e73cadb3822de250d1e81d70b4c77c19b8b13d502da77007a4

  • \Users\Admin\AppData\Local\Temp\IXP002.TMP\165807817.exe

    Filesize

    269KB

    MD5

    3e393e838fd8e093bc6f75a67b6aa133

    SHA1

    e61b14e8866a88b9a513aef484c1930ee5ae7682

    SHA256

    861d4773a6b3ad6000e847c1a6d26aa639d7f2b3a1c7e7ee34b10fff4e7191de

    SHA512

    dbc7676578d0b4c3e703cb4061b2bb61e603fdfe03adfb3e72d665c5d0878872e7ce62df23d272e73cadb3822de250d1e81d70b4c77c19b8b13d502da77007a4

  • \Users\Admin\AppData\Local\Temp\IXP002.TMP\165807817.exe

    Filesize

    269KB

    MD5

    3e393e838fd8e093bc6f75a67b6aa133

    SHA1

    e61b14e8866a88b9a513aef484c1930ee5ae7682

    SHA256

    861d4773a6b3ad6000e847c1a6d26aa639d7f2b3a1c7e7ee34b10fff4e7191de

    SHA512

    dbc7676578d0b4c3e703cb4061b2bb61e603fdfe03adfb3e72d665c5d0878872e7ce62df23d272e73cadb3822de250d1e81d70b4c77c19b8b13d502da77007a4

  • \Users\Admin\AppData\Local\Temp\IXP002.TMP\239426835.exe

    Filesize

    353KB

    MD5

    ccd062ab23586df59d24e355985014cb

    SHA1

    acd43763c57c23cc50c45cc06e214bd0c5f95388

    SHA256

    2f86ec37281d45fe3248d6b3195143fa727916355534aad60b81a0145fc66b99

    SHA512

    9b9799c7fd853c86377510003a81b8438ab809d78cdcaa55adf18249360542eca169994f1d5830bc67705ab443e7cc67e7ec9c1bb39cd973e52bb3b4291ed5ac

  • \Users\Admin\AppData\Local\Temp\IXP002.TMP\239426835.exe

    Filesize

    353KB

    MD5

    ccd062ab23586df59d24e355985014cb

    SHA1

    acd43763c57c23cc50c45cc06e214bd0c5f95388

    SHA256

    2f86ec37281d45fe3248d6b3195143fa727916355534aad60b81a0145fc66b99

    SHA512

    9b9799c7fd853c86377510003a81b8438ab809d78cdcaa55adf18249360542eca169994f1d5830bc67705ab443e7cc67e7ec9c1bb39cd973e52bb3b4291ed5ac

  • \Users\Admin\AppData\Local\Temp\IXP002.TMP\239426835.exe

    Filesize

    353KB

    MD5

    ccd062ab23586df59d24e355985014cb

    SHA1

    acd43763c57c23cc50c45cc06e214bd0c5f95388

    SHA256

    2f86ec37281d45fe3248d6b3195143fa727916355534aad60b81a0145fc66b99

    SHA512

    9b9799c7fd853c86377510003a81b8438ab809d78cdcaa55adf18249360542eca169994f1d5830bc67705ab443e7cc67e7ec9c1bb39cd973e52bb3b4291ed5ac

  • memory/672-124-0x0000000000400000-0x0000000002B9E000-memory.dmp

    Filesize

    39.6MB

  • memory/672-91-0x0000000000240000-0x000000000026D000-memory.dmp

    Filesize

    180KB

  • memory/672-100-0x0000000002D30000-0x0000000002D42000-memory.dmp

    Filesize

    72KB

  • memory/672-98-0x0000000002D30000-0x0000000002D42000-memory.dmp

    Filesize

    72KB

  • memory/672-102-0x0000000002D30000-0x0000000002D42000-memory.dmp

    Filesize

    72KB

  • memory/672-96-0x0000000002D30000-0x0000000002D42000-memory.dmp

    Filesize

    72KB

  • memory/672-104-0x0000000002D30000-0x0000000002D42000-memory.dmp

    Filesize

    72KB

  • memory/672-106-0x0000000002D30000-0x0000000002D42000-memory.dmp

    Filesize

    72KB

  • memory/672-108-0x0000000002D30000-0x0000000002D42000-memory.dmp

    Filesize

    72KB

  • memory/672-110-0x0000000002D30000-0x0000000002D42000-memory.dmp

    Filesize

    72KB

  • memory/672-112-0x0000000002D30000-0x0000000002D42000-memory.dmp

    Filesize

    72KB

  • memory/672-114-0x0000000002D30000-0x0000000002D42000-memory.dmp

    Filesize

    72KB

  • memory/672-116-0x0000000002D30000-0x0000000002D42000-memory.dmp

    Filesize

    72KB

  • memory/672-120-0x0000000002D30000-0x0000000002D42000-memory.dmp

    Filesize

    72KB

  • memory/672-118-0x0000000002D30000-0x0000000002D42000-memory.dmp

    Filesize

    72KB

  • memory/672-122-0x0000000002D30000-0x0000000002D42000-memory.dmp

    Filesize

    72KB

  • memory/672-95-0x0000000002D30000-0x0000000002D42000-memory.dmp

    Filesize

    72KB

  • memory/672-90-0x0000000000360000-0x000000000037A000-memory.dmp

    Filesize

    104KB

  • memory/672-125-0x0000000000400000-0x0000000002B9E000-memory.dmp

    Filesize

    39.6MB

  • memory/672-94-0x0000000002D30000-0x0000000002D48000-memory.dmp

    Filesize

    96KB

  • memory/672-93-0x0000000004990000-0x00000000049D0000-memory.dmp

    Filesize

    256KB

  • memory/672-92-0x0000000004990000-0x00000000049D0000-memory.dmp

    Filesize

    256KB

  • memory/1944-138-0x0000000006FE0000-0x000000000701A000-memory.dmp

    Filesize

    232KB

  • memory/1944-160-0x0000000006FE0000-0x0000000007015000-memory.dmp

    Filesize

    212KB

  • memory/1944-943-0x0000000007050000-0x0000000007090000-memory.dmp

    Filesize

    256KB

  • memory/1944-137-0x00000000049D0000-0x0000000004A0C000-memory.dmp

    Filesize

    240KB

  • memory/1944-941-0x0000000007050000-0x0000000007090000-memory.dmp

    Filesize

    256KB

  • memory/1944-142-0x0000000006FE0000-0x0000000007015000-memory.dmp

    Filesize

    212KB

  • memory/1944-144-0x0000000006FE0000-0x0000000007015000-memory.dmp

    Filesize

    212KB

  • memory/1944-148-0x0000000006FE0000-0x0000000007015000-memory.dmp

    Filesize

    212KB

  • memory/1944-154-0x0000000006FE0000-0x0000000007015000-memory.dmp

    Filesize

    212KB

  • memory/1944-156-0x0000000006FE0000-0x0000000007015000-memory.dmp

    Filesize

    212KB

  • memory/1944-158-0x0000000006FE0000-0x0000000007015000-memory.dmp

    Filesize

    212KB

  • memory/1944-162-0x0000000006FE0000-0x0000000007015000-memory.dmp

    Filesize

    212KB

  • memory/1944-164-0x0000000006FE0000-0x0000000007015000-memory.dmp

    Filesize

    212KB

  • memory/1944-166-0x0000000006FE0000-0x0000000007015000-memory.dmp

    Filesize

    212KB

  • memory/1944-168-0x0000000006FE0000-0x0000000007015000-memory.dmp

    Filesize

    212KB

  • memory/1944-940-0x0000000007050000-0x0000000007090000-memory.dmp

    Filesize

    256KB

  • memory/1944-152-0x0000000006FE0000-0x0000000007015000-memory.dmp

    Filesize

    212KB

  • memory/1944-150-0x0000000006FE0000-0x0000000007015000-memory.dmp

    Filesize

    212KB

  • memory/1944-146-0x0000000006FE0000-0x0000000007015000-memory.dmp

    Filesize

    212KB

  • memory/1944-140-0x0000000006FE0000-0x0000000007015000-memory.dmp

    Filesize

    212KB

  • memory/1944-139-0x0000000006FE0000-0x0000000007015000-memory.dmp

    Filesize

    212KB

  • memory/1944-236-0x0000000007050000-0x0000000007090000-memory.dmp

    Filesize

    256KB

  • memory/1944-238-0x0000000007050000-0x0000000007090000-memory.dmp

    Filesize

    256KB

  • memory/1944-234-0x0000000000360000-0x00000000003A6000-memory.dmp

    Filesize

    280KB

  • memory/1944-240-0x0000000007050000-0x0000000007090000-memory.dmp

    Filesize

    256KB

  • memory/1944-935-0x0000000007050000-0x0000000007090000-memory.dmp

    Filesize

    256KB

  • memory/1944-939-0x0000000007050000-0x0000000007090000-memory.dmp

    Filesize

    256KB

  • memory/1980-54-0x0000000002C70000-0x0000000002D52000-memory.dmp

    Filesize

    904KB

  • memory/1980-123-0x0000000000400000-0x0000000002C62000-memory.dmp

    Filesize

    40.4MB

  • memory/1980-86-0x00000000044B0000-0x000000000459B000-memory.dmp

    Filesize

    940KB