Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
206s -
max time network
273s -
platform
windows7_x64 -
resource
win7-20230220-en -
resource tags
arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system -
submitted
06/05/2023, 20:48
Static task
static1
Behavioral task
behavioral1
Sample
1d312a5a743e74e425028084142feef99737b3d83ca1c7488f67edc890f552ba.exe
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
1d312a5a743e74e425028084142feef99737b3d83ca1c7488f67edc890f552ba.exe
Resource
win10v2004-20230220-en
General
-
Target
1d312a5a743e74e425028084142feef99737b3d83ca1c7488f67edc890f552ba.exe
-
Size
1.0MB
-
MD5
8af80e434b001f0295f92b79077d0c15
-
SHA1
58756ad97c7b63259403f4372cfa7fd84a61addf
-
SHA256
1d312a5a743e74e425028084142feef99737b3d83ca1c7488f67edc890f552ba
-
SHA512
a64b0f8fd178f91e697a684704d8787b4ee667d58c2c265d374f731d06e368a995fcf1c93e6debf23a262ba5b77108e1c30e3498f2ca70beabcb201e75c0ec3e
-
SSDEEP
24576:3CAYkSvuevX2o0Kjm4BNQyv39+v19w6NpkH+RQ0R4owkPiyFG7HEK:PStvX2ozjm4HFv3M0ckH+RocjFG
Malware Config
Signatures
-
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" 162451254.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" 162451254.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" 162451254.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" 162451254.exe Key created \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection 162451254.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" 162451254.exe -
Executes dropped EXE 4 IoCs
pid Process 768 lF272076.exe 1320 qD163070.exe 1388 162451254.exe 1428 272189732.exe -
Loads dropped DLL 10 IoCs
pid Process 916 1d312a5a743e74e425028084142feef99737b3d83ca1c7488f67edc890f552ba.exe 768 lF272076.exe 768 lF272076.exe 1320 qD163070.exe 1320 qD163070.exe 1320 qD163070.exe 1388 162451254.exe 1320 qD163070.exe 1320 qD163070.exe 1428 272189732.exe -
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Features 162451254.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0" 162451254.exe -
Adds Run key to start application 2 TTPs 6 IoCs
description ioc Process Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce qD163070.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\"" qD163070.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce 1d312a5a743e74e425028084142feef99737b3d83ca1c7488f67edc890f552ba.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" 1d312a5a743e74e425028084142feef99737b3d83ca1c7488f67edc890f552ba.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce lF272076.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" lF272076.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 1388 162451254.exe 1388 162451254.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 1388 162451254.exe Token: SeDebugPrivilege 1428 272189732.exe -
Suspicious use of WriteProcessMemory 28 IoCs
description pid Process procid_target PID 916 wrote to memory of 768 916 1d312a5a743e74e425028084142feef99737b3d83ca1c7488f67edc890f552ba.exe 28 PID 916 wrote to memory of 768 916 1d312a5a743e74e425028084142feef99737b3d83ca1c7488f67edc890f552ba.exe 28 PID 916 wrote to memory of 768 916 1d312a5a743e74e425028084142feef99737b3d83ca1c7488f67edc890f552ba.exe 28 PID 916 wrote to memory of 768 916 1d312a5a743e74e425028084142feef99737b3d83ca1c7488f67edc890f552ba.exe 28 PID 916 wrote to memory of 768 916 1d312a5a743e74e425028084142feef99737b3d83ca1c7488f67edc890f552ba.exe 28 PID 916 wrote to memory of 768 916 1d312a5a743e74e425028084142feef99737b3d83ca1c7488f67edc890f552ba.exe 28 PID 916 wrote to memory of 768 916 1d312a5a743e74e425028084142feef99737b3d83ca1c7488f67edc890f552ba.exe 28 PID 768 wrote to memory of 1320 768 lF272076.exe 29 PID 768 wrote to memory of 1320 768 lF272076.exe 29 PID 768 wrote to memory of 1320 768 lF272076.exe 29 PID 768 wrote to memory of 1320 768 lF272076.exe 29 PID 768 wrote to memory of 1320 768 lF272076.exe 29 PID 768 wrote to memory of 1320 768 lF272076.exe 29 PID 768 wrote to memory of 1320 768 lF272076.exe 29 PID 1320 wrote to memory of 1388 1320 qD163070.exe 30 PID 1320 wrote to memory of 1388 1320 qD163070.exe 30 PID 1320 wrote to memory of 1388 1320 qD163070.exe 30 PID 1320 wrote to memory of 1388 1320 qD163070.exe 30 PID 1320 wrote to memory of 1388 1320 qD163070.exe 30 PID 1320 wrote to memory of 1388 1320 qD163070.exe 30 PID 1320 wrote to memory of 1388 1320 qD163070.exe 30 PID 1320 wrote to memory of 1428 1320 qD163070.exe 31 PID 1320 wrote to memory of 1428 1320 qD163070.exe 31 PID 1320 wrote to memory of 1428 1320 qD163070.exe 31 PID 1320 wrote to memory of 1428 1320 qD163070.exe 31 PID 1320 wrote to memory of 1428 1320 qD163070.exe 31 PID 1320 wrote to memory of 1428 1320 qD163070.exe 31 PID 1320 wrote to memory of 1428 1320 qD163070.exe 31
Processes
-
C:\Users\Admin\AppData\Local\Temp\1d312a5a743e74e425028084142feef99737b3d83ca1c7488f67edc890f552ba.exe"C:\Users\Admin\AppData\Local\Temp\1d312a5a743e74e425028084142feef99737b3d83ca1c7488f67edc890f552ba.exe"1⤵
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:916 -
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\lF272076.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\lF272076.exe2⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:768 -
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qD163070.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qD163070.exe3⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:1320 -
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\162451254.exeC:\Users\Admin\AppData\Local\Temp\IXP002.TMP\162451254.exe4⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Loads dropped DLL
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1388
-
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\272189732.exeC:\Users\Admin\AppData\Local\Temp\IXP002.TMP\272189732.exe4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
PID:1428
-
-
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
719KB
MD514f4eaa7ae2edf596ab5aa6259317026
SHA13cf20c0c6026b0ac23b17b49542a7c00f669ad82
SHA256a502e76ab90fa397c80d0700c83ace1a300521b818c22d535ea0b115eadb63d8
SHA512be6ec5e96f48f846369dff64261ef43420061b5a8d1d5969ba60ceaca8c1e72c664752d77d88b67cad935cd02a1cfe187eb2fd5cd5dd995e9d7f3eb0fc9ac6f9
-
Filesize
719KB
MD514f4eaa7ae2edf596ab5aa6259317026
SHA13cf20c0c6026b0ac23b17b49542a7c00f669ad82
SHA256a502e76ab90fa397c80d0700c83ace1a300521b818c22d535ea0b115eadb63d8
SHA512be6ec5e96f48f846369dff64261ef43420061b5a8d1d5969ba60ceaca8c1e72c664752d77d88b67cad935cd02a1cfe187eb2fd5cd5dd995e9d7f3eb0fc9ac6f9
-
Filesize
547KB
MD5f1f14512c243c673ed9d12b01b231c97
SHA19f459709c22bb68c003e059fa7c0748b36532f98
SHA2569c2f308f4028ef90be0915e36b65aa516e610d536121048c598c833ee8dd7566
SHA512d3440fe5279eae3cbfb8af837ea6f8917e630ac96ee0de66972f1a9ee54cd7e1fdb700cb5da10471ab762da16426a1deaccc38a9261989ff96485f828e01d300
-
Filesize
547KB
MD5f1f14512c243c673ed9d12b01b231c97
SHA19f459709c22bb68c003e059fa7c0748b36532f98
SHA2569c2f308f4028ef90be0915e36b65aa516e610d536121048c598c833ee8dd7566
SHA512d3440fe5279eae3cbfb8af837ea6f8917e630ac96ee0de66972f1a9ee54cd7e1fdb700cb5da10471ab762da16426a1deaccc38a9261989ff96485f828e01d300
-
Filesize
269KB
MD5d8a23874a3620e74d09c39cfe54b852b
SHA148fc01f5c560a7863e9c4aef279a30ddb63f0378
SHA256313d8545a08d26b195af8d1ef8227f35d84f2c6b868af382ec091e9c25ffba50
SHA512d40f7e1512ed8d3e7125a69c6bce16675d14f965a0f4a4ad9d546c6110fc3026b377d346732d32e34850593ca728aa3528254430cd1a22d558248afb48027b6b
-
Filesize
269KB
MD5d8a23874a3620e74d09c39cfe54b852b
SHA148fc01f5c560a7863e9c4aef279a30ddb63f0378
SHA256313d8545a08d26b195af8d1ef8227f35d84f2c6b868af382ec091e9c25ffba50
SHA512d40f7e1512ed8d3e7125a69c6bce16675d14f965a0f4a4ad9d546c6110fc3026b377d346732d32e34850593ca728aa3528254430cd1a22d558248afb48027b6b
-
Filesize
269KB
MD5d8a23874a3620e74d09c39cfe54b852b
SHA148fc01f5c560a7863e9c4aef279a30ddb63f0378
SHA256313d8545a08d26b195af8d1ef8227f35d84f2c6b868af382ec091e9c25ffba50
SHA512d40f7e1512ed8d3e7125a69c6bce16675d14f965a0f4a4ad9d546c6110fc3026b377d346732d32e34850593ca728aa3528254430cd1a22d558248afb48027b6b
-
Filesize
353KB
MD573cb8f16cb86208e26b37812bb3a91e8
SHA1acc61d785ca8f3aeaa557414cce48abafe8f6969
SHA25678238405fadaa7fdf788eb336ae4d5592a516442967b2563e5fb7a18131f312c
SHA5129a06bb7570cc84d0e7d1fb6f2570fa171bb2b20da61003d8630057ccf10a0dfe7486beeb3bc89107e5e1ba5acda02fbc0a1a52a060f46a4f3c49f9e1e2b00945
-
Filesize
353KB
MD573cb8f16cb86208e26b37812bb3a91e8
SHA1acc61d785ca8f3aeaa557414cce48abafe8f6969
SHA25678238405fadaa7fdf788eb336ae4d5592a516442967b2563e5fb7a18131f312c
SHA5129a06bb7570cc84d0e7d1fb6f2570fa171bb2b20da61003d8630057ccf10a0dfe7486beeb3bc89107e5e1ba5acda02fbc0a1a52a060f46a4f3c49f9e1e2b00945
-
Filesize
353KB
MD573cb8f16cb86208e26b37812bb3a91e8
SHA1acc61d785ca8f3aeaa557414cce48abafe8f6969
SHA25678238405fadaa7fdf788eb336ae4d5592a516442967b2563e5fb7a18131f312c
SHA5129a06bb7570cc84d0e7d1fb6f2570fa171bb2b20da61003d8630057ccf10a0dfe7486beeb3bc89107e5e1ba5acda02fbc0a1a52a060f46a4f3c49f9e1e2b00945
-
Filesize
719KB
MD514f4eaa7ae2edf596ab5aa6259317026
SHA13cf20c0c6026b0ac23b17b49542a7c00f669ad82
SHA256a502e76ab90fa397c80d0700c83ace1a300521b818c22d535ea0b115eadb63d8
SHA512be6ec5e96f48f846369dff64261ef43420061b5a8d1d5969ba60ceaca8c1e72c664752d77d88b67cad935cd02a1cfe187eb2fd5cd5dd995e9d7f3eb0fc9ac6f9
-
Filesize
719KB
MD514f4eaa7ae2edf596ab5aa6259317026
SHA13cf20c0c6026b0ac23b17b49542a7c00f669ad82
SHA256a502e76ab90fa397c80d0700c83ace1a300521b818c22d535ea0b115eadb63d8
SHA512be6ec5e96f48f846369dff64261ef43420061b5a8d1d5969ba60ceaca8c1e72c664752d77d88b67cad935cd02a1cfe187eb2fd5cd5dd995e9d7f3eb0fc9ac6f9
-
Filesize
547KB
MD5f1f14512c243c673ed9d12b01b231c97
SHA19f459709c22bb68c003e059fa7c0748b36532f98
SHA2569c2f308f4028ef90be0915e36b65aa516e610d536121048c598c833ee8dd7566
SHA512d3440fe5279eae3cbfb8af837ea6f8917e630ac96ee0de66972f1a9ee54cd7e1fdb700cb5da10471ab762da16426a1deaccc38a9261989ff96485f828e01d300
-
Filesize
547KB
MD5f1f14512c243c673ed9d12b01b231c97
SHA19f459709c22bb68c003e059fa7c0748b36532f98
SHA2569c2f308f4028ef90be0915e36b65aa516e610d536121048c598c833ee8dd7566
SHA512d3440fe5279eae3cbfb8af837ea6f8917e630ac96ee0de66972f1a9ee54cd7e1fdb700cb5da10471ab762da16426a1deaccc38a9261989ff96485f828e01d300
-
Filesize
269KB
MD5d8a23874a3620e74d09c39cfe54b852b
SHA148fc01f5c560a7863e9c4aef279a30ddb63f0378
SHA256313d8545a08d26b195af8d1ef8227f35d84f2c6b868af382ec091e9c25ffba50
SHA512d40f7e1512ed8d3e7125a69c6bce16675d14f965a0f4a4ad9d546c6110fc3026b377d346732d32e34850593ca728aa3528254430cd1a22d558248afb48027b6b
-
Filesize
269KB
MD5d8a23874a3620e74d09c39cfe54b852b
SHA148fc01f5c560a7863e9c4aef279a30ddb63f0378
SHA256313d8545a08d26b195af8d1ef8227f35d84f2c6b868af382ec091e9c25ffba50
SHA512d40f7e1512ed8d3e7125a69c6bce16675d14f965a0f4a4ad9d546c6110fc3026b377d346732d32e34850593ca728aa3528254430cd1a22d558248afb48027b6b
-
Filesize
269KB
MD5d8a23874a3620e74d09c39cfe54b852b
SHA148fc01f5c560a7863e9c4aef279a30ddb63f0378
SHA256313d8545a08d26b195af8d1ef8227f35d84f2c6b868af382ec091e9c25ffba50
SHA512d40f7e1512ed8d3e7125a69c6bce16675d14f965a0f4a4ad9d546c6110fc3026b377d346732d32e34850593ca728aa3528254430cd1a22d558248afb48027b6b
-
Filesize
353KB
MD573cb8f16cb86208e26b37812bb3a91e8
SHA1acc61d785ca8f3aeaa557414cce48abafe8f6969
SHA25678238405fadaa7fdf788eb336ae4d5592a516442967b2563e5fb7a18131f312c
SHA5129a06bb7570cc84d0e7d1fb6f2570fa171bb2b20da61003d8630057ccf10a0dfe7486beeb3bc89107e5e1ba5acda02fbc0a1a52a060f46a4f3c49f9e1e2b00945
-
Filesize
353KB
MD573cb8f16cb86208e26b37812bb3a91e8
SHA1acc61d785ca8f3aeaa557414cce48abafe8f6969
SHA25678238405fadaa7fdf788eb336ae4d5592a516442967b2563e5fb7a18131f312c
SHA5129a06bb7570cc84d0e7d1fb6f2570fa171bb2b20da61003d8630057ccf10a0dfe7486beeb3bc89107e5e1ba5acda02fbc0a1a52a060f46a4f3c49f9e1e2b00945
-
Filesize
353KB
MD573cb8f16cb86208e26b37812bb3a91e8
SHA1acc61d785ca8f3aeaa557414cce48abafe8f6969
SHA25678238405fadaa7fdf788eb336ae4d5592a516442967b2563e5fb7a18131f312c
SHA5129a06bb7570cc84d0e7d1fb6f2570fa171bb2b20da61003d8630057ccf10a0dfe7486beeb3bc89107e5e1ba5acda02fbc0a1a52a060f46a4f3c49f9e1e2b00945