Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
33s -
platform
windows7_x64 -
resource
win7-20230220-en -
resource tags
arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system -
submitted
06/05/2023, 20:52
Static task
static1
Behavioral task
behavioral1
Sample
1f271567be6e1d3ef6edb068a3afb6f3de43076b906d28cb9466e55e400ab54f.exe
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
1f271567be6e1d3ef6edb068a3afb6f3de43076b906d28cb9466e55e400ab54f.exe
Resource
win10v2004-20230220-en
General
-
Target
1f271567be6e1d3ef6edb068a3afb6f3de43076b906d28cb9466e55e400ab54f.exe
-
Size
685KB
-
MD5
a535488d1208eb430fef9fa3ccf1f6e8
-
SHA1
ee7607dd58e4655c4a33eb1b1cf3eb31fd7a2fdf
-
SHA256
1f271567be6e1d3ef6edb068a3afb6f3de43076b906d28cb9466e55e400ab54f
-
SHA512
b6161d268bd6038dd2791b8c573dd2620e35ba42e6f0969e4e9c3266d648a3f1cfd73907691e4d1cc2c9798779bfe705ea998505573d4531d2d0caf315b6cbe0
-
SSDEEP
12288:py902dT4IOxGBG+RVVlMFWyCSKVx5mKZbkNDWYmXZ5Sy8r/3A6Hyd7h:pybdEIOQdMoSy3mLWrXPSbwmWh
Malware Config
Signatures
-
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" 42094843.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" 42094843.exe Key created \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection 42094843.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" 42094843.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" 42094843.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" 42094843.exe -
Executes dropped EXE 3 IoCs
pid Process 1984 un880540.exe 568 42094843.exe 324 rk731241.exe -
Loads dropped DLL 8 IoCs
pid Process 1988 1f271567be6e1d3ef6edb068a3afb6f3de43076b906d28cb9466e55e400ab54f.exe 1984 un880540.exe 1984 un880540.exe 1984 un880540.exe 568 42094843.exe 1984 un880540.exe 1984 un880540.exe 324 rk731241.exe -
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Features 42094843.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0" 42094843.exe -
Adds Run key to start application 2 TTPs 4 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" 1f271567be6e1d3ef6edb068a3afb6f3de43076b906d28cb9466e55e400ab54f.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce un880540.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" un880540.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce 1f271567be6e1d3ef6edb068a3afb6f3de43076b906d28cb9466e55e400ab54f.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 568 42094843.exe 568 42094843.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 568 42094843.exe Token: SeDebugPrivilege 324 rk731241.exe -
Suspicious use of WriteProcessMemory 21 IoCs
description pid Process procid_target PID 1988 wrote to memory of 1984 1988 1f271567be6e1d3ef6edb068a3afb6f3de43076b906d28cb9466e55e400ab54f.exe 27 PID 1988 wrote to memory of 1984 1988 1f271567be6e1d3ef6edb068a3afb6f3de43076b906d28cb9466e55e400ab54f.exe 27 PID 1988 wrote to memory of 1984 1988 1f271567be6e1d3ef6edb068a3afb6f3de43076b906d28cb9466e55e400ab54f.exe 27 PID 1988 wrote to memory of 1984 1988 1f271567be6e1d3ef6edb068a3afb6f3de43076b906d28cb9466e55e400ab54f.exe 27 PID 1988 wrote to memory of 1984 1988 1f271567be6e1d3ef6edb068a3afb6f3de43076b906d28cb9466e55e400ab54f.exe 27 PID 1988 wrote to memory of 1984 1988 1f271567be6e1d3ef6edb068a3afb6f3de43076b906d28cb9466e55e400ab54f.exe 27 PID 1988 wrote to memory of 1984 1988 1f271567be6e1d3ef6edb068a3afb6f3de43076b906d28cb9466e55e400ab54f.exe 27 PID 1984 wrote to memory of 568 1984 un880540.exe 28 PID 1984 wrote to memory of 568 1984 un880540.exe 28 PID 1984 wrote to memory of 568 1984 un880540.exe 28 PID 1984 wrote to memory of 568 1984 un880540.exe 28 PID 1984 wrote to memory of 568 1984 un880540.exe 28 PID 1984 wrote to memory of 568 1984 un880540.exe 28 PID 1984 wrote to memory of 568 1984 un880540.exe 28 PID 1984 wrote to memory of 324 1984 un880540.exe 29 PID 1984 wrote to memory of 324 1984 un880540.exe 29 PID 1984 wrote to memory of 324 1984 un880540.exe 29 PID 1984 wrote to memory of 324 1984 un880540.exe 29 PID 1984 wrote to memory of 324 1984 un880540.exe 29 PID 1984 wrote to memory of 324 1984 un880540.exe 29 PID 1984 wrote to memory of 324 1984 un880540.exe 29
Processes
-
C:\Users\Admin\AppData\Local\Temp\1f271567be6e1d3ef6edb068a3afb6f3de43076b906d28cb9466e55e400ab54f.exe"C:\Users\Admin\AppData\Local\Temp\1f271567be6e1d3ef6edb068a3afb6f3de43076b906d28cb9466e55e400ab54f.exe"1⤵
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:1988 -
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un880540.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un880540.exe2⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:1984 -
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\42094843.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\42094843.exe3⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Loads dropped DLL
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:568
-
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\rk731241.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\rk731241.exe3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
PID:324
-
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
531KB
MD5dd47cee50a17e1022ee2398f113a6c22
SHA1a4a5824780f2477257dc68b0dc5d43b1c148ca32
SHA256b0632fed1accbb14070c0191fbbbcc36b0f981f61e403d5c38e9a6f8357c9dd9
SHA51280be477a45cea718c99f16105a6d191bde25d56d03b50ba8887c7402b76298710fd696f46df6d0b66ca3c47ca991e74841b91712b8418ec492c5560275bef219
-
Filesize
531KB
MD5dd47cee50a17e1022ee2398f113a6c22
SHA1a4a5824780f2477257dc68b0dc5d43b1c148ca32
SHA256b0632fed1accbb14070c0191fbbbcc36b0f981f61e403d5c38e9a6f8357c9dd9
SHA51280be477a45cea718c99f16105a6d191bde25d56d03b50ba8887c7402b76298710fd696f46df6d0b66ca3c47ca991e74841b91712b8418ec492c5560275bef219
-
Filesize
249KB
MD568cf4b598154c0f8202208bfc69c983a
SHA17eb1b010ee6aabbc3f5c367e4844d29a9dad4c14
SHA256f9f2d7be6fdff3a2989ec9a86e5ea0cb1d23afb298a4b14cd56d5ec94685f347
SHA512b53da746cd4fecb856116c37869274d6c43993e34f218ec28b45b094f87017717925bc4f09bbadbf05d0c40a2918798a82b35ea255edfd71b671cfc579f83c30
-
Filesize
249KB
MD568cf4b598154c0f8202208bfc69c983a
SHA17eb1b010ee6aabbc3f5c367e4844d29a9dad4c14
SHA256f9f2d7be6fdff3a2989ec9a86e5ea0cb1d23afb298a4b14cd56d5ec94685f347
SHA512b53da746cd4fecb856116c37869274d6c43993e34f218ec28b45b094f87017717925bc4f09bbadbf05d0c40a2918798a82b35ea255edfd71b671cfc579f83c30
-
Filesize
249KB
MD568cf4b598154c0f8202208bfc69c983a
SHA17eb1b010ee6aabbc3f5c367e4844d29a9dad4c14
SHA256f9f2d7be6fdff3a2989ec9a86e5ea0cb1d23afb298a4b14cd56d5ec94685f347
SHA512b53da746cd4fecb856116c37869274d6c43993e34f218ec28b45b094f87017717925bc4f09bbadbf05d0c40a2918798a82b35ea255edfd71b671cfc579f83c30
-
Filesize
332KB
MD55b43d5c5f3670cbb7b9065cde42aa509
SHA131e574bfb5439d0f8f39407dda555b2c7e5c21e6
SHA25601b97fe861bb19bcf3680a56a04f3b382d87d4d032bafc5f5d4e1e1b26e51679
SHA512154a1880da5e3b667e30243ac0a4c73b35cbac526ab650140340119089194c187d7dd9133035c988599438db742c61ebc80cac4173d303fd5ec4b57ec14e4239
-
Filesize
332KB
MD55b43d5c5f3670cbb7b9065cde42aa509
SHA131e574bfb5439d0f8f39407dda555b2c7e5c21e6
SHA25601b97fe861bb19bcf3680a56a04f3b382d87d4d032bafc5f5d4e1e1b26e51679
SHA512154a1880da5e3b667e30243ac0a4c73b35cbac526ab650140340119089194c187d7dd9133035c988599438db742c61ebc80cac4173d303fd5ec4b57ec14e4239
-
Filesize
332KB
MD55b43d5c5f3670cbb7b9065cde42aa509
SHA131e574bfb5439d0f8f39407dda555b2c7e5c21e6
SHA25601b97fe861bb19bcf3680a56a04f3b382d87d4d032bafc5f5d4e1e1b26e51679
SHA512154a1880da5e3b667e30243ac0a4c73b35cbac526ab650140340119089194c187d7dd9133035c988599438db742c61ebc80cac4173d303fd5ec4b57ec14e4239
-
Filesize
531KB
MD5dd47cee50a17e1022ee2398f113a6c22
SHA1a4a5824780f2477257dc68b0dc5d43b1c148ca32
SHA256b0632fed1accbb14070c0191fbbbcc36b0f981f61e403d5c38e9a6f8357c9dd9
SHA51280be477a45cea718c99f16105a6d191bde25d56d03b50ba8887c7402b76298710fd696f46df6d0b66ca3c47ca991e74841b91712b8418ec492c5560275bef219
-
Filesize
531KB
MD5dd47cee50a17e1022ee2398f113a6c22
SHA1a4a5824780f2477257dc68b0dc5d43b1c148ca32
SHA256b0632fed1accbb14070c0191fbbbcc36b0f981f61e403d5c38e9a6f8357c9dd9
SHA51280be477a45cea718c99f16105a6d191bde25d56d03b50ba8887c7402b76298710fd696f46df6d0b66ca3c47ca991e74841b91712b8418ec492c5560275bef219
-
Filesize
249KB
MD568cf4b598154c0f8202208bfc69c983a
SHA17eb1b010ee6aabbc3f5c367e4844d29a9dad4c14
SHA256f9f2d7be6fdff3a2989ec9a86e5ea0cb1d23afb298a4b14cd56d5ec94685f347
SHA512b53da746cd4fecb856116c37869274d6c43993e34f218ec28b45b094f87017717925bc4f09bbadbf05d0c40a2918798a82b35ea255edfd71b671cfc579f83c30
-
Filesize
249KB
MD568cf4b598154c0f8202208bfc69c983a
SHA17eb1b010ee6aabbc3f5c367e4844d29a9dad4c14
SHA256f9f2d7be6fdff3a2989ec9a86e5ea0cb1d23afb298a4b14cd56d5ec94685f347
SHA512b53da746cd4fecb856116c37869274d6c43993e34f218ec28b45b094f87017717925bc4f09bbadbf05d0c40a2918798a82b35ea255edfd71b671cfc579f83c30
-
Filesize
249KB
MD568cf4b598154c0f8202208bfc69c983a
SHA17eb1b010ee6aabbc3f5c367e4844d29a9dad4c14
SHA256f9f2d7be6fdff3a2989ec9a86e5ea0cb1d23afb298a4b14cd56d5ec94685f347
SHA512b53da746cd4fecb856116c37869274d6c43993e34f218ec28b45b094f87017717925bc4f09bbadbf05d0c40a2918798a82b35ea255edfd71b671cfc579f83c30
-
Filesize
332KB
MD55b43d5c5f3670cbb7b9065cde42aa509
SHA131e574bfb5439d0f8f39407dda555b2c7e5c21e6
SHA25601b97fe861bb19bcf3680a56a04f3b382d87d4d032bafc5f5d4e1e1b26e51679
SHA512154a1880da5e3b667e30243ac0a4c73b35cbac526ab650140340119089194c187d7dd9133035c988599438db742c61ebc80cac4173d303fd5ec4b57ec14e4239
-
Filesize
332KB
MD55b43d5c5f3670cbb7b9065cde42aa509
SHA131e574bfb5439d0f8f39407dda555b2c7e5c21e6
SHA25601b97fe861bb19bcf3680a56a04f3b382d87d4d032bafc5f5d4e1e1b26e51679
SHA512154a1880da5e3b667e30243ac0a4c73b35cbac526ab650140340119089194c187d7dd9133035c988599438db742c61ebc80cac4173d303fd5ec4b57ec14e4239
-
Filesize
332KB
MD55b43d5c5f3670cbb7b9065cde42aa509
SHA131e574bfb5439d0f8f39407dda555b2c7e5c21e6
SHA25601b97fe861bb19bcf3680a56a04f3b382d87d4d032bafc5f5d4e1e1b26e51679
SHA512154a1880da5e3b667e30243ac0a4c73b35cbac526ab650140340119089194c187d7dd9133035c988599438db742c61ebc80cac4173d303fd5ec4b57ec14e4239