Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
173s -
platform
windows7_x64 -
resource
win7-20230220-en -
resource tags
arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system -
submitted
06/05/2023, 21:00
Static task
static1
Behavioral task
behavioral1
Sample
251a3e306621ec02865c2871a4e666531c49b9c6e16fac078a5fbe46eee08a4c.exe
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
251a3e306621ec02865c2871a4e666531c49b9c6e16fac078a5fbe46eee08a4c.exe
Resource
win10v2004-20230220-en
General
-
Target
251a3e306621ec02865c2871a4e666531c49b9c6e16fac078a5fbe46eee08a4c.exe
-
Size
1.2MB
-
MD5
58806eb7b40570803bfd19fe66ae01bf
-
SHA1
cf1b3c766ed2e82363c1c0ca73d1bbd361f9a131
-
SHA256
251a3e306621ec02865c2871a4e666531c49b9c6e16fac078a5fbe46eee08a4c
-
SHA512
4f98854223ebbbeefccc31b97b3c34268c2217977ecbf6a299937710c472bdef4cff7480226ac25f5063127bb2a06245ba993f3f7f3342013b33d5eeb96579f3
-
SSDEEP
24576:Fc9RstFRHwzmMZlFXCTYaOo2QduHmp8tagFhXskm:FcQrSmdcpOdp/gX
Malware Config
Signatures
-
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" 137239924.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" 137239924.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" 137239924.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" 137239924.exe Key created \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection 137239924.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" 137239924.exe -
Executes dropped EXE 4 IoCs
pid Process 1520 qv264349.exe 1208 gv434705.exe 368 137239924.exe 1660 217307972.exe -
Loads dropped DLL 10 IoCs
pid Process 2020 251a3e306621ec02865c2871a4e666531c49b9c6e16fac078a5fbe46eee08a4c.exe 1520 qv264349.exe 1520 qv264349.exe 1208 gv434705.exe 1208 gv434705.exe 1208 gv434705.exe 368 137239924.exe 1208 gv434705.exe 1208 gv434705.exe 1660 217307972.exe -
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Features 137239924.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0" 137239924.exe -
Adds Run key to start application 2 TTPs 6 IoCs
description ioc Process Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce 251a3e306621ec02865c2871a4e666531c49b9c6e16fac078a5fbe46eee08a4c.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" 251a3e306621ec02865c2871a4e666531c49b9c6e16fac078a5fbe46eee08a4c.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce qv264349.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" qv264349.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce gv434705.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\"" gv434705.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 368 137239924.exe 368 137239924.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 368 137239924.exe Token: SeDebugPrivilege 1660 217307972.exe -
Suspicious use of WriteProcessMemory 28 IoCs
description pid Process procid_target PID 2020 wrote to memory of 1520 2020 251a3e306621ec02865c2871a4e666531c49b9c6e16fac078a5fbe46eee08a4c.exe 27 PID 2020 wrote to memory of 1520 2020 251a3e306621ec02865c2871a4e666531c49b9c6e16fac078a5fbe46eee08a4c.exe 27 PID 2020 wrote to memory of 1520 2020 251a3e306621ec02865c2871a4e666531c49b9c6e16fac078a5fbe46eee08a4c.exe 27 PID 2020 wrote to memory of 1520 2020 251a3e306621ec02865c2871a4e666531c49b9c6e16fac078a5fbe46eee08a4c.exe 27 PID 2020 wrote to memory of 1520 2020 251a3e306621ec02865c2871a4e666531c49b9c6e16fac078a5fbe46eee08a4c.exe 27 PID 2020 wrote to memory of 1520 2020 251a3e306621ec02865c2871a4e666531c49b9c6e16fac078a5fbe46eee08a4c.exe 27 PID 2020 wrote to memory of 1520 2020 251a3e306621ec02865c2871a4e666531c49b9c6e16fac078a5fbe46eee08a4c.exe 27 PID 1520 wrote to memory of 1208 1520 qv264349.exe 28 PID 1520 wrote to memory of 1208 1520 qv264349.exe 28 PID 1520 wrote to memory of 1208 1520 qv264349.exe 28 PID 1520 wrote to memory of 1208 1520 qv264349.exe 28 PID 1520 wrote to memory of 1208 1520 qv264349.exe 28 PID 1520 wrote to memory of 1208 1520 qv264349.exe 28 PID 1520 wrote to memory of 1208 1520 qv264349.exe 28 PID 1208 wrote to memory of 368 1208 gv434705.exe 29 PID 1208 wrote to memory of 368 1208 gv434705.exe 29 PID 1208 wrote to memory of 368 1208 gv434705.exe 29 PID 1208 wrote to memory of 368 1208 gv434705.exe 29 PID 1208 wrote to memory of 368 1208 gv434705.exe 29 PID 1208 wrote to memory of 368 1208 gv434705.exe 29 PID 1208 wrote to memory of 368 1208 gv434705.exe 29 PID 1208 wrote to memory of 1660 1208 gv434705.exe 30 PID 1208 wrote to memory of 1660 1208 gv434705.exe 30 PID 1208 wrote to memory of 1660 1208 gv434705.exe 30 PID 1208 wrote to memory of 1660 1208 gv434705.exe 30 PID 1208 wrote to memory of 1660 1208 gv434705.exe 30 PID 1208 wrote to memory of 1660 1208 gv434705.exe 30 PID 1208 wrote to memory of 1660 1208 gv434705.exe 30
Processes
-
C:\Users\Admin\AppData\Local\Temp\251a3e306621ec02865c2871a4e666531c49b9c6e16fac078a5fbe46eee08a4c.exe"C:\Users\Admin\AppData\Local\Temp\251a3e306621ec02865c2871a4e666531c49b9c6e16fac078a5fbe46eee08a4c.exe"1⤵
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:2020 -
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\qv264349.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\qv264349.exe2⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:1520 -
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\gv434705.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\gv434705.exe3⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:1208 -
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\137239924.exeC:\Users\Admin\AppData\Local\Temp\IXP002.TMP\137239924.exe4⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Loads dropped DLL
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:368
-
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\217307972.exeC:\Users\Admin\AppData\Local\Temp\IXP002.TMP\217307972.exe4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
PID:1660
-
-
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
763KB
MD50e3a87f5fbde6985aa586bb53da140d8
SHA1f87d70a6bf68b017be78540cbceb35d9cf3267e8
SHA256d13043c44eca8a7eb2415dc218d87a5d9b561783ff92d215dfb248b38d20b423
SHA51252ec3ad56b9e3edb497ad4f2fd916162fbf35020b9c8931f31dff6e374ea505d42144a4ddb8e77214d2a562f3d15ea58bf091ca612826975cbcac72db1ae251c
-
Filesize
763KB
MD50e3a87f5fbde6985aa586bb53da140d8
SHA1f87d70a6bf68b017be78540cbceb35d9cf3267e8
SHA256d13043c44eca8a7eb2415dc218d87a5d9b561783ff92d215dfb248b38d20b423
SHA51252ec3ad56b9e3edb497ad4f2fd916162fbf35020b9c8931f31dff6e374ea505d42144a4ddb8e77214d2a562f3d15ea58bf091ca612826975cbcac72db1ae251c
-
Filesize
592KB
MD5dbf7b7943e0bbfbfe2ff3081429310c2
SHA14633b71d0234283b80e9cd8cf3ae8a638866b8d0
SHA25693394041a467699908ec68b26301930ab36f0bf0164bde2a1b195f6c9b919d2d
SHA512884eb3bd5c1cca47c47406ff2834129ee971b2480659450bb775b39cdf3a7ade843e2a359ab5b76bd7bd04877698c1fa58df484daa80a6433e0757d3ac4f803e
-
Filesize
592KB
MD5dbf7b7943e0bbfbfe2ff3081429310c2
SHA14633b71d0234283b80e9cd8cf3ae8a638866b8d0
SHA25693394041a467699908ec68b26301930ab36f0bf0164bde2a1b195f6c9b919d2d
SHA512884eb3bd5c1cca47c47406ff2834129ee971b2480659450bb775b39cdf3a7ade843e2a359ab5b76bd7bd04877698c1fa58df484daa80a6433e0757d3ac4f803e
-
Filesize
376KB
MD5808c6015ca73ae5171c3cb969a156c6b
SHA13ab3439a5c48623a248166eed4f20e73437b2e36
SHA256bb8e0f54593b23da5b272eb1734b6eec66f09d07b2699162f8e77b73094346fc
SHA512a1821b2168460260a28aeb0b881be02e264f4abbf8ef3800f3ac442da72667bfb3406b6941ceea92e86a50e764f0e882c3d767766ed88ac71c34809002ca6483
-
Filesize
376KB
MD5808c6015ca73ae5171c3cb969a156c6b
SHA13ab3439a5c48623a248166eed4f20e73437b2e36
SHA256bb8e0f54593b23da5b272eb1734b6eec66f09d07b2699162f8e77b73094346fc
SHA512a1821b2168460260a28aeb0b881be02e264f4abbf8ef3800f3ac442da72667bfb3406b6941ceea92e86a50e764f0e882c3d767766ed88ac71c34809002ca6483
-
Filesize
376KB
MD5808c6015ca73ae5171c3cb969a156c6b
SHA13ab3439a5c48623a248166eed4f20e73437b2e36
SHA256bb8e0f54593b23da5b272eb1734b6eec66f09d07b2699162f8e77b73094346fc
SHA512a1821b2168460260a28aeb0b881be02e264f4abbf8ef3800f3ac442da72667bfb3406b6941ceea92e86a50e764f0e882c3d767766ed88ac71c34809002ca6483
-
Filesize
459KB
MD528c9569fdfa17a87ada4d354430339f8
SHA1d14414d275ead078c603ff60c08ce452475d3c5a
SHA2563640ff98e63f79701d453338015bb2053e359016fb7e0d82b681b751adae04b1
SHA512354bf9c17a39487f5d3125eb7aff5735f9fe7eb5a926d78f21ce5d0f7ee532da15b0b231151b772a2b6f79707e3eb21f77968a98ce59c31179ea62dac82d1610
-
Filesize
459KB
MD528c9569fdfa17a87ada4d354430339f8
SHA1d14414d275ead078c603ff60c08ce452475d3c5a
SHA2563640ff98e63f79701d453338015bb2053e359016fb7e0d82b681b751adae04b1
SHA512354bf9c17a39487f5d3125eb7aff5735f9fe7eb5a926d78f21ce5d0f7ee532da15b0b231151b772a2b6f79707e3eb21f77968a98ce59c31179ea62dac82d1610
-
Filesize
459KB
MD528c9569fdfa17a87ada4d354430339f8
SHA1d14414d275ead078c603ff60c08ce452475d3c5a
SHA2563640ff98e63f79701d453338015bb2053e359016fb7e0d82b681b751adae04b1
SHA512354bf9c17a39487f5d3125eb7aff5735f9fe7eb5a926d78f21ce5d0f7ee532da15b0b231151b772a2b6f79707e3eb21f77968a98ce59c31179ea62dac82d1610
-
Filesize
763KB
MD50e3a87f5fbde6985aa586bb53da140d8
SHA1f87d70a6bf68b017be78540cbceb35d9cf3267e8
SHA256d13043c44eca8a7eb2415dc218d87a5d9b561783ff92d215dfb248b38d20b423
SHA51252ec3ad56b9e3edb497ad4f2fd916162fbf35020b9c8931f31dff6e374ea505d42144a4ddb8e77214d2a562f3d15ea58bf091ca612826975cbcac72db1ae251c
-
Filesize
763KB
MD50e3a87f5fbde6985aa586bb53da140d8
SHA1f87d70a6bf68b017be78540cbceb35d9cf3267e8
SHA256d13043c44eca8a7eb2415dc218d87a5d9b561783ff92d215dfb248b38d20b423
SHA51252ec3ad56b9e3edb497ad4f2fd916162fbf35020b9c8931f31dff6e374ea505d42144a4ddb8e77214d2a562f3d15ea58bf091ca612826975cbcac72db1ae251c
-
Filesize
592KB
MD5dbf7b7943e0bbfbfe2ff3081429310c2
SHA14633b71d0234283b80e9cd8cf3ae8a638866b8d0
SHA25693394041a467699908ec68b26301930ab36f0bf0164bde2a1b195f6c9b919d2d
SHA512884eb3bd5c1cca47c47406ff2834129ee971b2480659450bb775b39cdf3a7ade843e2a359ab5b76bd7bd04877698c1fa58df484daa80a6433e0757d3ac4f803e
-
Filesize
592KB
MD5dbf7b7943e0bbfbfe2ff3081429310c2
SHA14633b71d0234283b80e9cd8cf3ae8a638866b8d0
SHA25693394041a467699908ec68b26301930ab36f0bf0164bde2a1b195f6c9b919d2d
SHA512884eb3bd5c1cca47c47406ff2834129ee971b2480659450bb775b39cdf3a7ade843e2a359ab5b76bd7bd04877698c1fa58df484daa80a6433e0757d3ac4f803e
-
Filesize
376KB
MD5808c6015ca73ae5171c3cb969a156c6b
SHA13ab3439a5c48623a248166eed4f20e73437b2e36
SHA256bb8e0f54593b23da5b272eb1734b6eec66f09d07b2699162f8e77b73094346fc
SHA512a1821b2168460260a28aeb0b881be02e264f4abbf8ef3800f3ac442da72667bfb3406b6941ceea92e86a50e764f0e882c3d767766ed88ac71c34809002ca6483
-
Filesize
376KB
MD5808c6015ca73ae5171c3cb969a156c6b
SHA13ab3439a5c48623a248166eed4f20e73437b2e36
SHA256bb8e0f54593b23da5b272eb1734b6eec66f09d07b2699162f8e77b73094346fc
SHA512a1821b2168460260a28aeb0b881be02e264f4abbf8ef3800f3ac442da72667bfb3406b6941ceea92e86a50e764f0e882c3d767766ed88ac71c34809002ca6483
-
Filesize
376KB
MD5808c6015ca73ae5171c3cb969a156c6b
SHA13ab3439a5c48623a248166eed4f20e73437b2e36
SHA256bb8e0f54593b23da5b272eb1734b6eec66f09d07b2699162f8e77b73094346fc
SHA512a1821b2168460260a28aeb0b881be02e264f4abbf8ef3800f3ac442da72667bfb3406b6941ceea92e86a50e764f0e882c3d767766ed88ac71c34809002ca6483
-
Filesize
459KB
MD528c9569fdfa17a87ada4d354430339f8
SHA1d14414d275ead078c603ff60c08ce452475d3c5a
SHA2563640ff98e63f79701d453338015bb2053e359016fb7e0d82b681b751adae04b1
SHA512354bf9c17a39487f5d3125eb7aff5735f9fe7eb5a926d78f21ce5d0f7ee532da15b0b231151b772a2b6f79707e3eb21f77968a98ce59c31179ea62dac82d1610
-
Filesize
459KB
MD528c9569fdfa17a87ada4d354430339f8
SHA1d14414d275ead078c603ff60c08ce452475d3c5a
SHA2563640ff98e63f79701d453338015bb2053e359016fb7e0d82b681b751adae04b1
SHA512354bf9c17a39487f5d3125eb7aff5735f9fe7eb5a926d78f21ce5d0f7ee532da15b0b231151b772a2b6f79707e3eb21f77968a98ce59c31179ea62dac82d1610
-
Filesize
459KB
MD528c9569fdfa17a87ada4d354430339f8
SHA1d14414d275ead078c603ff60c08ce452475d3c5a
SHA2563640ff98e63f79701d453338015bb2053e359016fb7e0d82b681b751adae04b1
SHA512354bf9c17a39487f5d3125eb7aff5735f9fe7eb5a926d78f21ce5d0f7ee532da15b0b231151b772a2b6f79707e3eb21f77968a98ce59c31179ea62dac82d1610