Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
141s -
max time network
32s -
platform
windows7_x64 -
resource
win7-20230220-en -
resource tags
arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system -
submitted
11/05/2023, 15:44
Static task
static1
Behavioral task
behavioral1
Sample
120.exe
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
120.exe
Resource
win10v2004-20230220-en
General
-
Target
120.exe
-
Size
168KB
-
MD5
2ed3923a2bac11502a7ac4f3397386b2
-
SHA1
7f7ed3cbece211d1babcf23b32bada1f8ab92474
-
SHA256
a05d5b921f7deea5c147da6bc0b70fc5f7847d9d2ba788af446100f708021248
-
SHA512
8a9c84a01e98d65aaf1e3d5d4a13e82a8f2f509ba0889a21c4f042f381c540beea56dbde55f883d18e349a010584f1a07c464f1b4a10db6ce93dd43d7d5790eb
-
SSDEEP
3072:3SgWPKbig1X2+SY3MCOtKDwrkNGvneeYg/E5zhJytck6ZK7bETV:32g1X2+SkMvHrkzgs5z1KbETV
Malware Config
Signatures
-
Executes dropped EXE 9 IoCs
pid Process 772 iexplorer.exe 1516 iexplorer.exe 868 iexplorer.exe 340 iexplorer.exe 832 iexplorer.exe 816 iexplorer.exe 1916 iexplorer.exe 932 iexplorer.exe 812 iexplorer.exe -
Loads dropped DLL 18 IoCs
pid Process 1768 120.exe 1768 120.exe 772 iexplorer.exe 772 iexplorer.exe 1516 iexplorer.exe 1516 iexplorer.exe 868 iexplorer.exe 868 iexplorer.exe 340 iexplorer.exe 340 iexplorer.exe 832 iexplorer.exe 832 iexplorer.exe 816 iexplorer.exe 816 iexplorer.exe 1916 iexplorer.exe 1916 iexplorer.exe 932 iexplorer.exe 932 iexplorer.exe -
Drops file in System32 directory 20 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\iexplorer.exe iexplorer.exe File created C:\Windows\SysWOW64\iexplorer.exe iexplorer.exe File opened for modification C:\Windows\SysWOW64\iexplorer.exe iexplorer.exe File opened for modification C:\Windows\SysWOW64\iexplorer.exe iexplorer.exe File created C:\Windows\SysWOW64\iexplorer.exe iexplorer.exe File opened for modification C:\Windows\SysWOW64\iexplorer.exe iexplorer.exe File opened for modification C:\Windows\SysWOW64\iexplorer.exe 120.exe File opened for modification C:\Windows\SysWOW64\iexplorer.exe iexplorer.exe File opened for modification C:\Windows\SysWOW64\iexplorer.exe iexplorer.exe File created C:\Windows\SysWOW64\iexplorer.exe iexplorer.exe File opened for modification C:\Windows\SysWOW64\iexplorer.exe iexplorer.exe File created C:\Windows\SysWOW64\iexplorer.exe iexplorer.exe File created C:\Windows\SysWOW64\iexplorer.exe 120.exe File created C:\Windows\SysWOW64\iexplorer.exe iexplorer.exe File created C:\Windows\SysWOW64\iexplorer.exe iexplorer.exe File opened for modification C:\Windows\SysWOW64\iexplorer.exe iexplorer.exe File created C:\Windows\SysWOW64\iexplorer.exe iexplorer.exe File opened for modification C:\Windows\SysWOW64\iexplorer.exe iexplorer.exe File created C:\Windows\SysWOW64\iexplorer.exe iexplorer.exe File created C:\Windows\SysWOW64\iexplorer.exe iexplorer.exe -
Suspicious use of WriteProcessMemory 36 IoCs
description pid Process procid_target PID 1768 wrote to memory of 772 1768 120.exe 28 PID 1768 wrote to memory of 772 1768 120.exe 28 PID 1768 wrote to memory of 772 1768 120.exe 28 PID 1768 wrote to memory of 772 1768 120.exe 28 PID 772 wrote to memory of 1516 772 iexplorer.exe 29 PID 772 wrote to memory of 1516 772 iexplorer.exe 29 PID 772 wrote to memory of 1516 772 iexplorer.exe 29 PID 772 wrote to memory of 1516 772 iexplorer.exe 29 PID 1516 wrote to memory of 868 1516 iexplorer.exe 30 PID 1516 wrote to memory of 868 1516 iexplorer.exe 30 PID 1516 wrote to memory of 868 1516 iexplorer.exe 30 PID 1516 wrote to memory of 868 1516 iexplorer.exe 30 PID 868 wrote to memory of 340 868 iexplorer.exe 31 PID 868 wrote to memory of 340 868 iexplorer.exe 31 PID 868 wrote to memory of 340 868 iexplorer.exe 31 PID 868 wrote to memory of 340 868 iexplorer.exe 31 PID 340 wrote to memory of 832 340 iexplorer.exe 32 PID 340 wrote to memory of 832 340 iexplorer.exe 32 PID 340 wrote to memory of 832 340 iexplorer.exe 32 PID 340 wrote to memory of 832 340 iexplorer.exe 32 PID 832 wrote to memory of 816 832 iexplorer.exe 33 PID 832 wrote to memory of 816 832 iexplorer.exe 33 PID 832 wrote to memory of 816 832 iexplorer.exe 33 PID 832 wrote to memory of 816 832 iexplorer.exe 33 PID 816 wrote to memory of 1916 816 iexplorer.exe 34 PID 816 wrote to memory of 1916 816 iexplorer.exe 34 PID 816 wrote to memory of 1916 816 iexplorer.exe 34 PID 816 wrote to memory of 1916 816 iexplorer.exe 34 PID 1916 wrote to memory of 932 1916 iexplorer.exe 35 PID 1916 wrote to memory of 932 1916 iexplorer.exe 35 PID 1916 wrote to memory of 932 1916 iexplorer.exe 35 PID 1916 wrote to memory of 932 1916 iexplorer.exe 35 PID 932 wrote to memory of 812 932 iexplorer.exe 36 PID 932 wrote to memory of 812 932 iexplorer.exe 36 PID 932 wrote to memory of 812 932 iexplorer.exe 36 PID 932 wrote to memory of 812 932 iexplorer.exe 36
Processes
-
C:\Users\Admin\AppData\Local\Temp\120.exe"C:\Users\Admin\AppData\Local\Temp\120.exe"1⤵
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:1768 -
C:\Windows\SysWOW64\iexplorer.exeC:\Windows\system32\iexplorer.exe 448 "C:\Users\Admin\AppData\Local\Temp\120.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:772 -
C:\Windows\SysWOW64\iexplorer.exeC:\Windows\system32\iexplorer.exe 512 "C:\Windows\SysWOW64\iexplorer.exe"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:1516 -
C:\Windows\SysWOW64\iexplorer.exeC:\Windows\system32\iexplorer.exe 528 "C:\Windows\SysWOW64\iexplorer.exe"4⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:868 -
C:\Windows\SysWOW64\iexplorer.exeC:\Windows\system32\iexplorer.exe 532 "C:\Windows\SysWOW64\iexplorer.exe"5⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:340 -
C:\Windows\SysWOW64\iexplorer.exeC:\Windows\system32\iexplorer.exe 520 "C:\Windows\SysWOW64\iexplorer.exe"6⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:832 -
C:\Windows\SysWOW64\iexplorer.exeC:\Windows\system32\iexplorer.exe 508 "C:\Windows\SysWOW64\iexplorer.exe"7⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:816 -
C:\Windows\SysWOW64\iexplorer.exeC:\Windows\system32\iexplorer.exe 516 "C:\Windows\SysWOW64\iexplorer.exe"8⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:1916 -
C:\Windows\SysWOW64\iexplorer.exeC:\Windows\system32\iexplorer.exe 540 "C:\Windows\SysWOW64\iexplorer.exe"9⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:932 -
C:\Windows\SysWOW64\iexplorer.exeC:\Windows\system32\iexplorer.exe 544 "C:\Windows\SysWOW64\iexplorer.exe"10⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:812
-
-
-
-
-
-
-
-
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
168KB
MD52ed3923a2bac11502a7ac4f3397386b2
SHA17f7ed3cbece211d1babcf23b32bada1f8ab92474
SHA256a05d5b921f7deea5c147da6bc0b70fc5f7847d9d2ba788af446100f708021248
SHA5128a9c84a01e98d65aaf1e3d5d4a13e82a8f2f509ba0889a21c4f042f381c540beea56dbde55f883d18e349a010584f1a07c464f1b4a10db6ce93dd43d7d5790eb
-
Filesize
168KB
MD52ed3923a2bac11502a7ac4f3397386b2
SHA17f7ed3cbece211d1babcf23b32bada1f8ab92474
SHA256a05d5b921f7deea5c147da6bc0b70fc5f7847d9d2ba788af446100f708021248
SHA5128a9c84a01e98d65aaf1e3d5d4a13e82a8f2f509ba0889a21c4f042f381c540beea56dbde55f883d18e349a010584f1a07c464f1b4a10db6ce93dd43d7d5790eb
-
Filesize
168KB
MD52ed3923a2bac11502a7ac4f3397386b2
SHA17f7ed3cbece211d1babcf23b32bada1f8ab92474
SHA256a05d5b921f7deea5c147da6bc0b70fc5f7847d9d2ba788af446100f708021248
SHA5128a9c84a01e98d65aaf1e3d5d4a13e82a8f2f509ba0889a21c4f042f381c540beea56dbde55f883d18e349a010584f1a07c464f1b4a10db6ce93dd43d7d5790eb
-
Filesize
168KB
MD52ed3923a2bac11502a7ac4f3397386b2
SHA17f7ed3cbece211d1babcf23b32bada1f8ab92474
SHA256a05d5b921f7deea5c147da6bc0b70fc5f7847d9d2ba788af446100f708021248
SHA5128a9c84a01e98d65aaf1e3d5d4a13e82a8f2f509ba0889a21c4f042f381c540beea56dbde55f883d18e349a010584f1a07c464f1b4a10db6ce93dd43d7d5790eb
-
Filesize
168KB
MD52ed3923a2bac11502a7ac4f3397386b2
SHA17f7ed3cbece211d1babcf23b32bada1f8ab92474
SHA256a05d5b921f7deea5c147da6bc0b70fc5f7847d9d2ba788af446100f708021248
SHA5128a9c84a01e98d65aaf1e3d5d4a13e82a8f2f509ba0889a21c4f042f381c540beea56dbde55f883d18e349a010584f1a07c464f1b4a10db6ce93dd43d7d5790eb
-
Filesize
168KB
MD52ed3923a2bac11502a7ac4f3397386b2
SHA17f7ed3cbece211d1babcf23b32bada1f8ab92474
SHA256a05d5b921f7deea5c147da6bc0b70fc5f7847d9d2ba788af446100f708021248
SHA5128a9c84a01e98d65aaf1e3d5d4a13e82a8f2f509ba0889a21c4f042f381c540beea56dbde55f883d18e349a010584f1a07c464f1b4a10db6ce93dd43d7d5790eb
-
Filesize
168KB
MD52ed3923a2bac11502a7ac4f3397386b2
SHA17f7ed3cbece211d1babcf23b32bada1f8ab92474
SHA256a05d5b921f7deea5c147da6bc0b70fc5f7847d9d2ba788af446100f708021248
SHA5128a9c84a01e98d65aaf1e3d5d4a13e82a8f2f509ba0889a21c4f042f381c540beea56dbde55f883d18e349a010584f1a07c464f1b4a10db6ce93dd43d7d5790eb
-
Filesize
168KB
MD52ed3923a2bac11502a7ac4f3397386b2
SHA17f7ed3cbece211d1babcf23b32bada1f8ab92474
SHA256a05d5b921f7deea5c147da6bc0b70fc5f7847d9d2ba788af446100f708021248
SHA5128a9c84a01e98d65aaf1e3d5d4a13e82a8f2f509ba0889a21c4f042f381c540beea56dbde55f883d18e349a010584f1a07c464f1b4a10db6ce93dd43d7d5790eb
-
Filesize
168KB
MD52ed3923a2bac11502a7ac4f3397386b2
SHA17f7ed3cbece211d1babcf23b32bada1f8ab92474
SHA256a05d5b921f7deea5c147da6bc0b70fc5f7847d9d2ba788af446100f708021248
SHA5128a9c84a01e98d65aaf1e3d5d4a13e82a8f2f509ba0889a21c4f042f381c540beea56dbde55f883d18e349a010584f1a07c464f1b4a10db6ce93dd43d7d5790eb
-
Filesize
168KB
MD52ed3923a2bac11502a7ac4f3397386b2
SHA17f7ed3cbece211d1babcf23b32bada1f8ab92474
SHA256a05d5b921f7deea5c147da6bc0b70fc5f7847d9d2ba788af446100f708021248
SHA5128a9c84a01e98d65aaf1e3d5d4a13e82a8f2f509ba0889a21c4f042f381c540beea56dbde55f883d18e349a010584f1a07c464f1b4a10db6ce93dd43d7d5790eb
-
Filesize
168KB
MD52ed3923a2bac11502a7ac4f3397386b2
SHA17f7ed3cbece211d1babcf23b32bada1f8ab92474
SHA256a05d5b921f7deea5c147da6bc0b70fc5f7847d9d2ba788af446100f708021248
SHA5128a9c84a01e98d65aaf1e3d5d4a13e82a8f2f509ba0889a21c4f042f381c540beea56dbde55f883d18e349a010584f1a07c464f1b4a10db6ce93dd43d7d5790eb
-
Filesize
168KB
MD52ed3923a2bac11502a7ac4f3397386b2
SHA17f7ed3cbece211d1babcf23b32bada1f8ab92474
SHA256a05d5b921f7deea5c147da6bc0b70fc5f7847d9d2ba788af446100f708021248
SHA5128a9c84a01e98d65aaf1e3d5d4a13e82a8f2f509ba0889a21c4f042f381c540beea56dbde55f883d18e349a010584f1a07c464f1b4a10db6ce93dd43d7d5790eb
-
Filesize
168KB
MD52ed3923a2bac11502a7ac4f3397386b2
SHA17f7ed3cbece211d1babcf23b32bada1f8ab92474
SHA256a05d5b921f7deea5c147da6bc0b70fc5f7847d9d2ba788af446100f708021248
SHA5128a9c84a01e98d65aaf1e3d5d4a13e82a8f2f509ba0889a21c4f042f381c540beea56dbde55f883d18e349a010584f1a07c464f1b4a10db6ce93dd43d7d5790eb
-
Filesize
168KB
MD52ed3923a2bac11502a7ac4f3397386b2
SHA17f7ed3cbece211d1babcf23b32bada1f8ab92474
SHA256a05d5b921f7deea5c147da6bc0b70fc5f7847d9d2ba788af446100f708021248
SHA5128a9c84a01e98d65aaf1e3d5d4a13e82a8f2f509ba0889a21c4f042f381c540beea56dbde55f883d18e349a010584f1a07c464f1b4a10db6ce93dd43d7d5790eb
-
Filesize
168KB
MD52ed3923a2bac11502a7ac4f3397386b2
SHA17f7ed3cbece211d1babcf23b32bada1f8ab92474
SHA256a05d5b921f7deea5c147da6bc0b70fc5f7847d9d2ba788af446100f708021248
SHA5128a9c84a01e98d65aaf1e3d5d4a13e82a8f2f509ba0889a21c4f042f381c540beea56dbde55f883d18e349a010584f1a07c464f1b4a10db6ce93dd43d7d5790eb
-
Filesize
168KB
MD52ed3923a2bac11502a7ac4f3397386b2
SHA17f7ed3cbece211d1babcf23b32bada1f8ab92474
SHA256a05d5b921f7deea5c147da6bc0b70fc5f7847d9d2ba788af446100f708021248
SHA5128a9c84a01e98d65aaf1e3d5d4a13e82a8f2f509ba0889a21c4f042f381c540beea56dbde55f883d18e349a010584f1a07c464f1b4a10db6ce93dd43d7d5790eb
-
Filesize
168KB
MD52ed3923a2bac11502a7ac4f3397386b2
SHA17f7ed3cbece211d1babcf23b32bada1f8ab92474
SHA256a05d5b921f7deea5c147da6bc0b70fc5f7847d9d2ba788af446100f708021248
SHA5128a9c84a01e98d65aaf1e3d5d4a13e82a8f2f509ba0889a21c4f042f381c540beea56dbde55f883d18e349a010584f1a07c464f1b4a10db6ce93dd43d7d5790eb
-
Filesize
168KB
MD52ed3923a2bac11502a7ac4f3397386b2
SHA17f7ed3cbece211d1babcf23b32bada1f8ab92474
SHA256a05d5b921f7deea5c147da6bc0b70fc5f7847d9d2ba788af446100f708021248
SHA5128a9c84a01e98d65aaf1e3d5d4a13e82a8f2f509ba0889a21c4f042f381c540beea56dbde55f883d18e349a010584f1a07c464f1b4a10db6ce93dd43d7d5790eb
-
Filesize
168KB
MD52ed3923a2bac11502a7ac4f3397386b2
SHA17f7ed3cbece211d1babcf23b32bada1f8ab92474
SHA256a05d5b921f7deea5c147da6bc0b70fc5f7847d9d2ba788af446100f708021248
SHA5128a9c84a01e98d65aaf1e3d5d4a13e82a8f2f509ba0889a21c4f042f381c540beea56dbde55f883d18e349a010584f1a07c464f1b4a10db6ce93dd43d7d5790eb
-
Filesize
168KB
MD52ed3923a2bac11502a7ac4f3397386b2
SHA17f7ed3cbece211d1babcf23b32bada1f8ab92474
SHA256a05d5b921f7deea5c147da6bc0b70fc5f7847d9d2ba788af446100f708021248
SHA5128a9c84a01e98d65aaf1e3d5d4a13e82a8f2f509ba0889a21c4f042f381c540beea56dbde55f883d18e349a010584f1a07c464f1b4a10db6ce93dd43d7d5790eb
-
Filesize
168KB
MD52ed3923a2bac11502a7ac4f3397386b2
SHA17f7ed3cbece211d1babcf23b32bada1f8ab92474
SHA256a05d5b921f7deea5c147da6bc0b70fc5f7847d9d2ba788af446100f708021248
SHA5128a9c84a01e98d65aaf1e3d5d4a13e82a8f2f509ba0889a21c4f042f381c540beea56dbde55f883d18e349a010584f1a07c464f1b4a10db6ce93dd43d7d5790eb
-
Filesize
168KB
MD52ed3923a2bac11502a7ac4f3397386b2
SHA17f7ed3cbece211d1babcf23b32bada1f8ab92474
SHA256a05d5b921f7deea5c147da6bc0b70fc5f7847d9d2ba788af446100f708021248
SHA5128a9c84a01e98d65aaf1e3d5d4a13e82a8f2f509ba0889a21c4f042f381c540beea56dbde55f883d18e349a010584f1a07c464f1b4a10db6ce93dd43d7d5790eb
-
Filesize
168KB
MD52ed3923a2bac11502a7ac4f3397386b2
SHA17f7ed3cbece211d1babcf23b32bada1f8ab92474
SHA256a05d5b921f7deea5c147da6bc0b70fc5f7847d9d2ba788af446100f708021248
SHA5128a9c84a01e98d65aaf1e3d5d4a13e82a8f2f509ba0889a21c4f042f381c540beea56dbde55f883d18e349a010584f1a07c464f1b4a10db6ce93dd43d7d5790eb
-
Filesize
168KB
MD52ed3923a2bac11502a7ac4f3397386b2
SHA17f7ed3cbece211d1babcf23b32bada1f8ab92474
SHA256a05d5b921f7deea5c147da6bc0b70fc5f7847d9d2ba788af446100f708021248
SHA5128a9c84a01e98d65aaf1e3d5d4a13e82a8f2f509ba0889a21c4f042f381c540beea56dbde55f883d18e349a010584f1a07c464f1b4a10db6ce93dd43d7d5790eb
-
Filesize
168KB
MD52ed3923a2bac11502a7ac4f3397386b2
SHA17f7ed3cbece211d1babcf23b32bada1f8ab92474
SHA256a05d5b921f7deea5c147da6bc0b70fc5f7847d9d2ba788af446100f708021248
SHA5128a9c84a01e98d65aaf1e3d5d4a13e82a8f2f509ba0889a21c4f042f381c540beea56dbde55f883d18e349a010584f1a07c464f1b4a10db6ce93dd43d7d5790eb
-
Filesize
168KB
MD52ed3923a2bac11502a7ac4f3397386b2
SHA17f7ed3cbece211d1babcf23b32bada1f8ab92474
SHA256a05d5b921f7deea5c147da6bc0b70fc5f7847d9d2ba788af446100f708021248
SHA5128a9c84a01e98d65aaf1e3d5d4a13e82a8f2f509ba0889a21c4f042f381c540beea56dbde55f883d18e349a010584f1a07c464f1b4a10db6ce93dd43d7d5790eb
-
Filesize
168KB
MD52ed3923a2bac11502a7ac4f3397386b2
SHA17f7ed3cbece211d1babcf23b32bada1f8ab92474
SHA256a05d5b921f7deea5c147da6bc0b70fc5f7847d9d2ba788af446100f708021248
SHA5128a9c84a01e98d65aaf1e3d5d4a13e82a8f2f509ba0889a21c4f042f381c540beea56dbde55f883d18e349a010584f1a07c464f1b4a10db6ce93dd43d7d5790eb
-
Filesize
168KB
MD52ed3923a2bac11502a7ac4f3397386b2
SHA17f7ed3cbece211d1babcf23b32bada1f8ab92474
SHA256a05d5b921f7deea5c147da6bc0b70fc5f7847d9d2ba788af446100f708021248
SHA5128a9c84a01e98d65aaf1e3d5d4a13e82a8f2f509ba0889a21c4f042f381c540beea56dbde55f883d18e349a010584f1a07c464f1b4a10db6ce93dd43d7d5790eb
-
Filesize
168KB
MD52ed3923a2bac11502a7ac4f3397386b2
SHA17f7ed3cbece211d1babcf23b32bada1f8ab92474
SHA256a05d5b921f7deea5c147da6bc0b70fc5f7847d9d2ba788af446100f708021248
SHA5128a9c84a01e98d65aaf1e3d5d4a13e82a8f2f509ba0889a21c4f042f381c540beea56dbde55f883d18e349a010584f1a07c464f1b4a10db6ce93dd43d7d5790eb