Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
88s -
max time network
104s -
platform
windows10-2004_x64 -
resource
win10v2004-20230221-en -
resource tags
arch:x64arch:x86image:win10v2004-20230221-enlocale:en-usos:windows10-2004-x64system -
submitted
08/06/2023, 00:19
Static task
static1
General
-
Target
f74b0d648abb68dd4ca41d7eaaf26ddc2bd3f3c89dae349a2473a383bec6b61d.exe
-
Size
121KB
-
MD5
f1276fc56363cd1110f34e2395cec452
-
SHA1
e996371d3250dc58abf271710d9ecf6cb888f373
-
SHA256
f74b0d648abb68dd4ca41d7eaaf26ddc2bd3f3c89dae349a2473a383bec6b61d
-
SHA512
4e638a879a8ecc36dc7dd006ce323650b7d86128fe19831e303d223274e1ba7078fead2c79ff3349ea894f91684496e9192bb28e1591803c6c97ae248c14597c
-
SSDEEP
3072:09QLdsON8xxwaTq29LFNcrLfWvq8oyhuWVFrag1shbErtvx:GQLvN8VTDcXWVFmZhArt
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection AppLaunch.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" AppLaunch.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" AppLaunch.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" AppLaunch.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" AppLaunch.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" AppLaunch.exe -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 1304 set thread context of 1320 1304 f74b0d648abb68dd4ca41d7eaaf26ddc2bd3f3c89dae349a2473a383bec6b61d.exe 87 -
Program crash 1 IoCs
pid pid_target Process procid_target 1884 1304 WerFault.exe 85 -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 1320 AppLaunch.exe 1320 AppLaunch.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 1320 AppLaunch.exe -
Suspicious use of WriteProcessMemory 5 IoCs
description pid Process procid_target PID 1304 wrote to memory of 1320 1304 f74b0d648abb68dd4ca41d7eaaf26ddc2bd3f3c89dae349a2473a383bec6b61d.exe 87 PID 1304 wrote to memory of 1320 1304 f74b0d648abb68dd4ca41d7eaaf26ddc2bd3f3c89dae349a2473a383bec6b61d.exe 87 PID 1304 wrote to memory of 1320 1304 f74b0d648abb68dd4ca41d7eaaf26ddc2bd3f3c89dae349a2473a383bec6b61d.exe 87 PID 1304 wrote to memory of 1320 1304 f74b0d648abb68dd4ca41d7eaaf26ddc2bd3f3c89dae349a2473a383bec6b61d.exe 87 PID 1304 wrote to memory of 1320 1304 f74b0d648abb68dd4ca41d7eaaf26ddc2bd3f3c89dae349a2473a383bec6b61d.exe 87
Processes
-
C:\Users\Admin\AppData\Local\Temp\f74b0d648abb68dd4ca41d7eaaf26ddc2bd3f3c89dae349a2473a383bec6b61d.exe"C:\Users\Admin\AppData\Local\Temp\f74b0d648abb68dd4ca41d7eaaf26ddc2bd3f3c89dae349a2473a383bec6b61d.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1304 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"2⤵
- Modifies Windows Defender Real-time Protection settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1320
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1304 -s 4882⤵
- Program crash
PID:1884
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 484 -p 1304 -ip 13041⤵PID:368