Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    122s
  • max time network
    126s
  • platform
    windows7_x64
  • resource
    win7-20230831-en
  • resource tags

    arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
  • submitted
    20/09/2023, 21:43

General

  • Target

    file.exe

  • Size

    1.3MB

  • MD5

    829a0997d9f85f18f95428d9f5aa7d49

  • SHA1

    6ab9efaad3949097b0449af87908b47ebc03d4f4

  • SHA256

    a104162675efa1ef6558d3f8edf218b8c2be3832e38fba88b4e0b73679e54b73

  • SHA512

    87856d9368f0169ddbfc0aebaea80f0415f3663658a171bd60e4e46b69606135a5db4b06b92591e8801e6fa91a4d0f482b3e5018efb3108ab9439cd456420116

  • SSDEEP

    24576:dy5Gcgp7hV2lgilAPS8eY/JLsPUcGfNcZZWMoyTYIWDHMNyV/kinKjmlV4SF:45G17hV2zkJLdxNSPTYRDsNojn7lV4S

Malware Config

Signatures

  • Detects Healer an antivirus disabler dropper 5 IoCs
  • Healer

    Healer an antivirus disabler dropper.

  • Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs
  • Executes dropped EXE 4 IoCs
  • Loads dropped DLL 13 IoCs
  • Adds Run key to start application 2 TTPs 4 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Program crash 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 47 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\file.exe
    "C:\Users\Admin\AppData\Local\Temp\file.exe"
    1⤵
    • Loads dropped DLL
    • Adds Run key to start application
    • Suspicious use of WriteProcessMemory
    PID:2828
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v4335560.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v4335560.exe
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Adds Run key to start application
      • Suspicious use of WriteProcessMemory
      PID:2244
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v2351085.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v2351085.exe
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Adds Run key to start application
        • Suspicious use of WriteProcessMemory
        PID:2436
        • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\v0410008.exe
          C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\v0410008.exe
          4⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • Adds Run key to start application
          • Suspicious use of WriteProcessMemory
          PID:1736
          • C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\a9924969.exe
            C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\a9924969.exe
            5⤵
            • Executes dropped EXE
            • Loads dropped DLL
            • Suspicious use of SetThreadContext
            • Suspicious use of WriteProcessMemory
            PID:2716
            • C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
              "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
              6⤵
              • Modifies Windows Defender Real-time Protection settings
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of AdjustPrivilegeToken
              PID:2012
            • C:\Windows\SysWOW64\WerFault.exe
              C:\Windows\SysWOW64\WerFault.exe -u -p 2716 -s 268
              6⤵
              • Loads dropped DLL
              • Program crash
              PID:2824

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v4335560.exe

    Filesize

    1.2MB

    MD5

    45e1bb363472955de1a2e4b1335c852b

    SHA1

    7e201e105089f7fc4f41080498f32ac2a94da08f

    SHA256

    521d191b2ffb11026e0676dbe949edd59d17c33582017910d634cbe2ae4fc4c3

    SHA512

    2cbad2264a4e2f2bf5f422903ae5d6d30a3467a0a4127aaebd5ff3ee3624a657ea8319511be17c15103d39bcdea07f0befa3ce6d1f3afe0a77039d664357a845

  • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v4335560.exe

    Filesize

    1.2MB

    MD5

    45e1bb363472955de1a2e4b1335c852b

    SHA1

    7e201e105089f7fc4f41080498f32ac2a94da08f

    SHA256

    521d191b2ffb11026e0676dbe949edd59d17c33582017910d634cbe2ae4fc4c3

    SHA512

    2cbad2264a4e2f2bf5f422903ae5d6d30a3467a0a4127aaebd5ff3ee3624a657ea8319511be17c15103d39bcdea07f0befa3ce6d1f3afe0a77039d664357a845

  • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v2351085.exe

    Filesize

    870KB

    MD5

    3b992d18ae58055d298868be93e2f74e

    SHA1

    11e96195bdc3d0167ff8965dbd6ba21fdd6bf25e

    SHA256

    77ad19e172b1078cd60aa9ac05a2f6aca73c693b2298837e056eec77ed822847

    SHA512

    388b2e62d59e07b0cb9b8baedc14a268156332d4fd6a72f270dcceb2a198a9f59b09d3ee399adfdc84c435bd25a2cdc03eee75aaccadbbafcdf4b1f689d90be2

  • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v2351085.exe

    Filesize

    870KB

    MD5

    3b992d18ae58055d298868be93e2f74e

    SHA1

    11e96195bdc3d0167ff8965dbd6ba21fdd6bf25e

    SHA256

    77ad19e172b1078cd60aa9ac05a2f6aca73c693b2298837e056eec77ed822847

    SHA512

    388b2e62d59e07b0cb9b8baedc14a268156332d4fd6a72f270dcceb2a198a9f59b09d3ee399adfdc84c435bd25a2cdc03eee75aaccadbbafcdf4b1f689d90be2

  • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\v0410008.exe

    Filesize

    510KB

    MD5

    6bb934dfbe45989e1dfdb4802fa46f90

    SHA1

    d911c365b4f3370776431360d1827cb317592d45

    SHA256

    f289047c50be9c6f65c2554ca9ed62ef295925df87f93b1b1cd308cab3b58e81

    SHA512

    aa94c95780d90a8a2a4a26acb3c4060ce1b64ba0bc2c7b7dae6e0a7b72b01d4c5397bbe10c0d96a1350d9a869c8172b23eeae433f92b9ca8bfa1c332441200e2

  • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\v0410008.exe

    Filesize

    510KB

    MD5

    6bb934dfbe45989e1dfdb4802fa46f90

    SHA1

    d911c365b4f3370776431360d1827cb317592d45

    SHA256

    f289047c50be9c6f65c2554ca9ed62ef295925df87f93b1b1cd308cab3b58e81

    SHA512

    aa94c95780d90a8a2a4a26acb3c4060ce1b64ba0bc2c7b7dae6e0a7b72b01d4c5397bbe10c0d96a1350d9a869c8172b23eeae433f92b9ca8bfa1c332441200e2

  • C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\a9924969.exe

    Filesize

    861KB

    MD5

    02516cea3b25d33955d47c80a5de5355

    SHA1

    388444a80e33c5f549ff66f2b2139bb89fea088b

    SHA256

    03d5c33a38f900a2d69685215fedc2ed6978575cf728072839a652045e6d7e88

    SHA512

    b28f4db97d275d7206b23c77c65b4befbeb5a2881ed3c0554bd1a7e36dc5dd2e3b3c9b3c93ca9c6e28ef07bf56e947d1c288034bbbbf4acabfd7a8cd87f097ef

  • C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\a9924969.exe

    Filesize

    861KB

    MD5

    02516cea3b25d33955d47c80a5de5355

    SHA1

    388444a80e33c5f549ff66f2b2139bb89fea088b

    SHA256

    03d5c33a38f900a2d69685215fedc2ed6978575cf728072839a652045e6d7e88

    SHA512

    b28f4db97d275d7206b23c77c65b4befbeb5a2881ed3c0554bd1a7e36dc5dd2e3b3c9b3c93ca9c6e28ef07bf56e947d1c288034bbbbf4acabfd7a8cd87f097ef

  • C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\a9924969.exe

    Filesize

    861KB

    MD5

    02516cea3b25d33955d47c80a5de5355

    SHA1

    388444a80e33c5f549ff66f2b2139bb89fea088b

    SHA256

    03d5c33a38f900a2d69685215fedc2ed6978575cf728072839a652045e6d7e88

    SHA512

    b28f4db97d275d7206b23c77c65b4befbeb5a2881ed3c0554bd1a7e36dc5dd2e3b3c9b3c93ca9c6e28ef07bf56e947d1c288034bbbbf4acabfd7a8cd87f097ef

  • \Users\Admin\AppData\Local\Temp\IXP000.TMP\v4335560.exe

    Filesize

    1.2MB

    MD5

    45e1bb363472955de1a2e4b1335c852b

    SHA1

    7e201e105089f7fc4f41080498f32ac2a94da08f

    SHA256

    521d191b2ffb11026e0676dbe949edd59d17c33582017910d634cbe2ae4fc4c3

    SHA512

    2cbad2264a4e2f2bf5f422903ae5d6d30a3467a0a4127aaebd5ff3ee3624a657ea8319511be17c15103d39bcdea07f0befa3ce6d1f3afe0a77039d664357a845

  • \Users\Admin\AppData\Local\Temp\IXP000.TMP\v4335560.exe

    Filesize

    1.2MB

    MD5

    45e1bb363472955de1a2e4b1335c852b

    SHA1

    7e201e105089f7fc4f41080498f32ac2a94da08f

    SHA256

    521d191b2ffb11026e0676dbe949edd59d17c33582017910d634cbe2ae4fc4c3

    SHA512

    2cbad2264a4e2f2bf5f422903ae5d6d30a3467a0a4127aaebd5ff3ee3624a657ea8319511be17c15103d39bcdea07f0befa3ce6d1f3afe0a77039d664357a845

  • \Users\Admin\AppData\Local\Temp\IXP001.TMP\v2351085.exe

    Filesize

    870KB

    MD5

    3b992d18ae58055d298868be93e2f74e

    SHA1

    11e96195bdc3d0167ff8965dbd6ba21fdd6bf25e

    SHA256

    77ad19e172b1078cd60aa9ac05a2f6aca73c693b2298837e056eec77ed822847

    SHA512

    388b2e62d59e07b0cb9b8baedc14a268156332d4fd6a72f270dcceb2a198a9f59b09d3ee399adfdc84c435bd25a2cdc03eee75aaccadbbafcdf4b1f689d90be2

  • \Users\Admin\AppData\Local\Temp\IXP001.TMP\v2351085.exe

    Filesize

    870KB

    MD5

    3b992d18ae58055d298868be93e2f74e

    SHA1

    11e96195bdc3d0167ff8965dbd6ba21fdd6bf25e

    SHA256

    77ad19e172b1078cd60aa9ac05a2f6aca73c693b2298837e056eec77ed822847

    SHA512

    388b2e62d59e07b0cb9b8baedc14a268156332d4fd6a72f270dcceb2a198a9f59b09d3ee399adfdc84c435bd25a2cdc03eee75aaccadbbafcdf4b1f689d90be2

  • \Users\Admin\AppData\Local\Temp\IXP002.TMP\v0410008.exe

    Filesize

    510KB

    MD5

    6bb934dfbe45989e1dfdb4802fa46f90

    SHA1

    d911c365b4f3370776431360d1827cb317592d45

    SHA256

    f289047c50be9c6f65c2554ca9ed62ef295925df87f93b1b1cd308cab3b58e81

    SHA512

    aa94c95780d90a8a2a4a26acb3c4060ce1b64ba0bc2c7b7dae6e0a7b72b01d4c5397bbe10c0d96a1350d9a869c8172b23eeae433f92b9ca8bfa1c332441200e2

  • \Users\Admin\AppData\Local\Temp\IXP002.TMP\v0410008.exe

    Filesize

    510KB

    MD5

    6bb934dfbe45989e1dfdb4802fa46f90

    SHA1

    d911c365b4f3370776431360d1827cb317592d45

    SHA256

    f289047c50be9c6f65c2554ca9ed62ef295925df87f93b1b1cd308cab3b58e81

    SHA512

    aa94c95780d90a8a2a4a26acb3c4060ce1b64ba0bc2c7b7dae6e0a7b72b01d4c5397bbe10c0d96a1350d9a869c8172b23eeae433f92b9ca8bfa1c332441200e2

  • \Users\Admin\AppData\Local\Temp\IXP003.TMP\a9924969.exe

    Filesize

    861KB

    MD5

    02516cea3b25d33955d47c80a5de5355

    SHA1

    388444a80e33c5f549ff66f2b2139bb89fea088b

    SHA256

    03d5c33a38f900a2d69685215fedc2ed6978575cf728072839a652045e6d7e88

    SHA512

    b28f4db97d275d7206b23c77c65b4befbeb5a2881ed3c0554bd1a7e36dc5dd2e3b3c9b3c93ca9c6e28ef07bf56e947d1c288034bbbbf4acabfd7a8cd87f097ef

  • \Users\Admin\AppData\Local\Temp\IXP003.TMP\a9924969.exe

    Filesize

    861KB

    MD5

    02516cea3b25d33955d47c80a5de5355

    SHA1

    388444a80e33c5f549ff66f2b2139bb89fea088b

    SHA256

    03d5c33a38f900a2d69685215fedc2ed6978575cf728072839a652045e6d7e88

    SHA512

    b28f4db97d275d7206b23c77c65b4befbeb5a2881ed3c0554bd1a7e36dc5dd2e3b3c9b3c93ca9c6e28ef07bf56e947d1c288034bbbbf4acabfd7a8cd87f097ef

  • \Users\Admin\AppData\Local\Temp\IXP003.TMP\a9924969.exe

    Filesize

    861KB

    MD5

    02516cea3b25d33955d47c80a5de5355

    SHA1

    388444a80e33c5f549ff66f2b2139bb89fea088b

    SHA256

    03d5c33a38f900a2d69685215fedc2ed6978575cf728072839a652045e6d7e88

    SHA512

    b28f4db97d275d7206b23c77c65b4befbeb5a2881ed3c0554bd1a7e36dc5dd2e3b3c9b3c93ca9c6e28ef07bf56e947d1c288034bbbbf4acabfd7a8cd87f097ef

  • \Users\Admin\AppData\Local\Temp\IXP003.TMP\a9924969.exe

    Filesize

    861KB

    MD5

    02516cea3b25d33955d47c80a5de5355

    SHA1

    388444a80e33c5f549ff66f2b2139bb89fea088b

    SHA256

    03d5c33a38f900a2d69685215fedc2ed6978575cf728072839a652045e6d7e88

    SHA512

    b28f4db97d275d7206b23c77c65b4befbeb5a2881ed3c0554bd1a7e36dc5dd2e3b3c9b3c93ca9c6e28ef07bf56e947d1c288034bbbbf4acabfd7a8cd87f097ef

  • \Users\Admin\AppData\Local\Temp\IXP003.TMP\a9924969.exe

    Filesize

    861KB

    MD5

    02516cea3b25d33955d47c80a5de5355

    SHA1

    388444a80e33c5f549ff66f2b2139bb89fea088b

    SHA256

    03d5c33a38f900a2d69685215fedc2ed6978575cf728072839a652045e6d7e88

    SHA512

    b28f4db97d275d7206b23c77c65b4befbeb5a2881ed3c0554bd1a7e36dc5dd2e3b3c9b3c93ca9c6e28ef07bf56e947d1c288034bbbbf4acabfd7a8cd87f097ef

  • \Users\Admin\AppData\Local\Temp\IXP003.TMP\a9924969.exe

    Filesize

    861KB

    MD5

    02516cea3b25d33955d47c80a5de5355

    SHA1

    388444a80e33c5f549ff66f2b2139bb89fea088b

    SHA256

    03d5c33a38f900a2d69685215fedc2ed6978575cf728072839a652045e6d7e88

    SHA512

    b28f4db97d275d7206b23c77c65b4befbeb5a2881ed3c0554bd1a7e36dc5dd2e3b3c9b3c93ca9c6e28ef07bf56e947d1c288034bbbbf4acabfd7a8cd87f097ef

  • \Users\Admin\AppData\Local\Temp\IXP003.TMP\a9924969.exe

    Filesize

    861KB

    MD5

    02516cea3b25d33955d47c80a5de5355

    SHA1

    388444a80e33c5f549ff66f2b2139bb89fea088b

    SHA256

    03d5c33a38f900a2d69685215fedc2ed6978575cf728072839a652045e6d7e88

    SHA512

    b28f4db97d275d7206b23c77c65b4befbeb5a2881ed3c0554bd1a7e36dc5dd2e3b3c9b3c93ca9c6e28ef07bf56e947d1c288034bbbbf4acabfd7a8cd87f097ef

  • memory/2012-47-0x0000000000400000-0x000000000040A000-memory.dmp

    Filesize

    40KB

  • memory/2012-51-0x00000000FFFDE000-0x00000000FFFDF000-memory.dmp

    Filesize

    4KB

  • memory/2012-54-0x0000000000400000-0x000000000040A000-memory.dmp

    Filesize

    40KB

  • memory/2012-56-0x0000000000400000-0x000000000040A000-memory.dmp

    Filesize

    40KB

  • memory/2012-52-0x0000000000400000-0x000000000040A000-memory.dmp

    Filesize

    40KB

  • memory/2012-49-0x0000000000400000-0x000000000040A000-memory.dmp

    Filesize

    40KB

  • memory/2012-43-0x0000000000400000-0x000000000040A000-memory.dmp

    Filesize

    40KB

  • memory/2012-45-0x0000000000400000-0x000000000040A000-memory.dmp

    Filesize

    40KB