Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    118s
  • max time network
    121s
  • platform
    windows7_x64
  • resource
    win7-20230831-en
  • resource tags

    arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
  • submitted
    21/09/2023, 02:36

General

  • Target

    file.exe

  • Size

    1.3MB

  • MD5

    7b42d6a6c807934c6eb4893984a8b655

  • SHA1

    ebf8b35481869080d39070be5ef8ecec8722d778

  • SHA256

    99e0a3b18cb3e7cc6efbfc4330995241ec60acf24d3488eeb5785cda6202e643

  • SHA512

    9205daf9a20c103e58b58f10d2c0f5bc6fe61dda2774d8b39a8a98639e93b9866e775c8d8e80bf598378d52e81c2cf2092f7d4a0f0c131c2b337aa71334159e9

  • SSDEEP

    24576:ayhM6z0V11JV5YQD7k5gi+gI8sbhzABZbcKJKg9+nE:ha64H2ntsb9AK

Malware Config

Signatures

  • Detects Healer an antivirus disabler dropper 4 IoCs
  • Healer

    Healer an antivirus disabler dropper.

  • Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs
  • Executes dropped EXE 5 IoCs
  • Loads dropped DLL 14 IoCs
  • Windows security modification 2 TTPs 2 IoCs
  • Adds Run key to start application 2 TTPs 4 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Program crash 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 63 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\file.exe
    "C:\Users\Admin\AppData\Local\Temp\file.exe"
    1⤵
    • Loads dropped DLL
    • Adds Run key to start application
    • Suspicious use of WriteProcessMemory
    PID:1888
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v2822601.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v2822601.exe
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Adds Run key to start application
      • Suspicious use of WriteProcessMemory
      PID:1244
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v7176629.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v7176629.exe
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Adds Run key to start application
        • Suspicious use of WriteProcessMemory
        PID:2412
        • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\v1419768.exe
          C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\v1419768.exe
          4⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • Adds Run key to start application
          • Suspicious use of WriteProcessMemory
          PID:2980
          • C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\a7140523.exe
            C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\a7140523.exe
            5⤵
            • Modifies Windows Defender Real-time Protection settings
            • Executes dropped EXE
            • Windows security modification
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:2672
          • C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\b5854524.exe
            C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\b5854524.exe
            5⤵
            • Executes dropped EXE
            • Loads dropped DLL
            • Suspicious use of SetThreadContext
            • Suspicious use of WriteProcessMemory
            PID:2808
            • C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
              "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
              6⤵
              • Suspicious use of WriteProcessMemory
              PID:2492
              • C:\Windows\SysWOW64\WerFault.exe
                C:\Windows\SysWOW64\WerFault.exe -u -p 2492 -s 268
                7⤵
                • Program crash
                PID:2716
            • C:\Windows\SysWOW64\WerFault.exe
              C:\Windows\SysWOW64\WerFault.exe -u -p 2808 -s 268
              6⤵
              • Loads dropped DLL
              • Program crash
              PID:2620

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v2822601.exe

    Filesize

    1.2MB

    MD5

    70ad65feb577c991ffc339181460821d

    SHA1

    9df73311bd016266da65618983cb13f4a691c843

    SHA256

    e9a99722dc156af6197427ab0784b331a3a8a82425d02b61d528b3dec03fdf3e

    SHA512

    128e32f0c9034c97e2a58e58436f0eed13605ca7f0a81f81bdd29df5b3a54c8ccdc55887779120267fa28a1a62ca1622c6f472b55fb414a86259a6dfc55de64a

  • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v2822601.exe

    Filesize

    1.2MB

    MD5

    70ad65feb577c991ffc339181460821d

    SHA1

    9df73311bd016266da65618983cb13f4a691c843

    SHA256

    e9a99722dc156af6197427ab0784b331a3a8a82425d02b61d528b3dec03fdf3e

    SHA512

    128e32f0c9034c97e2a58e58436f0eed13605ca7f0a81f81bdd29df5b3a54c8ccdc55887779120267fa28a1a62ca1622c6f472b55fb414a86259a6dfc55de64a

  • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v7176629.exe

    Filesize

    837KB

    MD5

    bf3581a3ecf940740dd1aca8ac857a8c

    SHA1

    f86a5552de70bdc174a7d7014c6a2f8c433e6f97

    SHA256

    5990eb3cc77e477eaa6bd69d1786663fb176164f3507578de82b7b7b8933eecd

    SHA512

    c837dca72926376ef08dd2a9ac743d8541480b9ee4184aea185ceb77397a378ffc8a562efcca2a36bd1b08153875c1c4c9d449b3fc94ff4ad68da6e0ff4ebd59

  • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v7176629.exe

    Filesize

    837KB

    MD5

    bf3581a3ecf940740dd1aca8ac857a8c

    SHA1

    f86a5552de70bdc174a7d7014c6a2f8c433e6f97

    SHA256

    5990eb3cc77e477eaa6bd69d1786663fb176164f3507578de82b7b7b8933eecd

    SHA512

    c837dca72926376ef08dd2a9ac743d8541480b9ee4184aea185ceb77397a378ffc8a562efcca2a36bd1b08153875c1c4c9d449b3fc94ff4ad68da6e0ff4ebd59

  • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\v1419768.exe

    Filesize

    476KB

    MD5

    20c4b972047a7345270a5c20b4493392

    SHA1

    cc87a938246ad078510c5dce40a487f197f90d5a

    SHA256

    b5b7a7cf198f6e8454d46d6e35c0bae9b76edfad3ce7566e129b5cbaa8e36e9a

    SHA512

    167f9dee3676173d475a25fa237ffc7c6843f54e773abbc0ca023661a08345af655e9946fd5ff87baa58480ca34ece463dc5391f93c97de28a591fcecbb66403

  • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\v1419768.exe

    Filesize

    476KB

    MD5

    20c4b972047a7345270a5c20b4493392

    SHA1

    cc87a938246ad078510c5dce40a487f197f90d5a

    SHA256

    b5b7a7cf198f6e8454d46d6e35c0bae9b76edfad3ce7566e129b5cbaa8e36e9a

    SHA512

    167f9dee3676173d475a25fa237ffc7c6843f54e773abbc0ca023661a08345af655e9946fd5ff87baa58480ca34ece463dc5391f93c97de28a591fcecbb66403

  • C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\a7140523.exe

    Filesize

    11KB

    MD5

    ebc18c0930b24f701d6a53185a72939c

    SHA1

    1049cec9e7bb27d735ae447286aa18d7e1993dad

    SHA256

    b2501b84803871c8fdef2b7f65de00ac2480d84da05515f29b299cfc6585657e

    SHA512

    5ceca9604513b89dbed91f154ff4151368c686804b27cdc1acdaa9ffaddf1a32e47189a5160c22597a97fefbcc76de24e260e89bfabb0936702ebb9a411c0470

  • C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\a7140523.exe

    Filesize

    11KB

    MD5

    ebc18c0930b24f701d6a53185a72939c

    SHA1

    1049cec9e7bb27d735ae447286aa18d7e1993dad

    SHA256

    b2501b84803871c8fdef2b7f65de00ac2480d84da05515f29b299cfc6585657e

    SHA512

    5ceca9604513b89dbed91f154ff4151368c686804b27cdc1acdaa9ffaddf1a32e47189a5160c22597a97fefbcc76de24e260e89bfabb0936702ebb9a411c0470

  • C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\b5854524.exe

    Filesize

    1.0MB

    MD5

    4a622c9ca41f3298ef2eb64573acdef6

    SHA1

    5238f9fef40b07edf55fd3e50e4333e87acab6d7

    SHA256

    d847d6cc45999d53a315323d9932a502850f92c89b90914c780e4c37827596b2

    SHA512

    2e7204cf0bdfe9d70337a4af9a69b8b7534bcf0364feed91ab641e93d179266ad33c69d0a0d860067a68f077a5e5696c01fafef64db75f2c2c636e0e20b6a490

  • C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\b5854524.exe

    Filesize

    1.0MB

    MD5

    4a622c9ca41f3298ef2eb64573acdef6

    SHA1

    5238f9fef40b07edf55fd3e50e4333e87acab6d7

    SHA256

    d847d6cc45999d53a315323d9932a502850f92c89b90914c780e4c37827596b2

    SHA512

    2e7204cf0bdfe9d70337a4af9a69b8b7534bcf0364feed91ab641e93d179266ad33c69d0a0d860067a68f077a5e5696c01fafef64db75f2c2c636e0e20b6a490

  • C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\b5854524.exe

    Filesize

    1.0MB

    MD5

    4a622c9ca41f3298ef2eb64573acdef6

    SHA1

    5238f9fef40b07edf55fd3e50e4333e87acab6d7

    SHA256

    d847d6cc45999d53a315323d9932a502850f92c89b90914c780e4c37827596b2

    SHA512

    2e7204cf0bdfe9d70337a4af9a69b8b7534bcf0364feed91ab641e93d179266ad33c69d0a0d860067a68f077a5e5696c01fafef64db75f2c2c636e0e20b6a490

  • \Users\Admin\AppData\Local\Temp\IXP000.TMP\v2822601.exe

    Filesize

    1.2MB

    MD5

    70ad65feb577c991ffc339181460821d

    SHA1

    9df73311bd016266da65618983cb13f4a691c843

    SHA256

    e9a99722dc156af6197427ab0784b331a3a8a82425d02b61d528b3dec03fdf3e

    SHA512

    128e32f0c9034c97e2a58e58436f0eed13605ca7f0a81f81bdd29df5b3a54c8ccdc55887779120267fa28a1a62ca1622c6f472b55fb414a86259a6dfc55de64a

  • \Users\Admin\AppData\Local\Temp\IXP000.TMP\v2822601.exe

    Filesize

    1.2MB

    MD5

    70ad65feb577c991ffc339181460821d

    SHA1

    9df73311bd016266da65618983cb13f4a691c843

    SHA256

    e9a99722dc156af6197427ab0784b331a3a8a82425d02b61d528b3dec03fdf3e

    SHA512

    128e32f0c9034c97e2a58e58436f0eed13605ca7f0a81f81bdd29df5b3a54c8ccdc55887779120267fa28a1a62ca1622c6f472b55fb414a86259a6dfc55de64a

  • \Users\Admin\AppData\Local\Temp\IXP001.TMP\v7176629.exe

    Filesize

    837KB

    MD5

    bf3581a3ecf940740dd1aca8ac857a8c

    SHA1

    f86a5552de70bdc174a7d7014c6a2f8c433e6f97

    SHA256

    5990eb3cc77e477eaa6bd69d1786663fb176164f3507578de82b7b7b8933eecd

    SHA512

    c837dca72926376ef08dd2a9ac743d8541480b9ee4184aea185ceb77397a378ffc8a562efcca2a36bd1b08153875c1c4c9d449b3fc94ff4ad68da6e0ff4ebd59

  • \Users\Admin\AppData\Local\Temp\IXP001.TMP\v7176629.exe

    Filesize

    837KB

    MD5

    bf3581a3ecf940740dd1aca8ac857a8c

    SHA1

    f86a5552de70bdc174a7d7014c6a2f8c433e6f97

    SHA256

    5990eb3cc77e477eaa6bd69d1786663fb176164f3507578de82b7b7b8933eecd

    SHA512

    c837dca72926376ef08dd2a9ac743d8541480b9ee4184aea185ceb77397a378ffc8a562efcca2a36bd1b08153875c1c4c9d449b3fc94ff4ad68da6e0ff4ebd59

  • \Users\Admin\AppData\Local\Temp\IXP002.TMP\v1419768.exe

    Filesize

    476KB

    MD5

    20c4b972047a7345270a5c20b4493392

    SHA1

    cc87a938246ad078510c5dce40a487f197f90d5a

    SHA256

    b5b7a7cf198f6e8454d46d6e35c0bae9b76edfad3ce7566e129b5cbaa8e36e9a

    SHA512

    167f9dee3676173d475a25fa237ffc7c6843f54e773abbc0ca023661a08345af655e9946fd5ff87baa58480ca34ece463dc5391f93c97de28a591fcecbb66403

  • \Users\Admin\AppData\Local\Temp\IXP002.TMP\v1419768.exe

    Filesize

    476KB

    MD5

    20c4b972047a7345270a5c20b4493392

    SHA1

    cc87a938246ad078510c5dce40a487f197f90d5a

    SHA256

    b5b7a7cf198f6e8454d46d6e35c0bae9b76edfad3ce7566e129b5cbaa8e36e9a

    SHA512

    167f9dee3676173d475a25fa237ffc7c6843f54e773abbc0ca023661a08345af655e9946fd5ff87baa58480ca34ece463dc5391f93c97de28a591fcecbb66403

  • \Users\Admin\AppData\Local\Temp\IXP003.TMP\a7140523.exe

    Filesize

    11KB

    MD5

    ebc18c0930b24f701d6a53185a72939c

    SHA1

    1049cec9e7bb27d735ae447286aa18d7e1993dad

    SHA256

    b2501b84803871c8fdef2b7f65de00ac2480d84da05515f29b299cfc6585657e

    SHA512

    5ceca9604513b89dbed91f154ff4151368c686804b27cdc1acdaa9ffaddf1a32e47189a5160c22597a97fefbcc76de24e260e89bfabb0936702ebb9a411c0470

  • \Users\Admin\AppData\Local\Temp\IXP003.TMP\b5854524.exe

    Filesize

    1.0MB

    MD5

    4a622c9ca41f3298ef2eb64573acdef6

    SHA1

    5238f9fef40b07edf55fd3e50e4333e87acab6d7

    SHA256

    d847d6cc45999d53a315323d9932a502850f92c89b90914c780e4c37827596b2

    SHA512

    2e7204cf0bdfe9d70337a4af9a69b8b7534bcf0364feed91ab641e93d179266ad33c69d0a0d860067a68f077a5e5696c01fafef64db75f2c2c636e0e20b6a490

  • \Users\Admin\AppData\Local\Temp\IXP003.TMP\b5854524.exe

    Filesize

    1.0MB

    MD5

    4a622c9ca41f3298ef2eb64573acdef6

    SHA1

    5238f9fef40b07edf55fd3e50e4333e87acab6d7

    SHA256

    d847d6cc45999d53a315323d9932a502850f92c89b90914c780e4c37827596b2

    SHA512

    2e7204cf0bdfe9d70337a4af9a69b8b7534bcf0364feed91ab641e93d179266ad33c69d0a0d860067a68f077a5e5696c01fafef64db75f2c2c636e0e20b6a490

  • \Users\Admin\AppData\Local\Temp\IXP003.TMP\b5854524.exe

    Filesize

    1.0MB

    MD5

    4a622c9ca41f3298ef2eb64573acdef6

    SHA1

    5238f9fef40b07edf55fd3e50e4333e87acab6d7

    SHA256

    d847d6cc45999d53a315323d9932a502850f92c89b90914c780e4c37827596b2

    SHA512

    2e7204cf0bdfe9d70337a4af9a69b8b7534bcf0364feed91ab641e93d179266ad33c69d0a0d860067a68f077a5e5696c01fafef64db75f2c2c636e0e20b6a490

  • \Users\Admin\AppData\Local\Temp\IXP003.TMP\b5854524.exe

    Filesize

    1.0MB

    MD5

    4a622c9ca41f3298ef2eb64573acdef6

    SHA1

    5238f9fef40b07edf55fd3e50e4333e87acab6d7

    SHA256

    d847d6cc45999d53a315323d9932a502850f92c89b90914c780e4c37827596b2

    SHA512

    2e7204cf0bdfe9d70337a4af9a69b8b7534bcf0364feed91ab641e93d179266ad33c69d0a0d860067a68f077a5e5696c01fafef64db75f2c2c636e0e20b6a490

  • \Users\Admin\AppData\Local\Temp\IXP003.TMP\b5854524.exe

    Filesize

    1.0MB

    MD5

    4a622c9ca41f3298ef2eb64573acdef6

    SHA1

    5238f9fef40b07edf55fd3e50e4333e87acab6d7

    SHA256

    d847d6cc45999d53a315323d9932a502850f92c89b90914c780e4c37827596b2

    SHA512

    2e7204cf0bdfe9d70337a4af9a69b8b7534bcf0364feed91ab641e93d179266ad33c69d0a0d860067a68f077a5e5696c01fafef64db75f2c2c636e0e20b6a490

  • \Users\Admin\AppData\Local\Temp\IXP003.TMP\b5854524.exe

    Filesize

    1.0MB

    MD5

    4a622c9ca41f3298ef2eb64573acdef6

    SHA1

    5238f9fef40b07edf55fd3e50e4333e87acab6d7

    SHA256

    d847d6cc45999d53a315323d9932a502850f92c89b90914c780e4c37827596b2

    SHA512

    2e7204cf0bdfe9d70337a4af9a69b8b7534bcf0364feed91ab641e93d179266ad33c69d0a0d860067a68f077a5e5696c01fafef64db75f2c2c636e0e20b6a490

  • \Users\Admin\AppData\Local\Temp\IXP003.TMP\b5854524.exe

    Filesize

    1.0MB

    MD5

    4a622c9ca41f3298ef2eb64573acdef6

    SHA1

    5238f9fef40b07edf55fd3e50e4333e87acab6d7

    SHA256

    d847d6cc45999d53a315323d9932a502850f92c89b90914c780e4c37827596b2

    SHA512

    2e7204cf0bdfe9d70337a4af9a69b8b7534bcf0364feed91ab641e93d179266ad33c69d0a0d860067a68f077a5e5696c01fafef64db75f2c2c636e0e20b6a490

  • memory/2492-53-0x0000000000400000-0x000000000042F000-memory.dmp

    Filesize

    188KB

  • memory/2492-52-0x0000000000400000-0x000000000042F000-memory.dmp

    Filesize

    188KB

  • memory/2492-51-0x0000000000400000-0x000000000042F000-memory.dmp

    Filesize

    188KB

  • memory/2492-54-0x0000000000400000-0x000000000042F000-memory.dmp

    Filesize

    188KB

  • memory/2492-55-0x0000000000400000-0x000000000042F000-memory.dmp

    Filesize

    188KB

  • memory/2492-56-0x0000000000400000-0x000000000042F000-memory.dmp

    Filesize

    188KB

  • memory/2492-58-0x0000000000400000-0x000000000042F000-memory.dmp

    Filesize

    188KB

  • memory/2492-57-0x00000000FFFDE000-0x00000000FFFDF000-memory.dmp

    Filesize

    4KB

  • memory/2492-60-0x0000000000400000-0x000000000042F000-memory.dmp

    Filesize

    188KB

  • memory/2492-62-0x0000000000400000-0x000000000042F000-memory.dmp

    Filesize

    188KB

  • memory/2672-41-0x000007FEF5200000-0x000007FEF5BEC000-memory.dmp

    Filesize

    9.9MB

  • memory/2672-40-0x000007FEF5200000-0x000007FEF5BEC000-memory.dmp

    Filesize

    9.9MB

  • memory/2672-39-0x000007FEF5200000-0x000007FEF5BEC000-memory.dmp

    Filesize

    9.9MB

  • memory/2672-38-0x0000000000180000-0x000000000018A000-memory.dmp

    Filesize

    40KB