Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    122s
  • max time network
    125s
  • platform
    windows7_x64
  • resource
    win7-20230831-en
  • resource tags

    arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
  • submitted
    23/09/2023, 15:51

General

  • Target

    e1c29f91924be94ceb6cbc2aecbd34ccdd9b2761d4b1c.exe

  • Size

    1.0MB

  • MD5

    6bf4c9d2b8dbd206c60ca8cd78c66141

  • SHA1

    638da5eaece51d6cf4ac16b8c157d0794b873eb1

  • SHA256

    e1c29f91924be94ceb6cbc2aecbd34ccdd9b2761d4b1c880e91bd0b053bbc79a

  • SHA512

    4f653e12ac116bfd1012c7c71beda733cd5d3401fefff98b8a1f9506665fe350795981909b6c16a0b99ffab56ccbddffd0d6e5ea8431933227b72e49a883cec7

  • SSDEEP

    24576:iyCQhvgJFECQG2llomrEaAHEw3+oOG3P+uUG:JCQhYJslohHEw3cG3

Malware Config

Signatures

  • Detects Healer an antivirus disabler dropper 4 IoCs
  • Healer

    Healer an antivirus disabler dropper.

  • Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs
  • Executes dropped EXE 5 IoCs
  • Loads dropped DLL 14 IoCs
  • Windows security modification 2 TTPs 2 IoCs
  • Adds Run key to start application 2 TTPs 4 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Program crash 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 63 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\e1c29f91924be94ceb6cbc2aecbd34ccdd9b2761d4b1c.exe
    "C:\Users\Admin\AppData\Local\Temp\e1c29f91924be94ceb6cbc2aecbd34ccdd9b2761d4b1c.exe"
    1⤵
    • Loads dropped DLL
    • Adds Run key to start application
    • Suspicious use of WriteProcessMemory
    PID:2188
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v0139395.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v0139395.exe
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Adds Run key to start application
      • Suspicious use of WriteProcessMemory
      PID:2052
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v5523814.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v5523814.exe
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Adds Run key to start application
        • Suspicious use of WriteProcessMemory
        PID:2584
        • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\v2232713.exe
          C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\v2232713.exe
          4⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • Adds Run key to start application
          • Suspicious use of WriteProcessMemory
          PID:2728
          • C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\a3839540.exe
            C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\a3839540.exe
            5⤵
            • Modifies Windows Defender Real-time Protection settings
            • Executes dropped EXE
            • Windows security modification
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:2596
          • C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\b1121980.exe
            C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\b1121980.exe
            5⤵
            • Executes dropped EXE
            • Loads dropped DLL
            • Suspicious use of SetThreadContext
            • Suspicious use of WriteProcessMemory
            PID:2608
            • C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
              "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
              6⤵
              • Suspicious use of WriteProcessMemory
              PID:2664
              • C:\Windows\SysWOW64\WerFault.exe
                C:\Windows\SysWOW64\WerFault.exe -u -p 2664 -s 268
                7⤵
                • Program crash
                PID:2564
            • C:\Windows\SysWOW64\WerFault.exe
              C:\Windows\SysWOW64\WerFault.exe -u -p 2608 -s 268
              6⤵
              • Loads dropped DLL
              • Program crash
              PID:2504

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v0139395.exe

    Filesize

    961KB

    MD5

    d9f040d855d241e47de3a1453ba55a1e

    SHA1

    2d00d6dec7749e6fcc6eb3f84ab1cc5aebace0bb

    SHA256

    a02e356eee47289418037bdcaa8b5b84a6c180e4a72dc5554de79798672d5e8a

    SHA512

    b29b9f27f2c584d4377ee3e322a2548758e63df1aafe5ce9b846e80ce5daebae9c32ca909212c7f103fd7fe5fd666a3a715c832e13ad7982ef2b1d7898aad43c

  • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v0139395.exe

    Filesize

    961KB

    MD5

    d9f040d855d241e47de3a1453ba55a1e

    SHA1

    2d00d6dec7749e6fcc6eb3f84ab1cc5aebace0bb

    SHA256

    a02e356eee47289418037bdcaa8b5b84a6c180e4a72dc5554de79798672d5e8a

    SHA512

    b29b9f27f2c584d4377ee3e322a2548758e63df1aafe5ce9b846e80ce5daebae9c32ca909212c7f103fd7fe5fd666a3a715c832e13ad7982ef2b1d7898aad43c

  • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v5523814.exe

    Filesize

    658KB

    MD5

    8c88f4e2a9cbd0f50308ecfbf2682492

    SHA1

    e507d31c34bcd36f6f07c3b4d8281736f040638e

    SHA256

    9d1636298ec6323ac30f7517bf00f730242e299260607050cd68bd0b2e70150f

    SHA512

    4c4176cc20acffe78e2973e38c2d7ac0668770d6ad0180fd9a12e3d8807037b9e18636053e2cfde6d9ab1d048196b6772b9a9df41b2f638c266ee923fa47a223

  • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v5523814.exe

    Filesize

    658KB

    MD5

    8c88f4e2a9cbd0f50308ecfbf2682492

    SHA1

    e507d31c34bcd36f6f07c3b4d8281736f040638e

    SHA256

    9d1636298ec6323ac30f7517bf00f730242e299260607050cd68bd0b2e70150f

    SHA512

    4c4176cc20acffe78e2973e38c2d7ac0668770d6ad0180fd9a12e3d8807037b9e18636053e2cfde6d9ab1d048196b6772b9a9df41b2f638c266ee923fa47a223

  • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\v2232713.exe

    Filesize

    387KB

    MD5

    b632113c967bf119c2ffb113d0ec60c1

    SHA1

    276ea6f7dd7213adfe9b343245bfa194bc33ee12

    SHA256

    e2f83068722be66f38fafe331c409f92898a4abfff1926a64c7577489c5fb89a

    SHA512

    f9367f52715bd2e83f0cb6655a0ec09458d1f371fb9263ed44da9a92e6647d301d15c77fe297027937b354100f4565d23d8ed8fcfcd954bf3effdc736f89127b

  • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\v2232713.exe

    Filesize

    387KB

    MD5

    b632113c967bf119c2ffb113d0ec60c1

    SHA1

    276ea6f7dd7213adfe9b343245bfa194bc33ee12

    SHA256

    e2f83068722be66f38fafe331c409f92898a4abfff1926a64c7577489c5fb89a

    SHA512

    f9367f52715bd2e83f0cb6655a0ec09458d1f371fb9263ed44da9a92e6647d301d15c77fe297027937b354100f4565d23d8ed8fcfcd954bf3effdc736f89127b

  • C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\a3839540.exe

    Filesize

    11KB

    MD5

    c8a8cea45e9b40590620ed7be3a231aa

    SHA1

    104f68acbfb921ed2e7bf6fb35f427643e7bbc2c

    SHA256

    e8777b31dbbc5db5ca15255be6ba323e57a5ca6eefe1f775d35bb05925af4aa1

    SHA512

    c59e0d5da5c966524f2370a5877212a3cfc9fc628ac7a09608bac67a13e5325c3858e50131fa4e0b1e6cdc036e48c481d40cfceeebf5cc52ab050ca1ff77f7d1

  • C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\a3839540.exe

    Filesize

    11KB

    MD5

    c8a8cea45e9b40590620ed7be3a231aa

    SHA1

    104f68acbfb921ed2e7bf6fb35f427643e7bbc2c

    SHA256

    e8777b31dbbc5db5ca15255be6ba323e57a5ca6eefe1f775d35bb05925af4aa1

    SHA512

    c59e0d5da5c966524f2370a5877212a3cfc9fc628ac7a09608bac67a13e5325c3858e50131fa4e0b1e6cdc036e48c481d40cfceeebf5cc52ab050ca1ff77f7d1

  • C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\b1121980.exe

    Filesize

    700KB

    MD5

    4512b6c7e1f51db836d1540f2c9a75ac

    SHA1

    29da3d6f1ebf55b797f6c8b585c1c1690673dd4b

    SHA256

    d870398c8243d9c8549a4b373eb665975675564e449c88c82b17470ff0b1c9ba

    SHA512

    0e320f9a1435940ffa59b8bc7e901b0afacff9fa7fcee8bd3ccf37107c0c7d463d26db152171b708e05dd1e0570cf0ef4c2de5735aa26fa1cc58da6c33e8488b

  • C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\b1121980.exe

    Filesize

    700KB

    MD5

    4512b6c7e1f51db836d1540f2c9a75ac

    SHA1

    29da3d6f1ebf55b797f6c8b585c1c1690673dd4b

    SHA256

    d870398c8243d9c8549a4b373eb665975675564e449c88c82b17470ff0b1c9ba

    SHA512

    0e320f9a1435940ffa59b8bc7e901b0afacff9fa7fcee8bd3ccf37107c0c7d463d26db152171b708e05dd1e0570cf0ef4c2de5735aa26fa1cc58da6c33e8488b

  • C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\b1121980.exe

    Filesize

    700KB

    MD5

    4512b6c7e1f51db836d1540f2c9a75ac

    SHA1

    29da3d6f1ebf55b797f6c8b585c1c1690673dd4b

    SHA256

    d870398c8243d9c8549a4b373eb665975675564e449c88c82b17470ff0b1c9ba

    SHA512

    0e320f9a1435940ffa59b8bc7e901b0afacff9fa7fcee8bd3ccf37107c0c7d463d26db152171b708e05dd1e0570cf0ef4c2de5735aa26fa1cc58da6c33e8488b

  • \Users\Admin\AppData\Local\Temp\IXP000.TMP\v0139395.exe

    Filesize

    961KB

    MD5

    d9f040d855d241e47de3a1453ba55a1e

    SHA1

    2d00d6dec7749e6fcc6eb3f84ab1cc5aebace0bb

    SHA256

    a02e356eee47289418037bdcaa8b5b84a6c180e4a72dc5554de79798672d5e8a

    SHA512

    b29b9f27f2c584d4377ee3e322a2548758e63df1aafe5ce9b846e80ce5daebae9c32ca909212c7f103fd7fe5fd666a3a715c832e13ad7982ef2b1d7898aad43c

  • \Users\Admin\AppData\Local\Temp\IXP000.TMP\v0139395.exe

    Filesize

    961KB

    MD5

    d9f040d855d241e47de3a1453ba55a1e

    SHA1

    2d00d6dec7749e6fcc6eb3f84ab1cc5aebace0bb

    SHA256

    a02e356eee47289418037bdcaa8b5b84a6c180e4a72dc5554de79798672d5e8a

    SHA512

    b29b9f27f2c584d4377ee3e322a2548758e63df1aafe5ce9b846e80ce5daebae9c32ca909212c7f103fd7fe5fd666a3a715c832e13ad7982ef2b1d7898aad43c

  • \Users\Admin\AppData\Local\Temp\IXP001.TMP\v5523814.exe

    Filesize

    658KB

    MD5

    8c88f4e2a9cbd0f50308ecfbf2682492

    SHA1

    e507d31c34bcd36f6f07c3b4d8281736f040638e

    SHA256

    9d1636298ec6323ac30f7517bf00f730242e299260607050cd68bd0b2e70150f

    SHA512

    4c4176cc20acffe78e2973e38c2d7ac0668770d6ad0180fd9a12e3d8807037b9e18636053e2cfde6d9ab1d048196b6772b9a9df41b2f638c266ee923fa47a223

  • \Users\Admin\AppData\Local\Temp\IXP001.TMP\v5523814.exe

    Filesize

    658KB

    MD5

    8c88f4e2a9cbd0f50308ecfbf2682492

    SHA1

    e507d31c34bcd36f6f07c3b4d8281736f040638e

    SHA256

    9d1636298ec6323ac30f7517bf00f730242e299260607050cd68bd0b2e70150f

    SHA512

    4c4176cc20acffe78e2973e38c2d7ac0668770d6ad0180fd9a12e3d8807037b9e18636053e2cfde6d9ab1d048196b6772b9a9df41b2f638c266ee923fa47a223

  • \Users\Admin\AppData\Local\Temp\IXP002.TMP\v2232713.exe

    Filesize

    387KB

    MD5

    b632113c967bf119c2ffb113d0ec60c1

    SHA1

    276ea6f7dd7213adfe9b343245bfa194bc33ee12

    SHA256

    e2f83068722be66f38fafe331c409f92898a4abfff1926a64c7577489c5fb89a

    SHA512

    f9367f52715bd2e83f0cb6655a0ec09458d1f371fb9263ed44da9a92e6647d301d15c77fe297027937b354100f4565d23d8ed8fcfcd954bf3effdc736f89127b

  • \Users\Admin\AppData\Local\Temp\IXP002.TMP\v2232713.exe

    Filesize

    387KB

    MD5

    b632113c967bf119c2ffb113d0ec60c1

    SHA1

    276ea6f7dd7213adfe9b343245bfa194bc33ee12

    SHA256

    e2f83068722be66f38fafe331c409f92898a4abfff1926a64c7577489c5fb89a

    SHA512

    f9367f52715bd2e83f0cb6655a0ec09458d1f371fb9263ed44da9a92e6647d301d15c77fe297027937b354100f4565d23d8ed8fcfcd954bf3effdc736f89127b

  • \Users\Admin\AppData\Local\Temp\IXP003.TMP\a3839540.exe

    Filesize

    11KB

    MD5

    c8a8cea45e9b40590620ed7be3a231aa

    SHA1

    104f68acbfb921ed2e7bf6fb35f427643e7bbc2c

    SHA256

    e8777b31dbbc5db5ca15255be6ba323e57a5ca6eefe1f775d35bb05925af4aa1

    SHA512

    c59e0d5da5c966524f2370a5877212a3cfc9fc628ac7a09608bac67a13e5325c3858e50131fa4e0b1e6cdc036e48c481d40cfceeebf5cc52ab050ca1ff77f7d1

  • \Users\Admin\AppData\Local\Temp\IXP003.TMP\b1121980.exe

    Filesize

    700KB

    MD5

    4512b6c7e1f51db836d1540f2c9a75ac

    SHA1

    29da3d6f1ebf55b797f6c8b585c1c1690673dd4b

    SHA256

    d870398c8243d9c8549a4b373eb665975675564e449c88c82b17470ff0b1c9ba

    SHA512

    0e320f9a1435940ffa59b8bc7e901b0afacff9fa7fcee8bd3ccf37107c0c7d463d26db152171b708e05dd1e0570cf0ef4c2de5735aa26fa1cc58da6c33e8488b

  • \Users\Admin\AppData\Local\Temp\IXP003.TMP\b1121980.exe

    Filesize

    700KB

    MD5

    4512b6c7e1f51db836d1540f2c9a75ac

    SHA1

    29da3d6f1ebf55b797f6c8b585c1c1690673dd4b

    SHA256

    d870398c8243d9c8549a4b373eb665975675564e449c88c82b17470ff0b1c9ba

    SHA512

    0e320f9a1435940ffa59b8bc7e901b0afacff9fa7fcee8bd3ccf37107c0c7d463d26db152171b708e05dd1e0570cf0ef4c2de5735aa26fa1cc58da6c33e8488b

  • \Users\Admin\AppData\Local\Temp\IXP003.TMP\b1121980.exe

    Filesize

    700KB

    MD5

    4512b6c7e1f51db836d1540f2c9a75ac

    SHA1

    29da3d6f1ebf55b797f6c8b585c1c1690673dd4b

    SHA256

    d870398c8243d9c8549a4b373eb665975675564e449c88c82b17470ff0b1c9ba

    SHA512

    0e320f9a1435940ffa59b8bc7e901b0afacff9fa7fcee8bd3ccf37107c0c7d463d26db152171b708e05dd1e0570cf0ef4c2de5735aa26fa1cc58da6c33e8488b

  • \Users\Admin\AppData\Local\Temp\IXP003.TMP\b1121980.exe

    Filesize

    700KB

    MD5

    4512b6c7e1f51db836d1540f2c9a75ac

    SHA1

    29da3d6f1ebf55b797f6c8b585c1c1690673dd4b

    SHA256

    d870398c8243d9c8549a4b373eb665975675564e449c88c82b17470ff0b1c9ba

    SHA512

    0e320f9a1435940ffa59b8bc7e901b0afacff9fa7fcee8bd3ccf37107c0c7d463d26db152171b708e05dd1e0570cf0ef4c2de5735aa26fa1cc58da6c33e8488b

  • \Users\Admin\AppData\Local\Temp\IXP003.TMP\b1121980.exe

    Filesize

    700KB

    MD5

    4512b6c7e1f51db836d1540f2c9a75ac

    SHA1

    29da3d6f1ebf55b797f6c8b585c1c1690673dd4b

    SHA256

    d870398c8243d9c8549a4b373eb665975675564e449c88c82b17470ff0b1c9ba

    SHA512

    0e320f9a1435940ffa59b8bc7e901b0afacff9fa7fcee8bd3ccf37107c0c7d463d26db152171b708e05dd1e0570cf0ef4c2de5735aa26fa1cc58da6c33e8488b

  • \Users\Admin\AppData\Local\Temp\IXP003.TMP\b1121980.exe

    Filesize

    700KB

    MD5

    4512b6c7e1f51db836d1540f2c9a75ac

    SHA1

    29da3d6f1ebf55b797f6c8b585c1c1690673dd4b

    SHA256

    d870398c8243d9c8549a4b373eb665975675564e449c88c82b17470ff0b1c9ba

    SHA512

    0e320f9a1435940ffa59b8bc7e901b0afacff9fa7fcee8bd3ccf37107c0c7d463d26db152171b708e05dd1e0570cf0ef4c2de5735aa26fa1cc58da6c33e8488b

  • \Users\Admin\AppData\Local\Temp\IXP003.TMP\b1121980.exe

    Filesize

    700KB

    MD5

    4512b6c7e1f51db836d1540f2c9a75ac

    SHA1

    29da3d6f1ebf55b797f6c8b585c1c1690673dd4b

    SHA256

    d870398c8243d9c8549a4b373eb665975675564e449c88c82b17470ff0b1c9ba

    SHA512

    0e320f9a1435940ffa59b8bc7e901b0afacff9fa7fcee8bd3ccf37107c0c7d463d26db152171b708e05dd1e0570cf0ef4c2de5735aa26fa1cc58da6c33e8488b

  • memory/2596-41-0x000007FEF58C0000-0x000007FEF62AC000-memory.dmp

    Filesize

    9.9MB

  • memory/2596-40-0x000007FEF58C0000-0x000007FEF62AC000-memory.dmp

    Filesize

    9.9MB

  • memory/2596-38-0x0000000000CE0000-0x0000000000CEA000-memory.dmp

    Filesize

    40KB

  • memory/2596-39-0x000007FEF58C0000-0x000007FEF62AC000-memory.dmp

    Filesize

    9.9MB

  • memory/2664-58-0x0000000000400000-0x000000000042F000-memory.dmp

    Filesize

    188KB

  • memory/2664-56-0x0000000000400000-0x000000000042F000-memory.dmp

    Filesize

    188KB

  • memory/2664-57-0x00000000FFFDE000-0x00000000FFFDF000-memory.dmp

    Filesize

    4KB

  • memory/2664-52-0x0000000000400000-0x000000000042F000-memory.dmp

    Filesize

    188KB

  • memory/2664-60-0x0000000000400000-0x000000000042F000-memory.dmp

    Filesize

    188KB

  • memory/2664-62-0x0000000000400000-0x000000000042F000-memory.dmp

    Filesize

    188KB

  • memory/2664-51-0x0000000000400000-0x000000000042F000-memory.dmp

    Filesize

    188KB

  • memory/2664-55-0x0000000000400000-0x000000000042F000-memory.dmp

    Filesize

    188KB

  • memory/2664-54-0x0000000000400000-0x000000000042F000-memory.dmp

    Filesize

    188KB

  • memory/2664-53-0x0000000000400000-0x000000000042F000-memory.dmp

    Filesize

    188KB