Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
104s -
max time network
110s -
platform
windows10-1703_x64 -
resource
win10-20230915-en -
resource tags
arch:x64arch:x86image:win10-20230915-enlocale:en-usos:windows10-1703-x64system -
submitted
24/09/2023, 01:39
Static task
static1
Behavioral task
behavioral1
Sample
be6882a4b0bacccc0975f14f068d005259d1497139a05dd5cd44a4a387ba48eb.exe
Resource
win10-20230915-en
General
-
Target
be6882a4b0bacccc0975f14f068d005259d1497139a05dd5cd44a4a387ba48eb.exe
-
Size
933KB
-
MD5
94c5ab840e8b4e75489f701e195c577b
-
SHA1
1f2c8492b75888b26cf4a3906a9d546abaf41627
-
SHA256
be6882a4b0bacccc0975f14f068d005259d1497139a05dd5cd44a4a387ba48eb
-
SHA512
e4594d8ca8375f3ac35b0bda42f7002ced3b558ff4832bf9407b4cee05366de0b497b5f0c28a13421926dcd7cb464315eb7186bc243917e599817ba592f62651
-
SSDEEP
24576:nyTDuksQFdmbrNhScd7PHWKP6diY8FCR2:yfuSFwbrNhS2z2CjYDR
Malware Config
Signatures
-
Detects Healer an antivirus disabler dropper 1 IoCs
resource yara_rule behavioral1/memory/2284-28-0x0000000000400000-0x000000000040A000-memory.dmp healer -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" AppLaunch.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" AppLaunch.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" AppLaunch.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" AppLaunch.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" AppLaunch.exe -
Executes dropped EXE 4 IoCs
pid Process 1040 v2704231.exe 3848 v0551435.exe 1312 v5295163.exe 1348 a6801733.exe -
Adds Run key to start application 2 TTPs 4 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" be6882a4b0bacccc0975f14f068d005259d1497139a05dd5cd44a4a387ba48eb.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" v2704231.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\"" v0551435.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup3 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP003.TMP\\\"" v5295163.exe -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 1348 set thread context of 2284 1348 a6801733.exe 73 -
Program crash 1 IoCs
pid pid_target Process procid_target 1564 1348 WerFault.exe 72 -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 2284 AppLaunch.exe 2284 AppLaunch.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 2284 AppLaunch.exe -
Suspicious use of WriteProcessMemory 20 IoCs
description pid Process procid_target PID 2420 wrote to memory of 1040 2420 be6882a4b0bacccc0975f14f068d005259d1497139a05dd5cd44a4a387ba48eb.exe 69 PID 2420 wrote to memory of 1040 2420 be6882a4b0bacccc0975f14f068d005259d1497139a05dd5cd44a4a387ba48eb.exe 69 PID 2420 wrote to memory of 1040 2420 be6882a4b0bacccc0975f14f068d005259d1497139a05dd5cd44a4a387ba48eb.exe 69 PID 1040 wrote to memory of 3848 1040 v2704231.exe 70 PID 1040 wrote to memory of 3848 1040 v2704231.exe 70 PID 1040 wrote to memory of 3848 1040 v2704231.exe 70 PID 3848 wrote to memory of 1312 3848 v0551435.exe 71 PID 3848 wrote to memory of 1312 3848 v0551435.exe 71 PID 3848 wrote to memory of 1312 3848 v0551435.exe 71 PID 1312 wrote to memory of 1348 1312 v5295163.exe 72 PID 1312 wrote to memory of 1348 1312 v5295163.exe 72 PID 1312 wrote to memory of 1348 1312 v5295163.exe 72 PID 1348 wrote to memory of 2284 1348 a6801733.exe 73 PID 1348 wrote to memory of 2284 1348 a6801733.exe 73 PID 1348 wrote to memory of 2284 1348 a6801733.exe 73 PID 1348 wrote to memory of 2284 1348 a6801733.exe 73 PID 1348 wrote to memory of 2284 1348 a6801733.exe 73 PID 1348 wrote to memory of 2284 1348 a6801733.exe 73 PID 1348 wrote to memory of 2284 1348 a6801733.exe 73 PID 1348 wrote to memory of 2284 1348 a6801733.exe 73
Processes
-
C:\Users\Admin\AppData\Local\Temp\be6882a4b0bacccc0975f14f068d005259d1497139a05dd5cd44a4a387ba48eb.exe"C:\Users\Admin\AppData\Local\Temp\be6882a4b0bacccc0975f14f068d005259d1497139a05dd5cd44a4a387ba48eb.exe"1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:2420 -
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v2704231.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v2704231.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:1040 -
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v0551435.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v0551435.exe3⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:3848 -
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\v5295163.exeC:\Users\Admin\AppData\Local\Temp\IXP002.TMP\v5295163.exe4⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:1312 -
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\a6801733.exeC:\Users\Admin\AppData\Local\Temp\IXP003.TMP\a6801733.exe5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1348 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"6⤵
- Modifies Windows Defender Real-time Protection settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2284
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1348 -s 5526⤵
- Program crash
PID:1564
-
-
-
-
-
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
831KB
MD54360209e1ec2907230dfbfe08d584c7d
SHA19de6f56cc2d20356741740ff7b5c67e1be59cfa6
SHA2563509269a32378a661f2a41e986badd3b82fcfcd1256171f7f144d449dfb459c0
SHA512cf58b6514611f0d0f1f499f72154946594673f46660a8ad0f04adc66a1ea28eaefecd71baf4fa078379db82a8cf4a5fde2f93ba13fbc69c6cb8ac1eb550c38b3
-
Filesize
831KB
MD54360209e1ec2907230dfbfe08d584c7d
SHA19de6f56cc2d20356741740ff7b5c67e1be59cfa6
SHA2563509269a32378a661f2a41e986badd3b82fcfcd1256171f7f144d449dfb459c0
SHA512cf58b6514611f0d0f1f499f72154946594673f46660a8ad0f04adc66a1ea28eaefecd71baf4fa078379db82a8cf4a5fde2f93ba13fbc69c6cb8ac1eb550c38b3
-
Filesize
604KB
MD5e4ca384a062d569f5b3db636e77780d4
SHA1396c01b235a0a4c4021d40e33704d4ab0b369da7
SHA256e30e3900960f2f17a33f245fc16b1667cec5c2c70c6782c296b8477e1d60be49
SHA512cafb149f316a6f8e2ad17f6eab18307686dea4082d5fd19dd4a428b0d902faaa5e8f1735faad8728094851035ab40fdebf4f9d1bfae97f165a72da8e6670d8ac
-
Filesize
604KB
MD5e4ca384a062d569f5b3db636e77780d4
SHA1396c01b235a0a4c4021d40e33704d4ab0b369da7
SHA256e30e3900960f2f17a33f245fc16b1667cec5c2c70c6782c296b8477e1d60be49
SHA512cafb149f316a6f8e2ad17f6eab18307686dea4082d5fd19dd4a428b0d902faaa5e8f1735faad8728094851035ab40fdebf4f9d1bfae97f165a72da8e6670d8ac
-
Filesize
344KB
MD53302cb96f2e78df45b5a285ad5ab93e0
SHA172c22273ca9737e5fef7523ea53fb10f8ae1505a
SHA256de91757813fb9795ca7799ff71534d0254681682e2a50b721d63ce7a45e70ac0
SHA512e627c4b91cce00bc05b044885145436f79a961b139c92caa4f55515fa1cb120d0201e365984d6eebf47f6b05dacd28212437732174d083408bccded0bb06ba4d
-
Filesize
344KB
MD53302cb96f2e78df45b5a285ad5ab93e0
SHA172c22273ca9737e5fef7523ea53fb10f8ae1505a
SHA256de91757813fb9795ca7799ff71534d0254681682e2a50b721d63ce7a45e70ac0
SHA512e627c4b91cce00bc05b044885145436f79a961b139c92caa4f55515fa1cb120d0201e365984d6eebf47f6b05dacd28212437732174d083408bccded0bb06ba4d
-
Filesize
220KB
MD5320ff3fc99045974a3e3b00c1b4211fe
SHA1cca91a54907e0adea094f9f1576d20eda155f70c
SHA2566d8db0bb44a86151647b1f1164e2b2c015b62f1f8af86b35db4e95ff32707c40
SHA512b676425b5fe86e951235c973d8a1732161cdf89b16b673f2bb457a8eb497cdaadeaa6f06d59861eb7478739a1ce0d1fcc5ffea6e3e26f978778a219b501bf15d
-
Filesize
220KB
MD5320ff3fc99045974a3e3b00c1b4211fe
SHA1cca91a54907e0adea094f9f1576d20eda155f70c
SHA2566d8db0bb44a86151647b1f1164e2b2c015b62f1f8af86b35db4e95ff32707c40
SHA512b676425b5fe86e951235c973d8a1732161cdf89b16b673f2bb457a8eb497cdaadeaa6f06d59861eb7478739a1ce0d1fcc5ffea6e3e26f978778a219b501bf15d