Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
120s -
max time network
129s -
platform
windows7_x64 -
resource
win7-20230831-en -
resource tags
arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system -
submitted
30/09/2023, 00:26
Static task
static1
Behavioral task
behavioral1
Sample
8015a689dedb82e08a271eb3c73dae25.exe
Resource
win7-20230831-en
Behavioral task
behavioral2
Sample
8015a689dedb82e08a271eb3c73dae25.exe
Resource
win10v2004-20230915-en
General
-
Target
8015a689dedb82e08a271eb3c73dae25.exe
-
Size
858KB
-
MD5
8015a689dedb82e08a271eb3c73dae25
-
SHA1
da49e81d8483cf6862eeb3a941dc7be823386be6
-
SHA256
61221be0c1a1a39191550be28e12be6c7892ef4a8879ef2b931a08f528e61bef
-
SHA512
889f415762bd9780b3dd16075090914bca33544d1184ff7f4c40af096db818d96014dc656c00d1c07fa22c9acb7afd59f29e005d1531507932e8e8a37de9e17b
-
SSDEEP
12288:MMrDy90nCCkjcjnFIHumsozVhv2In9gaTx4sZ4bSfBu48vBdosH9hD8riSt5Rlwl:/yJjcZcfXvgS4aZu/so9hDGiS1lwoA
Malware Config
Signatures
-
Executes dropped EXE 4 IoCs
pid Process 1964 z9171270.exe 2380 z7744638.exe 2752 z1329028.exe 2736 r4757234.exe -
Loads dropped DLL 13 IoCs
pid Process 2080 8015a689dedb82e08a271eb3c73dae25.exe 1964 z9171270.exe 1964 z9171270.exe 2380 z7744638.exe 2380 z7744638.exe 2752 z1329028.exe 2752 z1329028.exe 2752 z1329028.exe 2736 r4757234.exe 2652 WerFault.exe 2652 WerFault.exe 2652 WerFault.exe 2652 WerFault.exe -
Adds Run key to start application 2 TTPs 4 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\"" z7744638.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup3 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP003.TMP\\\"" z1329028.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" 8015a689dedb82e08a271eb3c73dae25.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" z9171270.exe -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 2736 set thread context of 2856 2736 r4757234.exe 33 -
Program crash 2 IoCs
pid pid_target Process procid_target 2652 2736 WerFault.exe 31 2128 2856 WerFault.exe 33 -
Suspicious use of WriteProcessMemory 56 IoCs
description pid Process procid_target PID 2080 wrote to memory of 1964 2080 8015a689dedb82e08a271eb3c73dae25.exe 28 PID 2080 wrote to memory of 1964 2080 8015a689dedb82e08a271eb3c73dae25.exe 28 PID 2080 wrote to memory of 1964 2080 8015a689dedb82e08a271eb3c73dae25.exe 28 PID 2080 wrote to memory of 1964 2080 8015a689dedb82e08a271eb3c73dae25.exe 28 PID 2080 wrote to memory of 1964 2080 8015a689dedb82e08a271eb3c73dae25.exe 28 PID 2080 wrote to memory of 1964 2080 8015a689dedb82e08a271eb3c73dae25.exe 28 PID 2080 wrote to memory of 1964 2080 8015a689dedb82e08a271eb3c73dae25.exe 28 PID 1964 wrote to memory of 2380 1964 z9171270.exe 29 PID 1964 wrote to memory of 2380 1964 z9171270.exe 29 PID 1964 wrote to memory of 2380 1964 z9171270.exe 29 PID 1964 wrote to memory of 2380 1964 z9171270.exe 29 PID 1964 wrote to memory of 2380 1964 z9171270.exe 29 PID 1964 wrote to memory of 2380 1964 z9171270.exe 29 PID 1964 wrote to memory of 2380 1964 z9171270.exe 29 PID 2380 wrote to memory of 2752 2380 z7744638.exe 30 PID 2380 wrote to memory of 2752 2380 z7744638.exe 30 PID 2380 wrote to memory of 2752 2380 z7744638.exe 30 PID 2380 wrote to memory of 2752 2380 z7744638.exe 30 PID 2380 wrote to memory of 2752 2380 z7744638.exe 30 PID 2380 wrote to memory of 2752 2380 z7744638.exe 30 PID 2380 wrote to memory of 2752 2380 z7744638.exe 30 PID 2752 wrote to memory of 2736 2752 z1329028.exe 31 PID 2752 wrote to memory of 2736 2752 z1329028.exe 31 PID 2752 wrote to memory of 2736 2752 z1329028.exe 31 PID 2752 wrote to memory of 2736 2752 z1329028.exe 31 PID 2752 wrote to memory of 2736 2752 z1329028.exe 31 PID 2752 wrote to memory of 2736 2752 z1329028.exe 31 PID 2752 wrote to memory of 2736 2752 z1329028.exe 31 PID 2736 wrote to memory of 2856 2736 r4757234.exe 33 PID 2736 wrote to memory of 2856 2736 r4757234.exe 33 PID 2736 wrote to memory of 2856 2736 r4757234.exe 33 PID 2736 wrote to memory of 2856 2736 r4757234.exe 33 PID 2736 wrote to memory of 2856 2736 r4757234.exe 33 PID 2736 wrote to memory of 2856 2736 r4757234.exe 33 PID 2736 wrote to memory of 2856 2736 r4757234.exe 33 PID 2736 wrote to memory of 2856 2736 r4757234.exe 33 PID 2736 wrote to memory of 2856 2736 r4757234.exe 33 PID 2736 wrote to memory of 2856 2736 r4757234.exe 33 PID 2736 wrote to memory of 2856 2736 r4757234.exe 33 PID 2736 wrote to memory of 2856 2736 r4757234.exe 33 PID 2736 wrote to memory of 2856 2736 r4757234.exe 33 PID 2736 wrote to memory of 2856 2736 r4757234.exe 33 PID 2736 wrote to memory of 2652 2736 r4757234.exe 34 PID 2736 wrote to memory of 2652 2736 r4757234.exe 34 PID 2736 wrote to memory of 2652 2736 r4757234.exe 34 PID 2736 wrote to memory of 2652 2736 r4757234.exe 34 PID 2736 wrote to memory of 2652 2736 r4757234.exe 34 PID 2736 wrote to memory of 2652 2736 r4757234.exe 34 PID 2736 wrote to memory of 2652 2736 r4757234.exe 34 PID 2856 wrote to memory of 2128 2856 AppLaunch.exe 35 PID 2856 wrote to memory of 2128 2856 AppLaunch.exe 35 PID 2856 wrote to memory of 2128 2856 AppLaunch.exe 35 PID 2856 wrote to memory of 2128 2856 AppLaunch.exe 35 PID 2856 wrote to memory of 2128 2856 AppLaunch.exe 35 PID 2856 wrote to memory of 2128 2856 AppLaunch.exe 35 PID 2856 wrote to memory of 2128 2856 AppLaunch.exe 35
Processes
-
C:\Users\Admin\AppData\Local\Temp\8015a689dedb82e08a271eb3c73dae25.exe"C:\Users\Admin\AppData\Local\Temp\8015a689dedb82e08a271eb3c73dae25.exe"1⤵
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:2080 -
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z9171270.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z9171270.exe2⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:1964 -
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z7744638.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z7744638.exe3⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:2380 -
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\z1329028.exeC:\Users\Admin\AppData\Local\Temp\IXP002.TMP\z1329028.exe4⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:2752 -
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\r4757234.exeC:\Users\Admin\AppData\Local\Temp\IXP003.TMP\r4757234.exe5⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2736 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"6⤵
- Suspicious use of WriteProcessMemory
PID:2856 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2856 -s 2687⤵
- Program crash
PID:2128
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2736 -s 2766⤵
- Loads dropped DLL
- Program crash
PID:2652
-
-
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
764KB
MD5d562f0b76b85ad9499b68dfb5a980b81
SHA115dd3f468fdedc472a9574b366e13e011fba07e5
SHA2565c03c2b8f71a0cefb6b93b3e45e6bcbae11d9ca8ab8c34c4ed482846ec1c5c52
SHA512004237610f03c42863735125339bcb26044e227ecbb5c77c36bddc75ebbe31c26f4850a22f93ff83c2e1b0236e76a83e0bfb855788a3125c213bbf2638638c0a
-
Filesize
764KB
MD5d562f0b76b85ad9499b68dfb5a980b81
SHA115dd3f468fdedc472a9574b366e13e011fba07e5
SHA2565c03c2b8f71a0cefb6b93b3e45e6bcbae11d9ca8ab8c34c4ed482846ec1c5c52
SHA512004237610f03c42863735125339bcb26044e227ecbb5c77c36bddc75ebbe31c26f4850a22f93ff83c2e1b0236e76a83e0bfb855788a3125c213bbf2638638c0a
-
Filesize
581KB
MD5d89feb4a0d80834e13aa810d82f6ab57
SHA19ee5a0df1f5c00f5ea37a102ca3bd28dd33786d9
SHA256ec0a4065c6dcf5f2d52cb14d0be222c16cbf8f896b5f7c486d9367f1c3d8eabc
SHA5126cb197a171c35130041bae888d8f4a3a8daab07bbb6db90d9e67f88e25eac2ad58d6d70fa287d5c60d753a46214cda1b11b57d103314d44b518633136020e97d
-
Filesize
581KB
MD5d89feb4a0d80834e13aa810d82f6ab57
SHA19ee5a0df1f5c00f5ea37a102ca3bd28dd33786d9
SHA256ec0a4065c6dcf5f2d52cb14d0be222c16cbf8f896b5f7c486d9367f1c3d8eabc
SHA5126cb197a171c35130041bae888d8f4a3a8daab07bbb6db90d9e67f88e25eac2ad58d6d70fa287d5c60d753a46214cda1b11b57d103314d44b518633136020e97d
-
Filesize
399KB
MD5b21a69c9906ecbd153e6a5833f34f123
SHA1d97b8650c4ae35939fb7a1a9781052e162548176
SHA256ac183f88a05ebed1a45ff2f33ffe6656d5170365dd6bc020bb47a9f2f27021bd
SHA512bd55d67c22f3157007308d297d301d324e72cc81893cfe50a7a191e2cc6e51fa51f393293567c036e75dcdb9500fcc50c82bb851862530a2f5a1f54e0f1c9156
-
Filesize
399KB
MD5b21a69c9906ecbd153e6a5833f34f123
SHA1d97b8650c4ae35939fb7a1a9781052e162548176
SHA256ac183f88a05ebed1a45ff2f33ffe6656d5170365dd6bc020bb47a9f2f27021bd
SHA512bd55d67c22f3157007308d297d301d324e72cc81893cfe50a7a191e2cc6e51fa51f393293567c036e75dcdb9500fcc50c82bb851862530a2f5a1f54e0f1c9156
-
Filesize
356KB
MD56dd69237f51a66a0e6a1d936409e47ee
SHA135508ee98d6908645461648baa32b34a66147b2b
SHA256b9d10ffbb119f0c4294a624dadd62e2896911b3acdbc199a9ab7c1b220b9e1fb
SHA5124b79f3b3731d047a844963e2235b7da0e20c18740955efe1faf236a10abbb2eea8c9cabcff717f7c1c2647ac13b17b8325d06e9c6a2c48d10e7e21c004fb3212
-
Filesize
356KB
MD56dd69237f51a66a0e6a1d936409e47ee
SHA135508ee98d6908645461648baa32b34a66147b2b
SHA256b9d10ffbb119f0c4294a624dadd62e2896911b3acdbc199a9ab7c1b220b9e1fb
SHA5124b79f3b3731d047a844963e2235b7da0e20c18740955efe1faf236a10abbb2eea8c9cabcff717f7c1c2647ac13b17b8325d06e9c6a2c48d10e7e21c004fb3212
-
Filesize
356KB
MD56dd69237f51a66a0e6a1d936409e47ee
SHA135508ee98d6908645461648baa32b34a66147b2b
SHA256b9d10ffbb119f0c4294a624dadd62e2896911b3acdbc199a9ab7c1b220b9e1fb
SHA5124b79f3b3731d047a844963e2235b7da0e20c18740955efe1faf236a10abbb2eea8c9cabcff717f7c1c2647ac13b17b8325d06e9c6a2c48d10e7e21c004fb3212
-
Filesize
764KB
MD5d562f0b76b85ad9499b68dfb5a980b81
SHA115dd3f468fdedc472a9574b366e13e011fba07e5
SHA2565c03c2b8f71a0cefb6b93b3e45e6bcbae11d9ca8ab8c34c4ed482846ec1c5c52
SHA512004237610f03c42863735125339bcb26044e227ecbb5c77c36bddc75ebbe31c26f4850a22f93ff83c2e1b0236e76a83e0bfb855788a3125c213bbf2638638c0a
-
Filesize
764KB
MD5d562f0b76b85ad9499b68dfb5a980b81
SHA115dd3f468fdedc472a9574b366e13e011fba07e5
SHA2565c03c2b8f71a0cefb6b93b3e45e6bcbae11d9ca8ab8c34c4ed482846ec1c5c52
SHA512004237610f03c42863735125339bcb26044e227ecbb5c77c36bddc75ebbe31c26f4850a22f93ff83c2e1b0236e76a83e0bfb855788a3125c213bbf2638638c0a
-
Filesize
581KB
MD5d89feb4a0d80834e13aa810d82f6ab57
SHA19ee5a0df1f5c00f5ea37a102ca3bd28dd33786d9
SHA256ec0a4065c6dcf5f2d52cb14d0be222c16cbf8f896b5f7c486d9367f1c3d8eabc
SHA5126cb197a171c35130041bae888d8f4a3a8daab07bbb6db90d9e67f88e25eac2ad58d6d70fa287d5c60d753a46214cda1b11b57d103314d44b518633136020e97d
-
Filesize
581KB
MD5d89feb4a0d80834e13aa810d82f6ab57
SHA19ee5a0df1f5c00f5ea37a102ca3bd28dd33786d9
SHA256ec0a4065c6dcf5f2d52cb14d0be222c16cbf8f896b5f7c486d9367f1c3d8eabc
SHA5126cb197a171c35130041bae888d8f4a3a8daab07bbb6db90d9e67f88e25eac2ad58d6d70fa287d5c60d753a46214cda1b11b57d103314d44b518633136020e97d
-
Filesize
399KB
MD5b21a69c9906ecbd153e6a5833f34f123
SHA1d97b8650c4ae35939fb7a1a9781052e162548176
SHA256ac183f88a05ebed1a45ff2f33ffe6656d5170365dd6bc020bb47a9f2f27021bd
SHA512bd55d67c22f3157007308d297d301d324e72cc81893cfe50a7a191e2cc6e51fa51f393293567c036e75dcdb9500fcc50c82bb851862530a2f5a1f54e0f1c9156
-
Filesize
399KB
MD5b21a69c9906ecbd153e6a5833f34f123
SHA1d97b8650c4ae35939fb7a1a9781052e162548176
SHA256ac183f88a05ebed1a45ff2f33ffe6656d5170365dd6bc020bb47a9f2f27021bd
SHA512bd55d67c22f3157007308d297d301d324e72cc81893cfe50a7a191e2cc6e51fa51f393293567c036e75dcdb9500fcc50c82bb851862530a2f5a1f54e0f1c9156
-
Filesize
356KB
MD56dd69237f51a66a0e6a1d936409e47ee
SHA135508ee98d6908645461648baa32b34a66147b2b
SHA256b9d10ffbb119f0c4294a624dadd62e2896911b3acdbc199a9ab7c1b220b9e1fb
SHA5124b79f3b3731d047a844963e2235b7da0e20c18740955efe1faf236a10abbb2eea8c9cabcff717f7c1c2647ac13b17b8325d06e9c6a2c48d10e7e21c004fb3212
-
Filesize
356KB
MD56dd69237f51a66a0e6a1d936409e47ee
SHA135508ee98d6908645461648baa32b34a66147b2b
SHA256b9d10ffbb119f0c4294a624dadd62e2896911b3acdbc199a9ab7c1b220b9e1fb
SHA5124b79f3b3731d047a844963e2235b7da0e20c18740955efe1faf236a10abbb2eea8c9cabcff717f7c1c2647ac13b17b8325d06e9c6a2c48d10e7e21c004fb3212
-
Filesize
356KB
MD56dd69237f51a66a0e6a1d936409e47ee
SHA135508ee98d6908645461648baa32b34a66147b2b
SHA256b9d10ffbb119f0c4294a624dadd62e2896911b3acdbc199a9ab7c1b220b9e1fb
SHA5124b79f3b3731d047a844963e2235b7da0e20c18740955efe1faf236a10abbb2eea8c9cabcff717f7c1c2647ac13b17b8325d06e9c6a2c48d10e7e21c004fb3212
-
Filesize
356KB
MD56dd69237f51a66a0e6a1d936409e47ee
SHA135508ee98d6908645461648baa32b34a66147b2b
SHA256b9d10ffbb119f0c4294a624dadd62e2896911b3acdbc199a9ab7c1b220b9e1fb
SHA5124b79f3b3731d047a844963e2235b7da0e20c18740955efe1faf236a10abbb2eea8c9cabcff717f7c1c2647ac13b17b8325d06e9c6a2c48d10e7e21c004fb3212
-
Filesize
356KB
MD56dd69237f51a66a0e6a1d936409e47ee
SHA135508ee98d6908645461648baa32b34a66147b2b
SHA256b9d10ffbb119f0c4294a624dadd62e2896911b3acdbc199a9ab7c1b220b9e1fb
SHA5124b79f3b3731d047a844963e2235b7da0e20c18740955efe1faf236a10abbb2eea8c9cabcff717f7c1c2647ac13b17b8325d06e9c6a2c48d10e7e21c004fb3212
-
Filesize
356KB
MD56dd69237f51a66a0e6a1d936409e47ee
SHA135508ee98d6908645461648baa32b34a66147b2b
SHA256b9d10ffbb119f0c4294a624dadd62e2896911b3acdbc199a9ab7c1b220b9e1fb
SHA5124b79f3b3731d047a844963e2235b7da0e20c18740955efe1faf236a10abbb2eea8c9cabcff717f7c1c2647ac13b17b8325d06e9c6a2c48d10e7e21c004fb3212
-
Filesize
356KB
MD56dd69237f51a66a0e6a1d936409e47ee
SHA135508ee98d6908645461648baa32b34a66147b2b
SHA256b9d10ffbb119f0c4294a624dadd62e2896911b3acdbc199a9ab7c1b220b9e1fb
SHA5124b79f3b3731d047a844963e2235b7da0e20c18740955efe1faf236a10abbb2eea8c9cabcff717f7c1c2647ac13b17b8325d06e9c6a2c48d10e7e21c004fb3212