Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    121s
  • max time network
    124s
  • platform
    windows7_x64
  • resource
    win7-20230831-en
  • resource tags

    arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
  • submitted
    03/10/2023, 12:59

General

  • Target

    file.exe

  • Size

    1.4MB

  • MD5

    8e4953b029a067606b849f9ee0c4b84a

  • SHA1

    d436270f3c48dbaff65b1b457151b54ea16e2139

  • SHA256

    48eb3ec3e2861155e7452daa59c6b022f15c3927bcd482fe15b0827460e58c6c

  • SHA512

    dcfbcca7294d956f95dc005d865c01c41759661499381d3f941b62f6af3e4cd612879dee7d7255f69169baceda052b1f1b8a8eaf99cb3ff89d46ed00c519fb94

  • SSDEEP

    24576:KyWIlnP1wm8LGHLxaZqoelH8det2gh4t4oeprHSY6MN6EexrIyLiizypi/XmGVv:RWaIoE8Xlcd82git4oWjBNN7IIoypifJ

Malware Config

Signatures

  • Detects Healer an antivirus disabler dropper 4 IoCs
  • Healer

    Healer an antivirus disabler dropper.

  • Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs
  • Executes dropped EXE 5 IoCs
  • Loads dropped DLL 13 IoCs
  • Windows security modification 2 TTPs 2 IoCs
  • Adds Run key to start application 2 TTPs 4 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Program crash 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 63 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\file.exe
    "C:\Users\Admin\AppData\Local\Temp\file.exe"
    1⤵
    • Loads dropped DLL
    • Adds Run key to start application
    • Suspicious use of WriteProcessMemory
    PID:3064
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\JM6Hw72.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\JM6Hw72.exe
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Adds Run key to start application
      • Suspicious use of WriteProcessMemory
      PID:2824
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\vp1dc20.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\vp1dc20.exe
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Adds Run key to start application
        • Suspicious use of WriteProcessMemory
        PID:1228
        • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\Hs4bG53.exe
          C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\Hs4bG53.exe
          4⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • Adds Run key to start application
          • Suspicious use of WriteProcessMemory
          PID:2760
          • C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\1Hj65Fu7.exe
            C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\1Hj65Fu7.exe
            5⤵
            • Modifies Windows Defender Real-time Protection settings
            • Executes dropped EXE
            • Windows security modification
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:2648
          • C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\2Il2352.exe
            C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\2Il2352.exe
            5⤵
            • Executes dropped EXE
            • Loads dropped DLL
            • Suspicious use of SetThreadContext
            • Suspicious use of WriteProcessMemory
            PID:2764
            • C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
              "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
              6⤵
              • Suspicious use of WriteProcessMemory
              PID:2584
              • C:\Windows\SysWOW64\WerFault.exe
                C:\Windows\SysWOW64\WerFault.exe -u -p 2584 -s 268
                7⤵
                • Program crash
                PID:2596
            • C:\Windows\SysWOW64\WerFault.exe
              C:\Windows\SysWOW64\WerFault.exe -u -p 2764 -s 284
              6⤵
              • Loads dropped DLL
              • Program crash
              PID:2548

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\JM6Hw72.exe

    Filesize

    1.3MB

    MD5

    e1e8abba9a0b456d0c090c11787f30ed

    SHA1

    26dc85a0ea8b6d75fad89e39270e082d114096a5

    SHA256

    934e55a849a0ba8cf736dcd56cd0c4f9dea8e764d6ad9bff139e20a384e61e1d

    SHA512

    d51bc67a952d1a91045c8785eb6cb30eb2812a6ef6af053d64c3370064865d6753bcb4334e60508449e41ff3ef4f505127b7d1ee59f8adeec4420345b0d74375

  • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\JM6Hw72.exe

    Filesize

    1.3MB

    MD5

    e1e8abba9a0b456d0c090c11787f30ed

    SHA1

    26dc85a0ea8b6d75fad89e39270e082d114096a5

    SHA256

    934e55a849a0ba8cf736dcd56cd0c4f9dea8e764d6ad9bff139e20a384e61e1d

    SHA512

    d51bc67a952d1a91045c8785eb6cb30eb2812a6ef6af053d64c3370064865d6753bcb4334e60508449e41ff3ef4f505127b7d1ee59f8adeec4420345b0d74375

  • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\vp1dc20.exe

    Filesize

    876KB

    MD5

    243cec31a427a31c31ec724f4d498d87

    SHA1

    9c4ef6023cd9fa6969e06a172a52976394bc738f

    SHA256

    c307f751174a3bc318dfb60145407b4039da64f062d8f49455b79aee7b5a0a0c

    SHA512

    689bf9d8e202a4fbdeed90169f24a58886f4dae0518555da7a37fa5ff0b06668a227be983163c02d9810ff6588925cae0bd1f3b1cc5ae47549fbf97b102a9bca

  • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\vp1dc20.exe

    Filesize

    876KB

    MD5

    243cec31a427a31c31ec724f4d498d87

    SHA1

    9c4ef6023cd9fa6969e06a172a52976394bc738f

    SHA256

    c307f751174a3bc318dfb60145407b4039da64f062d8f49455b79aee7b5a0a0c

    SHA512

    689bf9d8e202a4fbdeed90169f24a58886f4dae0518555da7a37fa5ff0b06668a227be983163c02d9810ff6588925cae0bd1f3b1cc5ae47549fbf97b102a9bca

  • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\Hs4bG53.exe

    Filesize

    489KB

    MD5

    2e43bdad4a676260f1326bdcdf2588d6

    SHA1

    6c05f043fe6c570dd21aa837a45b52285bd63ef3

    SHA256

    c05cabe7d5ba3926cb32454214cf657595d93c9865fb1041fa4e31683675c3d6

    SHA512

    bd46fe0890d10911d332ebaf408a39639f9bf62417e2f65140be74dd5980ccbced0247823ef0e6ea30e3d8e4e0e0eb18ed20e001ab790125f73240e9abda7788

  • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\Hs4bG53.exe

    Filesize

    489KB

    MD5

    2e43bdad4a676260f1326bdcdf2588d6

    SHA1

    6c05f043fe6c570dd21aa837a45b52285bd63ef3

    SHA256

    c05cabe7d5ba3926cb32454214cf657595d93c9865fb1041fa4e31683675c3d6

    SHA512

    bd46fe0890d10911d332ebaf408a39639f9bf62417e2f65140be74dd5980ccbced0247823ef0e6ea30e3d8e4e0e0eb18ed20e001ab790125f73240e9abda7788

  • C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\1Hj65Fu7.exe

    Filesize

    21KB

    MD5

    3a539005b5120364a61462988075abe9

    SHA1

    bb40cb2ab520d11636af3c141a828bea492e8602

    SHA256

    3767d41de43a0810856ab4ecae45722e1d809412447127fc58281090330f93bc

    SHA512

    af558d46b314e48be13d87af5aed44786278b02f85a69565ec475f966b5ecb9a424c2bd3e04fa2937192f24f24ed964573ad1c438b6c15f9e2997fc339b44938

  • C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\1Hj65Fu7.exe

    Filesize

    21KB

    MD5

    3a539005b5120364a61462988075abe9

    SHA1

    bb40cb2ab520d11636af3c141a828bea492e8602

    SHA256

    3767d41de43a0810856ab4ecae45722e1d809412447127fc58281090330f93bc

    SHA512

    af558d46b314e48be13d87af5aed44786278b02f85a69565ec475f966b5ecb9a424c2bd3e04fa2937192f24f24ed964573ad1c438b6c15f9e2997fc339b44938

  • C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\2Il2352.exe

    Filesize

    1.4MB

    MD5

    3f1a76337cfb740ee90d715a106852d3

    SHA1

    4a849b0eafe7393c9ebba8a30df452c1ea9165d1

    SHA256

    fd1431544e22a95a6adc5257b3ce64f64806d187f8dd9c74cc6fcea7c33b5fed

    SHA512

    8afdd0364756c21d7c981824b3d80b237515e462e19a96bb4cf72ef789c9725676e6885500bfd08f26bde6fed491aebca441c55634f511574e43cfa4d001975a

  • C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\2Il2352.exe

    Filesize

    1.4MB

    MD5

    3f1a76337cfb740ee90d715a106852d3

    SHA1

    4a849b0eafe7393c9ebba8a30df452c1ea9165d1

    SHA256

    fd1431544e22a95a6adc5257b3ce64f64806d187f8dd9c74cc6fcea7c33b5fed

    SHA512

    8afdd0364756c21d7c981824b3d80b237515e462e19a96bb4cf72ef789c9725676e6885500bfd08f26bde6fed491aebca441c55634f511574e43cfa4d001975a

  • \Users\Admin\AppData\Local\Temp\IXP000.TMP\JM6Hw72.exe

    Filesize

    1.3MB

    MD5

    e1e8abba9a0b456d0c090c11787f30ed

    SHA1

    26dc85a0ea8b6d75fad89e39270e082d114096a5

    SHA256

    934e55a849a0ba8cf736dcd56cd0c4f9dea8e764d6ad9bff139e20a384e61e1d

    SHA512

    d51bc67a952d1a91045c8785eb6cb30eb2812a6ef6af053d64c3370064865d6753bcb4334e60508449e41ff3ef4f505127b7d1ee59f8adeec4420345b0d74375

  • \Users\Admin\AppData\Local\Temp\IXP000.TMP\JM6Hw72.exe

    Filesize

    1.3MB

    MD5

    e1e8abba9a0b456d0c090c11787f30ed

    SHA1

    26dc85a0ea8b6d75fad89e39270e082d114096a5

    SHA256

    934e55a849a0ba8cf736dcd56cd0c4f9dea8e764d6ad9bff139e20a384e61e1d

    SHA512

    d51bc67a952d1a91045c8785eb6cb30eb2812a6ef6af053d64c3370064865d6753bcb4334e60508449e41ff3ef4f505127b7d1ee59f8adeec4420345b0d74375

  • \Users\Admin\AppData\Local\Temp\IXP001.TMP\vp1dc20.exe

    Filesize

    876KB

    MD5

    243cec31a427a31c31ec724f4d498d87

    SHA1

    9c4ef6023cd9fa6969e06a172a52976394bc738f

    SHA256

    c307f751174a3bc318dfb60145407b4039da64f062d8f49455b79aee7b5a0a0c

    SHA512

    689bf9d8e202a4fbdeed90169f24a58886f4dae0518555da7a37fa5ff0b06668a227be983163c02d9810ff6588925cae0bd1f3b1cc5ae47549fbf97b102a9bca

  • \Users\Admin\AppData\Local\Temp\IXP001.TMP\vp1dc20.exe

    Filesize

    876KB

    MD5

    243cec31a427a31c31ec724f4d498d87

    SHA1

    9c4ef6023cd9fa6969e06a172a52976394bc738f

    SHA256

    c307f751174a3bc318dfb60145407b4039da64f062d8f49455b79aee7b5a0a0c

    SHA512

    689bf9d8e202a4fbdeed90169f24a58886f4dae0518555da7a37fa5ff0b06668a227be983163c02d9810ff6588925cae0bd1f3b1cc5ae47549fbf97b102a9bca

  • \Users\Admin\AppData\Local\Temp\IXP002.TMP\Hs4bG53.exe

    Filesize

    489KB

    MD5

    2e43bdad4a676260f1326bdcdf2588d6

    SHA1

    6c05f043fe6c570dd21aa837a45b52285bd63ef3

    SHA256

    c05cabe7d5ba3926cb32454214cf657595d93c9865fb1041fa4e31683675c3d6

    SHA512

    bd46fe0890d10911d332ebaf408a39639f9bf62417e2f65140be74dd5980ccbced0247823ef0e6ea30e3d8e4e0e0eb18ed20e001ab790125f73240e9abda7788

  • \Users\Admin\AppData\Local\Temp\IXP002.TMP\Hs4bG53.exe

    Filesize

    489KB

    MD5

    2e43bdad4a676260f1326bdcdf2588d6

    SHA1

    6c05f043fe6c570dd21aa837a45b52285bd63ef3

    SHA256

    c05cabe7d5ba3926cb32454214cf657595d93c9865fb1041fa4e31683675c3d6

    SHA512

    bd46fe0890d10911d332ebaf408a39639f9bf62417e2f65140be74dd5980ccbced0247823ef0e6ea30e3d8e4e0e0eb18ed20e001ab790125f73240e9abda7788

  • \Users\Admin\AppData\Local\Temp\IXP003.TMP\1Hj65Fu7.exe

    Filesize

    21KB

    MD5

    3a539005b5120364a61462988075abe9

    SHA1

    bb40cb2ab520d11636af3c141a828bea492e8602

    SHA256

    3767d41de43a0810856ab4ecae45722e1d809412447127fc58281090330f93bc

    SHA512

    af558d46b314e48be13d87af5aed44786278b02f85a69565ec475f966b5ecb9a424c2bd3e04fa2937192f24f24ed964573ad1c438b6c15f9e2997fc339b44938

  • \Users\Admin\AppData\Local\Temp\IXP003.TMP\2Il2352.exe

    Filesize

    1.4MB

    MD5

    3f1a76337cfb740ee90d715a106852d3

    SHA1

    4a849b0eafe7393c9ebba8a30df452c1ea9165d1

    SHA256

    fd1431544e22a95a6adc5257b3ce64f64806d187f8dd9c74cc6fcea7c33b5fed

    SHA512

    8afdd0364756c21d7c981824b3d80b237515e462e19a96bb4cf72ef789c9725676e6885500bfd08f26bde6fed491aebca441c55634f511574e43cfa4d001975a

  • \Users\Admin\AppData\Local\Temp\IXP003.TMP\2Il2352.exe

    Filesize

    1.4MB

    MD5

    3f1a76337cfb740ee90d715a106852d3

    SHA1

    4a849b0eafe7393c9ebba8a30df452c1ea9165d1

    SHA256

    fd1431544e22a95a6adc5257b3ce64f64806d187f8dd9c74cc6fcea7c33b5fed

    SHA512

    8afdd0364756c21d7c981824b3d80b237515e462e19a96bb4cf72ef789c9725676e6885500bfd08f26bde6fed491aebca441c55634f511574e43cfa4d001975a

  • \Users\Admin\AppData\Local\Temp\IXP003.TMP\2Il2352.exe

    Filesize

    1.4MB

    MD5

    3f1a76337cfb740ee90d715a106852d3

    SHA1

    4a849b0eafe7393c9ebba8a30df452c1ea9165d1

    SHA256

    fd1431544e22a95a6adc5257b3ce64f64806d187f8dd9c74cc6fcea7c33b5fed

    SHA512

    8afdd0364756c21d7c981824b3d80b237515e462e19a96bb4cf72ef789c9725676e6885500bfd08f26bde6fed491aebca441c55634f511574e43cfa4d001975a

  • \Users\Admin\AppData\Local\Temp\IXP003.TMP\2Il2352.exe

    Filesize

    1.4MB

    MD5

    3f1a76337cfb740ee90d715a106852d3

    SHA1

    4a849b0eafe7393c9ebba8a30df452c1ea9165d1

    SHA256

    fd1431544e22a95a6adc5257b3ce64f64806d187f8dd9c74cc6fcea7c33b5fed

    SHA512

    8afdd0364756c21d7c981824b3d80b237515e462e19a96bb4cf72ef789c9725676e6885500bfd08f26bde6fed491aebca441c55634f511574e43cfa4d001975a

  • \Users\Admin\AppData\Local\Temp\IXP003.TMP\2Il2352.exe

    Filesize

    1.4MB

    MD5

    3f1a76337cfb740ee90d715a106852d3

    SHA1

    4a849b0eafe7393c9ebba8a30df452c1ea9165d1

    SHA256

    fd1431544e22a95a6adc5257b3ce64f64806d187f8dd9c74cc6fcea7c33b5fed

    SHA512

    8afdd0364756c21d7c981824b3d80b237515e462e19a96bb4cf72ef789c9725676e6885500bfd08f26bde6fed491aebca441c55634f511574e43cfa4d001975a

  • \Users\Admin\AppData\Local\Temp\IXP003.TMP\2Il2352.exe

    Filesize

    1.4MB

    MD5

    3f1a76337cfb740ee90d715a106852d3

    SHA1

    4a849b0eafe7393c9ebba8a30df452c1ea9165d1

    SHA256

    fd1431544e22a95a6adc5257b3ce64f64806d187f8dd9c74cc6fcea7c33b5fed

    SHA512

    8afdd0364756c21d7c981824b3d80b237515e462e19a96bb4cf72ef789c9725676e6885500bfd08f26bde6fed491aebca441c55634f511574e43cfa4d001975a

  • memory/2584-53-0x0000000000400000-0x0000000000428000-memory.dmp

    Filesize

    160KB

  • memory/2584-49-0x0000000000400000-0x0000000000428000-memory.dmp

    Filesize

    160KB

  • memory/2584-50-0x0000000000400000-0x0000000000428000-memory.dmp

    Filesize

    160KB

  • memory/2584-52-0x0000000000400000-0x0000000000428000-memory.dmp

    Filesize

    160KB

  • memory/2584-48-0x0000000000400000-0x0000000000428000-memory.dmp

    Filesize

    160KB

  • memory/2584-51-0x0000000000400000-0x0000000000428000-memory.dmp

    Filesize

    160KB

  • memory/2584-54-0x00000000FFFDE000-0x00000000FFFDF000-memory.dmp

    Filesize

    4KB

  • memory/2584-55-0x0000000000400000-0x0000000000428000-memory.dmp

    Filesize

    160KB

  • memory/2584-57-0x0000000000400000-0x0000000000428000-memory.dmp

    Filesize

    160KB

  • memory/2584-59-0x0000000000400000-0x0000000000428000-memory.dmp

    Filesize

    160KB

  • memory/2648-41-0x000007FEF5F80000-0x000007FEF696C000-memory.dmp

    Filesize

    9.9MB

  • memory/2648-40-0x000007FEF5F80000-0x000007FEF696C000-memory.dmp

    Filesize

    9.9MB

  • memory/2648-39-0x000007FEF5F80000-0x000007FEF696C000-memory.dmp

    Filesize

    9.9MB

  • memory/2648-38-0x00000000010C0000-0x00000000010CA000-memory.dmp

    Filesize

    40KB