Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
118s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20230831-en -
resource tags
arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system -
submitted
06/10/2023, 02:22
Static task
static1
Behavioral task
behavioral1
Sample
file.exe
Resource
win7-20230831-en
Behavioral task
behavioral2
Sample
file.exe
Resource
win10v2004-20230915-en
General
-
Target
file.exe
-
Size
1.8MB
-
MD5
dbbab62ee8416942d0cfd08a740509a9
-
SHA1
0a410083ff1abe7c403e27b0089312099f10b178
-
SHA256
82ee1ad2edf67bb4e1e94a1759c6adbf1ef4d235ab01165009d51dca66435bf2
-
SHA512
db7be93ccaf58acc746d58637edfcc3459b7f4fa6a4870599f770b9a56bb9bc3a2e12613d150281ef75b1f02d8fed5ba50a36ac7db9e9ff29ae510d2965fae80
-
SSDEEP
49152:yd/268bRZcM7phDUXvM7PaRiQk7cIJQCw9D5C1L6LS:VbRZJ7HGPvkQIO5C1L6O
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection AppLaunch.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" AppLaunch.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" AppLaunch.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" AppLaunch.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" AppLaunch.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" AppLaunch.exe -
Executes dropped EXE 4 IoCs
pid Process 2764 UK5ZD59.exe 1148 zF3rp71.exe 2744 lJ5ac51.exe 2672 1rp87qG8.exe -
Loads dropped DLL 13 IoCs
pid Process 2408 file.exe 2764 UK5ZD59.exe 2764 UK5ZD59.exe 1148 zF3rp71.exe 1148 zF3rp71.exe 2744 lJ5ac51.exe 2744 lJ5ac51.exe 2744 lJ5ac51.exe 2672 1rp87qG8.exe 3020 WerFault.exe 3020 WerFault.exe 3020 WerFault.exe 3020 WerFault.exe -
Adds Run key to start application 2 TTPs 4 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup3 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP003.TMP\\\"" lJ5ac51.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" file.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" UK5ZD59.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\"" zF3rp71.exe -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 2672 set thread context of 2248 2672 1rp87qG8.exe 32 -
Program crash 1 IoCs
pid pid_target Process procid_target 3020 2672 WerFault.exe 31 -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 2248 AppLaunch.exe 2248 AppLaunch.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 2248 AppLaunch.exe -
Suspicious use of WriteProcessMemory 48 IoCs
description pid Process procid_target PID 2408 wrote to memory of 2764 2408 file.exe 28 PID 2408 wrote to memory of 2764 2408 file.exe 28 PID 2408 wrote to memory of 2764 2408 file.exe 28 PID 2408 wrote to memory of 2764 2408 file.exe 28 PID 2408 wrote to memory of 2764 2408 file.exe 28 PID 2408 wrote to memory of 2764 2408 file.exe 28 PID 2408 wrote to memory of 2764 2408 file.exe 28 PID 2764 wrote to memory of 1148 2764 UK5ZD59.exe 29 PID 2764 wrote to memory of 1148 2764 UK5ZD59.exe 29 PID 2764 wrote to memory of 1148 2764 UK5ZD59.exe 29 PID 2764 wrote to memory of 1148 2764 UK5ZD59.exe 29 PID 2764 wrote to memory of 1148 2764 UK5ZD59.exe 29 PID 2764 wrote to memory of 1148 2764 UK5ZD59.exe 29 PID 2764 wrote to memory of 1148 2764 UK5ZD59.exe 29 PID 1148 wrote to memory of 2744 1148 zF3rp71.exe 30 PID 1148 wrote to memory of 2744 1148 zF3rp71.exe 30 PID 1148 wrote to memory of 2744 1148 zF3rp71.exe 30 PID 1148 wrote to memory of 2744 1148 zF3rp71.exe 30 PID 1148 wrote to memory of 2744 1148 zF3rp71.exe 30 PID 1148 wrote to memory of 2744 1148 zF3rp71.exe 30 PID 1148 wrote to memory of 2744 1148 zF3rp71.exe 30 PID 2744 wrote to memory of 2672 2744 lJ5ac51.exe 31 PID 2744 wrote to memory of 2672 2744 lJ5ac51.exe 31 PID 2744 wrote to memory of 2672 2744 lJ5ac51.exe 31 PID 2744 wrote to memory of 2672 2744 lJ5ac51.exe 31 PID 2744 wrote to memory of 2672 2744 lJ5ac51.exe 31 PID 2744 wrote to memory of 2672 2744 lJ5ac51.exe 31 PID 2744 wrote to memory of 2672 2744 lJ5ac51.exe 31 PID 2672 wrote to memory of 2248 2672 1rp87qG8.exe 32 PID 2672 wrote to memory of 2248 2672 1rp87qG8.exe 32 PID 2672 wrote to memory of 2248 2672 1rp87qG8.exe 32 PID 2672 wrote to memory of 2248 2672 1rp87qG8.exe 32 PID 2672 wrote to memory of 2248 2672 1rp87qG8.exe 32 PID 2672 wrote to memory of 2248 2672 1rp87qG8.exe 32 PID 2672 wrote to memory of 2248 2672 1rp87qG8.exe 32 PID 2672 wrote to memory of 2248 2672 1rp87qG8.exe 32 PID 2672 wrote to memory of 2248 2672 1rp87qG8.exe 32 PID 2672 wrote to memory of 2248 2672 1rp87qG8.exe 32 PID 2672 wrote to memory of 2248 2672 1rp87qG8.exe 32 PID 2672 wrote to memory of 2248 2672 1rp87qG8.exe 32 PID 2672 wrote to memory of 2248 2672 1rp87qG8.exe 32 PID 2672 wrote to memory of 3020 2672 1rp87qG8.exe 33 PID 2672 wrote to memory of 3020 2672 1rp87qG8.exe 33 PID 2672 wrote to memory of 3020 2672 1rp87qG8.exe 33 PID 2672 wrote to memory of 3020 2672 1rp87qG8.exe 33 PID 2672 wrote to memory of 3020 2672 1rp87qG8.exe 33 PID 2672 wrote to memory of 3020 2672 1rp87qG8.exe 33 PID 2672 wrote to memory of 3020 2672 1rp87qG8.exe 33
Processes
-
C:\Users\Admin\AppData\Local\Temp\file.exe"C:\Users\Admin\AppData\Local\Temp\file.exe"1⤵
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:2408 -
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\UK5ZD59.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\UK5ZD59.exe2⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:2764 -
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\zF3rp71.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\zF3rp71.exe3⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:1148 -
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\lJ5ac51.exeC:\Users\Admin\AppData\Local\Temp\IXP002.TMP\lJ5ac51.exe4⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:2744 -
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\1rp87qG8.exeC:\Users\Admin\AppData\Local\Temp\IXP003.TMP\1rp87qG8.exe5⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2672 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"6⤵
- Modifies Windows Defender Real-time Protection settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2248
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2672 -s 2846⤵
- Loads dropped DLL
- Program crash
PID:3020
-
-
-
-
-
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.7MB
MD5fb66f5802e64db7899755e8461a993d1
SHA19d21c935e734f67b5bc4a003b740d31b6a375afe
SHA25682f220184c259b93c5e875a82e1ed170632235bb675e726761b9662bfb533ad6
SHA512d650042e2fe28960f082cbb843c1c6b46a4e546f83e8ef155f7dad40e1ebc2291de2b434ceea1bc4728de9af6ac6a04fcac085aac858f3c765e26044e5855d5c
-
Filesize
1.7MB
MD5fb66f5802e64db7899755e8461a993d1
SHA19d21c935e734f67b5bc4a003b740d31b6a375afe
SHA25682f220184c259b93c5e875a82e1ed170632235bb675e726761b9662bfb533ad6
SHA512d650042e2fe28960f082cbb843c1c6b46a4e546f83e8ef155f7dad40e1ebc2291de2b434ceea1bc4728de9af6ac6a04fcac085aac858f3c765e26044e5855d5c
-
Filesize
1.2MB
MD52d09e2dc287105f078544aa21a7558c2
SHA12482913419c989c22fef728a5f1f05c130657c45
SHA256ef529c6fbba0b3bccf9d7c1857e7e1b6b13a2760dbe8fab79f663ddd5c86c343
SHA51226a77b59a02ef9cfcd857d3fd19f658fb4ff2d30936ab28148aeb52cccd4bdeb74a7bc035bc632ae65986e4566d576d95095c4453ac858dace2a7ce95add92aa
-
Filesize
1.2MB
MD52d09e2dc287105f078544aa21a7558c2
SHA12482913419c989c22fef728a5f1f05c130657c45
SHA256ef529c6fbba0b3bccf9d7c1857e7e1b6b13a2760dbe8fab79f663ddd5c86c343
SHA51226a77b59a02ef9cfcd857d3fd19f658fb4ff2d30936ab28148aeb52cccd4bdeb74a7bc035bc632ae65986e4566d576d95095c4453ac858dace2a7ce95add92aa
-
Filesize
725KB
MD599ad4bca8993d6828353765a38ae6bdf
SHA1a6851ceb81c7a996221573f7dd96fd0e5f929d28
SHA256d948b8e0d03a53446aec8ac6ec5ef3fec92d78c0d6731f117a5b4dc17e7f3bd9
SHA512ecc7bee2e435a0ce49dbb758c70b2ed7319c0e1baf76d5eccf704b4264f2ed2770b7bd77aaa8f9a8142dae87a9682e03215bd7649842c630fa1753dd069e2ef0
-
Filesize
725KB
MD599ad4bca8993d6828353765a38ae6bdf
SHA1a6851ceb81c7a996221573f7dd96fd0e5f929d28
SHA256d948b8e0d03a53446aec8ac6ec5ef3fec92d78c0d6731f117a5b4dc17e7f3bd9
SHA512ecc7bee2e435a0ce49dbb758c70b2ed7319c0e1baf76d5eccf704b4264f2ed2770b7bd77aaa8f9a8142dae87a9682e03215bd7649842c630fa1753dd069e2ef0
-
Filesize
1.8MB
MD5ca7a5693b5b0e8b54d6dad6a5b1b86b5
SHA149da08ec9be5e002b0d22dd630182c3a905c76c7
SHA2562d66fdf0417c3d3612015ff191a2010f78fffda1b1f2ed7682181ed7c8fa7c12
SHA51268ac5c2bb689bbfc903cd2a13fe9ecf998b442690ef41d88f611ce40cb8cca1d795099cd40bc7f5325203e6314baf6a537d8369be78ecb1703f8cfc75cf26158
-
Filesize
1.8MB
MD5ca7a5693b5b0e8b54d6dad6a5b1b86b5
SHA149da08ec9be5e002b0d22dd630182c3a905c76c7
SHA2562d66fdf0417c3d3612015ff191a2010f78fffda1b1f2ed7682181ed7c8fa7c12
SHA51268ac5c2bb689bbfc903cd2a13fe9ecf998b442690ef41d88f611ce40cb8cca1d795099cd40bc7f5325203e6314baf6a537d8369be78ecb1703f8cfc75cf26158
-
Filesize
1.8MB
MD5ca7a5693b5b0e8b54d6dad6a5b1b86b5
SHA149da08ec9be5e002b0d22dd630182c3a905c76c7
SHA2562d66fdf0417c3d3612015ff191a2010f78fffda1b1f2ed7682181ed7c8fa7c12
SHA51268ac5c2bb689bbfc903cd2a13fe9ecf998b442690ef41d88f611ce40cb8cca1d795099cd40bc7f5325203e6314baf6a537d8369be78ecb1703f8cfc75cf26158
-
Filesize
1.7MB
MD5fb66f5802e64db7899755e8461a993d1
SHA19d21c935e734f67b5bc4a003b740d31b6a375afe
SHA25682f220184c259b93c5e875a82e1ed170632235bb675e726761b9662bfb533ad6
SHA512d650042e2fe28960f082cbb843c1c6b46a4e546f83e8ef155f7dad40e1ebc2291de2b434ceea1bc4728de9af6ac6a04fcac085aac858f3c765e26044e5855d5c
-
Filesize
1.7MB
MD5fb66f5802e64db7899755e8461a993d1
SHA19d21c935e734f67b5bc4a003b740d31b6a375afe
SHA25682f220184c259b93c5e875a82e1ed170632235bb675e726761b9662bfb533ad6
SHA512d650042e2fe28960f082cbb843c1c6b46a4e546f83e8ef155f7dad40e1ebc2291de2b434ceea1bc4728de9af6ac6a04fcac085aac858f3c765e26044e5855d5c
-
Filesize
1.2MB
MD52d09e2dc287105f078544aa21a7558c2
SHA12482913419c989c22fef728a5f1f05c130657c45
SHA256ef529c6fbba0b3bccf9d7c1857e7e1b6b13a2760dbe8fab79f663ddd5c86c343
SHA51226a77b59a02ef9cfcd857d3fd19f658fb4ff2d30936ab28148aeb52cccd4bdeb74a7bc035bc632ae65986e4566d576d95095c4453ac858dace2a7ce95add92aa
-
Filesize
1.2MB
MD52d09e2dc287105f078544aa21a7558c2
SHA12482913419c989c22fef728a5f1f05c130657c45
SHA256ef529c6fbba0b3bccf9d7c1857e7e1b6b13a2760dbe8fab79f663ddd5c86c343
SHA51226a77b59a02ef9cfcd857d3fd19f658fb4ff2d30936ab28148aeb52cccd4bdeb74a7bc035bc632ae65986e4566d576d95095c4453ac858dace2a7ce95add92aa
-
Filesize
725KB
MD599ad4bca8993d6828353765a38ae6bdf
SHA1a6851ceb81c7a996221573f7dd96fd0e5f929d28
SHA256d948b8e0d03a53446aec8ac6ec5ef3fec92d78c0d6731f117a5b4dc17e7f3bd9
SHA512ecc7bee2e435a0ce49dbb758c70b2ed7319c0e1baf76d5eccf704b4264f2ed2770b7bd77aaa8f9a8142dae87a9682e03215bd7649842c630fa1753dd069e2ef0
-
Filesize
725KB
MD599ad4bca8993d6828353765a38ae6bdf
SHA1a6851ceb81c7a996221573f7dd96fd0e5f929d28
SHA256d948b8e0d03a53446aec8ac6ec5ef3fec92d78c0d6731f117a5b4dc17e7f3bd9
SHA512ecc7bee2e435a0ce49dbb758c70b2ed7319c0e1baf76d5eccf704b4264f2ed2770b7bd77aaa8f9a8142dae87a9682e03215bd7649842c630fa1753dd069e2ef0
-
Filesize
1.8MB
MD5ca7a5693b5b0e8b54d6dad6a5b1b86b5
SHA149da08ec9be5e002b0d22dd630182c3a905c76c7
SHA2562d66fdf0417c3d3612015ff191a2010f78fffda1b1f2ed7682181ed7c8fa7c12
SHA51268ac5c2bb689bbfc903cd2a13fe9ecf998b442690ef41d88f611ce40cb8cca1d795099cd40bc7f5325203e6314baf6a537d8369be78ecb1703f8cfc75cf26158
-
Filesize
1.8MB
MD5ca7a5693b5b0e8b54d6dad6a5b1b86b5
SHA149da08ec9be5e002b0d22dd630182c3a905c76c7
SHA2562d66fdf0417c3d3612015ff191a2010f78fffda1b1f2ed7682181ed7c8fa7c12
SHA51268ac5c2bb689bbfc903cd2a13fe9ecf998b442690ef41d88f611ce40cb8cca1d795099cd40bc7f5325203e6314baf6a537d8369be78ecb1703f8cfc75cf26158
-
Filesize
1.8MB
MD5ca7a5693b5b0e8b54d6dad6a5b1b86b5
SHA149da08ec9be5e002b0d22dd630182c3a905c76c7
SHA2562d66fdf0417c3d3612015ff191a2010f78fffda1b1f2ed7682181ed7c8fa7c12
SHA51268ac5c2bb689bbfc903cd2a13fe9ecf998b442690ef41d88f611ce40cb8cca1d795099cd40bc7f5325203e6314baf6a537d8369be78ecb1703f8cfc75cf26158
-
Filesize
1.8MB
MD5ca7a5693b5b0e8b54d6dad6a5b1b86b5
SHA149da08ec9be5e002b0d22dd630182c3a905c76c7
SHA2562d66fdf0417c3d3612015ff191a2010f78fffda1b1f2ed7682181ed7c8fa7c12
SHA51268ac5c2bb689bbfc903cd2a13fe9ecf998b442690ef41d88f611ce40cb8cca1d795099cd40bc7f5325203e6314baf6a537d8369be78ecb1703f8cfc75cf26158
-
Filesize
1.8MB
MD5ca7a5693b5b0e8b54d6dad6a5b1b86b5
SHA149da08ec9be5e002b0d22dd630182c3a905c76c7
SHA2562d66fdf0417c3d3612015ff191a2010f78fffda1b1f2ed7682181ed7c8fa7c12
SHA51268ac5c2bb689bbfc903cd2a13fe9ecf998b442690ef41d88f611ce40cb8cca1d795099cd40bc7f5325203e6314baf6a537d8369be78ecb1703f8cfc75cf26158
-
Filesize
1.8MB
MD5ca7a5693b5b0e8b54d6dad6a5b1b86b5
SHA149da08ec9be5e002b0d22dd630182c3a905c76c7
SHA2562d66fdf0417c3d3612015ff191a2010f78fffda1b1f2ed7682181ed7c8fa7c12
SHA51268ac5c2bb689bbfc903cd2a13fe9ecf998b442690ef41d88f611ce40cb8cca1d795099cd40bc7f5325203e6314baf6a537d8369be78ecb1703f8cfc75cf26158
-
Filesize
1.8MB
MD5ca7a5693b5b0e8b54d6dad6a5b1b86b5
SHA149da08ec9be5e002b0d22dd630182c3a905c76c7
SHA2562d66fdf0417c3d3612015ff191a2010f78fffda1b1f2ed7682181ed7c8fa7c12
SHA51268ac5c2bb689bbfc903cd2a13fe9ecf998b442690ef41d88f611ce40cb8cca1d795099cd40bc7f5325203e6314baf6a537d8369be78ecb1703f8cfc75cf26158