Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    118s
  • max time network
    121s
  • platform
    windows7_x64
  • resource
    win7-20230831-en
  • resource tags

    arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
  • submitted
    06/10/2023, 02:22

General

  • Target

    file.exe

  • Size

    1.8MB

  • MD5

    dbbab62ee8416942d0cfd08a740509a9

  • SHA1

    0a410083ff1abe7c403e27b0089312099f10b178

  • SHA256

    82ee1ad2edf67bb4e1e94a1759c6adbf1ef4d235ab01165009d51dca66435bf2

  • SHA512

    db7be93ccaf58acc746d58637edfcc3459b7f4fa6a4870599f770b9a56bb9bc3a2e12613d150281ef75b1f02d8fed5ba50a36ac7db9e9ff29ae510d2965fae80

  • SSDEEP

    49152:yd/268bRZcM7phDUXvM7PaRiQk7cIJQCw9D5C1L6LS:VbRZJ7HGPvkQIO5C1L6O

Malware Config

Signatures

  • Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs
  • Executes dropped EXE 4 IoCs
  • Loads dropped DLL 13 IoCs
  • Adds Run key to start application 2 TTPs 4 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Program crash 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 48 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\file.exe
    "C:\Users\Admin\AppData\Local\Temp\file.exe"
    1⤵
    • Loads dropped DLL
    • Adds Run key to start application
    • Suspicious use of WriteProcessMemory
    PID:2408
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\UK5ZD59.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\UK5ZD59.exe
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Adds Run key to start application
      • Suspicious use of WriteProcessMemory
      PID:2764
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\zF3rp71.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\zF3rp71.exe
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Adds Run key to start application
        • Suspicious use of WriteProcessMemory
        PID:1148
        • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\lJ5ac51.exe
          C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\lJ5ac51.exe
          4⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • Adds Run key to start application
          • Suspicious use of WriteProcessMemory
          PID:2744
          • C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\1rp87qG8.exe
            C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\1rp87qG8.exe
            5⤵
            • Executes dropped EXE
            • Loads dropped DLL
            • Suspicious use of SetThreadContext
            • Suspicious use of WriteProcessMemory
            PID:2672
            • C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
              "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
              6⤵
              • Modifies Windows Defender Real-time Protection settings
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of AdjustPrivilegeToken
              PID:2248
            • C:\Windows\SysWOW64\WerFault.exe
              C:\Windows\SysWOW64\WerFault.exe -u -p 2672 -s 284
              6⤵
              • Loads dropped DLL
              • Program crash
              PID:3020

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\UK5ZD59.exe

    Filesize

    1.7MB

    MD5

    fb66f5802e64db7899755e8461a993d1

    SHA1

    9d21c935e734f67b5bc4a003b740d31b6a375afe

    SHA256

    82f220184c259b93c5e875a82e1ed170632235bb675e726761b9662bfb533ad6

    SHA512

    d650042e2fe28960f082cbb843c1c6b46a4e546f83e8ef155f7dad40e1ebc2291de2b434ceea1bc4728de9af6ac6a04fcac085aac858f3c765e26044e5855d5c

  • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\UK5ZD59.exe

    Filesize

    1.7MB

    MD5

    fb66f5802e64db7899755e8461a993d1

    SHA1

    9d21c935e734f67b5bc4a003b740d31b6a375afe

    SHA256

    82f220184c259b93c5e875a82e1ed170632235bb675e726761b9662bfb533ad6

    SHA512

    d650042e2fe28960f082cbb843c1c6b46a4e546f83e8ef155f7dad40e1ebc2291de2b434ceea1bc4728de9af6ac6a04fcac085aac858f3c765e26044e5855d5c

  • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\zF3rp71.exe

    Filesize

    1.2MB

    MD5

    2d09e2dc287105f078544aa21a7558c2

    SHA1

    2482913419c989c22fef728a5f1f05c130657c45

    SHA256

    ef529c6fbba0b3bccf9d7c1857e7e1b6b13a2760dbe8fab79f663ddd5c86c343

    SHA512

    26a77b59a02ef9cfcd857d3fd19f658fb4ff2d30936ab28148aeb52cccd4bdeb74a7bc035bc632ae65986e4566d576d95095c4453ac858dace2a7ce95add92aa

  • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\zF3rp71.exe

    Filesize

    1.2MB

    MD5

    2d09e2dc287105f078544aa21a7558c2

    SHA1

    2482913419c989c22fef728a5f1f05c130657c45

    SHA256

    ef529c6fbba0b3bccf9d7c1857e7e1b6b13a2760dbe8fab79f663ddd5c86c343

    SHA512

    26a77b59a02ef9cfcd857d3fd19f658fb4ff2d30936ab28148aeb52cccd4bdeb74a7bc035bc632ae65986e4566d576d95095c4453ac858dace2a7ce95add92aa

  • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\lJ5ac51.exe

    Filesize

    725KB

    MD5

    99ad4bca8993d6828353765a38ae6bdf

    SHA1

    a6851ceb81c7a996221573f7dd96fd0e5f929d28

    SHA256

    d948b8e0d03a53446aec8ac6ec5ef3fec92d78c0d6731f117a5b4dc17e7f3bd9

    SHA512

    ecc7bee2e435a0ce49dbb758c70b2ed7319c0e1baf76d5eccf704b4264f2ed2770b7bd77aaa8f9a8142dae87a9682e03215bd7649842c630fa1753dd069e2ef0

  • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\lJ5ac51.exe

    Filesize

    725KB

    MD5

    99ad4bca8993d6828353765a38ae6bdf

    SHA1

    a6851ceb81c7a996221573f7dd96fd0e5f929d28

    SHA256

    d948b8e0d03a53446aec8ac6ec5ef3fec92d78c0d6731f117a5b4dc17e7f3bd9

    SHA512

    ecc7bee2e435a0ce49dbb758c70b2ed7319c0e1baf76d5eccf704b4264f2ed2770b7bd77aaa8f9a8142dae87a9682e03215bd7649842c630fa1753dd069e2ef0

  • C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\1rp87qG8.exe

    Filesize

    1.8MB

    MD5

    ca7a5693b5b0e8b54d6dad6a5b1b86b5

    SHA1

    49da08ec9be5e002b0d22dd630182c3a905c76c7

    SHA256

    2d66fdf0417c3d3612015ff191a2010f78fffda1b1f2ed7682181ed7c8fa7c12

    SHA512

    68ac5c2bb689bbfc903cd2a13fe9ecf998b442690ef41d88f611ce40cb8cca1d795099cd40bc7f5325203e6314baf6a537d8369be78ecb1703f8cfc75cf26158

  • C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\1rp87qG8.exe

    Filesize

    1.8MB

    MD5

    ca7a5693b5b0e8b54d6dad6a5b1b86b5

    SHA1

    49da08ec9be5e002b0d22dd630182c3a905c76c7

    SHA256

    2d66fdf0417c3d3612015ff191a2010f78fffda1b1f2ed7682181ed7c8fa7c12

    SHA512

    68ac5c2bb689bbfc903cd2a13fe9ecf998b442690ef41d88f611ce40cb8cca1d795099cd40bc7f5325203e6314baf6a537d8369be78ecb1703f8cfc75cf26158

  • C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\1rp87qG8.exe

    Filesize

    1.8MB

    MD5

    ca7a5693b5b0e8b54d6dad6a5b1b86b5

    SHA1

    49da08ec9be5e002b0d22dd630182c3a905c76c7

    SHA256

    2d66fdf0417c3d3612015ff191a2010f78fffda1b1f2ed7682181ed7c8fa7c12

    SHA512

    68ac5c2bb689bbfc903cd2a13fe9ecf998b442690ef41d88f611ce40cb8cca1d795099cd40bc7f5325203e6314baf6a537d8369be78ecb1703f8cfc75cf26158

  • \Users\Admin\AppData\Local\Temp\IXP000.TMP\UK5ZD59.exe

    Filesize

    1.7MB

    MD5

    fb66f5802e64db7899755e8461a993d1

    SHA1

    9d21c935e734f67b5bc4a003b740d31b6a375afe

    SHA256

    82f220184c259b93c5e875a82e1ed170632235bb675e726761b9662bfb533ad6

    SHA512

    d650042e2fe28960f082cbb843c1c6b46a4e546f83e8ef155f7dad40e1ebc2291de2b434ceea1bc4728de9af6ac6a04fcac085aac858f3c765e26044e5855d5c

  • \Users\Admin\AppData\Local\Temp\IXP000.TMP\UK5ZD59.exe

    Filesize

    1.7MB

    MD5

    fb66f5802e64db7899755e8461a993d1

    SHA1

    9d21c935e734f67b5bc4a003b740d31b6a375afe

    SHA256

    82f220184c259b93c5e875a82e1ed170632235bb675e726761b9662bfb533ad6

    SHA512

    d650042e2fe28960f082cbb843c1c6b46a4e546f83e8ef155f7dad40e1ebc2291de2b434ceea1bc4728de9af6ac6a04fcac085aac858f3c765e26044e5855d5c

  • \Users\Admin\AppData\Local\Temp\IXP001.TMP\zF3rp71.exe

    Filesize

    1.2MB

    MD5

    2d09e2dc287105f078544aa21a7558c2

    SHA1

    2482913419c989c22fef728a5f1f05c130657c45

    SHA256

    ef529c6fbba0b3bccf9d7c1857e7e1b6b13a2760dbe8fab79f663ddd5c86c343

    SHA512

    26a77b59a02ef9cfcd857d3fd19f658fb4ff2d30936ab28148aeb52cccd4bdeb74a7bc035bc632ae65986e4566d576d95095c4453ac858dace2a7ce95add92aa

  • \Users\Admin\AppData\Local\Temp\IXP001.TMP\zF3rp71.exe

    Filesize

    1.2MB

    MD5

    2d09e2dc287105f078544aa21a7558c2

    SHA1

    2482913419c989c22fef728a5f1f05c130657c45

    SHA256

    ef529c6fbba0b3bccf9d7c1857e7e1b6b13a2760dbe8fab79f663ddd5c86c343

    SHA512

    26a77b59a02ef9cfcd857d3fd19f658fb4ff2d30936ab28148aeb52cccd4bdeb74a7bc035bc632ae65986e4566d576d95095c4453ac858dace2a7ce95add92aa

  • \Users\Admin\AppData\Local\Temp\IXP002.TMP\lJ5ac51.exe

    Filesize

    725KB

    MD5

    99ad4bca8993d6828353765a38ae6bdf

    SHA1

    a6851ceb81c7a996221573f7dd96fd0e5f929d28

    SHA256

    d948b8e0d03a53446aec8ac6ec5ef3fec92d78c0d6731f117a5b4dc17e7f3bd9

    SHA512

    ecc7bee2e435a0ce49dbb758c70b2ed7319c0e1baf76d5eccf704b4264f2ed2770b7bd77aaa8f9a8142dae87a9682e03215bd7649842c630fa1753dd069e2ef0

  • \Users\Admin\AppData\Local\Temp\IXP002.TMP\lJ5ac51.exe

    Filesize

    725KB

    MD5

    99ad4bca8993d6828353765a38ae6bdf

    SHA1

    a6851ceb81c7a996221573f7dd96fd0e5f929d28

    SHA256

    d948b8e0d03a53446aec8ac6ec5ef3fec92d78c0d6731f117a5b4dc17e7f3bd9

    SHA512

    ecc7bee2e435a0ce49dbb758c70b2ed7319c0e1baf76d5eccf704b4264f2ed2770b7bd77aaa8f9a8142dae87a9682e03215bd7649842c630fa1753dd069e2ef0

  • \Users\Admin\AppData\Local\Temp\IXP003.TMP\1rp87qG8.exe

    Filesize

    1.8MB

    MD5

    ca7a5693b5b0e8b54d6dad6a5b1b86b5

    SHA1

    49da08ec9be5e002b0d22dd630182c3a905c76c7

    SHA256

    2d66fdf0417c3d3612015ff191a2010f78fffda1b1f2ed7682181ed7c8fa7c12

    SHA512

    68ac5c2bb689bbfc903cd2a13fe9ecf998b442690ef41d88f611ce40cb8cca1d795099cd40bc7f5325203e6314baf6a537d8369be78ecb1703f8cfc75cf26158

  • \Users\Admin\AppData\Local\Temp\IXP003.TMP\1rp87qG8.exe

    Filesize

    1.8MB

    MD5

    ca7a5693b5b0e8b54d6dad6a5b1b86b5

    SHA1

    49da08ec9be5e002b0d22dd630182c3a905c76c7

    SHA256

    2d66fdf0417c3d3612015ff191a2010f78fffda1b1f2ed7682181ed7c8fa7c12

    SHA512

    68ac5c2bb689bbfc903cd2a13fe9ecf998b442690ef41d88f611ce40cb8cca1d795099cd40bc7f5325203e6314baf6a537d8369be78ecb1703f8cfc75cf26158

  • \Users\Admin\AppData\Local\Temp\IXP003.TMP\1rp87qG8.exe

    Filesize

    1.8MB

    MD5

    ca7a5693b5b0e8b54d6dad6a5b1b86b5

    SHA1

    49da08ec9be5e002b0d22dd630182c3a905c76c7

    SHA256

    2d66fdf0417c3d3612015ff191a2010f78fffda1b1f2ed7682181ed7c8fa7c12

    SHA512

    68ac5c2bb689bbfc903cd2a13fe9ecf998b442690ef41d88f611ce40cb8cca1d795099cd40bc7f5325203e6314baf6a537d8369be78ecb1703f8cfc75cf26158

  • \Users\Admin\AppData\Local\Temp\IXP003.TMP\1rp87qG8.exe

    Filesize

    1.8MB

    MD5

    ca7a5693b5b0e8b54d6dad6a5b1b86b5

    SHA1

    49da08ec9be5e002b0d22dd630182c3a905c76c7

    SHA256

    2d66fdf0417c3d3612015ff191a2010f78fffda1b1f2ed7682181ed7c8fa7c12

    SHA512

    68ac5c2bb689bbfc903cd2a13fe9ecf998b442690ef41d88f611ce40cb8cca1d795099cd40bc7f5325203e6314baf6a537d8369be78ecb1703f8cfc75cf26158

  • \Users\Admin\AppData\Local\Temp\IXP003.TMP\1rp87qG8.exe

    Filesize

    1.8MB

    MD5

    ca7a5693b5b0e8b54d6dad6a5b1b86b5

    SHA1

    49da08ec9be5e002b0d22dd630182c3a905c76c7

    SHA256

    2d66fdf0417c3d3612015ff191a2010f78fffda1b1f2ed7682181ed7c8fa7c12

    SHA512

    68ac5c2bb689bbfc903cd2a13fe9ecf998b442690ef41d88f611ce40cb8cca1d795099cd40bc7f5325203e6314baf6a537d8369be78ecb1703f8cfc75cf26158

  • \Users\Admin\AppData\Local\Temp\IXP003.TMP\1rp87qG8.exe

    Filesize

    1.8MB

    MD5

    ca7a5693b5b0e8b54d6dad6a5b1b86b5

    SHA1

    49da08ec9be5e002b0d22dd630182c3a905c76c7

    SHA256

    2d66fdf0417c3d3612015ff191a2010f78fffda1b1f2ed7682181ed7c8fa7c12

    SHA512

    68ac5c2bb689bbfc903cd2a13fe9ecf998b442690ef41d88f611ce40cb8cca1d795099cd40bc7f5325203e6314baf6a537d8369be78ecb1703f8cfc75cf26158

  • \Users\Admin\AppData\Local\Temp\IXP003.TMP\1rp87qG8.exe

    Filesize

    1.8MB

    MD5

    ca7a5693b5b0e8b54d6dad6a5b1b86b5

    SHA1

    49da08ec9be5e002b0d22dd630182c3a905c76c7

    SHA256

    2d66fdf0417c3d3612015ff191a2010f78fffda1b1f2ed7682181ed7c8fa7c12

    SHA512

    68ac5c2bb689bbfc903cd2a13fe9ecf998b442690ef41d88f611ce40cb8cca1d795099cd40bc7f5325203e6314baf6a537d8369be78ecb1703f8cfc75cf26158

  • memory/2248-48-0x00000000FFFDE000-0x00000000FFFDF000-memory.dmp

    Filesize

    4KB

  • memory/2248-73-0x0000000000290000-0x00000000002A6000-memory.dmp

    Filesize

    88KB

  • memory/2248-49-0x0000000000400000-0x0000000000432000-memory.dmp

    Filesize

    200KB

  • memory/2248-51-0x0000000000400000-0x0000000000432000-memory.dmp

    Filesize

    200KB

  • memory/2248-53-0x0000000000400000-0x0000000000432000-memory.dmp

    Filesize

    200KB

  • memory/2248-46-0x0000000000400000-0x0000000000432000-memory.dmp

    Filesize

    200KB

  • memory/2248-44-0x0000000000400000-0x0000000000432000-memory.dmp

    Filesize

    200KB

  • memory/2248-45-0x0000000000400000-0x0000000000432000-memory.dmp

    Filesize

    200KB

  • memory/2248-43-0x0000000000400000-0x0000000000432000-memory.dmp

    Filesize

    200KB

  • memory/2248-58-0x0000000000200000-0x000000000021E000-memory.dmp

    Filesize

    120KB

  • memory/2248-59-0x0000000000290000-0x00000000002AC000-memory.dmp

    Filesize

    112KB

  • memory/2248-61-0x0000000000290000-0x00000000002A6000-memory.dmp

    Filesize

    88KB

  • memory/2248-67-0x0000000000290000-0x00000000002A6000-memory.dmp

    Filesize

    88KB

  • memory/2248-47-0x0000000000400000-0x0000000000432000-memory.dmp

    Filesize

    200KB

  • memory/2248-79-0x0000000000290000-0x00000000002A6000-memory.dmp

    Filesize

    88KB

  • memory/2248-85-0x0000000000290000-0x00000000002A6000-memory.dmp

    Filesize

    88KB

  • memory/2248-87-0x0000000000290000-0x00000000002A6000-memory.dmp

    Filesize

    88KB

  • memory/2248-83-0x0000000000290000-0x00000000002A6000-memory.dmp

    Filesize

    88KB

  • memory/2248-81-0x0000000000290000-0x00000000002A6000-memory.dmp

    Filesize

    88KB

  • memory/2248-77-0x0000000000290000-0x00000000002A6000-memory.dmp

    Filesize

    88KB

  • memory/2248-75-0x0000000000290000-0x00000000002A6000-memory.dmp

    Filesize

    88KB

  • memory/2248-71-0x0000000000290000-0x00000000002A6000-memory.dmp

    Filesize

    88KB

  • memory/2248-69-0x0000000000290000-0x00000000002A6000-memory.dmp

    Filesize

    88KB

  • memory/2248-65-0x0000000000290000-0x00000000002A6000-memory.dmp

    Filesize

    88KB

  • memory/2248-63-0x0000000000290000-0x00000000002A6000-memory.dmp

    Filesize

    88KB

  • memory/2248-60-0x0000000000290000-0x00000000002A6000-memory.dmp

    Filesize

    88KB