Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
125s -
max time network
131s -
platform
windows10-1703_x64 -
resource
win10-20230915-en -
resource tags
arch:x64arch:x86image:win10-20230915-enlocale:en-usos:windows10-1703-x64system -
submitted
06/10/2023, 06:54
Static task
static1
Behavioral task
behavioral1
Sample
41f7e0470500869ec08f02dc15c617530366c87b2e9b88d737a4cc6da8b3f6ec.exe
Resource
win10-20230915-en
General
-
Target
41f7e0470500869ec08f02dc15c617530366c87b2e9b88d737a4cc6da8b3f6ec.exe
-
Size
1.7MB
-
MD5
ade24d5fe9103f8d5bc932ac9e5a1b12
-
SHA1
e7126cf193a5ed3bef181a573789254f258c84bc
-
SHA256
41f7e0470500869ec08f02dc15c617530366c87b2e9b88d737a4cc6da8b3f6ec
-
SHA512
14e473f1da2b23f41dd1e0766ee59147506a25ecdb4fd2a62df0eabfcaf740bc8eda7cdf959dcd257657abcc42c9cb69c57bba0da04fc17204822296db2f794d
-
SSDEEP
49152:bhP+rwhDFCux5lCfVvMcA1v5Z0P3ohJYghZrM:tP+EhDF/DwcGP3oQghV
Malware Config
Signatures
-
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" AppLaunch.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" AppLaunch.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" AppLaunch.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" AppLaunch.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" AppLaunch.exe -
Executes dropped EXE 5 IoCs
pid Process 596 jl2bi06.exe 1260 VU2GO48.exe 4540 MU6Ik76.exe 2664 do2Pj35.exe 5000 1Vb42rw9.exe -
Adds Run key to start application 2 TTPs 5 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup4 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP004.TMP\\\"" do2Pj35.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" 41f7e0470500869ec08f02dc15c617530366c87b2e9b88d737a4cc6da8b3f6ec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" jl2bi06.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\"" VU2GO48.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup3 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP003.TMP\\\"" MU6Ik76.exe -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 5000 set thread context of 4668 5000 1Vb42rw9.exe 75 -
Program crash 1 IoCs
pid pid_target Process procid_target 3956 5000 WerFault.exe 74 -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 4668 AppLaunch.exe 4668 AppLaunch.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 4668 AppLaunch.exe -
Suspicious use of WriteProcessMemory 24 IoCs
description pid Process procid_target PID 4224 wrote to memory of 596 4224 41f7e0470500869ec08f02dc15c617530366c87b2e9b88d737a4cc6da8b3f6ec.exe 70 PID 4224 wrote to memory of 596 4224 41f7e0470500869ec08f02dc15c617530366c87b2e9b88d737a4cc6da8b3f6ec.exe 70 PID 4224 wrote to memory of 596 4224 41f7e0470500869ec08f02dc15c617530366c87b2e9b88d737a4cc6da8b3f6ec.exe 70 PID 596 wrote to memory of 1260 596 jl2bi06.exe 71 PID 596 wrote to memory of 1260 596 jl2bi06.exe 71 PID 596 wrote to memory of 1260 596 jl2bi06.exe 71 PID 1260 wrote to memory of 4540 1260 VU2GO48.exe 72 PID 1260 wrote to memory of 4540 1260 VU2GO48.exe 72 PID 1260 wrote to memory of 4540 1260 VU2GO48.exe 72 PID 4540 wrote to memory of 2664 4540 MU6Ik76.exe 73 PID 4540 wrote to memory of 2664 4540 MU6Ik76.exe 73 PID 4540 wrote to memory of 2664 4540 MU6Ik76.exe 73 PID 2664 wrote to memory of 5000 2664 do2Pj35.exe 74 PID 2664 wrote to memory of 5000 2664 do2Pj35.exe 74 PID 2664 wrote to memory of 5000 2664 do2Pj35.exe 74 PID 5000 wrote to memory of 4668 5000 1Vb42rw9.exe 75 PID 5000 wrote to memory of 4668 5000 1Vb42rw9.exe 75 PID 5000 wrote to memory of 4668 5000 1Vb42rw9.exe 75 PID 5000 wrote to memory of 4668 5000 1Vb42rw9.exe 75 PID 5000 wrote to memory of 4668 5000 1Vb42rw9.exe 75 PID 5000 wrote to memory of 4668 5000 1Vb42rw9.exe 75 PID 5000 wrote to memory of 4668 5000 1Vb42rw9.exe 75 PID 5000 wrote to memory of 4668 5000 1Vb42rw9.exe 75 PID 5000 wrote to memory of 4668 5000 1Vb42rw9.exe 75
Processes
-
C:\Users\Admin\AppData\Local\Temp\41f7e0470500869ec08f02dc15c617530366c87b2e9b88d737a4cc6da8b3f6ec.exe"C:\Users\Admin\AppData\Local\Temp\41f7e0470500869ec08f02dc15c617530366c87b2e9b88d737a4cc6da8b3f6ec.exe"1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:4224 -
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\jl2bi06.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\jl2bi06.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:596 -
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\VU2GO48.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\VU2GO48.exe3⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:1260 -
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\MU6Ik76.exeC:\Users\Admin\AppData\Local\Temp\IXP002.TMP\MU6Ik76.exe4⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:4540 -
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\do2Pj35.exeC:\Users\Admin\AppData\Local\Temp\IXP003.TMP\do2Pj35.exe5⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:2664 -
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\1Vb42rw9.exeC:\Users\Admin\AppData\Local\Temp\IXP004.TMP\1Vb42rw9.exe6⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:5000 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"7⤵
- Modifies Windows Defender Real-time Protection settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4668
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5000 -s 5647⤵
- Program crash
PID:3956
-
-
-
-
-
-
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.6MB
MD5fa1d206ffbd3d61847a5524cfa4dbabb
SHA1cd902bdeeaee1ed9e3cef49bbaeb4bd7ce1a3b25
SHA256d965a586513532905e52a80f33c1d92b6d2cea465f773dce6e71824d4f4b437c
SHA51275988a3b013f7d74cfe6e759274c34a793a3e707a8d8363d8eb0dd3f96f3abe5909b9c4f6dca46064d72f1d2518bde70185f643cbc06dc7bee9b1047213c3b9d
-
Filesize
1.6MB
MD5fa1d206ffbd3d61847a5524cfa4dbabb
SHA1cd902bdeeaee1ed9e3cef49bbaeb4bd7ce1a3b25
SHA256d965a586513532905e52a80f33c1d92b6d2cea465f773dce6e71824d4f4b437c
SHA51275988a3b013f7d74cfe6e759274c34a793a3e707a8d8363d8eb0dd3f96f3abe5909b9c4f6dca46064d72f1d2518bde70185f643cbc06dc7bee9b1047213c3b9d
-
Filesize
1.4MB
MD5c32257bcb317733a15199e376ab6e92d
SHA1028497b6db187dc77f4c2ef2835e4874b61a42a4
SHA2560a985ce00f95876b8e813db4f02450da78dbdc5cf366e62bcce24c7b8a8ec95f
SHA51286f949d61b3881c12be26a9e074cc8d683f98cde978ff1fdac0b9ad4d3a5655a3f1e2cb0ab179bdfd2c4a72bb190563792b875c73dd1c890dc90728cd8f9f00a
-
Filesize
1.4MB
MD5c32257bcb317733a15199e376ab6e92d
SHA1028497b6db187dc77f4c2ef2835e4874b61a42a4
SHA2560a985ce00f95876b8e813db4f02450da78dbdc5cf366e62bcce24c7b8a8ec95f
SHA51286f949d61b3881c12be26a9e074cc8d683f98cde978ff1fdac0b9ad4d3a5655a3f1e2cb0ab179bdfd2c4a72bb190563792b875c73dd1c890dc90728cd8f9f00a
-
Filesize
1.2MB
MD5182d8e9456bce221c940008c38b74336
SHA1556e7557334d76d8ad02c97c602f909252e4a915
SHA2560bb170a026c6d9a85e6df7eae645c323c2ecb2c03d6428dd291c369995b683c8
SHA512f4552db3ce89f9895c59ead84106f8e25fb0249f639dccf03143aa1aeaeca2f997fd6c95ac3a85f68ed4b90f0ae54c9acaec1da21b24d5bd50f004807a279395
-
Filesize
1.2MB
MD5182d8e9456bce221c940008c38b74336
SHA1556e7557334d76d8ad02c97c602f909252e4a915
SHA2560bb170a026c6d9a85e6df7eae645c323c2ecb2c03d6428dd291c369995b683c8
SHA512f4552db3ce89f9895c59ead84106f8e25fb0249f639dccf03143aa1aeaeca2f997fd6c95ac3a85f68ed4b90f0ae54c9acaec1da21b24d5bd50f004807a279395
-
Filesize
725KB
MD515e65ffc98187396d14046542bca8ed3
SHA17d6078e07f23bbdcfc0f6de0ab2ffbd489e8cbf9
SHA256fc86d97ba0cc6787174ba872d478e33cdb9ecccb04934846606a7fde6f8290ac
SHA512192d775dbfb7f1d97402c4e3527108c046f332b2ae7be02e215772c45c2cb147ca3174525f65fe852da1eb81b196b60bb414516bd305f6a345a8c517f8b43bd2
-
Filesize
725KB
MD515e65ffc98187396d14046542bca8ed3
SHA17d6078e07f23bbdcfc0f6de0ab2ffbd489e8cbf9
SHA256fc86d97ba0cc6787174ba872d478e33cdb9ecccb04934846606a7fde6f8290ac
SHA512192d775dbfb7f1d97402c4e3527108c046f332b2ae7be02e215772c45c2cb147ca3174525f65fe852da1eb81b196b60bb414516bd305f6a345a8c517f8b43bd2
-
Filesize
1.8MB
MD5ca7a5693b5b0e8b54d6dad6a5b1b86b5
SHA149da08ec9be5e002b0d22dd630182c3a905c76c7
SHA2562d66fdf0417c3d3612015ff191a2010f78fffda1b1f2ed7682181ed7c8fa7c12
SHA51268ac5c2bb689bbfc903cd2a13fe9ecf998b442690ef41d88f611ce40cb8cca1d795099cd40bc7f5325203e6314baf6a537d8369be78ecb1703f8cfc75cf26158
-
Filesize
1.8MB
MD5ca7a5693b5b0e8b54d6dad6a5b1b86b5
SHA149da08ec9be5e002b0d22dd630182c3a905c76c7
SHA2562d66fdf0417c3d3612015ff191a2010f78fffda1b1f2ed7682181ed7c8fa7c12
SHA51268ac5c2bb689bbfc903cd2a13fe9ecf998b442690ef41d88f611ce40cb8cca1d795099cd40bc7f5325203e6314baf6a537d8369be78ecb1703f8cfc75cf26158