Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
119s -
max time network
131s -
platform
windows7_x64 -
resource
win7-20230831-en -
resource tags
arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system -
submitted
10/10/2023, 21:42
Static task
static1
Behavioral task
behavioral1
Sample
file.exe
Resource
win7-20230831-en
Behavioral task
behavioral2
Sample
file.exe
Resource
win10v2004-20230915-en
General
-
Target
file.exe
-
Size
1.2MB
-
MD5
ae6bcbf4dc011c51606da631ad289c40
-
SHA1
63c0cecd9cb56b51de089ffa8becf1803add964b
-
SHA256
3c53812acc6c7331c2bd86c8f29e3500b040c945ebdbcaec4e8b0fb63e9b6aa3
-
SHA512
cdfafe4358c48d6f40d67a62b3ad8f319cba0164af7c2c9327494d6a72718ed615c957987501cc9449aa7dd64a09e61c4bc9d17b536852300e2070a3e422cabf
-
SSDEEP
24576:Hy0oTwhjrwoMWdjcXAdaybDk/2nPEGIAiXrmhNgOEYd76pqyEllFoea7/:S0oTwhjMoTdo6a5uPhIDXCjUYZ6pqyEY
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection 1jJ44zT3.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" 1jJ44zT3.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" 1jJ44zT3.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" 1jJ44zT3.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" 1jJ44zT3.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" 1jJ44zT3.exe -
Executes dropped EXE 5 IoCs
pid Process 1740 CB4DQ66.exe 2600 Ds1MV99.exe 2308 op2bt28.exe 2716 1jJ44zT3.exe 2520 2wC4075.exe -
Loads dropped DLL 14 IoCs
pid Process 2988 file.exe 1740 CB4DQ66.exe 1740 CB4DQ66.exe 2600 Ds1MV99.exe 2600 Ds1MV99.exe 2308 op2bt28.exe 2308 op2bt28.exe 2716 1jJ44zT3.exe 2308 op2bt28.exe 2520 2wC4075.exe 2336 WerFault.exe 2336 WerFault.exe 2336 WerFault.exe 2336 WerFault.exe -
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Features 1jJ44zT3.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0" 1jJ44zT3.exe -
Adds Run key to start application 2 TTPs 4 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" file.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" CB4DQ66.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\"" Ds1MV99.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup3 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP003.TMP\\\"" op2bt28.exe -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 2520 set thread context of 2596 2520 2wC4075.exe 33 -
Program crash 1 IoCs
pid pid_target Process procid_target 2336 2520 WerFault.exe 32 -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 2716 1jJ44zT3.exe 2716 1jJ44zT3.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 2716 1jJ44zT3.exe -
Suspicious use of WriteProcessMemory 56 IoCs
description pid Process procid_target PID 2988 wrote to memory of 1740 2988 file.exe 28 PID 2988 wrote to memory of 1740 2988 file.exe 28 PID 2988 wrote to memory of 1740 2988 file.exe 28 PID 2988 wrote to memory of 1740 2988 file.exe 28 PID 2988 wrote to memory of 1740 2988 file.exe 28 PID 2988 wrote to memory of 1740 2988 file.exe 28 PID 2988 wrote to memory of 1740 2988 file.exe 28 PID 1740 wrote to memory of 2600 1740 CB4DQ66.exe 29 PID 1740 wrote to memory of 2600 1740 CB4DQ66.exe 29 PID 1740 wrote to memory of 2600 1740 CB4DQ66.exe 29 PID 1740 wrote to memory of 2600 1740 CB4DQ66.exe 29 PID 1740 wrote to memory of 2600 1740 CB4DQ66.exe 29 PID 1740 wrote to memory of 2600 1740 CB4DQ66.exe 29 PID 1740 wrote to memory of 2600 1740 CB4DQ66.exe 29 PID 2600 wrote to memory of 2308 2600 Ds1MV99.exe 30 PID 2600 wrote to memory of 2308 2600 Ds1MV99.exe 30 PID 2600 wrote to memory of 2308 2600 Ds1MV99.exe 30 PID 2600 wrote to memory of 2308 2600 Ds1MV99.exe 30 PID 2600 wrote to memory of 2308 2600 Ds1MV99.exe 30 PID 2600 wrote to memory of 2308 2600 Ds1MV99.exe 30 PID 2600 wrote to memory of 2308 2600 Ds1MV99.exe 30 PID 2308 wrote to memory of 2716 2308 op2bt28.exe 31 PID 2308 wrote to memory of 2716 2308 op2bt28.exe 31 PID 2308 wrote to memory of 2716 2308 op2bt28.exe 31 PID 2308 wrote to memory of 2716 2308 op2bt28.exe 31 PID 2308 wrote to memory of 2716 2308 op2bt28.exe 31 PID 2308 wrote to memory of 2716 2308 op2bt28.exe 31 PID 2308 wrote to memory of 2716 2308 op2bt28.exe 31 PID 2308 wrote to memory of 2520 2308 op2bt28.exe 32 PID 2308 wrote to memory of 2520 2308 op2bt28.exe 32 PID 2308 wrote to memory of 2520 2308 op2bt28.exe 32 PID 2308 wrote to memory of 2520 2308 op2bt28.exe 32 PID 2308 wrote to memory of 2520 2308 op2bt28.exe 32 PID 2308 wrote to memory of 2520 2308 op2bt28.exe 32 PID 2308 wrote to memory of 2520 2308 op2bt28.exe 32 PID 2520 wrote to memory of 2596 2520 2wC4075.exe 33 PID 2520 wrote to memory of 2596 2520 2wC4075.exe 33 PID 2520 wrote to memory of 2596 2520 2wC4075.exe 33 PID 2520 wrote to memory of 2596 2520 2wC4075.exe 33 PID 2520 wrote to memory of 2596 2520 2wC4075.exe 33 PID 2520 wrote to memory of 2596 2520 2wC4075.exe 33 PID 2520 wrote to memory of 2596 2520 2wC4075.exe 33 PID 2520 wrote to memory of 2596 2520 2wC4075.exe 33 PID 2520 wrote to memory of 2596 2520 2wC4075.exe 33 PID 2520 wrote to memory of 2596 2520 2wC4075.exe 33 PID 2520 wrote to memory of 2596 2520 2wC4075.exe 33 PID 2520 wrote to memory of 2596 2520 2wC4075.exe 33 PID 2520 wrote to memory of 2596 2520 2wC4075.exe 33 PID 2520 wrote to memory of 2596 2520 2wC4075.exe 33 PID 2520 wrote to memory of 2336 2520 2wC4075.exe 34 PID 2520 wrote to memory of 2336 2520 2wC4075.exe 34 PID 2520 wrote to memory of 2336 2520 2wC4075.exe 34 PID 2520 wrote to memory of 2336 2520 2wC4075.exe 34 PID 2520 wrote to memory of 2336 2520 2wC4075.exe 34 PID 2520 wrote to memory of 2336 2520 2wC4075.exe 34 PID 2520 wrote to memory of 2336 2520 2wC4075.exe 34
Processes
-
C:\Users\Admin\AppData\Local\Temp\file.exe"C:\Users\Admin\AppData\Local\Temp\file.exe"1⤵
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:2988 -
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\CB4DQ66.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\CB4DQ66.exe2⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:1740 -
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\Ds1MV99.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\Ds1MV99.exe3⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:2600 -
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\op2bt28.exeC:\Users\Admin\AppData\Local\Temp\IXP002.TMP\op2bt28.exe4⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:2308 -
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\1jJ44zT3.exeC:\Users\Admin\AppData\Local\Temp\IXP003.TMP\1jJ44zT3.exe5⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Loads dropped DLL
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2716
-
-
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\2wC4075.exeC:\Users\Admin\AppData\Local\Temp\IXP003.TMP\2wC4075.exe5⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2520 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"6⤵PID:2596
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2520 -s 2846⤵
- Loads dropped DLL
- Program crash
PID:2336
-
-
-
-
-
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.0MB
MD5329da0069bb2125b78e45b5248d186ed
SHA1c2fd67c3c0d5dd1904827cbed13c674d86952d5f
SHA2561356cdbb022ed71041a0b779f53eee900f40771bffdadfb0493891af537d1159
SHA51236062bc46d78240e5c2b39fc9b3a389c5dc97f76c834e90bae64b73c09a9db6318e1e8b2ff223dcf0d8814e13267c4bf1b44178668ad5cf132892ed3484c4fdf
-
Filesize
1.0MB
MD5329da0069bb2125b78e45b5248d186ed
SHA1c2fd67c3c0d5dd1904827cbed13c674d86952d5f
SHA2561356cdbb022ed71041a0b779f53eee900f40771bffdadfb0493891af537d1159
SHA51236062bc46d78240e5c2b39fc9b3a389c5dc97f76c834e90bae64b73c09a9db6318e1e8b2ff223dcf0d8814e13267c4bf1b44178668ad5cf132892ed3484c4fdf
-
Filesize
745KB
MD51c28ec10c263eab4b6413b280d108d46
SHA1bb5d7812bbb014f58057d0dfbb9e596db44f6cc7
SHA2565c101224df6e71cda990eb4ab5427034bcd4f7451cb86aa77b05c170ea83f9be
SHA5125b86e70ca49bfa68463003e758284bab973c65be7b849190d766f5bbd879ed237bc6516575d717d10966696323282e34ed0ecd829cfab86543b3951ff2479670
-
Filesize
745KB
MD51c28ec10c263eab4b6413b280d108d46
SHA1bb5d7812bbb014f58057d0dfbb9e596db44f6cc7
SHA2565c101224df6e71cda990eb4ab5427034bcd4f7451cb86aa77b05c170ea83f9be
SHA5125b86e70ca49bfa68463003e758284bab973c65be7b849190d766f5bbd879ed237bc6516575d717d10966696323282e34ed0ecd829cfab86543b3951ff2479670
-
Filesize
494KB
MD57dbda2a911a3c08bc3ac4539e4096cf6
SHA1033907f8b2bf668cf2ab1de228e14ab2d490041a
SHA256aacb49d435e7f0c6b2f7affe3a670bdc5c3917ce25e8f68d4b561877a85b8da5
SHA512e8c7b9d0447794d200ec68adca5612dabc4c9ac6e4f7f1a0727011da499ee8a53f03a1a27e577a45cb726903d89bba21110e474e38b3da24cfee5433eb6a1329
-
Filesize
494KB
MD57dbda2a911a3c08bc3ac4539e4096cf6
SHA1033907f8b2bf668cf2ab1de228e14ab2d490041a
SHA256aacb49d435e7f0c6b2f7affe3a670bdc5c3917ce25e8f68d4b561877a85b8da5
SHA512e8c7b9d0447794d200ec68adca5612dabc4c9ac6e4f7f1a0727011da499ee8a53f03a1a27e577a45cb726903d89bba21110e474e38b3da24cfee5433eb6a1329
-
Filesize
194KB
MD56241b03d68a610324ecda52f0f84e287
SHA1da80280b6e3925e455925efd6c6e59a6118269c4
SHA256ec74de9416b8ef2c3bdb1a9835e54548b3185524210d1aeffa91c98f74f751e2
SHA512a60fe447cb0bed8e6cbd7c344b19a4602553209cbda7a40993f0fdf01e096bda4b79de0b528ecebf2efa0007f81d7bd6c7ef84252b2a160c93d642a78f0095f9
-
Filesize
194KB
MD56241b03d68a610324ecda52f0f84e287
SHA1da80280b6e3925e455925efd6c6e59a6118269c4
SHA256ec74de9416b8ef2c3bdb1a9835e54548b3185524210d1aeffa91c98f74f751e2
SHA512a60fe447cb0bed8e6cbd7c344b19a4602553209cbda7a40993f0fdf01e096bda4b79de0b528ecebf2efa0007f81d7bd6c7ef84252b2a160c93d642a78f0095f9
-
Filesize
448KB
MD5eb224ab4447fd162331de829a25cd323
SHA1bc548105ff28c7df16c2bad188e84347ac545fac
SHA2562297046a8c31790163a45d192afd48fc77260888829587fec5b72fe52cf489f0
SHA512212ca1b198b858f9ef012cf691ea579657711601e5e26aa673650d40248b4576c7cab718a02f58ca2ee7000e2cc479fcbbe37f06358f33066205838e19df913c
-
Filesize
448KB
MD5eb224ab4447fd162331de829a25cd323
SHA1bc548105ff28c7df16c2bad188e84347ac545fac
SHA2562297046a8c31790163a45d192afd48fc77260888829587fec5b72fe52cf489f0
SHA512212ca1b198b858f9ef012cf691ea579657711601e5e26aa673650d40248b4576c7cab718a02f58ca2ee7000e2cc479fcbbe37f06358f33066205838e19df913c
-
Filesize
1.0MB
MD5329da0069bb2125b78e45b5248d186ed
SHA1c2fd67c3c0d5dd1904827cbed13c674d86952d5f
SHA2561356cdbb022ed71041a0b779f53eee900f40771bffdadfb0493891af537d1159
SHA51236062bc46d78240e5c2b39fc9b3a389c5dc97f76c834e90bae64b73c09a9db6318e1e8b2ff223dcf0d8814e13267c4bf1b44178668ad5cf132892ed3484c4fdf
-
Filesize
1.0MB
MD5329da0069bb2125b78e45b5248d186ed
SHA1c2fd67c3c0d5dd1904827cbed13c674d86952d5f
SHA2561356cdbb022ed71041a0b779f53eee900f40771bffdadfb0493891af537d1159
SHA51236062bc46d78240e5c2b39fc9b3a389c5dc97f76c834e90bae64b73c09a9db6318e1e8b2ff223dcf0d8814e13267c4bf1b44178668ad5cf132892ed3484c4fdf
-
Filesize
745KB
MD51c28ec10c263eab4b6413b280d108d46
SHA1bb5d7812bbb014f58057d0dfbb9e596db44f6cc7
SHA2565c101224df6e71cda990eb4ab5427034bcd4f7451cb86aa77b05c170ea83f9be
SHA5125b86e70ca49bfa68463003e758284bab973c65be7b849190d766f5bbd879ed237bc6516575d717d10966696323282e34ed0ecd829cfab86543b3951ff2479670
-
Filesize
745KB
MD51c28ec10c263eab4b6413b280d108d46
SHA1bb5d7812bbb014f58057d0dfbb9e596db44f6cc7
SHA2565c101224df6e71cda990eb4ab5427034bcd4f7451cb86aa77b05c170ea83f9be
SHA5125b86e70ca49bfa68463003e758284bab973c65be7b849190d766f5bbd879ed237bc6516575d717d10966696323282e34ed0ecd829cfab86543b3951ff2479670
-
Filesize
494KB
MD57dbda2a911a3c08bc3ac4539e4096cf6
SHA1033907f8b2bf668cf2ab1de228e14ab2d490041a
SHA256aacb49d435e7f0c6b2f7affe3a670bdc5c3917ce25e8f68d4b561877a85b8da5
SHA512e8c7b9d0447794d200ec68adca5612dabc4c9ac6e4f7f1a0727011da499ee8a53f03a1a27e577a45cb726903d89bba21110e474e38b3da24cfee5433eb6a1329
-
Filesize
494KB
MD57dbda2a911a3c08bc3ac4539e4096cf6
SHA1033907f8b2bf668cf2ab1de228e14ab2d490041a
SHA256aacb49d435e7f0c6b2f7affe3a670bdc5c3917ce25e8f68d4b561877a85b8da5
SHA512e8c7b9d0447794d200ec68adca5612dabc4c9ac6e4f7f1a0727011da499ee8a53f03a1a27e577a45cb726903d89bba21110e474e38b3da24cfee5433eb6a1329
-
Filesize
194KB
MD56241b03d68a610324ecda52f0f84e287
SHA1da80280b6e3925e455925efd6c6e59a6118269c4
SHA256ec74de9416b8ef2c3bdb1a9835e54548b3185524210d1aeffa91c98f74f751e2
SHA512a60fe447cb0bed8e6cbd7c344b19a4602553209cbda7a40993f0fdf01e096bda4b79de0b528ecebf2efa0007f81d7bd6c7ef84252b2a160c93d642a78f0095f9
-
Filesize
194KB
MD56241b03d68a610324ecda52f0f84e287
SHA1da80280b6e3925e455925efd6c6e59a6118269c4
SHA256ec74de9416b8ef2c3bdb1a9835e54548b3185524210d1aeffa91c98f74f751e2
SHA512a60fe447cb0bed8e6cbd7c344b19a4602553209cbda7a40993f0fdf01e096bda4b79de0b528ecebf2efa0007f81d7bd6c7ef84252b2a160c93d642a78f0095f9
-
Filesize
448KB
MD5eb224ab4447fd162331de829a25cd323
SHA1bc548105ff28c7df16c2bad188e84347ac545fac
SHA2562297046a8c31790163a45d192afd48fc77260888829587fec5b72fe52cf489f0
SHA512212ca1b198b858f9ef012cf691ea579657711601e5e26aa673650d40248b4576c7cab718a02f58ca2ee7000e2cc479fcbbe37f06358f33066205838e19df913c
-
Filesize
448KB
MD5eb224ab4447fd162331de829a25cd323
SHA1bc548105ff28c7df16c2bad188e84347ac545fac
SHA2562297046a8c31790163a45d192afd48fc77260888829587fec5b72fe52cf489f0
SHA512212ca1b198b858f9ef012cf691ea579657711601e5e26aa673650d40248b4576c7cab718a02f58ca2ee7000e2cc479fcbbe37f06358f33066205838e19df913c
-
Filesize
448KB
MD5eb224ab4447fd162331de829a25cd323
SHA1bc548105ff28c7df16c2bad188e84347ac545fac
SHA2562297046a8c31790163a45d192afd48fc77260888829587fec5b72fe52cf489f0
SHA512212ca1b198b858f9ef012cf691ea579657711601e5e26aa673650d40248b4576c7cab718a02f58ca2ee7000e2cc479fcbbe37f06358f33066205838e19df913c
-
Filesize
448KB
MD5eb224ab4447fd162331de829a25cd323
SHA1bc548105ff28c7df16c2bad188e84347ac545fac
SHA2562297046a8c31790163a45d192afd48fc77260888829587fec5b72fe52cf489f0
SHA512212ca1b198b858f9ef012cf691ea579657711601e5e26aa673650d40248b4576c7cab718a02f58ca2ee7000e2cc479fcbbe37f06358f33066205838e19df913c
-
Filesize
448KB
MD5eb224ab4447fd162331de829a25cd323
SHA1bc548105ff28c7df16c2bad188e84347ac545fac
SHA2562297046a8c31790163a45d192afd48fc77260888829587fec5b72fe52cf489f0
SHA512212ca1b198b858f9ef012cf691ea579657711601e5e26aa673650d40248b4576c7cab718a02f58ca2ee7000e2cc479fcbbe37f06358f33066205838e19df913c
-
Filesize
448KB
MD5eb224ab4447fd162331de829a25cd323
SHA1bc548105ff28c7df16c2bad188e84347ac545fac
SHA2562297046a8c31790163a45d192afd48fc77260888829587fec5b72fe52cf489f0
SHA512212ca1b198b858f9ef012cf691ea579657711601e5e26aa673650d40248b4576c7cab718a02f58ca2ee7000e2cc479fcbbe37f06358f33066205838e19df913c