Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    119s
  • max time network
    131s
  • platform
    windows7_x64
  • resource
    win7-20230831-en
  • resource tags

    arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
  • submitted
    10/10/2023, 21:42

General

  • Target

    file.exe

  • Size

    1.2MB

  • MD5

    ae6bcbf4dc011c51606da631ad289c40

  • SHA1

    63c0cecd9cb56b51de089ffa8becf1803add964b

  • SHA256

    3c53812acc6c7331c2bd86c8f29e3500b040c945ebdbcaec4e8b0fb63e9b6aa3

  • SHA512

    cdfafe4358c48d6f40d67a62b3ad8f319cba0164af7c2c9327494d6a72718ed615c957987501cc9449aa7dd64a09e61c4bc9d17b536852300e2070a3e422cabf

  • SSDEEP

    24576:Hy0oTwhjrwoMWdjcXAdaybDk/2nPEGIAiXrmhNgOEYd76pqyEllFoea7/:S0oTwhjMoTdo6a5uPhIDXCjUYZ6pqyEY

Malware Config

Signatures

  • Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs
  • Executes dropped EXE 5 IoCs
  • Loads dropped DLL 14 IoCs
  • Windows security modification 2 TTPs 2 IoCs
  • Adds Run key to start application 2 TTPs 4 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Program crash 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 56 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\file.exe
    "C:\Users\Admin\AppData\Local\Temp\file.exe"
    1⤵
    • Loads dropped DLL
    • Adds Run key to start application
    • Suspicious use of WriteProcessMemory
    PID:2988
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\CB4DQ66.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\CB4DQ66.exe
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Adds Run key to start application
      • Suspicious use of WriteProcessMemory
      PID:1740
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\Ds1MV99.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\Ds1MV99.exe
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Adds Run key to start application
        • Suspicious use of WriteProcessMemory
        PID:2600
        • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\op2bt28.exe
          C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\op2bt28.exe
          4⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • Adds Run key to start application
          • Suspicious use of WriteProcessMemory
          PID:2308
          • C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\1jJ44zT3.exe
            C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\1jJ44zT3.exe
            5⤵
            • Modifies Windows Defender Real-time Protection settings
            • Executes dropped EXE
            • Loads dropped DLL
            • Windows security modification
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:2716
          • C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\2wC4075.exe
            C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\2wC4075.exe
            5⤵
            • Executes dropped EXE
            • Loads dropped DLL
            • Suspicious use of SetThreadContext
            • Suspicious use of WriteProcessMemory
            PID:2520
            • C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
              "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
              6⤵
                PID:2596
              • C:\Windows\SysWOW64\WerFault.exe
                C:\Windows\SysWOW64\WerFault.exe -u -p 2520 -s 284
                6⤵
                • Loads dropped DLL
                • Program crash
                PID:2336

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\CB4DQ66.exe

      Filesize

      1.0MB

      MD5

      329da0069bb2125b78e45b5248d186ed

      SHA1

      c2fd67c3c0d5dd1904827cbed13c674d86952d5f

      SHA256

      1356cdbb022ed71041a0b779f53eee900f40771bffdadfb0493891af537d1159

      SHA512

      36062bc46d78240e5c2b39fc9b3a389c5dc97f76c834e90bae64b73c09a9db6318e1e8b2ff223dcf0d8814e13267c4bf1b44178668ad5cf132892ed3484c4fdf

    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\CB4DQ66.exe

      Filesize

      1.0MB

      MD5

      329da0069bb2125b78e45b5248d186ed

      SHA1

      c2fd67c3c0d5dd1904827cbed13c674d86952d5f

      SHA256

      1356cdbb022ed71041a0b779f53eee900f40771bffdadfb0493891af537d1159

      SHA512

      36062bc46d78240e5c2b39fc9b3a389c5dc97f76c834e90bae64b73c09a9db6318e1e8b2ff223dcf0d8814e13267c4bf1b44178668ad5cf132892ed3484c4fdf

    • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\Ds1MV99.exe

      Filesize

      745KB

      MD5

      1c28ec10c263eab4b6413b280d108d46

      SHA1

      bb5d7812bbb014f58057d0dfbb9e596db44f6cc7

      SHA256

      5c101224df6e71cda990eb4ab5427034bcd4f7451cb86aa77b05c170ea83f9be

      SHA512

      5b86e70ca49bfa68463003e758284bab973c65be7b849190d766f5bbd879ed237bc6516575d717d10966696323282e34ed0ecd829cfab86543b3951ff2479670

    • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\Ds1MV99.exe

      Filesize

      745KB

      MD5

      1c28ec10c263eab4b6413b280d108d46

      SHA1

      bb5d7812bbb014f58057d0dfbb9e596db44f6cc7

      SHA256

      5c101224df6e71cda990eb4ab5427034bcd4f7451cb86aa77b05c170ea83f9be

      SHA512

      5b86e70ca49bfa68463003e758284bab973c65be7b849190d766f5bbd879ed237bc6516575d717d10966696323282e34ed0ecd829cfab86543b3951ff2479670

    • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\op2bt28.exe

      Filesize

      494KB

      MD5

      7dbda2a911a3c08bc3ac4539e4096cf6

      SHA1

      033907f8b2bf668cf2ab1de228e14ab2d490041a

      SHA256

      aacb49d435e7f0c6b2f7affe3a670bdc5c3917ce25e8f68d4b561877a85b8da5

      SHA512

      e8c7b9d0447794d200ec68adca5612dabc4c9ac6e4f7f1a0727011da499ee8a53f03a1a27e577a45cb726903d89bba21110e474e38b3da24cfee5433eb6a1329

    • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\op2bt28.exe

      Filesize

      494KB

      MD5

      7dbda2a911a3c08bc3ac4539e4096cf6

      SHA1

      033907f8b2bf668cf2ab1de228e14ab2d490041a

      SHA256

      aacb49d435e7f0c6b2f7affe3a670bdc5c3917ce25e8f68d4b561877a85b8da5

      SHA512

      e8c7b9d0447794d200ec68adca5612dabc4c9ac6e4f7f1a0727011da499ee8a53f03a1a27e577a45cb726903d89bba21110e474e38b3da24cfee5433eb6a1329

    • C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\1jJ44zT3.exe

      Filesize

      194KB

      MD5

      6241b03d68a610324ecda52f0f84e287

      SHA1

      da80280b6e3925e455925efd6c6e59a6118269c4

      SHA256

      ec74de9416b8ef2c3bdb1a9835e54548b3185524210d1aeffa91c98f74f751e2

      SHA512

      a60fe447cb0bed8e6cbd7c344b19a4602553209cbda7a40993f0fdf01e096bda4b79de0b528ecebf2efa0007f81d7bd6c7ef84252b2a160c93d642a78f0095f9

    • C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\1jJ44zT3.exe

      Filesize

      194KB

      MD5

      6241b03d68a610324ecda52f0f84e287

      SHA1

      da80280b6e3925e455925efd6c6e59a6118269c4

      SHA256

      ec74de9416b8ef2c3bdb1a9835e54548b3185524210d1aeffa91c98f74f751e2

      SHA512

      a60fe447cb0bed8e6cbd7c344b19a4602553209cbda7a40993f0fdf01e096bda4b79de0b528ecebf2efa0007f81d7bd6c7ef84252b2a160c93d642a78f0095f9

    • C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\2wC4075.exe

      Filesize

      448KB

      MD5

      eb224ab4447fd162331de829a25cd323

      SHA1

      bc548105ff28c7df16c2bad188e84347ac545fac

      SHA256

      2297046a8c31790163a45d192afd48fc77260888829587fec5b72fe52cf489f0

      SHA512

      212ca1b198b858f9ef012cf691ea579657711601e5e26aa673650d40248b4576c7cab718a02f58ca2ee7000e2cc479fcbbe37f06358f33066205838e19df913c

    • C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\2wC4075.exe

      Filesize

      448KB

      MD5

      eb224ab4447fd162331de829a25cd323

      SHA1

      bc548105ff28c7df16c2bad188e84347ac545fac

      SHA256

      2297046a8c31790163a45d192afd48fc77260888829587fec5b72fe52cf489f0

      SHA512

      212ca1b198b858f9ef012cf691ea579657711601e5e26aa673650d40248b4576c7cab718a02f58ca2ee7000e2cc479fcbbe37f06358f33066205838e19df913c

    • \Users\Admin\AppData\Local\Temp\IXP000.TMP\CB4DQ66.exe

      Filesize

      1.0MB

      MD5

      329da0069bb2125b78e45b5248d186ed

      SHA1

      c2fd67c3c0d5dd1904827cbed13c674d86952d5f

      SHA256

      1356cdbb022ed71041a0b779f53eee900f40771bffdadfb0493891af537d1159

      SHA512

      36062bc46d78240e5c2b39fc9b3a389c5dc97f76c834e90bae64b73c09a9db6318e1e8b2ff223dcf0d8814e13267c4bf1b44178668ad5cf132892ed3484c4fdf

    • \Users\Admin\AppData\Local\Temp\IXP000.TMP\CB4DQ66.exe

      Filesize

      1.0MB

      MD5

      329da0069bb2125b78e45b5248d186ed

      SHA1

      c2fd67c3c0d5dd1904827cbed13c674d86952d5f

      SHA256

      1356cdbb022ed71041a0b779f53eee900f40771bffdadfb0493891af537d1159

      SHA512

      36062bc46d78240e5c2b39fc9b3a389c5dc97f76c834e90bae64b73c09a9db6318e1e8b2ff223dcf0d8814e13267c4bf1b44178668ad5cf132892ed3484c4fdf

    • \Users\Admin\AppData\Local\Temp\IXP001.TMP\Ds1MV99.exe

      Filesize

      745KB

      MD5

      1c28ec10c263eab4b6413b280d108d46

      SHA1

      bb5d7812bbb014f58057d0dfbb9e596db44f6cc7

      SHA256

      5c101224df6e71cda990eb4ab5427034bcd4f7451cb86aa77b05c170ea83f9be

      SHA512

      5b86e70ca49bfa68463003e758284bab973c65be7b849190d766f5bbd879ed237bc6516575d717d10966696323282e34ed0ecd829cfab86543b3951ff2479670

    • \Users\Admin\AppData\Local\Temp\IXP001.TMP\Ds1MV99.exe

      Filesize

      745KB

      MD5

      1c28ec10c263eab4b6413b280d108d46

      SHA1

      bb5d7812bbb014f58057d0dfbb9e596db44f6cc7

      SHA256

      5c101224df6e71cda990eb4ab5427034bcd4f7451cb86aa77b05c170ea83f9be

      SHA512

      5b86e70ca49bfa68463003e758284bab973c65be7b849190d766f5bbd879ed237bc6516575d717d10966696323282e34ed0ecd829cfab86543b3951ff2479670

    • \Users\Admin\AppData\Local\Temp\IXP002.TMP\op2bt28.exe

      Filesize

      494KB

      MD5

      7dbda2a911a3c08bc3ac4539e4096cf6

      SHA1

      033907f8b2bf668cf2ab1de228e14ab2d490041a

      SHA256

      aacb49d435e7f0c6b2f7affe3a670bdc5c3917ce25e8f68d4b561877a85b8da5

      SHA512

      e8c7b9d0447794d200ec68adca5612dabc4c9ac6e4f7f1a0727011da499ee8a53f03a1a27e577a45cb726903d89bba21110e474e38b3da24cfee5433eb6a1329

    • \Users\Admin\AppData\Local\Temp\IXP002.TMP\op2bt28.exe

      Filesize

      494KB

      MD5

      7dbda2a911a3c08bc3ac4539e4096cf6

      SHA1

      033907f8b2bf668cf2ab1de228e14ab2d490041a

      SHA256

      aacb49d435e7f0c6b2f7affe3a670bdc5c3917ce25e8f68d4b561877a85b8da5

      SHA512

      e8c7b9d0447794d200ec68adca5612dabc4c9ac6e4f7f1a0727011da499ee8a53f03a1a27e577a45cb726903d89bba21110e474e38b3da24cfee5433eb6a1329

    • \Users\Admin\AppData\Local\Temp\IXP003.TMP\1jJ44zT3.exe

      Filesize

      194KB

      MD5

      6241b03d68a610324ecda52f0f84e287

      SHA1

      da80280b6e3925e455925efd6c6e59a6118269c4

      SHA256

      ec74de9416b8ef2c3bdb1a9835e54548b3185524210d1aeffa91c98f74f751e2

      SHA512

      a60fe447cb0bed8e6cbd7c344b19a4602553209cbda7a40993f0fdf01e096bda4b79de0b528ecebf2efa0007f81d7bd6c7ef84252b2a160c93d642a78f0095f9

    • \Users\Admin\AppData\Local\Temp\IXP003.TMP\1jJ44zT3.exe

      Filesize

      194KB

      MD5

      6241b03d68a610324ecda52f0f84e287

      SHA1

      da80280b6e3925e455925efd6c6e59a6118269c4

      SHA256

      ec74de9416b8ef2c3bdb1a9835e54548b3185524210d1aeffa91c98f74f751e2

      SHA512

      a60fe447cb0bed8e6cbd7c344b19a4602553209cbda7a40993f0fdf01e096bda4b79de0b528ecebf2efa0007f81d7bd6c7ef84252b2a160c93d642a78f0095f9

    • \Users\Admin\AppData\Local\Temp\IXP003.TMP\2wC4075.exe

      Filesize

      448KB

      MD5

      eb224ab4447fd162331de829a25cd323

      SHA1

      bc548105ff28c7df16c2bad188e84347ac545fac

      SHA256

      2297046a8c31790163a45d192afd48fc77260888829587fec5b72fe52cf489f0

      SHA512

      212ca1b198b858f9ef012cf691ea579657711601e5e26aa673650d40248b4576c7cab718a02f58ca2ee7000e2cc479fcbbe37f06358f33066205838e19df913c

    • \Users\Admin\AppData\Local\Temp\IXP003.TMP\2wC4075.exe

      Filesize

      448KB

      MD5

      eb224ab4447fd162331de829a25cd323

      SHA1

      bc548105ff28c7df16c2bad188e84347ac545fac

      SHA256

      2297046a8c31790163a45d192afd48fc77260888829587fec5b72fe52cf489f0

      SHA512

      212ca1b198b858f9ef012cf691ea579657711601e5e26aa673650d40248b4576c7cab718a02f58ca2ee7000e2cc479fcbbe37f06358f33066205838e19df913c

    • \Users\Admin\AppData\Local\Temp\IXP003.TMP\2wC4075.exe

      Filesize

      448KB

      MD5

      eb224ab4447fd162331de829a25cd323

      SHA1

      bc548105ff28c7df16c2bad188e84347ac545fac

      SHA256

      2297046a8c31790163a45d192afd48fc77260888829587fec5b72fe52cf489f0

      SHA512

      212ca1b198b858f9ef012cf691ea579657711601e5e26aa673650d40248b4576c7cab718a02f58ca2ee7000e2cc479fcbbe37f06358f33066205838e19df913c

    • \Users\Admin\AppData\Local\Temp\IXP003.TMP\2wC4075.exe

      Filesize

      448KB

      MD5

      eb224ab4447fd162331de829a25cd323

      SHA1

      bc548105ff28c7df16c2bad188e84347ac545fac

      SHA256

      2297046a8c31790163a45d192afd48fc77260888829587fec5b72fe52cf489f0

      SHA512

      212ca1b198b858f9ef012cf691ea579657711601e5e26aa673650d40248b4576c7cab718a02f58ca2ee7000e2cc479fcbbe37f06358f33066205838e19df913c

    • \Users\Admin\AppData\Local\Temp\IXP003.TMP\2wC4075.exe

      Filesize

      448KB

      MD5

      eb224ab4447fd162331de829a25cd323

      SHA1

      bc548105ff28c7df16c2bad188e84347ac545fac

      SHA256

      2297046a8c31790163a45d192afd48fc77260888829587fec5b72fe52cf489f0

      SHA512

      212ca1b198b858f9ef012cf691ea579657711601e5e26aa673650d40248b4576c7cab718a02f58ca2ee7000e2cc479fcbbe37f06358f33066205838e19df913c

    • \Users\Admin\AppData\Local\Temp\IXP003.TMP\2wC4075.exe

      Filesize

      448KB

      MD5

      eb224ab4447fd162331de829a25cd323

      SHA1

      bc548105ff28c7df16c2bad188e84347ac545fac

      SHA256

      2297046a8c31790163a45d192afd48fc77260888829587fec5b72fe52cf489f0

      SHA512

      212ca1b198b858f9ef012cf691ea579657711601e5e26aa673650d40248b4576c7cab718a02f58ca2ee7000e2cc479fcbbe37f06358f33066205838e19df913c

    • memory/2596-80-0x0000000000400000-0x0000000000433000-memory.dmp

      Filesize

      204KB

    • memory/2596-76-0x0000000000400000-0x0000000000433000-memory.dmp

      Filesize

      204KB

    • memory/2596-95-0x0000000000400000-0x0000000000433000-memory.dmp

      Filesize

      204KB

    • memory/2596-90-0x0000000000400000-0x0000000000433000-memory.dmp

      Filesize

      204KB

    • memory/2596-89-0x0000000000400000-0x0000000000433000-memory.dmp

      Filesize

      204KB

    • memory/2596-87-0x0000000000400000-0x0000000000433000-memory.dmp

      Filesize

      204KB

    • memory/2596-85-0x0000000000400000-0x0000000000433000-memory.dmp

      Filesize

      204KB

    • memory/2596-81-0x0000000000400000-0x0000000000433000-memory.dmp

      Filesize

      204KB

    • memory/2596-84-0x00000000FFFDE000-0x00000000FFFDF000-memory.dmp

      Filesize

      4KB

    • memory/2596-83-0x0000000000400000-0x0000000000433000-memory.dmp

      Filesize

      204KB

    • memory/2596-82-0x0000000000400000-0x0000000000433000-memory.dmp

      Filesize

      204KB

    • memory/2596-78-0x0000000000400000-0x0000000000433000-memory.dmp

      Filesize

      204KB

    • memory/2716-53-0x0000000001FC0000-0x0000000001FD6000-memory.dmp

      Filesize

      88KB

    • memory/2716-59-0x0000000001FC0000-0x0000000001FD6000-memory.dmp

      Filesize

      88KB

    • memory/2716-49-0x0000000001FC0000-0x0000000001FD6000-memory.dmp

      Filesize

      88KB

    • memory/2716-45-0x0000000001FC0000-0x0000000001FD6000-memory.dmp

      Filesize

      88KB

    • memory/2716-51-0x0000000001FC0000-0x0000000001FD6000-memory.dmp

      Filesize

      88KB

    • memory/2716-61-0x0000000001FC0000-0x0000000001FD6000-memory.dmp

      Filesize

      88KB

    • memory/2716-67-0x0000000001FC0000-0x0000000001FD6000-memory.dmp

      Filesize

      88KB

    • memory/2716-55-0x0000000001FC0000-0x0000000001FD6000-memory.dmp

      Filesize

      88KB

    • memory/2716-57-0x0000000001FC0000-0x0000000001FD6000-memory.dmp

      Filesize

      88KB

    • memory/2716-47-0x0000000001FC0000-0x0000000001FD6000-memory.dmp

      Filesize

      88KB

    • memory/2716-63-0x0000000001FC0000-0x0000000001FD6000-memory.dmp

      Filesize

      88KB

    • memory/2716-65-0x0000000001FC0000-0x0000000001FD6000-memory.dmp

      Filesize

      88KB

    • memory/2716-43-0x0000000001FC0000-0x0000000001FD6000-memory.dmp

      Filesize

      88KB

    • memory/2716-42-0x0000000001FC0000-0x0000000001FD6000-memory.dmp

      Filesize

      88KB

    • memory/2716-41-0x0000000001FC0000-0x0000000001FDC000-memory.dmp

      Filesize

      112KB

    • memory/2716-40-0x00000000003E0000-0x00000000003FE000-memory.dmp

      Filesize

      120KB

    • memory/2716-69-0x0000000001FC0000-0x0000000001FD6000-memory.dmp

      Filesize

      88KB