Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    119s
  • max time network
    123s
  • platform
    windows7_x64
  • resource
    win7-20230831-en
  • resource tags

    arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
  • submitted
    10/10/2023, 12:14

General

  • Target

    file.exe

  • Size

    1.2MB

  • MD5

    8ac2f6a07c81dba4ccfe4325aca7628b

  • SHA1

    7a6e0262ff0b312add0a06b816ae27b5ba685fd9

  • SHA256

    75ec6c815f4ca762223a0ad901defff84ae8338f4ad9970a7a606bdb1514fd99

  • SHA512

    f826cea9687cab5799448320c169240dadaf89bea2dc72d305171796c1e7f9581a733ee3383924b5c8a92960bce9b8f44840730c533fc2ff8b4a704d28de69b9

  • SSDEEP

    24576:cyQFUOgYu8KjrAQq3PElA/u1+BwT0xUlZX7S5PRa:LSPutjM3Pt/uAwT0EIP

Malware Config

Signatures

  • Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs
  • Executes dropped EXE 5 IoCs
  • Loads dropped DLL 14 IoCs
  • Windows security modification 2 TTPs 2 IoCs
  • Adds Run key to start application 2 TTPs 4 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Program crash 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 63 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\file.exe
    "C:\Users\Admin\AppData\Local\Temp\file.exe"
    1⤵
    • Loads dropped DLL
    • Adds Run key to start application
    • Suspicious use of WriteProcessMemory
    PID:956
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\rC0Yh84.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\rC0Yh84.exe
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Adds Run key to start application
      • Suspicious use of WriteProcessMemory
      PID:2528
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\Lv4hz46.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\Lv4hz46.exe
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Adds Run key to start application
        • Suspicious use of WriteProcessMemory
        PID:1872
        • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\Pk3vg67.exe
          C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\Pk3vg67.exe
          4⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • Adds Run key to start application
          • Suspicious use of WriteProcessMemory
          PID:2688
          • C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\1Gm91dy3.exe
            C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\1Gm91dy3.exe
            5⤵
            • Modifies Windows Defender Real-time Protection settings
            • Executes dropped EXE
            • Loads dropped DLL
            • Windows security modification
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:2552
          • C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\2uY7201.exe
            C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\2uY7201.exe
            5⤵
            • Executes dropped EXE
            • Loads dropped DLL
            • Suspicious use of SetThreadContext
            • Suspicious use of WriteProcessMemory
            PID:2492
            • C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
              "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
              6⤵
              • Suspicious use of WriteProcessMemory
              PID:3024
              • C:\Windows\SysWOW64\WerFault.exe
                C:\Windows\SysWOW64\WerFault.exe -u -p 3024 -s 268
                7⤵
                • Program crash
                PID:516
            • C:\Windows\SysWOW64\WerFault.exe
              C:\Windows\SysWOW64\WerFault.exe -u -p 2492 -s 284
              6⤵
              • Loads dropped DLL
              • Program crash
              PID:268

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\rC0Yh84.exe

    Filesize

    1.0MB

    MD5

    85c1c75ca27ec5242dadee25a9ac4a7a

    SHA1

    7a0045bec0d6db1510e5041781621a2721af75c3

    SHA256

    5736605686e52da3953055a20a4365ebc67c5431b92d64b02c0c46d3ddd50c49

    SHA512

    ad06c9a46e2ba74f0ff0b8e12c4be7b4505a520a5048ef641dfabe6e6f7a8f6eea4a244ee48badb04a3918386a9d98e70a36add5eb429dae58e1adf830d2c41a

  • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\rC0Yh84.exe

    Filesize

    1.0MB

    MD5

    85c1c75ca27ec5242dadee25a9ac4a7a

    SHA1

    7a0045bec0d6db1510e5041781621a2721af75c3

    SHA256

    5736605686e52da3953055a20a4365ebc67c5431b92d64b02c0c46d3ddd50c49

    SHA512

    ad06c9a46e2ba74f0ff0b8e12c4be7b4505a520a5048ef641dfabe6e6f7a8f6eea4a244ee48badb04a3918386a9d98e70a36add5eb429dae58e1adf830d2c41a

  • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\Lv4hz46.exe

    Filesize

    746KB

    MD5

    73a7c9d1ae6f2f98ba6eb8802e9e136b

    SHA1

    fda2489487e49f975c64e30a02f8b763083e0f75

    SHA256

    60ef54f525f4f70ee7321cddd85f1a0bf087c4961a3c656c155f33c65a394aac

    SHA512

    6253e627e16b2030da3ec484b618ad1328701f185038c673631b01ad67e07c9bf17b011b36037be7fd78a772c7b594ade69519ffb02226da0a8aaf22d1ce67e0

  • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\Lv4hz46.exe

    Filesize

    746KB

    MD5

    73a7c9d1ae6f2f98ba6eb8802e9e136b

    SHA1

    fda2489487e49f975c64e30a02f8b763083e0f75

    SHA256

    60ef54f525f4f70ee7321cddd85f1a0bf087c4961a3c656c155f33c65a394aac

    SHA512

    6253e627e16b2030da3ec484b618ad1328701f185038c673631b01ad67e07c9bf17b011b36037be7fd78a772c7b594ade69519ffb02226da0a8aaf22d1ce67e0

  • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\Pk3vg67.exe

    Filesize

    492KB

    MD5

    47a573d5695dc295b4de60ce9a5e384d

    SHA1

    f1d3bbca40d60cdbf3b3c8915fcfb3ccabdc7ed1

    SHA256

    650037ec1bc1f5ec0d35f55c2ee94c4c52d3a929e348c6343915eee518f0cd2e

    SHA512

    fdd1d7d087c759f1af9e14f9c70cc2d83b10520265120c748ddfd17f987c7f08c20cb4e788241f571bd499116696d6d1962a9094fac16f088572cd671b18e788

  • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\Pk3vg67.exe

    Filesize

    492KB

    MD5

    47a573d5695dc295b4de60ce9a5e384d

    SHA1

    f1d3bbca40d60cdbf3b3c8915fcfb3ccabdc7ed1

    SHA256

    650037ec1bc1f5ec0d35f55c2ee94c4c52d3a929e348c6343915eee518f0cd2e

    SHA512

    fdd1d7d087c759f1af9e14f9c70cc2d83b10520265120c748ddfd17f987c7f08c20cb4e788241f571bd499116696d6d1962a9094fac16f088572cd671b18e788

  • C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\1Gm91dy3.exe

    Filesize

    194KB

    MD5

    6241b03d68a610324ecda52f0f84e287

    SHA1

    da80280b6e3925e455925efd6c6e59a6118269c4

    SHA256

    ec74de9416b8ef2c3bdb1a9835e54548b3185524210d1aeffa91c98f74f751e2

    SHA512

    a60fe447cb0bed8e6cbd7c344b19a4602553209cbda7a40993f0fdf01e096bda4b79de0b528ecebf2efa0007f81d7bd6c7ef84252b2a160c93d642a78f0095f9

  • C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\1Gm91dy3.exe

    Filesize

    194KB

    MD5

    6241b03d68a610324ecda52f0f84e287

    SHA1

    da80280b6e3925e455925efd6c6e59a6118269c4

    SHA256

    ec74de9416b8ef2c3bdb1a9835e54548b3185524210d1aeffa91c98f74f751e2

    SHA512

    a60fe447cb0bed8e6cbd7c344b19a4602553209cbda7a40993f0fdf01e096bda4b79de0b528ecebf2efa0007f81d7bd6c7ef84252b2a160c93d642a78f0095f9

  • C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\2uY7201.exe

    Filesize

    446KB

    MD5

    4ec364f4492ada0565a5b47bc297fe25

    SHA1

    c7ba7402b9e2848557df0f436fb3758f331861e3

    SHA256

    8de06038d075d45fe13d9ad2cd49c94727a3d45c3da696e5c790b4b45dbb8726

    SHA512

    f683f6d085a09fc561959eade281766ade498643f81da43e7acd05e59f1df87d9099fad6e564104a447dc36b0b66148dbe46c9c02e3d6036271f3b2358e38994

  • C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\2uY7201.exe

    Filesize

    446KB

    MD5

    4ec364f4492ada0565a5b47bc297fe25

    SHA1

    c7ba7402b9e2848557df0f436fb3758f331861e3

    SHA256

    8de06038d075d45fe13d9ad2cd49c94727a3d45c3da696e5c790b4b45dbb8726

    SHA512

    f683f6d085a09fc561959eade281766ade498643f81da43e7acd05e59f1df87d9099fad6e564104a447dc36b0b66148dbe46c9c02e3d6036271f3b2358e38994

  • \Users\Admin\AppData\Local\Temp\IXP000.TMP\rC0Yh84.exe

    Filesize

    1.0MB

    MD5

    85c1c75ca27ec5242dadee25a9ac4a7a

    SHA1

    7a0045bec0d6db1510e5041781621a2721af75c3

    SHA256

    5736605686e52da3953055a20a4365ebc67c5431b92d64b02c0c46d3ddd50c49

    SHA512

    ad06c9a46e2ba74f0ff0b8e12c4be7b4505a520a5048ef641dfabe6e6f7a8f6eea4a244ee48badb04a3918386a9d98e70a36add5eb429dae58e1adf830d2c41a

  • \Users\Admin\AppData\Local\Temp\IXP000.TMP\rC0Yh84.exe

    Filesize

    1.0MB

    MD5

    85c1c75ca27ec5242dadee25a9ac4a7a

    SHA1

    7a0045bec0d6db1510e5041781621a2721af75c3

    SHA256

    5736605686e52da3953055a20a4365ebc67c5431b92d64b02c0c46d3ddd50c49

    SHA512

    ad06c9a46e2ba74f0ff0b8e12c4be7b4505a520a5048ef641dfabe6e6f7a8f6eea4a244ee48badb04a3918386a9d98e70a36add5eb429dae58e1adf830d2c41a

  • \Users\Admin\AppData\Local\Temp\IXP001.TMP\Lv4hz46.exe

    Filesize

    746KB

    MD5

    73a7c9d1ae6f2f98ba6eb8802e9e136b

    SHA1

    fda2489487e49f975c64e30a02f8b763083e0f75

    SHA256

    60ef54f525f4f70ee7321cddd85f1a0bf087c4961a3c656c155f33c65a394aac

    SHA512

    6253e627e16b2030da3ec484b618ad1328701f185038c673631b01ad67e07c9bf17b011b36037be7fd78a772c7b594ade69519ffb02226da0a8aaf22d1ce67e0

  • \Users\Admin\AppData\Local\Temp\IXP001.TMP\Lv4hz46.exe

    Filesize

    746KB

    MD5

    73a7c9d1ae6f2f98ba6eb8802e9e136b

    SHA1

    fda2489487e49f975c64e30a02f8b763083e0f75

    SHA256

    60ef54f525f4f70ee7321cddd85f1a0bf087c4961a3c656c155f33c65a394aac

    SHA512

    6253e627e16b2030da3ec484b618ad1328701f185038c673631b01ad67e07c9bf17b011b36037be7fd78a772c7b594ade69519ffb02226da0a8aaf22d1ce67e0

  • \Users\Admin\AppData\Local\Temp\IXP002.TMP\Pk3vg67.exe

    Filesize

    492KB

    MD5

    47a573d5695dc295b4de60ce9a5e384d

    SHA1

    f1d3bbca40d60cdbf3b3c8915fcfb3ccabdc7ed1

    SHA256

    650037ec1bc1f5ec0d35f55c2ee94c4c52d3a929e348c6343915eee518f0cd2e

    SHA512

    fdd1d7d087c759f1af9e14f9c70cc2d83b10520265120c748ddfd17f987c7f08c20cb4e788241f571bd499116696d6d1962a9094fac16f088572cd671b18e788

  • \Users\Admin\AppData\Local\Temp\IXP002.TMP\Pk3vg67.exe

    Filesize

    492KB

    MD5

    47a573d5695dc295b4de60ce9a5e384d

    SHA1

    f1d3bbca40d60cdbf3b3c8915fcfb3ccabdc7ed1

    SHA256

    650037ec1bc1f5ec0d35f55c2ee94c4c52d3a929e348c6343915eee518f0cd2e

    SHA512

    fdd1d7d087c759f1af9e14f9c70cc2d83b10520265120c748ddfd17f987c7f08c20cb4e788241f571bd499116696d6d1962a9094fac16f088572cd671b18e788

  • \Users\Admin\AppData\Local\Temp\IXP003.TMP\1Gm91dy3.exe

    Filesize

    194KB

    MD5

    6241b03d68a610324ecda52f0f84e287

    SHA1

    da80280b6e3925e455925efd6c6e59a6118269c4

    SHA256

    ec74de9416b8ef2c3bdb1a9835e54548b3185524210d1aeffa91c98f74f751e2

    SHA512

    a60fe447cb0bed8e6cbd7c344b19a4602553209cbda7a40993f0fdf01e096bda4b79de0b528ecebf2efa0007f81d7bd6c7ef84252b2a160c93d642a78f0095f9

  • \Users\Admin\AppData\Local\Temp\IXP003.TMP\1Gm91dy3.exe

    Filesize

    194KB

    MD5

    6241b03d68a610324ecda52f0f84e287

    SHA1

    da80280b6e3925e455925efd6c6e59a6118269c4

    SHA256

    ec74de9416b8ef2c3bdb1a9835e54548b3185524210d1aeffa91c98f74f751e2

    SHA512

    a60fe447cb0bed8e6cbd7c344b19a4602553209cbda7a40993f0fdf01e096bda4b79de0b528ecebf2efa0007f81d7bd6c7ef84252b2a160c93d642a78f0095f9

  • \Users\Admin\AppData\Local\Temp\IXP003.TMP\2uY7201.exe

    Filesize

    446KB

    MD5

    4ec364f4492ada0565a5b47bc297fe25

    SHA1

    c7ba7402b9e2848557df0f436fb3758f331861e3

    SHA256

    8de06038d075d45fe13d9ad2cd49c94727a3d45c3da696e5c790b4b45dbb8726

    SHA512

    f683f6d085a09fc561959eade281766ade498643f81da43e7acd05e59f1df87d9099fad6e564104a447dc36b0b66148dbe46c9c02e3d6036271f3b2358e38994

  • \Users\Admin\AppData\Local\Temp\IXP003.TMP\2uY7201.exe

    Filesize

    446KB

    MD5

    4ec364f4492ada0565a5b47bc297fe25

    SHA1

    c7ba7402b9e2848557df0f436fb3758f331861e3

    SHA256

    8de06038d075d45fe13d9ad2cd49c94727a3d45c3da696e5c790b4b45dbb8726

    SHA512

    f683f6d085a09fc561959eade281766ade498643f81da43e7acd05e59f1df87d9099fad6e564104a447dc36b0b66148dbe46c9c02e3d6036271f3b2358e38994

  • \Users\Admin\AppData\Local\Temp\IXP003.TMP\2uY7201.exe

    Filesize

    446KB

    MD5

    4ec364f4492ada0565a5b47bc297fe25

    SHA1

    c7ba7402b9e2848557df0f436fb3758f331861e3

    SHA256

    8de06038d075d45fe13d9ad2cd49c94727a3d45c3da696e5c790b4b45dbb8726

    SHA512

    f683f6d085a09fc561959eade281766ade498643f81da43e7acd05e59f1df87d9099fad6e564104a447dc36b0b66148dbe46c9c02e3d6036271f3b2358e38994

  • \Users\Admin\AppData\Local\Temp\IXP003.TMP\2uY7201.exe

    Filesize

    446KB

    MD5

    4ec364f4492ada0565a5b47bc297fe25

    SHA1

    c7ba7402b9e2848557df0f436fb3758f331861e3

    SHA256

    8de06038d075d45fe13d9ad2cd49c94727a3d45c3da696e5c790b4b45dbb8726

    SHA512

    f683f6d085a09fc561959eade281766ade498643f81da43e7acd05e59f1df87d9099fad6e564104a447dc36b0b66148dbe46c9c02e3d6036271f3b2358e38994

  • \Users\Admin\AppData\Local\Temp\IXP003.TMP\2uY7201.exe

    Filesize

    446KB

    MD5

    4ec364f4492ada0565a5b47bc297fe25

    SHA1

    c7ba7402b9e2848557df0f436fb3758f331861e3

    SHA256

    8de06038d075d45fe13d9ad2cd49c94727a3d45c3da696e5c790b4b45dbb8726

    SHA512

    f683f6d085a09fc561959eade281766ade498643f81da43e7acd05e59f1df87d9099fad6e564104a447dc36b0b66148dbe46c9c02e3d6036271f3b2358e38994

  • \Users\Admin\AppData\Local\Temp\IXP003.TMP\2uY7201.exe

    Filesize

    446KB

    MD5

    4ec364f4492ada0565a5b47bc297fe25

    SHA1

    c7ba7402b9e2848557df0f436fb3758f331861e3

    SHA256

    8de06038d075d45fe13d9ad2cd49c94727a3d45c3da696e5c790b4b45dbb8726

    SHA512

    f683f6d085a09fc561959eade281766ade498643f81da43e7acd05e59f1df87d9099fad6e564104a447dc36b0b66148dbe46c9c02e3d6036271f3b2358e38994

  • memory/2552-42-0x0000000000520000-0x0000000000536000-memory.dmp

    Filesize

    88KB

  • memory/2552-43-0x0000000000520000-0x0000000000536000-memory.dmp

    Filesize

    88KB

  • memory/2552-55-0x0000000000520000-0x0000000000536000-memory.dmp

    Filesize

    88KB

  • memory/2552-61-0x0000000000520000-0x0000000000536000-memory.dmp

    Filesize

    88KB

  • memory/2552-59-0x0000000000520000-0x0000000000536000-memory.dmp

    Filesize

    88KB

  • memory/2552-65-0x0000000000520000-0x0000000000536000-memory.dmp

    Filesize

    88KB

  • memory/2552-63-0x0000000000520000-0x0000000000536000-memory.dmp

    Filesize

    88KB

  • memory/2552-69-0x0000000000520000-0x0000000000536000-memory.dmp

    Filesize

    88KB

  • memory/2552-67-0x0000000000520000-0x0000000000536000-memory.dmp

    Filesize

    88KB

  • memory/2552-53-0x0000000000520000-0x0000000000536000-memory.dmp

    Filesize

    88KB

  • memory/2552-45-0x0000000000520000-0x0000000000536000-memory.dmp

    Filesize

    88KB

  • memory/2552-41-0x0000000000520000-0x000000000053C000-memory.dmp

    Filesize

    112KB

  • memory/2552-40-0x0000000000340000-0x000000000035E000-memory.dmp

    Filesize

    120KB

  • memory/2552-57-0x0000000000520000-0x0000000000536000-memory.dmp

    Filesize

    88KB

  • memory/2552-47-0x0000000000520000-0x0000000000536000-memory.dmp

    Filesize

    88KB

  • memory/2552-49-0x0000000000520000-0x0000000000536000-memory.dmp

    Filesize

    88KB

  • memory/2552-51-0x0000000000520000-0x0000000000536000-memory.dmp

    Filesize

    88KB

  • memory/3024-76-0x0000000000400000-0x0000000000433000-memory.dmp

    Filesize

    204KB

  • memory/3024-83-0x00000000FFFDE000-0x00000000FFFDF000-memory.dmp

    Filesize

    4KB

  • memory/3024-82-0x0000000000400000-0x0000000000433000-memory.dmp

    Filesize

    204KB

  • memory/3024-80-0x0000000000400000-0x0000000000433000-memory.dmp

    Filesize

    204KB

  • memory/3024-86-0x0000000000400000-0x0000000000433000-memory.dmp

    Filesize

    204KB

  • memory/3024-88-0x0000000000400000-0x0000000000433000-memory.dmp

    Filesize

    204KB

  • memory/3024-84-0x0000000000400000-0x0000000000433000-memory.dmp

    Filesize

    204KB

  • memory/3024-81-0x0000000000400000-0x0000000000433000-memory.dmp

    Filesize

    204KB

  • memory/3024-79-0x0000000000400000-0x0000000000433000-memory.dmp

    Filesize

    204KB

  • memory/3024-78-0x0000000000400000-0x0000000000433000-memory.dmp

    Filesize

    204KB