Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    118s
  • max time network
    121s
  • platform
    windows7_x64
  • resource
    win7-20230831-en
  • resource tags

    arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
  • submitted
    10/10/2023, 12:15

General

  • Target

    file.exe

  • Size

    1.2MB

  • MD5

    8ac2f6a07c81dba4ccfe4325aca7628b

  • SHA1

    7a6e0262ff0b312add0a06b816ae27b5ba685fd9

  • SHA256

    75ec6c815f4ca762223a0ad901defff84ae8338f4ad9970a7a606bdb1514fd99

  • SHA512

    f826cea9687cab5799448320c169240dadaf89bea2dc72d305171796c1e7f9581a733ee3383924b5c8a92960bce9b8f44840730c533fc2ff8b4a704d28de69b9

  • SSDEEP

    24576:cyQFUOgYu8KjrAQq3PElA/u1+BwT0xUlZX7S5PRa:LSPutjM3Pt/uAwT0EIP

Malware Config

Signatures

  • Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs
  • Executes dropped EXE 5 IoCs
  • Loads dropped DLL 14 IoCs
  • Windows security modification 2 TTPs 2 IoCs
  • Adds Run key to start application 2 TTPs 4 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Program crash 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\file.exe
    "C:\Users\Admin\AppData\Local\Temp\file.exe"
    1⤵
    • Loads dropped DLL
    • Adds Run key to start application
    • Suspicious use of WriteProcessMemory
    PID:1848
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\rC0Yh84.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\rC0Yh84.exe
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Adds Run key to start application
      • Suspicious use of WriteProcessMemory
      PID:2008
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\Lv4hz46.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\Lv4hz46.exe
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Adds Run key to start application
        • Suspicious use of WriteProcessMemory
        PID:2056
        • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\Pk3vg67.exe
          C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\Pk3vg67.exe
          4⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • Adds Run key to start application
          • Suspicious use of WriteProcessMemory
          PID:2748
          • C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\1Gm91dy3.exe
            C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\1Gm91dy3.exe
            5⤵
            • Modifies Windows Defender Real-time Protection settings
            • Executes dropped EXE
            • Loads dropped DLL
            • Windows security modification
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:2512
          • C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\2uY7201.exe
            C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\2uY7201.exe
            5⤵
            • Executes dropped EXE
            • Loads dropped DLL
            • Suspicious use of SetThreadContext
            • Suspicious use of WriteProcessMemory
            PID:3032
            • C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
              "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
              6⤵
                PID:2488
              • C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
                "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
                6⤵
                • Suspicious use of WriteProcessMemory
                PID:1932
                • C:\Windows\SysWOW64\WerFault.exe
                  C:\Windows\SysWOW64\WerFault.exe -u -p 1932 -s 268
                  7⤵
                  • Program crash
                  PID:2932
              • C:\Windows\SysWOW64\WerFault.exe
                C:\Windows\SysWOW64\WerFault.exe -u -p 3032 -s 292
                6⤵
                • Loads dropped DLL
                • Program crash
                PID:2892

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\rC0Yh84.exe

      Filesize

      1.0MB

      MD5

      85c1c75ca27ec5242dadee25a9ac4a7a

      SHA1

      7a0045bec0d6db1510e5041781621a2721af75c3

      SHA256

      5736605686e52da3953055a20a4365ebc67c5431b92d64b02c0c46d3ddd50c49

      SHA512

      ad06c9a46e2ba74f0ff0b8e12c4be7b4505a520a5048ef641dfabe6e6f7a8f6eea4a244ee48badb04a3918386a9d98e70a36add5eb429dae58e1adf830d2c41a

    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\rC0Yh84.exe

      Filesize

      1.0MB

      MD5

      85c1c75ca27ec5242dadee25a9ac4a7a

      SHA1

      7a0045bec0d6db1510e5041781621a2721af75c3

      SHA256

      5736605686e52da3953055a20a4365ebc67c5431b92d64b02c0c46d3ddd50c49

      SHA512

      ad06c9a46e2ba74f0ff0b8e12c4be7b4505a520a5048ef641dfabe6e6f7a8f6eea4a244ee48badb04a3918386a9d98e70a36add5eb429dae58e1adf830d2c41a

    • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\Lv4hz46.exe

      Filesize

      746KB

      MD5

      73a7c9d1ae6f2f98ba6eb8802e9e136b

      SHA1

      fda2489487e49f975c64e30a02f8b763083e0f75

      SHA256

      60ef54f525f4f70ee7321cddd85f1a0bf087c4961a3c656c155f33c65a394aac

      SHA512

      6253e627e16b2030da3ec484b618ad1328701f185038c673631b01ad67e07c9bf17b011b36037be7fd78a772c7b594ade69519ffb02226da0a8aaf22d1ce67e0

    • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\Lv4hz46.exe

      Filesize

      746KB

      MD5

      73a7c9d1ae6f2f98ba6eb8802e9e136b

      SHA1

      fda2489487e49f975c64e30a02f8b763083e0f75

      SHA256

      60ef54f525f4f70ee7321cddd85f1a0bf087c4961a3c656c155f33c65a394aac

      SHA512

      6253e627e16b2030da3ec484b618ad1328701f185038c673631b01ad67e07c9bf17b011b36037be7fd78a772c7b594ade69519ffb02226da0a8aaf22d1ce67e0

    • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\Pk3vg67.exe

      Filesize

      492KB

      MD5

      47a573d5695dc295b4de60ce9a5e384d

      SHA1

      f1d3bbca40d60cdbf3b3c8915fcfb3ccabdc7ed1

      SHA256

      650037ec1bc1f5ec0d35f55c2ee94c4c52d3a929e348c6343915eee518f0cd2e

      SHA512

      fdd1d7d087c759f1af9e14f9c70cc2d83b10520265120c748ddfd17f987c7f08c20cb4e788241f571bd499116696d6d1962a9094fac16f088572cd671b18e788

    • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\Pk3vg67.exe

      Filesize

      492KB

      MD5

      47a573d5695dc295b4de60ce9a5e384d

      SHA1

      f1d3bbca40d60cdbf3b3c8915fcfb3ccabdc7ed1

      SHA256

      650037ec1bc1f5ec0d35f55c2ee94c4c52d3a929e348c6343915eee518f0cd2e

      SHA512

      fdd1d7d087c759f1af9e14f9c70cc2d83b10520265120c748ddfd17f987c7f08c20cb4e788241f571bd499116696d6d1962a9094fac16f088572cd671b18e788

    • C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\1Gm91dy3.exe

      Filesize

      194KB

      MD5

      6241b03d68a610324ecda52f0f84e287

      SHA1

      da80280b6e3925e455925efd6c6e59a6118269c4

      SHA256

      ec74de9416b8ef2c3bdb1a9835e54548b3185524210d1aeffa91c98f74f751e2

      SHA512

      a60fe447cb0bed8e6cbd7c344b19a4602553209cbda7a40993f0fdf01e096bda4b79de0b528ecebf2efa0007f81d7bd6c7ef84252b2a160c93d642a78f0095f9

    • C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\1Gm91dy3.exe

      Filesize

      194KB

      MD5

      6241b03d68a610324ecda52f0f84e287

      SHA1

      da80280b6e3925e455925efd6c6e59a6118269c4

      SHA256

      ec74de9416b8ef2c3bdb1a9835e54548b3185524210d1aeffa91c98f74f751e2

      SHA512

      a60fe447cb0bed8e6cbd7c344b19a4602553209cbda7a40993f0fdf01e096bda4b79de0b528ecebf2efa0007f81d7bd6c7ef84252b2a160c93d642a78f0095f9

    • C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\2uY7201.exe

      Filesize

      446KB

      MD5

      4ec364f4492ada0565a5b47bc297fe25

      SHA1

      c7ba7402b9e2848557df0f436fb3758f331861e3

      SHA256

      8de06038d075d45fe13d9ad2cd49c94727a3d45c3da696e5c790b4b45dbb8726

      SHA512

      f683f6d085a09fc561959eade281766ade498643f81da43e7acd05e59f1df87d9099fad6e564104a447dc36b0b66148dbe46c9c02e3d6036271f3b2358e38994

    • C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\2uY7201.exe

      Filesize

      446KB

      MD5

      4ec364f4492ada0565a5b47bc297fe25

      SHA1

      c7ba7402b9e2848557df0f436fb3758f331861e3

      SHA256

      8de06038d075d45fe13d9ad2cd49c94727a3d45c3da696e5c790b4b45dbb8726

      SHA512

      f683f6d085a09fc561959eade281766ade498643f81da43e7acd05e59f1df87d9099fad6e564104a447dc36b0b66148dbe46c9c02e3d6036271f3b2358e38994

    • \Users\Admin\AppData\Local\Temp\IXP000.TMP\rC0Yh84.exe

      Filesize

      1.0MB

      MD5

      85c1c75ca27ec5242dadee25a9ac4a7a

      SHA1

      7a0045bec0d6db1510e5041781621a2721af75c3

      SHA256

      5736605686e52da3953055a20a4365ebc67c5431b92d64b02c0c46d3ddd50c49

      SHA512

      ad06c9a46e2ba74f0ff0b8e12c4be7b4505a520a5048ef641dfabe6e6f7a8f6eea4a244ee48badb04a3918386a9d98e70a36add5eb429dae58e1adf830d2c41a

    • \Users\Admin\AppData\Local\Temp\IXP000.TMP\rC0Yh84.exe

      Filesize

      1.0MB

      MD5

      85c1c75ca27ec5242dadee25a9ac4a7a

      SHA1

      7a0045bec0d6db1510e5041781621a2721af75c3

      SHA256

      5736605686e52da3953055a20a4365ebc67c5431b92d64b02c0c46d3ddd50c49

      SHA512

      ad06c9a46e2ba74f0ff0b8e12c4be7b4505a520a5048ef641dfabe6e6f7a8f6eea4a244ee48badb04a3918386a9d98e70a36add5eb429dae58e1adf830d2c41a

    • \Users\Admin\AppData\Local\Temp\IXP001.TMP\Lv4hz46.exe

      Filesize

      746KB

      MD5

      73a7c9d1ae6f2f98ba6eb8802e9e136b

      SHA1

      fda2489487e49f975c64e30a02f8b763083e0f75

      SHA256

      60ef54f525f4f70ee7321cddd85f1a0bf087c4961a3c656c155f33c65a394aac

      SHA512

      6253e627e16b2030da3ec484b618ad1328701f185038c673631b01ad67e07c9bf17b011b36037be7fd78a772c7b594ade69519ffb02226da0a8aaf22d1ce67e0

    • \Users\Admin\AppData\Local\Temp\IXP001.TMP\Lv4hz46.exe

      Filesize

      746KB

      MD5

      73a7c9d1ae6f2f98ba6eb8802e9e136b

      SHA1

      fda2489487e49f975c64e30a02f8b763083e0f75

      SHA256

      60ef54f525f4f70ee7321cddd85f1a0bf087c4961a3c656c155f33c65a394aac

      SHA512

      6253e627e16b2030da3ec484b618ad1328701f185038c673631b01ad67e07c9bf17b011b36037be7fd78a772c7b594ade69519ffb02226da0a8aaf22d1ce67e0

    • \Users\Admin\AppData\Local\Temp\IXP002.TMP\Pk3vg67.exe

      Filesize

      492KB

      MD5

      47a573d5695dc295b4de60ce9a5e384d

      SHA1

      f1d3bbca40d60cdbf3b3c8915fcfb3ccabdc7ed1

      SHA256

      650037ec1bc1f5ec0d35f55c2ee94c4c52d3a929e348c6343915eee518f0cd2e

      SHA512

      fdd1d7d087c759f1af9e14f9c70cc2d83b10520265120c748ddfd17f987c7f08c20cb4e788241f571bd499116696d6d1962a9094fac16f088572cd671b18e788

    • \Users\Admin\AppData\Local\Temp\IXP002.TMP\Pk3vg67.exe

      Filesize

      492KB

      MD5

      47a573d5695dc295b4de60ce9a5e384d

      SHA1

      f1d3bbca40d60cdbf3b3c8915fcfb3ccabdc7ed1

      SHA256

      650037ec1bc1f5ec0d35f55c2ee94c4c52d3a929e348c6343915eee518f0cd2e

      SHA512

      fdd1d7d087c759f1af9e14f9c70cc2d83b10520265120c748ddfd17f987c7f08c20cb4e788241f571bd499116696d6d1962a9094fac16f088572cd671b18e788

    • \Users\Admin\AppData\Local\Temp\IXP003.TMP\1Gm91dy3.exe

      Filesize

      194KB

      MD5

      6241b03d68a610324ecda52f0f84e287

      SHA1

      da80280b6e3925e455925efd6c6e59a6118269c4

      SHA256

      ec74de9416b8ef2c3bdb1a9835e54548b3185524210d1aeffa91c98f74f751e2

      SHA512

      a60fe447cb0bed8e6cbd7c344b19a4602553209cbda7a40993f0fdf01e096bda4b79de0b528ecebf2efa0007f81d7bd6c7ef84252b2a160c93d642a78f0095f9

    • \Users\Admin\AppData\Local\Temp\IXP003.TMP\1Gm91dy3.exe

      Filesize

      194KB

      MD5

      6241b03d68a610324ecda52f0f84e287

      SHA1

      da80280b6e3925e455925efd6c6e59a6118269c4

      SHA256

      ec74de9416b8ef2c3bdb1a9835e54548b3185524210d1aeffa91c98f74f751e2

      SHA512

      a60fe447cb0bed8e6cbd7c344b19a4602553209cbda7a40993f0fdf01e096bda4b79de0b528ecebf2efa0007f81d7bd6c7ef84252b2a160c93d642a78f0095f9

    • \Users\Admin\AppData\Local\Temp\IXP003.TMP\2uY7201.exe

      Filesize

      446KB

      MD5

      4ec364f4492ada0565a5b47bc297fe25

      SHA1

      c7ba7402b9e2848557df0f436fb3758f331861e3

      SHA256

      8de06038d075d45fe13d9ad2cd49c94727a3d45c3da696e5c790b4b45dbb8726

      SHA512

      f683f6d085a09fc561959eade281766ade498643f81da43e7acd05e59f1df87d9099fad6e564104a447dc36b0b66148dbe46c9c02e3d6036271f3b2358e38994

    • \Users\Admin\AppData\Local\Temp\IXP003.TMP\2uY7201.exe

      Filesize

      446KB

      MD5

      4ec364f4492ada0565a5b47bc297fe25

      SHA1

      c7ba7402b9e2848557df0f436fb3758f331861e3

      SHA256

      8de06038d075d45fe13d9ad2cd49c94727a3d45c3da696e5c790b4b45dbb8726

      SHA512

      f683f6d085a09fc561959eade281766ade498643f81da43e7acd05e59f1df87d9099fad6e564104a447dc36b0b66148dbe46c9c02e3d6036271f3b2358e38994

    • \Users\Admin\AppData\Local\Temp\IXP003.TMP\2uY7201.exe

      Filesize

      446KB

      MD5

      4ec364f4492ada0565a5b47bc297fe25

      SHA1

      c7ba7402b9e2848557df0f436fb3758f331861e3

      SHA256

      8de06038d075d45fe13d9ad2cd49c94727a3d45c3da696e5c790b4b45dbb8726

      SHA512

      f683f6d085a09fc561959eade281766ade498643f81da43e7acd05e59f1df87d9099fad6e564104a447dc36b0b66148dbe46c9c02e3d6036271f3b2358e38994

    • \Users\Admin\AppData\Local\Temp\IXP003.TMP\2uY7201.exe

      Filesize

      446KB

      MD5

      4ec364f4492ada0565a5b47bc297fe25

      SHA1

      c7ba7402b9e2848557df0f436fb3758f331861e3

      SHA256

      8de06038d075d45fe13d9ad2cd49c94727a3d45c3da696e5c790b4b45dbb8726

      SHA512

      f683f6d085a09fc561959eade281766ade498643f81da43e7acd05e59f1df87d9099fad6e564104a447dc36b0b66148dbe46c9c02e3d6036271f3b2358e38994

    • \Users\Admin\AppData\Local\Temp\IXP003.TMP\2uY7201.exe

      Filesize

      446KB

      MD5

      4ec364f4492ada0565a5b47bc297fe25

      SHA1

      c7ba7402b9e2848557df0f436fb3758f331861e3

      SHA256

      8de06038d075d45fe13d9ad2cd49c94727a3d45c3da696e5c790b4b45dbb8726

      SHA512

      f683f6d085a09fc561959eade281766ade498643f81da43e7acd05e59f1df87d9099fad6e564104a447dc36b0b66148dbe46c9c02e3d6036271f3b2358e38994

    • \Users\Admin\AppData\Local\Temp\IXP003.TMP\2uY7201.exe

      Filesize

      446KB

      MD5

      4ec364f4492ada0565a5b47bc297fe25

      SHA1

      c7ba7402b9e2848557df0f436fb3758f331861e3

      SHA256

      8de06038d075d45fe13d9ad2cd49c94727a3d45c3da696e5c790b4b45dbb8726

      SHA512

      f683f6d085a09fc561959eade281766ade498643f81da43e7acd05e59f1df87d9099fad6e564104a447dc36b0b66148dbe46c9c02e3d6036271f3b2358e38994

    • memory/1932-85-0x0000000000400000-0x0000000000433000-memory.dmp

      Filesize

      204KB

    • memory/1932-87-0x0000000000400000-0x0000000000433000-memory.dmp

      Filesize

      204KB

    • memory/1932-76-0x0000000000400000-0x0000000000433000-memory.dmp

      Filesize

      204KB

    • memory/1932-82-0x00000000FFFDE000-0x00000000FFFDF000-memory.dmp

      Filesize

      4KB

    • memory/1932-83-0x0000000000400000-0x0000000000433000-memory.dmp

      Filesize

      204KB

    • memory/1932-81-0x0000000000400000-0x0000000000433000-memory.dmp

      Filesize

      204KB

    • memory/1932-80-0x0000000000400000-0x0000000000433000-memory.dmp

      Filesize

      204KB

    • memory/1932-79-0x0000000000400000-0x0000000000433000-memory.dmp

      Filesize

      204KB

    • memory/1932-78-0x0000000000400000-0x0000000000433000-memory.dmp

      Filesize

      204KB

    • memory/1932-77-0x0000000000400000-0x0000000000433000-memory.dmp

      Filesize

      204KB

    • memory/2512-55-0x0000000002140000-0x0000000002156000-memory.dmp

      Filesize

      88KB

    • memory/2512-53-0x0000000002140000-0x0000000002156000-memory.dmp

      Filesize

      88KB

    • memory/2512-40-0x0000000001F40000-0x0000000001F5E000-memory.dmp

      Filesize

      120KB

    • memory/2512-43-0x0000000002140000-0x0000000002156000-memory.dmp

      Filesize

      88KB

    • memory/2512-51-0x0000000002140000-0x0000000002156000-memory.dmp

      Filesize

      88KB

    • memory/2512-42-0x0000000002140000-0x0000000002156000-memory.dmp

      Filesize

      88KB

    • memory/2512-45-0x0000000002140000-0x0000000002156000-memory.dmp

      Filesize

      88KB

    • memory/2512-47-0x0000000002140000-0x0000000002156000-memory.dmp

      Filesize

      88KB

    • memory/2512-49-0x0000000002140000-0x0000000002156000-memory.dmp

      Filesize

      88KB

    • memory/2512-41-0x0000000002140000-0x000000000215C000-memory.dmp

      Filesize

      112KB

    • memory/2512-59-0x0000000002140000-0x0000000002156000-memory.dmp

      Filesize

      88KB

    • memory/2512-57-0x0000000002140000-0x0000000002156000-memory.dmp

      Filesize

      88KB

    • memory/2512-61-0x0000000002140000-0x0000000002156000-memory.dmp

      Filesize

      88KB

    • memory/2512-63-0x0000000002140000-0x0000000002156000-memory.dmp

      Filesize

      88KB

    • memory/2512-65-0x0000000002140000-0x0000000002156000-memory.dmp

      Filesize

      88KB

    • memory/2512-67-0x0000000002140000-0x0000000002156000-memory.dmp

      Filesize

      88KB

    • memory/2512-69-0x0000000002140000-0x0000000002156000-memory.dmp

      Filesize

      88KB