Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    118s
  • max time network
    121s
  • platform
    windows7_x64
  • resource
    win7-20230831-en
  • resource tags

    arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
  • submitted
    10/10/2023, 13:52

General

  • Target

    file.exe

  • Size

    1.2MB

  • MD5

    f2b6802f1168ccd9c2a77768afa537a4

  • SHA1

    ad5507055c765f20f947e9258a89383bd70bc6e0

  • SHA256

    346cc370aa94d16f99ab3420cb55a531bc6008dfd04c7326484b7cd28431d1ec

  • SHA512

    64365533e1bc5f9666bfb287cf594599b533de770c9472819d445efc881ab0447aedab83984a77b2909b238c60993dadcfa9b845a1fd812c3e350846db8ba1c9

  • SSDEEP

    24576:Wy13AGpKLTEwMSsfDrXscR9UdsZIw1X0xA+I0lcYJIQmkvYs2gY:l+GpKLYwMSs/njUdsZpXXMlhJIQ/vYs

Malware Config

Signatures

  • Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs
  • Executes dropped EXE 5 IoCs
  • Loads dropped DLL 14 IoCs
  • Windows security modification 2 TTPs 2 IoCs
  • Adds Run key to start application 2 TTPs 4 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Program crash 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 63 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\file.exe
    "C:\Users\Admin\AppData\Local\Temp\file.exe"
    1⤵
    • Loads dropped DLL
    • Adds Run key to start application
    • Suspicious use of WriteProcessMemory
    PID:1720
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\xY3Vj00.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\xY3Vj00.exe
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Adds Run key to start application
      • Suspicious use of WriteProcessMemory
      PID:2408
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\uv8Gi23.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\uv8Gi23.exe
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Adds Run key to start application
        • Suspicious use of WriteProcessMemory
        PID:2560
        • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\IU4Rr21.exe
          C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\IU4Rr21.exe
          4⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • Adds Run key to start application
          • Suspicious use of WriteProcessMemory
          PID:1728
          • C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\1pT18fK0.exe
            C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\1pT18fK0.exe
            5⤵
            • Modifies Windows Defender Real-time Protection settings
            • Executes dropped EXE
            • Loads dropped DLL
            • Windows security modification
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:2700
          • C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\2Yi8512.exe
            C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\2Yi8512.exe
            5⤵
            • Executes dropped EXE
            • Loads dropped DLL
            • Suspicious use of SetThreadContext
            • Suspicious use of WriteProcessMemory
            PID:2484
            • C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
              "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
              6⤵
                PID:2556
              • C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
                "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
                6⤵
                  PID:1016
                • C:\Windows\SysWOW64\WerFault.exe
                  C:\Windows\SysWOW64\WerFault.exe -u -p 2484 -s 292
                  6⤵
                  • Loads dropped DLL
                  • Program crash
                  PID:2988

      Network

      MITRE ATT&CK Enterprise v15

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\xY3Vj00.exe

        Filesize

        1.0MB

        MD5

        2ad5e3f90e5df9f3ff2ed6493aba7b9d

        SHA1

        e7cd33d4b80c2823cdbe01daff94ff31af85c342

        SHA256

        690876ffa430e1003514dffba0f10590649de3a760032d71408b2e0543418b2a

        SHA512

        d2eb08696bdf2d0523d7008d2d2c855ea8328fb2b2aa4c78eaa0c47001de559ec6a7f390e31a974636ec9ad7f72122b48819737b415eaf973a048f9b35892ff9

      • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\xY3Vj00.exe

        Filesize

        1.0MB

        MD5

        2ad5e3f90e5df9f3ff2ed6493aba7b9d

        SHA1

        e7cd33d4b80c2823cdbe01daff94ff31af85c342

        SHA256

        690876ffa430e1003514dffba0f10590649de3a760032d71408b2e0543418b2a

        SHA512

        d2eb08696bdf2d0523d7008d2d2c855ea8328fb2b2aa4c78eaa0c47001de559ec6a7f390e31a974636ec9ad7f72122b48819737b415eaf973a048f9b35892ff9

      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\uv8Gi23.exe

        Filesize

        746KB

        MD5

        c39856342ad1ad006f95457e087b9e51

        SHA1

        2189e78f7608463147d560c70630e0e6367d820f

        SHA256

        81ed7535dd45b4129c76334e792ee733b2f33235aaf0ea806e64341e15dd54c7

        SHA512

        14480bdb02d5f516f1fdbdff9e050cf18d46ce79f0a834ac71b1bd3f56c7a33c83a5bc4eb071088a8dc610e4f30d23c0270290710a6434fcc73fde0b89cb53f6

      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\uv8Gi23.exe

        Filesize

        746KB

        MD5

        c39856342ad1ad006f95457e087b9e51

        SHA1

        2189e78f7608463147d560c70630e0e6367d820f

        SHA256

        81ed7535dd45b4129c76334e792ee733b2f33235aaf0ea806e64341e15dd54c7

        SHA512

        14480bdb02d5f516f1fdbdff9e050cf18d46ce79f0a834ac71b1bd3f56c7a33c83a5bc4eb071088a8dc610e4f30d23c0270290710a6434fcc73fde0b89cb53f6

      • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\IU4Rr21.exe

        Filesize

        491KB

        MD5

        0e4fcf64fa7ec7e33560ec524ac7bbb1

        SHA1

        8133637b4b48404dfd7c33c9e2e83d31bcc2bc54

        SHA256

        d253f245470b01499dab0fadb733002d878dc9db2a62fdaea4c5dd08ba7f038f

        SHA512

        39a5ee4f32b909f465e6e9947bb300b92d1ad080167ea8a4dede0467bfe1898d315ada818f4d8bb85778b886024a495a4b0700368806685b48e056bb16fe5dca

      • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\IU4Rr21.exe

        Filesize

        491KB

        MD5

        0e4fcf64fa7ec7e33560ec524ac7bbb1

        SHA1

        8133637b4b48404dfd7c33c9e2e83d31bcc2bc54

        SHA256

        d253f245470b01499dab0fadb733002d878dc9db2a62fdaea4c5dd08ba7f038f

        SHA512

        39a5ee4f32b909f465e6e9947bb300b92d1ad080167ea8a4dede0467bfe1898d315ada818f4d8bb85778b886024a495a4b0700368806685b48e056bb16fe5dca

      • C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\1pT18fK0.exe

        Filesize

        194KB

        MD5

        6241b03d68a610324ecda52f0f84e287

        SHA1

        da80280b6e3925e455925efd6c6e59a6118269c4

        SHA256

        ec74de9416b8ef2c3bdb1a9835e54548b3185524210d1aeffa91c98f74f751e2

        SHA512

        a60fe447cb0bed8e6cbd7c344b19a4602553209cbda7a40993f0fdf01e096bda4b79de0b528ecebf2efa0007f81d7bd6c7ef84252b2a160c93d642a78f0095f9

      • C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\1pT18fK0.exe

        Filesize

        194KB

        MD5

        6241b03d68a610324ecda52f0f84e287

        SHA1

        da80280b6e3925e455925efd6c6e59a6118269c4

        SHA256

        ec74de9416b8ef2c3bdb1a9835e54548b3185524210d1aeffa91c98f74f751e2

        SHA512

        a60fe447cb0bed8e6cbd7c344b19a4602553209cbda7a40993f0fdf01e096bda4b79de0b528ecebf2efa0007f81d7bd6c7ef84252b2a160c93d642a78f0095f9

      • C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\2Yi8512.exe

        Filesize

        445KB

        MD5

        d644f10bbbcb24b382676c132ceec2f3

        SHA1

        19d3a37a38390a2c7d1bd9a14a887c7b3c2214cc

        SHA256

        6a7cea3debd6c397fcc74472b108a3250a88d61fb5b058b18b78f6919b70e5f1

        SHA512

        633347562c662a462f8e2c838e552e9fcbbad363f32055e2d833a10972a06bec96013bb838f57686f3a6d4cf5d1f4ec18b5fc8735c29ca219ed0d654cc22a40d

      • C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\2Yi8512.exe

        Filesize

        445KB

        MD5

        d644f10bbbcb24b382676c132ceec2f3

        SHA1

        19d3a37a38390a2c7d1bd9a14a887c7b3c2214cc

        SHA256

        6a7cea3debd6c397fcc74472b108a3250a88d61fb5b058b18b78f6919b70e5f1

        SHA512

        633347562c662a462f8e2c838e552e9fcbbad363f32055e2d833a10972a06bec96013bb838f57686f3a6d4cf5d1f4ec18b5fc8735c29ca219ed0d654cc22a40d

      • \Users\Admin\AppData\Local\Temp\IXP000.TMP\xY3Vj00.exe

        Filesize

        1.0MB

        MD5

        2ad5e3f90e5df9f3ff2ed6493aba7b9d

        SHA1

        e7cd33d4b80c2823cdbe01daff94ff31af85c342

        SHA256

        690876ffa430e1003514dffba0f10590649de3a760032d71408b2e0543418b2a

        SHA512

        d2eb08696bdf2d0523d7008d2d2c855ea8328fb2b2aa4c78eaa0c47001de559ec6a7f390e31a974636ec9ad7f72122b48819737b415eaf973a048f9b35892ff9

      • \Users\Admin\AppData\Local\Temp\IXP000.TMP\xY3Vj00.exe

        Filesize

        1.0MB

        MD5

        2ad5e3f90e5df9f3ff2ed6493aba7b9d

        SHA1

        e7cd33d4b80c2823cdbe01daff94ff31af85c342

        SHA256

        690876ffa430e1003514dffba0f10590649de3a760032d71408b2e0543418b2a

        SHA512

        d2eb08696bdf2d0523d7008d2d2c855ea8328fb2b2aa4c78eaa0c47001de559ec6a7f390e31a974636ec9ad7f72122b48819737b415eaf973a048f9b35892ff9

      • \Users\Admin\AppData\Local\Temp\IXP001.TMP\uv8Gi23.exe

        Filesize

        746KB

        MD5

        c39856342ad1ad006f95457e087b9e51

        SHA1

        2189e78f7608463147d560c70630e0e6367d820f

        SHA256

        81ed7535dd45b4129c76334e792ee733b2f33235aaf0ea806e64341e15dd54c7

        SHA512

        14480bdb02d5f516f1fdbdff9e050cf18d46ce79f0a834ac71b1bd3f56c7a33c83a5bc4eb071088a8dc610e4f30d23c0270290710a6434fcc73fde0b89cb53f6

      • \Users\Admin\AppData\Local\Temp\IXP001.TMP\uv8Gi23.exe

        Filesize

        746KB

        MD5

        c39856342ad1ad006f95457e087b9e51

        SHA1

        2189e78f7608463147d560c70630e0e6367d820f

        SHA256

        81ed7535dd45b4129c76334e792ee733b2f33235aaf0ea806e64341e15dd54c7

        SHA512

        14480bdb02d5f516f1fdbdff9e050cf18d46ce79f0a834ac71b1bd3f56c7a33c83a5bc4eb071088a8dc610e4f30d23c0270290710a6434fcc73fde0b89cb53f6

      • \Users\Admin\AppData\Local\Temp\IXP002.TMP\IU4Rr21.exe

        Filesize

        491KB

        MD5

        0e4fcf64fa7ec7e33560ec524ac7bbb1

        SHA1

        8133637b4b48404dfd7c33c9e2e83d31bcc2bc54

        SHA256

        d253f245470b01499dab0fadb733002d878dc9db2a62fdaea4c5dd08ba7f038f

        SHA512

        39a5ee4f32b909f465e6e9947bb300b92d1ad080167ea8a4dede0467bfe1898d315ada818f4d8bb85778b886024a495a4b0700368806685b48e056bb16fe5dca

      • \Users\Admin\AppData\Local\Temp\IXP002.TMP\IU4Rr21.exe

        Filesize

        491KB

        MD5

        0e4fcf64fa7ec7e33560ec524ac7bbb1

        SHA1

        8133637b4b48404dfd7c33c9e2e83d31bcc2bc54

        SHA256

        d253f245470b01499dab0fadb733002d878dc9db2a62fdaea4c5dd08ba7f038f

        SHA512

        39a5ee4f32b909f465e6e9947bb300b92d1ad080167ea8a4dede0467bfe1898d315ada818f4d8bb85778b886024a495a4b0700368806685b48e056bb16fe5dca

      • \Users\Admin\AppData\Local\Temp\IXP003.TMP\1pT18fK0.exe

        Filesize

        194KB

        MD5

        6241b03d68a610324ecda52f0f84e287

        SHA1

        da80280b6e3925e455925efd6c6e59a6118269c4

        SHA256

        ec74de9416b8ef2c3bdb1a9835e54548b3185524210d1aeffa91c98f74f751e2

        SHA512

        a60fe447cb0bed8e6cbd7c344b19a4602553209cbda7a40993f0fdf01e096bda4b79de0b528ecebf2efa0007f81d7bd6c7ef84252b2a160c93d642a78f0095f9

      • \Users\Admin\AppData\Local\Temp\IXP003.TMP\1pT18fK0.exe

        Filesize

        194KB

        MD5

        6241b03d68a610324ecda52f0f84e287

        SHA1

        da80280b6e3925e455925efd6c6e59a6118269c4

        SHA256

        ec74de9416b8ef2c3bdb1a9835e54548b3185524210d1aeffa91c98f74f751e2

        SHA512

        a60fe447cb0bed8e6cbd7c344b19a4602553209cbda7a40993f0fdf01e096bda4b79de0b528ecebf2efa0007f81d7bd6c7ef84252b2a160c93d642a78f0095f9

      • \Users\Admin\AppData\Local\Temp\IXP003.TMP\2Yi8512.exe

        Filesize

        445KB

        MD5

        d644f10bbbcb24b382676c132ceec2f3

        SHA1

        19d3a37a38390a2c7d1bd9a14a887c7b3c2214cc

        SHA256

        6a7cea3debd6c397fcc74472b108a3250a88d61fb5b058b18b78f6919b70e5f1

        SHA512

        633347562c662a462f8e2c838e552e9fcbbad363f32055e2d833a10972a06bec96013bb838f57686f3a6d4cf5d1f4ec18b5fc8735c29ca219ed0d654cc22a40d

      • \Users\Admin\AppData\Local\Temp\IXP003.TMP\2Yi8512.exe

        Filesize

        445KB

        MD5

        d644f10bbbcb24b382676c132ceec2f3

        SHA1

        19d3a37a38390a2c7d1bd9a14a887c7b3c2214cc

        SHA256

        6a7cea3debd6c397fcc74472b108a3250a88d61fb5b058b18b78f6919b70e5f1

        SHA512

        633347562c662a462f8e2c838e552e9fcbbad363f32055e2d833a10972a06bec96013bb838f57686f3a6d4cf5d1f4ec18b5fc8735c29ca219ed0d654cc22a40d

      • \Users\Admin\AppData\Local\Temp\IXP003.TMP\2Yi8512.exe

        Filesize

        445KB

        MD5

        d644f10bbbcb24b382676c132ceec2f3

        SHA1

        19d3a37a38390a2c7d1bd9a14a887c7b3c2214cc

        SHA256

        6a7cea3debd6c397fcc74472b108a3250a88d61fb5b058b18b78f6919b70e5f1

        SHA512

        633347562c662a462f8e2c838e552e9fcbbad363f32055e2d833a10972a06bec96013bb838f57686f3a6d4cf5d1f4ec18b5fc8735c29ca219ed0d654cc22a40d

      • \Users\Admin\AppData\Local\Temp\IXP003.TMP\2Yi8512.exe

        Filesize

        445KB

        MD5

        d644f10bbbcb24b382676c132ceec2f3

        SHA1

        19d3a37a38390a2c7d1bd9a14a887c7b3c2214cc

        SHA256

        6a7cea3debd6c397fcc74472b108a3250a88d61fb5b058b18b78f6919b70e5f1

        SHA512

        633347562c662a462f8e2c838e552e9fcbbad363f32055e2d833a10972a06bec96013bb838f57686f3a6d4cf5d1f4ec18b5fc8735c29ca219ed0d654cc22a40d

      • \Users\Admin\AppData\Local\Temp\IXP003.TMP\2Yi8512.exe

        Filesize

        445KB

        MD5

        d644f10bbbcb24b382676c132ceec2f3

        SHA1

        19d3a37a38390a2c7d1bd9a14a887c7b3c2214cc

        SHA256

        6a7cea3debd6c397fcc74472b108a3250a88d61fb5b058b18b78f6919b70e5f1

        SHA512

        633347562c662a462f8e2c838e552e9fcbbad363f32055e2d833a10972a06bec96013bb838f57686f3a6d4cf5d1f4ec18b5fc8735c29ca219ed0d654cc22a40d

      • \Users\Admin\AppData\Local\Temp\IXP003.TMP\2Yi8512.exe

        Filesize

        445KB

        MD5

        d644f10bbbcb24b382676c132ceec2f3

        SHA1

        19d3a37a38390a2c7d1bd9a14a887c7b3c2214cc

        SHA256

        6a7cea3debd6c397fcc74472b108a3250a88d61fb5b058b18b78f6919b70e5f1

        SHA512

        633347562c662a462f8e2c838e552e9fcbbad363f32055e2d833a10972a06bec96013bb838f57686f3a6d4cf5d1f4ec18b5fc8735c29ca219ed0d654cc22a40d

      • memory/1016-80-0x0000000000400000-0x0000000000433000-memory.dmp

        Filesize

        204KB

      • memory/1016-76-0x0000000000400000-0x0000000000433000-memory.dmp

        Filesize

        204KB

      • memory/1016-95-0x0000000000400000-0x0000000000433000-memory.dmp

        Filesize

        204KB

      • memory/1016-90-0x0000000000400000-0x0000000000433000-memory.dmp

        Filesize

        204KB

      • memory/1016-89-0x0000000000400000-0x0000000000433000-memory.dmp

        Filesize

        204KB

      • memory/1016-87-0x0000000000400000-0x0000000000433000-memory.dmp

        Filesize

        204KB

      • memory/1016-85-0x0000000000400000-0x0000000000433000-memory.dmp

        Filesize

        204KB

      • memory/1016-84-0x00000000FFFDE000-0x00000000FFFDF000-memory.dmp

        Filesize

        4KB

      • memory/1016-83-0x0000000000400000-0x0000000000433000-memory.dmp

        Filesize

        204KB

      • memory/1016-82-0x0000000000400000-0x0000000000433000-memory.dmp

        Filesize

        204KB

      • memory/1016-81-0x0000000000400000-0x0000000000433000-memory.dmp

        Filesize

        204KB

      • memory/1016-78-0x0000000000400000-0x0000000000433000-memory.dmp

        Filesize

        204KB

      • memory/2700-69-0x0000000001F30000-0x0000000001F46000-memory.dmp

        Filesize

        88KB

      • memory/2700-61-0x0000000001F30000-0x0000000001F46000-memory.dmp

        Filesize

        88KB

      • memory/2700-51-0x0000000001F30000-0x0000000001F46000-memory.dmp

        Filesize

        88KB

      • memory/2700-45-0x0000000001F30000-0x0000000001F46000-memory.dmp

        Filesize

        88KB

      • memory/2700-49-0x0000000001F30000-0x0000000001F46000-memory.dmp

        Filesize

        88KB

      • memory/2700-55-0x0000000001F30000-0x0000000001F46000-memory.dmp

        Filesize

        88KB

      • memory/2700-53-0x0000000001F30000-0x0000000001F46000-memory.dmp

        Filesize

        88KB

      • memory/2700-65-0x0000000001F30000-0x0000000001F46000-memory.dmp

        Filesize

        88KB

      • memory/2700-67-0x0000000001F30000-0x0000000001F46000-memory.dmp

        Filesize

        88KB

      • memory/2700-47-0x0000000001F30000-0x0000000001F46000-memory.dmp

        Filesize

        88KB

      • memory/2700-63-0x0000000001F30000-0x0000000001F46000-memory.dmp

        Filesize

        88KB

      • memory/2700-57-0x0000000001F30000-0x0000000001F46000-memory.dmp

        Filesize

        88KB

      • memory/2700-43-0x0000000001F30000-0x0000000001F46000-memory.dmp

        Filesize

        88KB

      • memory/2700-42-0x0000000001F30000-0x0000000001F46000-memory.dmp

        Filesize

        88KB

      • memory/2700-41-0x0000000001F30000-0x0000000001F4C000-memory.dmp

        Filesize

        112KB

      • memory/2700-40-0x0000000000500000-0x000000000051E000-memory.dmp

        Filesize

        120KB

      • memory/2700-59-0x0000000001F30000-0x0000000001F46000-memory.dmp

        Filesize

        88KB