Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    117s
  • max time network
    120s
  • platform
    windows7_x64
  • resource
    win7-20230831-en
  • resource tags

    arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
  • submitted
    10/10/2023, 13:19

General

  • Target

    file.exe

  • Size

    1.2MB

  • MD5

    ba744c71ad3b2bc2aaa91dac43c3560a

  • SHA1

    a8494e6b2449778d46e5ecaffe2f73927c173b57

  • SHA256

    e1c75364c3f932b775cfb1d2d5a65589710be2b40adeef66d53772e0a6bcb6aa

  • SHA512

    dbc058755d2152537cb13690feff35d36280d38db5cf786749d9b7889c62a1608d3dbbe679f3519b07aa445e5c3210e6583c6ce59daa41f640eddf226209cf0f

  • SSDEEP

    24576:HyN4a27dXgoV/THMw7hoxuc8x9z3dve7IxYrgxnb/4Jno:SNv27JTt0o9zhecxYr6b/Q

Malware Config

Signatures

  • Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs
  • Executes dropped EXE 5 IoCs
  • Loads dropped DLL 14 IoCs
  • Windows security modification 2 TTPs 2 IoCs
  • Adds Run key to start application 2 TTPs 4 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Program crash 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 56 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\file.exe
    "C:\Users\Admin\AppData\Local\Temp\file.exe"
    1⤵
    • Loads dropped DLL
    • Adds Run key to start application
    • Suspicious use of WriteProcessMemory
    PID:1612
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\oZ6Ib58.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\oZ6Ib58.exe
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Adds Run key to start application
      • Suspicious use of WriteProcessMemory
      PID:2984
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\YU5Kf42.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\YU5Kf42.exe
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Adds Run key to start application
        • Suspicious use of WriteProcessMemory
        PID:2368
        • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\Jd3Py61.exe
          C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\Jd3Py61.exe
          4⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • Adds Run key to start application
          • Suspicious use of WriteProcessMemory
          PID:2792
          • C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\1SV62hB3.exe
            C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\1SV62hB3.exe
            5⤵
            • Modifies Windows Defender Real-time Protection settings
            • Executes dropped EXE
            • Loads dropped DLL
            • Windows security modification
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:2156
          • C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\2Yo5714.exe
            C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\2Yo5714.exe
            5⤵
            • Executes dropped EXE
            • Loads dropped DLL
            • Suspicious use of SetThreadContext
            • Suspicious use of WriteProcessMemory
            PID:2436
            • C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
              "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
              6⤵
                PID:2336
              • C:\Windows\SysWOW64\WerFault.exe
                C:\Windows\SysWOW64\WerFault.exe -u -p 2436 -s 284
                6⤵
                • Loads dropped DLL
                • Program crash
                PID:2904

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\oZ6Ib58.exe

      Filesize

      1.0MB

      MD5

      a598f609eb10430d7e6d224c4873cf0c

      SHA1

      15d70418c22a933c816404a7d720d639a337992b

      SHA256

      14940583cd99f9880ad4dc18c5c6921266f6dab89f0b8d85db8c409fd8545002

      SHA512

      b502eac9ca261dbf956cad202e12542e7856f5642e967b7c3bca5a7feba4ca1e6a468aee6825917cb4cb4f5fb7698104bc41bf6ad46d2ac215518f3f70412fd1

    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\oZ6Ib58.exe

      Filesize

      1.0MB

      MD5

      a598f609eb10430d7e6d224c4873cf0c

      SHA1

      15d70418c22a933c816404a7d720d639a337992b

      SHA256

      14940583cd99f9880ad4dc18c5c6921266f6dab89f0b8d85db8c409fd8545002

      SHA512

      b502eac9ca261dbf956cad202e12542e7856f5642e967b7c3bca5a7feba4ca1e6a468aee6825917cb4cb4f5fb7698104bc41bf6ad46d2ac215518f3f70412fd1

    • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\YU5Kf42.exe

      Filesize

      745KB

      MD5

      04a94daab9afec040427dd84ec844ae1

      SHA1

      ca8f93ef567f3cc68b7098402651cd35e77e670d

      SHA256

      3673c6446cb9b50e97e0e27d1091e6a56f119b6e343428eea392da0ab09cb51b

      SHA512

      70a4497b898333ef63d9ab8491517c76e8b9901ca79425c93144df3b4c85569a5235f1a62b43f0c6e42839bb6bf786ac67c3ae813d74c308cf50cb71e1448806

    • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\YU5Kf42.exe

      Filesize

      745KB

      MD5

      04a94daab9afec040427dd84ec844ae1

      SHA1

      ca8f93ef567f3cc68b7098402651cd35e77e670d

      SHA256

      3673c6446cb9b50e97e0e27d1091e6a56f119b6e343428eea392da0ab09cb51b

      SHA512

      70a4497b898333ef63d9ab8491517c76e8b9901ca79425c93144df3b4c85569a5235f1a62b43f0c6e42839bb6bf786ac67c3ae813d74c308cf50cb71e1448806

    • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\Jd3Py61.exe

      Filesize

      492KB

      MD5

      6c590a9604c706b704fdad534823611f

      SHA1

      bb5a8f01129ae0cf852c7db5dc497aa0f326a7ff

      SHA256

      d62609e6f7d0a989bad3519493582ee26ad5015cc47c6e31685be9879a4717af

      SHA512

      7eb0c247bb879a3dfd38d5c6732b7d58f21182f6ac71fea9861f5f7a990b9efc4b80cce5d9fdf26f514446366ceba9ed95ca8e89f3b291330779bc8c74fbd64b

    • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\Jd3Py61.exe

      Filesize

      492KB

      MD5

      6c590a9604c706b704fdad534823611f

      SHA1

      bb5a8f01129ae0cf852c7db5dc497aa0f326a7ff

      SHA256

      d62609e6f7d0a989bad3519493582ee26ad5015cc47c6e31685be9879a4717af

      SHA512

      7eb0c247bb879a3dfd38d5c6732b7d58f21182f6ac71fea9861f5f7a990b9efc4b80cce5d9fdf26f514446366ceba9ed95ca8e89f3b291330779bc8c74fbd64b

    • C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\1SV62hB3.exe

      Filesize

      194KB

      MD5

      6241b03d68a610324ecda52f0f84e287

      SHA1

      da80280b6e3925e455925efd6c6e59a6118269c4

      SHA256

      ec74de9416b8ef2c3bdb1a9835e54548b3185524210d1aeffa91c98f74f751e2

      SHA512

      a60fe447cb0bed8e6cbd7c344b19a4602553209cbda7a40993f0fdf01e096bda4b79de0b528ecebf2efa0007f81d7bd6c7ef84252b2a160c93d642a78f0095f9

    • C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\1SV62hB3.exe

      Filesize

      194KB

      MD5

      6241b03d68a610324ecda52f0f84e287

      SHA1

      da80280b6e3925e455925efd6c6e59a6118269c4

      SHA256

      ec74de9416b8ef2c3bdb1a9835e54548b3185524210d1aeffa91c98f74f751e2

      SHA512

      a60fe447cb0bed8e6cbd7c344b19a4602553209cbda7a40993f0fdf01e096bda4b79de0b528ecebf2efa0007f81d7bd6c7ef84252b2a160c93d642a78f0095f9

    • C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\2Yo5714.exe

      Filesize

      446KB

      MD5

      a95dff4b299e84d682618aec232db47c

      SHA1

      69f166f5ee77fdf0a38d8685784decd3671ef27d

      SHA256

      d14ae98cee009df197b7810e342c0ec8abf7524e46ffa5441a9e752c8780d99b

      SHA512

      3f39b60cb748c7aa6ef6eff3e9babbe03ec8584d31de42897575b71123f9025edf4a09944e05488c23a694011f6665497991656b02d943b519cb0f19521c253c

    • C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\2Yo5714.exe

      Filesize

      446KB

      MD5

      a95dff4b299e84d682618aec232db47c

      SHA1

      69f166f5ee77fdf0a38d8685784decd3671ef27d

      SHA256

      d14ae98cee009df197b7810e342c0ec8abf7524e46ffa5441a9e752c8780d99b

      SHA512

      3f39b60cb748c7aa6ef6eff3e9babbe03ec8584d31de42897575b71123f9025edf4a09944e05488c23a694011f6665497991656b02d943b519cb0f19521c253c

    • \Users\Admin\AppData\Local\Temp\IXP000.TMP\oZ6Ib58.exe

      Filesize

      1.0MB

      MD5

      a598f609eb10430d7e6d224c4873cf0c

      SHA1

      15d70418c22a933c816404a7d720d639a337992b

      SHA256

      14940583cd99f9880ad4dc18c5c6921266f6dab89f0b8d85db8c409fd8545002

      SHA512

      b502eac9ca261dbf956cad202e12542e7856f5642e967b7c3bca5a7feba4ca1e6a468aee6825917cb4cb4f5fb7698104bc41bf6ad46d2ac215518f3f70412fd1

    • \Users\Admin\AppData\Local\Temp\IXP000.TMP\oZ6Ib58.exe

      Filesize

      1.0MB

      MD5

      a598f609eb10430d7e6d224c4873cf0c

      SHA1

      15d70418c22a933c816404a7d720d639a337992b

      SHA256

      14940583cd99f9880ad4dc18c5c6921266f6dab89f0b8d85db8c409fd8545002

      SHA512

      b502eac9ca261dbf956cad202e12542e7856f5642e967b7c3bca5a7feba4ca1e6a468aee6825917cb4cb4f5fb7698104bc41bf6ad46d2ac215518f3f70412fd1

    • \Users\Admin\AppData\Local\Temp\IXP001.TMP\YU5Kf42.exe

      Filesize

      745KB

      MD5

      04a94daab9afec040427dd84ec844ae1

      SHA1

      ca8f93ef567f3cc68b7098402651cd35e77e670d

      SHA256

      3673c6446cb9b50e97e0e27d1091e6a56f119b6e343428eea392da0ab09cb51b

      SHA512

      70a4497b898333ef63d9ab8491517c76e8b9901ca79425c93144df3b4c85569a5235f1a62b43f0c6e42839bb6bf786ac67c3ae813d74c308cf50cb71e1448806

    • \Users\Admin\AppData\Local\Temp\IXP001.TMP\YU5Kf42.exe

      Filesize

      745KB

      MD5

      04a94daab9afec040427dd84ec844ae1

      SHA1

      ca8f93ef567f3cc68b7098402651cd35e77e670d

      SHA256

      3673c6446cb9b50e97e0e27d1091e6a56f119b6e343428eea392da0ab09cb51b

      SHA512

      70a4497b898333ef63d9ab8491517c76e8b9901ca79425c93144df3b4c85569a5235f1a62b43f0c6e42839bb6bf786ac67c3ae813d74c308cf50cb71e1448806

    • \Users\Admin\AppData\Local\Temp\IXP002.TMP\Jd3Py61.exe

      Filesize

      492KB

      MD5

      6c590a9604c706b704fdad534823611f

      SHA1

      bb5a8f01129ae0cf852c7db5dc497aa0f326a7ff

      SHA256

      d62609e6f7d0a989bad3519493582ee26ad5015cc47c6e31685be9879a4717af

      SHA512

      7eb0c247bb879a3dfd38d5c6732b7d58f21182f6ac71fea9861f5f7a990b9efc4b80cce5d9fdf26f514446366ceba9ed95ca8e89f3b291330779bc8c74fbd64b

    • \Users\Admin\AppData\Local\Temp\IXP002.TMP\Jd3Py61.exe

      Filesize

      492KB

      MD5

      6c590a9604c706b704fdad534823611f

      SHA1

      bb5a8f01129ae0cf852c7db5dc497aa0f326a7ff

      SHA256

      d62609e6f7d0a989bad3519493582ee26ad5015cc47c6e31685be9879a4717af

      SHA512

      7eb0c247bb879a3dfd38d5c6732b7d58f21182f6ac71fea9861f5f7a990b9efc4b80cce5d9fdf26f514446366ceba9ed95ca8e89f3b291330779bc8c74fbd64b

    • \Users\Admin\AppData\Local\Temp\IXP003.TMP\1SV62hB3.exe

      Filesize

      194KB

      MD5

      6241b03d68a610324ecda52f0f84e287

      SHA1

      da80280b6e3925e455925efd6c6e59a6118269c4

      SHA256

      ec74de9416b8ef2c3bdb1a9835e54548b3185524210d1aeffa91c98f74f751e2

      SHA512

      a60fe447cb0bed8e6cbd7c344b19a4602553209cbda7a40993f0fdf01e096bda4b79de0b528ecebf2efa0007f81d7bd6c7ef84252b2a160c93d642a78f0095f9

    • \Users\Admin\AppData\Local\Temp\IXP003.TMP\1SV62hB3.exe

      Filesize

      194KB

      MD5

      6241b03d68a610324ecda52f0f84e287

      SHA1

      da80280b6e3925e455925efd6c6e59a6118269c4

      SHA256

      ec74de9416b8ef2c3bdb1a9835e54548b3185524210d1aeffa91c98f74f751e2

      SHA512

      a60fe447cb0bed8e6cbd7c344b19a4602553209cbda7a40993f0fdf01e096bda4b79de0b528ecebf2efa0007f81d7bd6c7ef84252b2a160c93d642a78f0095f9

    • \Users\Admin\AppData\Local\Temp\IXP003.TMP\2Yo5714.exe

      Filesize

      446KB

      MD5

      a95dff4b299e84d682618aec232db47c

      SHA1

      69f166f5ee77fdf0a38d8685784decd3671ef27d

      SHA256

      d14ae98cee009df197b7810e342c0ec8abf7524e46ffa5441a9e752c8780d99b

      SHA512

      3f39b60cb748c7aa6ef6eff3e9babbe03ec8584d31de42897575b71123f9025edf4a09944e05488c23a694011f6665497991656b02d943b519cb0f19521c253c

    • \Users\Admin\AppData\Local\Temp\IXP003.TMP\2Yo5714.exe

      Filesize

      446KB

      MD5

      a95dff4b299e84d682618aec232db47c

      SHA1

      69f166f5ee77fdf0a38d8685784decd3671ef27d

      SHA256

      d14ae98cee009df197b7810e342c0ec8abf7524e46ffa5441a9e752c8780d99b

      SHA512

      3f39b60cb748c7aa6ef6eff3e9babbe03ec8584d31de42897575b71123f9025edf4a09944e05488c23a694011f6665497991656b02d943b519cb0f19521c253c

    • \Users\Admin\AppData\Local\Temp\IXP003.TMP\2Yo5714.exe

      Filesize

      446KB

      MD5

      a95dff4b299e84d682618aec232db47c

      SHA1

      69f166f5ee77fdf0a38d8685784decd3671ef27d

      SHA256

      d14ae98cee009df197b7810e342c0ec8abf7524e46ffa5441a9e752c8780d99b

      SHA512

      3f39b60cb748c7aa6ef6eff3e9babbe03ec8584d31de42897575b71123f9025edf4a09944e05488c23a694011f6665497991656b02d943b519cb0f19521c253c

    • \Users\Admin\AppData\Local\Temp\IXP003.TMP\2Yo5714.exe

      Filesize

      446KB

      MD5

      a95dff4b299e84d682618aec232db47c

      SHA1

      69f166f5ee77fdf0a38d8685784decd3671ef27d

      SHA256

      d14ae98cee009df197b7810e342c0ec8abf7524e46ffa5441a9e752c8780d99b

      SHA512

      3f39b60cb748c7aa6ef6eff3e9babbe03ec8584d31de42897575b71123f9025edf4a09944e05488c23a694011f6665497991656b02d943b519cb0f19521c253c

    • \Users\Admin\AppData\Local\Temp\IXP003.TMP\2Yo5714.exe

      Filesize

      446KB

      MD5

      a95dff4b299e84d682618aec232db47c

      SHA1

      69f166f5ee77fdf0a38d8685784decd3671ef27d

      SHA256

      d14ae98cee009df197b7810e342c0ec8abf7524e46ffa5441a9e752c8780d99b

      SHA512

      3f39b60cb748c7aa6ef6eff3e9babbe03ec8584d31de42897575b71123f9025edf4a09944e05488c23a694011f6665497991656b02d943b519cb0f19521c253c

    • \Users\Admin\AppData\Local\Temp\IXP003.TMP\2Yo5714.exe

      Filesize

      446KB

      MD5

      a95dff4b299e84d682618aec232db47c

      SHA1

      69f166f5ee77fdf0a38d8685784decd3671ef27d

      SHA256

      d14ae98cee009df197b7810e342c0ec8abf7524e46ffa5441a9e752c8780d99b

      SHA512

      3f39b60cb748c7aa6ef6eff3e9babbe03ec8584d31de42897575b71123f9025edf4a09944e05488c23a694011f6665497991656b02d943b519cb0f19521c253c

    • memory/2156-59-0x0000000000530000-0x0000000000546000-memory.dmp

      Filesize

      88KB

    • memory/2156-49-0x0000000000530000-0x0000000000546000-memory.dmp

      Filesize

      88KB

    • memory/2156-55-0x0000000000530000-0x0000000000546000-memory.dmp

      Filesize

      88KB

    • memory/2156-57-0x0000000000530000-0x0000000000546000-memory.dmp

      Filesize

      88KB

    • memory/2156-63-0x0000000000530000-0x0000000000546000-memory.dmp

      Filesize

      88KB

    • memory/2156-61-0x0000000000530000-0x0000000000546000-memory.dmp

      Filesize

      88KB

    • memory/2156-69-0x0000000000530000-0x0000000000546000-memory.dmp

      Filesize

      88KB

    • memory/2156-67-0x0000000000530000-0x0000000000546000-memory.dmp

      Filesize

      88KB

    • memory/2156-65-0x0000000000530000-0x0000000000546000-memory.dmp

      Filesize

      88KB

    • memory/2156-47-0x0000000000530000-0x0000000000546000-memory.dmp

      Filesize

      88KB

    • memory/2156-51-0x0000000000530000-0x0000000000546000-memory.dmp

      Filesize

      88KB

    • memory/2156-43-0x0000000000530000-0x0000000000546000-memory.dmp

      Filesize

      88KB

    • memory/2156-45-0x0000000000530000-0x0000000000546000-memory.dmp

      Filesize

      88KB

    • memory/2156-40-0x00000000003A0000-0x00000000003BE000-memory.dmp

      Filesize

      120KB

    • memory/2156-41-0x0000000000530000-0x000000000054C000-memory.dmp

      Filesize

      112KB

    • memory/2156-53-0x0000000000530000-0x0000000000546000-memory.dmp

      Filesize

      88KB

    • memory/2156-42-0x0000000000530000-0x0000000000546000-memory.dmp

      Filesize

      88KB

    • memory/2336-80-0x0000000000400000-0x0000000000433000-memory.dmp

      Filesize

      204KB

    • memory/2336-86-0x0000000000400000-0x0000000000433000-memory.dmp

      Filesize

      204KB

    • memory/2336-88-0x00000000FFFDE000-0x00000000FFFDF000-memory.dmp

      Filesize

      4KB

    • memory/2336-89-0x0000000000400000-0x0000000000433000-memory.dmp

      Filesize

      204KB

    • memory/2336-91-0x0000000000400000-0x0000000000433000-memory.dmp

      Filesize

      204KB

    • memory/2336-93-0x0000000000400000-0x0000000000433000-memory.dmp

      Filesize

      204KB

    • memory/2336-94-0x0000000000400000-0x0000000000433000-memory.dmp

      Filesize

      204KB

    • memory/2336-84-0x0000000000400000-0x0000000000433000-memory.dmp

      Filesize

      204KB

    • memory/2336-82-0x0000000000400000-0x0000000000433000-memory.dmp

      Filesize

      204KB

    • memory/2336-78-0x0000000000400000-0x0000000000433000-memory.dmp

      Filesize

      204KB

    • memory/2336-76-0x0000000000400000-0x0000000000433000-memory.dmp

      Filesize

      204KB

    • memory/2336-99-0x0000000000400000-0x0000000000433000-memory.dmp

      Filesize

      204KB