Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    119s
  • max time network
    122s
  • platform
    windows7_x64
  • resource
    win7-20230831-en
  • resource tags

    arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
  • submitted
    10/10/2023, 13:21

General

  • Target

    file.exe

  • Size

    1.2MB

  • MD5

    ba744c71ad3b2bc2aaa91dac43c3560a

  • SHA1

    a8494e6b2449778d46e5ecaffe2f73927c173b57

  • SHA256

    e1c75364c3f932b775cfb1d2d5a65589710be2b40adeef66d53772e0a6bcb6aa

  • SHA512

    dbc058755d2152537cb13690feff35d36280d38db5cf786749d9b7889c62a1608d3dbbe679f3519b07aa445e5c3210e6583c6ce59daa41f640eddf226209cf0f

  • SSDEEP

    24576:HyN4a27dXgoV/THMw7hoxuc8x9z3dve7IxYrgxnb/4Jno:SNv27JTt0o9zhecxYr6b/Q

Malware Config

Signatures

  • Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs
  • Executes dropped EXE 5 IoCs
  • Loads dropped DLL 14 IoCs
  • Windows security modification 2 TTPs 2 IoCs
  • Adds Run key to start application 2 TTPs 4 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Program crash 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 63 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\file.exe
    "C:\Users\Admin\AppData\Local\Temp\file.exe"
    1⤵
    • Loads dropped DLL
    • Adds Run key to start application
    • Suspicious use of WriteProcessMemory
    PID:2884
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\oZ6Ib58.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\oZ6Ib58.exe
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Adds Run key to start application
      • Suspicious use of WriteProcessMemory
      PID:2068
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\YU5Kf42.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\YU5Kf42.exe
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Adds Run key to start application
        • Suspicious use of WriteProcessMemory
        PID:2228
        • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\Jd3Py61.exe
          C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\Jd3Py61.exe
          4⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • Adds Run key to start application
          • Suspicious use of WriteProcessMemory
          PID:2416
          • C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\1SV62hB3.exe
            C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\1SV62hB3.exe
            5⤵
            • Modifies Windows Defender Real-time Protection settings
            • Executes dropped EXE
            • Loads dropped DLL
            • Windows security modification
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:2640
          • C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\2Yo5714.exe
            C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\2Yo5714.exe
            5⤵
            • Executes dropped EXE
            • Loads dropped DLL
            • Suspicious use of SetThreadContext
            • Suspicious use of WriteProcessMemory
            PID:2664
            • C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
              "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
              6⤵
              • Suspicious use of WriteProcessMemory
              PID:2500
              • C:\Windows\SysWOW64\WerFault.exe
                C:\Windows\SysWOW64\WerFault.exe -u -p 2500 -s 268
                7⤵
                • Program crash
                PID:3020
            • C:\Windows\SysWOW64\WerFault.exe
              C:\Windows\SysWOW64\WerFault.exe -u -p 2664 -s 284
              6⤵
              • Loads dropped DLL
              • Program crash
              PID:2576

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\oZ6Ib58.exe

    Filesize

    1.0MB

    MD5

    a598f609eb10430d7e6d224c4873cf0c

    SHA1

    15d70418c22a933c816404a7d720d639a337992b

    SHA256

    14940583cd99f9880ad4dc18c5c6921266f6dab89f0b8d85db8c409fd8545002

    SHA512

    b502eac9ca261dbf956cad202e12542e7856f5642e967b7c3bca5a7feba4ca1e6a468aee6825917cb4cb4f5fb7698104bc41bf6ad46d2ac215518f3f70412fd1

  • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\oZ6Ib58.exe

    Filesize

    1.0MB

    MD5

    a598f609eb10430d7e6d224c4873cf0c

    SHA1

    15d70418c22a933c816404a7d720d639a337992b

    SHA256

    14940583cd99f9880ad4dc18c5c6921266f6dab89f0b8d85db8c409fd8545002

    SHA512

    b502eac9ca261dbf956cad202e12542e7856f5642e967b7c3bca5a7feba4ca1e6a468aee6825917cb4cb4f5fb7698104bc41bf6ad46d2ac215518f3f70412fd1

  • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\YU5Kf42.exe

    Filesize

    745KB

    MD5

    04a94daab9afec040427dd84ec844ae1

    SHA1

    ca8f93ef567f3cc68b7098402651cd35e77e670d

    SHA256

    3673c6446cb9b50e97e0e27d1091e6a56f119b6e343428eea392da0ab09cb51b

    SHA512

    70a4497b898333ef63d9ab8491517c76e8b9901ca79425c93144df3b4c85569a5235f1a62b43f0c6e42839bb6bf786ac67c3ae813d74c308cf50cb71e1448806

  • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\YU5Kf42.exe

    Filesize

    745KB

    MD5

    04a94daab9afec040427dd84ec844ae1

    SHA1

    ca8f93ef567f3cc68b7098402651cd35e77e670d

    SHA256

    3673c6446cb9b50e97e0e27d1091e6a56f119b6e343428eea392da0ab09cb51b

    SHA512

    70a4497b898333ef63d9ab8491517c76e8b9901ca79425c93144df3b4c85569a5235f1a62b43f0c6e42839bb6bf786ac67c3ae813d74c308cf50cb71e1448806

  • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\Jd3Py61.exe

    Filesize

    492KB

    MD5

    6c590a9604c706b704fdad534823611f

    SHA1

    bb5a8f01129ae0cf852c7db5dc497aa0f326a7ff

    SHA256

    d62609e6f7d0a989bad3519493582ee26ad5015cc47c6e31685be9879a4717af

    SHA512

    7eb0c247bb879a3dfd38d5c6732b7d58f21182f6ac71fea9861f5f7a990b9efc4b80cce5d9fdf26f514446366ceba9ed95ca8e89f3b291330779bc8c74fbd64b

  • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\Jd3Py61.exe

    Filesize

    492KB

    MD5

    6c590a9604c706b704fdad534823611f

    SHA1

    bb5a8f01129ae0cf852c7db5dc497aa0f326a7ff

    SHA256

    d62609e6f7d0a989bad3519493582ee26ad5015cc47c6e31685be9879a4717af

    SHA512

    7eb0c247bb879a3dfd38d5c6732b7d58f21182f6ac71fea9861f5f7a990b9efc4b80cce5d9fdf26f514446366ceba9ed95ca8e89f3b291330779bc8c74fbd64b

  • C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\1SV62hB3.exe

    Filesize

    194KB

    MD5

    6241b03d68a610324ecda52f0f84e287

    SHA1

    da80280b6e3925e455925efd6c6e59a6118269c4

    SHA256

    ec74de9416b8ef2c3bdb1a9835e54548b3185524210d1aeffa91c98f74f751e2

    SHA512

    a60fe447cb0bed8e6cbd7c344b19a4602553209cbda7a40993f0fdf01e096bda4b79de0b528ecebf2efa0007f81d7bd6c7ef84252b2a160c93d642a78f0095f9

  • C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\1SV62hB3.exe

    Filesize

    194KB

    MD5

    6241b03d68a610324ecda52f0f84e287

    SHA1

    da80280b6e3925e455925efd6c6e59a6118269c4

    SHA256

    ec74de9416b8ef2c3bdb1a9835e54548b3185524210d1aeffa91c98f74f751e2

    SHA512

    a60fe447cb0bed8e6cbd7c344b19a4602553209cbda7a40993f0fdf01e096bda4b79de0b528ecebf2efa0007f81d7bd6c7ef84252b2a160c93d642a78f0095f9

  • C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\2Yo5714.exe

    Filesize

    446KB

    MD5

    a95dff4b299e84d682618aec232db47c

    SHA1

    69f166f5ee77fdf0a38d8685784decd3671ef27d

    SHA256

    d14ae98cee009df197b7810e342c0ec8abf7524e46ffa5441a9e752c8780d99b

    SHA512

    3f39b60cb748c7aa6ef6eff3e9babbe03ec8584d31de42897575b71123f9025edf4a09944e05488c23a694011f6665497991656b02d943b519cb0f19521c253c

  • C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\2Yo5714.exe

    Filesize

    446KB

    MD5

    a95dff4b299e84d682618aec232db47c

    SHA1

    69f166f5ee77fdf0a38d8685784decd3671ef27d

    SHA256

    d14ae98cee009df197b7810e342c0ec8abf7524e46ffa5441a9e752c8780d99b

    SHA512

    3f39b60cb748c7aa6ef6eff3e9babbe03ec8584d31de42897575b71123f9025edf4a09944e05488c23a694011f6665497991656b02d943b519cb0f19521c253c

  • \Users\Admin\AppData\Local\Temp\IXP000.TMP\oZ6Ib58.exe

    Filesize

    1.0MB

    MD5

    a598f609eb10430d7e6d224c4873cf0c

    SHA1

    15d70418c22a933c816404a7d720d639a337992b

    SHA256

    14940583cd99f9880ad4dc18c5c6921266f6dab89f0b8d85db8c409fd8545002

    SHA512

    b502eac9ca261dbf956cad202e12542e7856f5642e967b7c3bca5a7feba4ca1e6a468aee6825917cb4cb4f5fb7698104bc41bf6ad46d2ac215518f3f70412fd1

  • \Users\Admin\AppData\Local\Temp\IXP000.TMP\oZ6Ib58.exe

    Filesize

    1.0MB

    MD5

    a598f609eb10430d7e6d224c4873cf0c

    SHA1

    15d70418c22a933c816404a7d720d639a337992b

    SHA256

    14940583cd99f9880ad4dc18c5c6921266f6dab89f0b8d85db8c409fd8545002

    SHA512

    b502eac9ca261dbf956cad202e12542e7856f5642e967b7c3bca5a7feba4ca1e6a468aee6825917cb4cb4f5fb7698104bc41bf6ad46d2ac215518f3f70412fd1

  • \Users\Admin\AppData\Local\Temp\IXP001.TMP\YU5Kf42.exe

    Filesize

    745KB

    MD5

    04a94daab9afec040427dd84ec844ae1

    SHA1

    ca8f93ef567f3cc68b7098402651cd35e77e670d

    SHA256

    3673c6446cb9b50e97e0e27d1091e6a56f119b6e343428eea392da0ab09cb51b

    SHA512

    70a4497b898333ef63d9ab8491517c76e8b9901ca79425c93144df3b4c85569a5235f1a62b43f0c6e42839bb6bf786ac67c3ae813d74c308cf50cb71e1448806

  • \Users\Admin\AppData\Local\Temp\IXP001.TMP\YU5Kf42.exe

    Filesize

    745KB

    MD5

    04a94daab9afec040427dd84ec844ae1

    SHA1

    ca8f93ef567f3cc68b7098402651cd35e77e670d

    SHA256

    3673c6446cb9b50e97e0e27d1091e6a56f119b6e343428eea392da0ab09cb51b

    SHA512

    70a4497b898333ef63d9ab8491517c76e8b9901ca79425c93144df3b4c85569a5235f1a62b43f0c6e42839bb6bf786ac67c3ae813d74c308cf50cb71e1448806

  • \Users\Admin\AppData\Local\Temp\IXP002.TMP\Jd3Py61.exe

    Filesize

    492KB

    MD5

    6c590a9604c706b704fdad534823611f

    SHA1

    bb5a8f01129ae0cf852c7db5dc497aa0f326a7ff

    SHA256

    d62609e6f7d0a989bad3519493582ee26ad5015cc47c6e31685be9879a4717af

    SHA512

    7eb0c247bb879a3dfd38d5c6732b7d58f21182f6ac71fea9861f5f7a990b9efc4b80cce5d9fdf26f514446366ceba9ed95ca8e89f3b291330779bc8c74fbd64b

  • \Users\Admin\AppData\Local\Temp\IXP002.TMP\Jd3Py61.exe

    Filesize

    492KB

    MD5

    6c590a9604c706b704fdad534823611f

    SHA1

    bb5a8f01129ae0cf852c7db5dc497aa0f326a7ff

    SHA256

    d62609e6f7d0a989bad3519493582ee26ad5015cc47c6e31685be9879a4717af

    SHA512

    7eb0c247bb879a3dfd38d5c6732b7d58f21182f6ac71fea9861f5f7a990b9efc4b80cce5d9fdf26f514446366ceba9ed95ca8e89f3b291330779bc8c74fbd64b

  • \Users\Admin\AppData\Local\Temp\IXP003.TMP\1SV62hB3.exe

    Filesize

    194KB

    MD5

    6241b03d68a610324ecda52f0f84e287

    SHA1

    da80280b6e3925e455925efd6c6e59a6118269c4

    SHA256

    ec74de9416b8ef2c3bdb1a9835e54548b3185524210d1aeffa91c98f74f751e2

    SHA512

    a60fe447cb0bed8e6cbd7c344b19a4602553209cbda7a40993f0fdf01e096bda4b79de0b528ecebf2efa0007f81d7bd6c7ef84252b2a160c93d642a78f0095f9

  • \Users\Admin\AppData\Local\Temp\IXP003.TMP\1SV62hB3.exe

    Filesize

    194KB

    MD5

    6241b03d68a610324ecda52f0f84e287

    SHA1

    da80280b6e3925e455925efd6c6e59a6118269c4

    SHA256

    ec74de9416b8ef2c3bdb1a9835e54548b3185524210d1aeffa91c98f74f751e2

    SHA512

    a60fe447cb0bed8e6cbd7c344b19a4602553209cbda7a40993f0fdf01e096bda4b79de0b528ecebf2efa0007f81d7bd6c7ef84252b2a160c93d642a78f0095f9

  • \Users\Admin\AppData\Local\Temp\IXP003.TMP\2Yo5714.exe

    Filesize

    446KB

    MD5

    a95dff4b299e84d682618aec232db47c

    SHA1

    69f166f5ee77fdf0a38d8685784decd3671ef27d

    SHA256

    d14ae98cee009df197b7810e342c0ec8abf7524e46ffa5441a9e752c8780d99b

    SHA512

    3f39b60cb748c7aa6ef6eff3e9babbe03ec8584d31de42897575b71123f9025edf4a09944e05488c23a694011f6665497991656b02d943b519cb0f19521c253c

  • \Users\Admin\AppData\Local\Temp\IXP003.TMP\2Yo5714.exe

    Filesize

    446KB

    MD5

    a95dff4b299e84d682618aec232db47c

    SHA1

    69f166f5ee77fdf0a38d8685784decd3671ef27d

    SHA256

    d14ae98cee009df197b7810e342c0ec8abf7524e46ffa5441a9e752c8780d99b

    SHA512

    3f39b60cb748c7aa6ef6eff3e9babbe03ec8584d31de42897575b71123f9025edf4a09944e05488c23a694011f6665497991656b02d943b519cb0f19521c253c

  • \Users\Admin\AppData\Local\Temp\IXP003.TMP\2Yo5714.exe

    Filesize

    446KB

    MD5

    a95dff4b299e84d682618aec232db47c

    SHA1

    69f166f5ee77fdf0a38d8685784decd3671ef27d

    SHA256

    d14ae98cee009df197b7810e342c0ec8abf7524e46ffa5441a9e752c8780d99b

    SHA512

    3f39b60cb748c7aa6ef6eff3e9babbe03ec8584d31de42897575b71123f9025edf4a09944e05488c23a694011f6665497991656b02d943b519cb0f19521c253c

  • \Users\Admin\AppData\Local\Temp\IXP003.TMP\2Yo5714.exe

    Filesize

    446KB

    MD5

    a95dff4b299e84d682618aec232db47c

    SHA1

    69f166f5ee77fdf0a38d8685784decd3671ef27d

    SHA256

    d14ae98cee009df197b7810e342c0ec8abf7524e46ffa5441a9e752c8780d99b

    SHA512

    3f39b60cb748c7aa6ef6eff3e9babbe03ec8584d31de42897575b71123f9025edf4a09944e05488c23a694011f6665497991656b02d943b519cb0f19521c253c

  • \Users\Admin\AppData\Local\Temp\IXP003.TMP\2Yo5714.exe

    Filesize

    446KB

    MD5

    a95dff4b299e84d682618aec232db47c

    SHA1

    69f166f5ee77fdf0a38d8685784decd3671ef27d

    SHA256

    d14ae98cee009df197b7810e342c0ec8abf7524e46ffa5441a9e752c8780d99b

    SHA512

    3f39b60cb748c7aa6ef6eff3e9babbe03ec8584d31de42897575b71123f9025edf4a09944e05488c23a694011f6665497991656b02d943b519cb0f19521c253c

  • \Users\Admin\AppData\Local\Temp\IXP003.TMP\2Yo5714.exe

    Filesize

    446KB

    MD5

    a95dff4b299e84d682618aec232db47c

    SHA1

    69f166f5ee77fdf0a38d8685784decd3671ef27d

    SHA256

    d14ae98cee009df197b7810e342c0ec8abf7524e46ffa5441a9e752c8780d99b

    SHA512

    3f39b60cb748c7aa6ef6eff3e9babbe03ec8584d31de42897575b71123f9025edf4a09944e05488c23a694011f6665497991656b02d943b519cb0f19521c253c

  • memory/2500-85-0x0000000000400000-0x0000000000433000-memory.dmp

    Filesize

    204KB

  • memory/2500-87-0x0000000000400000-0x0000000000433000-memory.dmp

    Filesize

    204KB

  • memory/2500-77-0x0000000000400000-0x0000000000433000-memory.dmp

    Filesize

    204KB

  • memory/2500-79-0x0000000000400000-0x0000000000433000-memory.dmp

    Filesize

    204KB

  • memory/2500-78-0x0000000000400000-0x0000000000433000-memory.dmp

    Filesize

    204KB

  • memory/2500-81-0x0000000000400000-0x0000000000433000-memory.dmp

    Filesize

    204KB

  • memory/2500-83-0x0000000000400000-0x0000000000433000-memory.dmp

    Filesize

    204KB

  • memory/2500-82-0x00000000FFFDE000-0x00000000FFFDF000-memory.dmp

    Filesize

    4KB

  • memory/2500-80-0x0000000000400000-0x0000000000433000-memory.dmp

    Filesize

    204KB

  • memory/2500-76-0x0000000000400000-0x0000000000433000-memory.dmp

    Filesize

    204KB

  • memory/2640-63-0x00000000009C0000-0x00000000009D6000-memory.dmp

    Filesize

    88KB

  • memory/2640-61-0x00000000009C0000-0x00000000009D6000-memory.dmp

    Filesize

    88KB

  • memory/2640-40-0x0000000000990000-0x00000000009AE000-memory.dmp

    Filesize

    120KB

  • memory/2640-42-0x00000000009C0000-0x00000000009D6000-memory.dmp

    Filesize

    88KB

  • memory/2640-43-0x00000000009C0000-0x00000000009D6000-memory.dmp

    Filesize

    88KB

  • memory/2640-49-0x00000000009C0000-0x00000000009D6000-memory.dmp

    Filesize

    88KB

  • memory/2640-51-0x00000000009C0000-0x00000000009D6000-memory.dmp

    Filesize

    88KB

  • memory/2640-55-0x00000000009C0000-0x00000000009D6000-memory.dmp

    Filesize

    88KB

  • memory/2640-57-0x00000000009C0000-0x00000000009D6000-memory.dmp

    Filesize

    88KB

  • memory/2640-41-0x00000000009C0000-0x00000000009DC000-memory.dmp

    Filesize

    112KB

  • memory/2640-45-0x00000000009C0000-0x00000000009D6000-memory.dmp

    Filesize

    88KB

  • memory/2640-65-0x00000000009C0000-0x00000000009D6000-memory.dmp

    Filesize

    88KB

  • memory/2640-69-0x00000000009C0000-0x00000000009D6000-memory.dmp

    Filesize

    88KB

  • memory/2640-67-0x00000000009C0000-0x00000000009D6000-memory.dmp

    Filesize

    88KB

  • memory/2640-59-0x00000000009C0000-0x00000000009D6000-memory.dmp

    Filesize

    88KB

  • memory/2640-53-0x00000000009C0000-0x00000000009D6000-memory.dmp

    Filesize

    88KB

  • memory/2640-47-0x00000000009C0000-0x00000000009D6000-memory.dmp

    Filesize

    88KB