Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    117s
  • max time network
    120s
  • platform
    windows7_x64
  • resource
    win7-20230831-en
  • resource tags

    arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
  • submitted
    10/10/2023, 14:37

General

  • Target

    file.exe

  • Size

    1.2MB

  • MD5

    20f095c0bc558207bdc4b54698b2e5ac

  • SHA1

    f2e57f74b4069049c6e3a6ef843dc77b3d26babf

  • SHA256

    5399e8e6a678d168904df91f25a8564e2d65374bb806673b7461efc136398bdf

  • SHA512

    b6998019c5c8e9e7692611d980c43f997fd3e8cc0c28de146aa9d46a2562c64d05054a3621910eb7f7892c80b3b0a8c9edcf7c9ee183b74d217daf554708c53c

  • SSDEEP

    24576:ZyKV5zUpZvKEmcH2nCaDyTbYyK5gMJmiG/ViP37bRTORkZrGPEKBX+ujD+X:MK/81KEtH2FOi/IUPrNTNZmuC

Malware Config

Signatures

  • Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs
  • Executes dropped EXE 5 IoCs
  • Loads dropped DLL 14 IoCs
  • Windows security modification 2 TTPs 2 IoCs
  • Adds Run key to start application 2 TTPs 4 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Program crash 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 56 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\file.exe
    "C:\Users\Admin\AppData\Local\Temp\file.exe"
    1⤵
    • Loads dropped DLL
    • Adds Run key to start application
    • Suspicious use of WriteProcessMemory
    PID:2208
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ib5yf10.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ib5yf10.exe
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Adds Run key to start application
      • Suspicious use of WriteProcessMemory
      PID:2512
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\Qz8uZ93.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\Qz8uZ93.exe
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Adds Run key to start application
        • Suspicious use of WriteProcessMemory
        PID:2704
        • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\De5sz79.exe
          C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\De5sz79.exe
          4⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • Adds Run key to start application
          • Suspicious use of WriteProcessMemory
          PID:2780
          • C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\1Vu09tI2.exe
            C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\1Vu09tI2.exe
            5⤵
            • Modifies Windows Defender Real-time Protection settings
            • Executes dropped EXE
            • Loads dropped DLL
            • Windows security modification
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:2700
          • C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\2yO7962.exe
            C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\2yO7962.exe
            5⤵
            • Executes dropped EXE
            • Loads dropped DLL
            • Suspicious use of SetThreadContext
            • Suspicious use of WriteProcessMemory
            PID:320
            • C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
              "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
              6⤵
                PID:528
              • C:\Windows\SysWOW64\WerFault.exe
                C:\Windows\SysWOW64\WerFault.exe -u -p 320 -s 284
                6⤵
                • Loads dropped DLL
                • Program crash
                PID:928

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ib5yf10.exe

      Filesize

      1.0MB

      MD5

      12daf0738431ec28bf0b3c14a6c5bb15

      SHA1

      189b854ae1dac9aae9158392a9bb494be931908c

      SHA256

      1dd4b0a2486b968c8eda5c225b462a9062a10016e8ef9602fb599fc5d363fe43

      SHA512

      3a004206faa8c602564ca8c6dea8b8e3e01a97cbba0d054c2d2f0c4d825b50fd4bae48cd2793cfa09a023edf3f409eac2866925a6f48e20e7097bf29508d630f

    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ib5yf10.exe

      Filesize

      1.0MB

      MD5

      12daf0738431ec28bf0b3c14a6c5bb15

      SHA1

      189b854ae1dac9aae9158392a9bb494be931908c

      SHA256

      1dd4b0a2486b968c8eda5c225b462a9062a10016e8ef9602fb599fc5d363fe43

      SHA512

      3a004206faa8c602564ca8c6dea8b8e3e01a97cbba0d054c2d2f0c4d825b50fd4bae48cd2793cfa09a023edf3f409eac2866925a6f48e20e7097bf29508d630f

    • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\Qz8uZ93.exe

      Filesize

      746KB

      MD5

      01ae5c825521735198787d418917ea13

      SHA1

      780f707f86d5450e6f9e559541a49cd63049bebb

      SHA256

      2f568a194fdd45ab429e068921f190a6a0020b91492aa56602d768405aa27bcb

      SHA512

      f2bfc7d9b6924d2aee5a3bcd4fd89c636c0bd26a49c36a6f0caa338d37fa6e087cad3b42ba2218d82a64f744ac116c50fcf989fc3a6ab7cba2ef1f9045da801a

    • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\Qz8uZ93.exe

      Filesize

      746KB

      MD5

      01ae5c825521735198787d418917ea13

      SHA1

      780f707f86d5450e6f9e559541a49cd63049bebb

      SHA256

      2f568a194fdd45ab429e068921f190a6a0020b91492aa56602d768405aa27bcb

      SHA512

      f2bfc7d9b6924d2aee5a3bcd4fd89c636c0bd26a49c36a6f0caa338d37fa6e087cad3b42ba2218d82a64f744ac116c50fcf989fc3a6ab7cba2ef1f9045da801a

    • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\De5sz79.exe

      Filesize

      494KB

      MD5

      c5c97e3c67f31a0022840fc249b7a24c

      SHA1

      a3f4ccf389ba66d0a951c12e6cce3d37feec173e

      SHA256

      96cd25869cefef1723035cf40189a831e6c4c9b03d63501941389a72a70b6f0f

      SHA512

      bd3ae1641033d10cf0d3e12e3572f9bce08f0514a08e1de5999fc4a1617c4d1a8b480a54f41587ffab511f1a9ef10fb27836aadb5bc73a83f024bfd9b22b132c

    • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\De5sz79.exe

      Filesize

      494KB

      MD5

      c5c97e3c67f31a0022840fc249b7a24c

      SHA1

      a3f4ccf389ba66d0a951c12e6cce3d37feec173e

      SHA256

      96cd25869cefef1723035cf40189a831e6c4c9b03d63501941389a72a70b6f0f

      SHA512

      bd3ae1641033d10cf0d3e12e3572f9bce08f0514a08e1de5999fc4a1617c4d1a8b480a54f41587ffab511f1a9ef10fb27836aadb5bc73a83f024bfd9b22b132c

    • C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\1Vu09tI2.exe

      Filesize

      194KB

      MD5

      6241b03d68a610324ecda52f0f84e287

      SHA1

      da80280b6e3925e455925efd6c6e59a6118269c4

      SHA256

      ec74de9416b8ef2c3bdb1a9835e54548b3185524210d1aeffa91c98f74f751e2

      SHA512

      a60fe447cb0bed8e6cbd7c344b19a4602553209cbda7a40993f0fdf01e096bda4b79de0b528ecebf2efa0007f81d7bd6c7ef84252b2a160c93d642a78f0095f9

    • C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\1Vu09tI2.exe

      Filesize

      194KB

      MD5

      6241b03d68a610324ecda52f0f84e287

      SHA1

      da80280b6e3925e455925efd6c6e59a6118269c4

      SHA256

      ec74de9416b8ef2c3bdb1a9835e54548b3185524210d1aeffa91c98f74f751e2

      SHA512

      a60fe447cb0bed8e6cbd7c344b19a4602553209cbda7a40993f0fdf01e096bda4b79de0b528ecebf2efa0007f81d7bd6c7ef84252b2a160c93d642a78f0095f9

    • C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\2yO7962.exe

      Filesize

      448KB

      MD5

      56cd66f1a3c78995a4d023eb8ce9c3a1

      SHA1

      7f04ff61b511aed1815e9072303fdd9f17b4816c

      SHA256

      7b8d1cb5e8219a890d7b6aa91414c91d1bdaed8f809eb54646a0ef3ed326ff04

      SHA512

      e4ab2f678352ca26436de71540015165e42d7831aab6d903ee15848cd51ee093ca3196664dcf262f52f9a6ffc93370c89f791967308511e7c127abb25cda6279

    • C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\2yO7962.exe

      Filesize

      448KB

      MD5

      56cd66f1a3c78995a4d023eb8ce9c3a1

      SHA1

      7f04ff61b511aed1815e9072303fdd9f17b4816c

      SHA256

      7b8d1cb5e8219a890d7b6aa91414c91d1bdaed8f809eb54646a0ef3ed326ff04

      SHA512

      e4ab2f678352ca26436de71540015165e42d7831aab6d903ee15848cd51ee093ca3196664dcf262f52f9a6ffc93370c89f791967308511e7c127abb25cda6279

    • \Users\Admin\AppData\Local\Temp\IXP000.TMP\ib5yf10.exe

      Filesize

      1.0MB

      MD5

      12daf0738431ec28bf0b3c14a6c5bb15

      SHA1

      189b854ae1dac9aae9158392a9bb494be931908c

      SHA256

      1dd4b0a2486b968c8eda5c225b462a9062a10016e8ef9602fb599fc5d363fe43

      SHA512

      3a004206faa8c602564ca8c6dea8b8e3e01a97cbba0d054c2d2f0c4d825b50fd4bae48cd2793cfa09a023edf3f409eac2866925a6f48e20e7097bf29508d630f

    • \Users\Admin\AppData\Local\Temp\IXP000.TMP\ib5yf10.exe

      Filesize

      1.0MB

      MD5

      12daf0738431ec28bf0b3c14a6c5bb15

      SHA1

      189b854ae1dac9aae9158392a9bb494be931908c

      SHA256

      1dd4b0a2486b968c8eda5c225b462a9062a10016e8ef9602fb599fc5d363fe43

      SHA512

      3a004206faa8c602564ca8c6dea8b8e3e01a97cbba0d054c2d2f0c4d825b50fd4bae48cd2793cfa09a023edf3f409eac2866925a6f48e20e7097bf29508d630f

    • \Users\Admin\AppData\Local\Temp\IXP001.TMP\Qz8uZ93.exe

      Filesize

      746KB

      MD5

      01ae5c825521735198787d418917ea13

      SHA1

      780f707f86d5450e6f9e559541a49cd63049bebb

      SHA256

      2f568a194fdd45ab429e068921f190a6a0020b91492aa56602d768405aa27bcb

      SHA512

      f2bfc7d9b6924d2aee5a3bcd4fd89c636c0bd26a49c36a6f0caa338d37fa6e087cad3b42ba2218d82a64f744ac116c50fcf989fc3a6ab7cba2ef1f9045da801a

    • \Users\Admin\AppData\Local\Temp\IXP001.TMP\Qz8uZ93.exe

      Filesize

      746KB

      MD5

      01ae5c825521735198787d418917ea13

      SHA1

      780f707f86d5450e6f9e559541a49cd63049bebb

      SHA256

      2f568a194fdd45ab429e068921f190a6a0020b91492aa56602d768405aa27bcb

      SHA512

      f2bfc7d9b6924d2aee5a3bcd4fd89c636c0bd26a49c36a6f0caa338d37fa6e087cad3b42ba2218d82a64f744ac116c50fcf989fc3a6ab7cba2ef1f9045da801a

    • \Users\Admin\AppData\Local\Temp\IXP002.TMP\De5sz79.exe

      Filesize

      494KB

      MD5

      c5c97e3c67f31a0022840fc249b7a24c

      SHA1

      a3f4ccf389ba66d0a951c12e6cce3d37feec173e

      SHA256

      96cd25869cefef1723035cf40189a831e6c4c9b03d63501941389a72a70b6f0f

      SHA512

      bd3ae1641033d10cf0d3e12e3572f9bce08f0514a08e1de5999fc4a1617c4d1a8b480a54f41587ffab511f1a9ef10fb27836aadb5bc73a83f024bfd9b22b132c

    • \Users\Admin\AppData\Local\Temp\IXP002.TMP\De5sz79.exe

      Filesize

      494KB

      MD5

      c5c97e3c67f31a0022840fc249b7a24c

      SHA1

      a3f4ccf389ba66d0a951c12e6cce3d37feec173e

      SHA256

      96cd25869cefef1723035cf40189a831e6c4c9b03d63501941389a72a70b6f0f

      SHA512

      bd3ae1641033d10cf0d3e12e3572f9bce08f0514a08e1de5999fc4a1617c4d1a8b480a54f41587ffab511f1a9ef10fb27836aadb5bc73a83f024bfd9b22b132c

    • \Users\Admin\AppData\Local\Temp\IXP003.TMP\1Vu09tI2.exe

      Filesize

      194KB

      MD5

      6241b03d68a610324ecda52f0f84e287

      SHA1

      da80280b6e3925e455925efd6c6e59a6118269c4

      SHA256

      ec74de9416b8ef2c3bdb1a9835e54548b3185524210d1aeffa91c98f74f751e2

      SHA512

      a60fe447cb0bed8e6cbd7c344b19a4602553209cbda7a40993f0fdf01e096bda4b79de0b528ecebf2efa0007f81d7bd6c7ef84252b2a160c93d642a78f0095f9

    • \Users\Admin\AppData\Local\Temp\IXP003.TMP\1Vu09tI2.exe

      Filesize

      194KB

      MD5

      6241b03d68a610324ecda52f0f84e287

      SHA1

      da80280b6e3925e455925efd6c6e59a6118269c4

      SHA256

      ec74de9416b8ef2c3bdb1a9835e54548b3185524210d1aeffa91c98f74f751e2

      SHA512

      a60fe447cb0bed8e6cbd7c344b19a4602553209cbda7a40993f0fdf01e096bda4b79de0b528ecebf2efa0007f81d7bd6c7ef84252b2a160c93d642a78f0095f9

    • \Users\Admin\AppData\Local\Temp\IXP003.TMP\2yO7962.exe

      Filesize

      448KB

      MD5

      56cd66f1a3c78995a4d023eb8ce9c3a1

      SHA1

      7f04ff61b511aed1815e9072303fdd9f17b4816c

      SHA256

      7b8d1cb5e8219a890d7b6aa91414c91d1bdaed8f809eb54646a0ef3ed326ff04

      SHA512

      e4ab2f678352ca26436de71540015165e42d7831aab6d903ee15848cd51ee093ca3196664dcf262f52f9a6ffc93370c89f791967308511e7c127abb25cda6279

    • \Users\Admin\AppData\Local\Temp\IXP003.TMP\2yO7962.exe

      Filesize

      448KB

      MD5

      56cd66f1a3c78995a4d023eb8ce9c3a1

      SHA1

      7f04ff61b511aed1815e9072303fdd9f17b4816c

      SHA256

      7b8d1cb5e8219a890d7b6aa91414c91d1bdaed8f809eb54646a0ef3ed326ff04

      SHA512

      e4ab2f678352ca26436de71540015165e42d7831aab6d903ee15848cd51ee093ca3196664dcf262f52f9a6ffc93370c89f791967308511e7c127abb25cda6279

    • \Users\Admin\AppData\Local\Temp\IXP003.TMP\2yO7962.exe

      Filesize

      448KB

      MD5

      56cd66f1a3c78995a4d023eb8ce9c3a1

      SHA1

      7f04ff61b511aed1815e9072303fdd9f17b4816c

      SHA256

      7b8d1cb5e8219a890d7b6aa91414c91d1bdaed8f809eb54646a0ef3ed326ff04

      SHA512

      e4ab2f678352ca26436de71540015165e42d7831aab6d903ee15848cd51ee093ca3196664dcf262f52f9a6ffc93370c89f791967308511e7c127abb25cda6279

    • \Users\Admin\AppData\Local\Temp\IXP003.TMP\2yO7962.exe

      Filesize

      448KB

      MD5

      56cd66f1a3c78995a4d023eb8ce9c3a1

      SHA1

      7f04ff61b511aed1815e9072303fdd9f17b4816c

      SHA256

      7b8d1cb5e8219a890d7b6aa91414c91d1bdaed8f809eb54646a0ef3ed326ff04

      SHA512

      e4ab2f678352ca26436de71540015165e42d7831aab6d903ee15848cd51ee093ca3196664dcf262f52f9a6ffc93370c89f791967308511e7c127abb25cda6279

    • \Users\Admin\AppData\Local\Temp\IXP003.TMP\2yO7962.exe

      Filesize

      448KB

      MD5

      56cd66f1a3c78995a4d023eb8ce9c3a1

      SHA1

      7f04ff61b511aed1815e9072303fdd9f17b4816c

      SHA256

      7b8d1cb5e8219a890d7b6aa91414c91d1bdaed8f809eb54646a0ef3ed326ff04

      SHA512

      e4ab2f678352ca26436de71540015165e42d7831aab6d903ee15848cd51ee093ca3196664dcf262f52f9a6ffc93370c89f791967308511e7c127abb25cda6279

    • \Users\Admin\AppData\Local\Temp\IXP003.TMP\2yO7962.exe

      Filesize

      448KB

      MD5

      56cd66f1a3c78995a4d023eb8ce9c3a1

      SHA1

      7f04ff61b511aed1815e9072303fdd9f17b4816c

      SHA256

      7b8d1cb5e8219a890d7b6aa91414c91d1bdaed8f809eb54646a0ef3ed326ff04

      SHA512

      e4ab2f678352ca26436de71540015165e42d7831aab6d903ee15848cd51ee093ca3196664dcf262f52f9a6ffc93370c89f791967308511e7c127abb25cda6279

    • memory/528-80-0x0000000000400000-0x0000000000433000-memory.dmp

      Filesize

      204KB

    • memory/528-76-0x0000000000400000-0x0000000000433000-memory.dmp

      Filesize

      204KB

    • memory/528-94-0x0000000000400000-0x0000000000433000-memory.dmp

      Filesize

      204KB

    • memory/528-90-0x0000000000400000-0x0000000000433000-memory.dmp

      Filesize

      204KB

    • memory/528-89-0x0000000000400000-0x0000000000433000-memory.dmp

      Filesize

      204KB

    • memory/528-87-0x0000000000400000-0x0000000000433000-memory.dmp

      Filesize

      204KB

    • memory/528-83-0x0000000000400000-0x0000000000433000-memory.dmp

      Filesize

      204KB

    • memory/528-84-0x00000000FFFDE000-0x00000000FFFDF000-memory.dmp

      Filesize

      4KB

    • memory/528-85-0x0000000000400000-0x0000000000433000-memory.dmp

      Filesize

      204KB

    • memory/528-82-0x0000000000400000-0x0000000000433000-memory.dmp

      Filesize

      204KB

    • memory/528-81-0x0000000000400000-0x0000000000433000-memory.dmp

      Filesize

      204KB

    • memory/528-78-0x0000000000400000-0x0000000000433000-memory.dmp

      Filesize

      204KB

    • memory/2700-69-0x0000000000B60000-0x0000000000B76000-memory.dmp

      Filesize

      88KB

    • memory/2700-61-0x0000000000B60000-0x0000000000B76000-memory.dmp

      Filesize

      88KB

    • memory/2700-59-0x0000000000B60000-0x0000000000B76000-memory.dmp

      Filesize

      88KB

    • memory/2700-47-0x0000000000B60000-0x0000000000B76000-memory.dmp

      Filesize

      88KB

    • memory/2700-57-0x0000000000B60000-0x0000000000B76000-memory.dmp

      Filesize

      88KB

    • memory/2700-55-0x0000000000B60000-0x0000000000B76000-memory.dmp

      Filesize

      88KB

    • memory/2700-53-0x0000000000B60000-0x0000000000B76000-memory.dmp

      Filesize

      88KB

    • memory/2700-65-0x0000000000B60000-0x0000000000B76000-memory.dmp

      Filesize

      88KB

    • memory/2700-67-0x0000000000B60000-0x0000000000B76000-memory.dmp

      Filesize

      88KB

    • memory/2700-45-0x0000000000B60000-0x0000000000B76000-memory.dmp

      Filesize

      88KB

    • memory/2700-63-0x0000000000B60000-0x0000000000B76000-memory.dmp

      Filesize

      88KB

    • memory/2700-49-0x0000000000B60000-0x0000000000B76000-memory.dmp

      Filesize

      88KB

    • memory/2700-43-0x0000000000B60000-0x0000000000B76000-memory.dmp

      Filesize

      88KB

    • memory/2700-42-0x0000000000B60000-0x0000000000B76000-memory.dmp

      Filesize

      88KB

    • memory/2700-41-0x0000000000B60000-0x0000000000B7C000-memory.dmp

      Filesize

      112KB

    • memory/2700-51-0x0000000000B60000-0x0000000000B76000-memory.dmp

      Filesize

      88KB

    • memory/2700-40-0x0000000000540000-0x000000000055E000-memory.dmp

      Filesize

      120KB