Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
117s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20230831-en -
resource tags
arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system -
submitted
10/10/2023, 14:37
Static task
static1
Behavioral task
behavioral1
Sample
file.exe
Resource
win7-20230831-en
General
-
Target
file.exe
-
Size
1.2MB
-
MD5
20f095c0bc558207bdc4b54698b2e5ac
-
SHA1
f2e57f74b4069049c6e3a6ef843dc77b3d26babf
-
SHA256
5399e8e6a678d168904df91f25a8564e2d65374bb806673b7461efc136398bdf
-
SHA512
b6998019c5c8e9e7692611d980c43f997fd3e8cc0c28de146aa9d46a2562c64d05054a3621910eb7f7892c80b3b0a8c9edcf7c9ee183b74d217daf554708c53c
-
SSDEEP
24576:ZyKV5zUpZvKEmcH2nCaDyTbYyK5gMJmiG/ViP37bRTORkZrGPEKBX+ujD+X:MK/81KEtH2FOi/IUPrNTNZmuC
Malware Config
Signatures
-
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" 1Vu09tI2.exe Key created \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection 1Vu09tI2.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" 1Vu09tI2.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" 1Vu09tI2.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" 1Vu09tI2.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" 1Vu09tI2.exe -
Executes dropped EXE 5 IoCs
pid Process 2512 ib5yf10.exe 2704 Qz8uZ93.exe 2780 De5sz79.exe 2700 1Vu09tI2.exe 320 2yO7962.exe -
Loads dropped DLL 14 IoCs
pid Process 2208 file.exe 2512 ib5yf10.exe 2512 ib5yf10.exe 2704 Qz8uZ93.exe 2704 Qz8uZ93.exe 2780 De5sz79.exe 2780 De5sz79.exe 2700 1Vu09tI2.exe 2780 De5sz79.exe 320 2yO7962.exe 928 WerFault.exe 928 WerFault.exe 928 WerFault.exe 928 WerFault.exe -
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Features 1Vu09tI2.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0" 1Vu09tI2.exe -
Adds Run key to start application 2 TTPs 4 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" file.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" ib5yf10.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\"" Qz8uZ93.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup3 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP003.TMP\\\"" De5sz79.exe -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 320 set thread context of 528 320 2yO7962.exe 33 -
Program crash 1 IoCs
pid pid_target Process procid_target 928 320 WerFault.exe 32 -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 2700 1Vu09tI2.exe 2700 1Vu09tI2.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 2700 1Vu09tI2.exe -
Suspicious use of WriteProcessMemory 56 IoCs
description pid Process procid_target PID 2208 wrote to memory of 2512 2208 file.exe 28 PID 2208 wrote to memory of 2512 2208 file.exe 28 PID 2208 wrote to memory of 2512 2208 file.exe 28 PID 2208 wrote to memory of 2512 2208 file.exe 28 PID 2208 wrote to memory of 2512 2208 file.exe 28 PID 2208 wrote to memory of 2512 2208 file.exe 28 PID 2208 wrote to memory of 2512 2208 file.exe 28 PID 2512 wrote to memory of 2704 2512 ib5yf10.exe 29 PID 2512 wrote to memory of 2704 2512 ib5yf10.exe 29 PID 2512 wrote to memory of 2704 2512 ib5yf10.exe 29 PID 2512 wrote to memory of 2704 2512 ib5yf10.exe 29 PID 2512 wrote to memory of 2704 2512 ib5yf10.exe 29 PID 2512 wrote to memory of 2704 2512 ib5yf10.exe 29 PID 2512 wrote to memory of 2704 2512 ib5yf10.exe 29 PID 2704 wrote to memory of 2780 2704 Qz8uZ93.exe 30 PID 2704 wrote to memory of 2780 2704 Qz8uZ93.exe 30 PID 2704 wrote to memory of 2780 2704 Qz8uZ93.exe 30 PID 2704 wrote to memory of 2780 2704 Qz8uZ93.exe 30 PID 2704 wrote to memory of 2780 2704 Qz8uZ93.exe 30 PID 2704 wrote to memory of 2780 2704 Qz8uZ93.exe 30 PID 2704 wrote to memory of 2780 2704 Qz8uZ93.exe 30 PID 2780 wrote to memory of 2700 2780 De5sz79.exe 31 PID 2780 wrote to memory of 2700 2780 De5sz79.exe 31 PID 2780 wrote to memory of 2700 2780 De5sz79.exe 31 PID 2780 wrote to memory of 2700 2780 De5sz79.exe 31 PID 2780 wrote to memory of 2700 2780 De5sz79.exe 31 PID 2780 wrote to memory of 2700 2780 De5sz79.exe 31 PID 2780 wrote to memory of 2700 2780 De5sz79.exe 31 PID 2780 wrote to memory of 320 2780 De5sz79.exe 32 PID 2780 wrote to memory of 320 2780 De5sz79.exe 32 PID 2780 wrote to memory of 320 2780 De5sz79.exe 32 PID 2780 wrote to memory of 320 2780 De5sz79.exe 32 PID 2780 wrote to memory of 320 2780 De5sz79.exe 32 PID 2780 wrote to memory of 320 2780 De5sz79.exe 32 PID 2780 wrote to memory of 320 2780 De5sz79.exe 32 PID 320 wrote to memory of 528 320 2yO7962.exe 33 PID 320 wrote to memory of 528 320 2yO7962.exe 33 PID 320 wrote to memory of 528 320 2yO7962.exe 33 PID 320 wrote to memory of 528 320 2yO7962.exe 33 PID 320 wrote to memory of 528 320 2yO7962.exe 33 PID 320 wrote to memory of 528 320 2yO7962.exe 33 PID 320 wrote to memory of 528 320 2yO7962.exe 33 PID 320 wrote to memory of 528 320 2yO7962.exe 33 PID 320 wrote to memory of 528 320 2yO7962.exe 33 PID 320 wrote to memory of 528 320 2yO7962.exe 33 PID 320 wrote to memory of 528 320 2yO7962.exe 33 PID 320 wrote to memory of 528 320 2yO7962.exe 33 PID 320 wrote to memory of 528 320 2yO7962.exe 33 PID 320 wrote to memory of 528 320 2yO7962.exe 33 PID 320 wrote to memory of 928 320 2yO7962.exe 34 PID 320 wrote to memory of 928 320 2yO7962.exe 34 PID 320 wrote to memory of 928 320 2yO7962.exe 34 PID 320 wrote to memory of 928 320 2yO7962.exe 34 PID 320 wrote to memory of 928 320 2yO7962.exe 34 PID 320 wrote to memory of 928 320 2yO7962.exe 34 PID 320 wrote to memory of 928 320 2yO7962.exe 34
Processes
-
C:\Users\Admin\AppData\Local\Temp\file.exe"C:\Users\Admin\AppData\Local\Temp\file.exe"1⤵
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:2208 -
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ib5yf10.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ib5yf10.exe2⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:2512 -
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\Qz8uZ93.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\Qz8uZ93.exe3⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:2704 -
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\De5sz79.exeC:\Users\Admin\AppData\Local\Temp\IXP002.TMP\De5sz79.exe4⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:2780 -
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\1Vu09tI2.exeC:\Users\Admin\AppData\Local\Temp\IXP003.TMP\1Vu09tI2.exe5⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Loads dropped DLL
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2700
-
-
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\2yO7962.exeC:\Users\Admin\AppData\Local\Temp\IXP003.TMP\2yO7962.exe5⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:320 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"6⤵PID:528
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 320 -s 2846⤵
- Loads dropped DLL
- Program crash
PID:928
-
-
-
-
-
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.0MB
MD512daf0738431ec28bf0b3c14a6c5bb15
SHA1189b854ae1dac9aae9158392a9bb494be931908c
SHA2561dd4b0a2486b968c8eda5c225b462a9062a10016e8ef9602fb599fc5d363fe43
SHA5123a004206faa8c602564ca8c6dea8b8e3e01a97cbba0d054c2d2f0c4d825b50fd4bae48cd2793cfa09a023edf3f409eac2866925a6f48e20e7097bf29508d630f
-
Filesize
1.0MB
MD512daf0738431ec28bf0b3c14a6c5bb15
SHA1189b854ae1dac9aae9158392a9bb494be931908c
SHA2561dd4b0a2486b968c8eda5c225b462a9062a10016e8ef9602fb599fc5d363fe43
SHA5123a004206faa8c602564ca8c6dea8b8e3e01a97cbba0d054c2d2f0c4d825b50fd4bae48cd2793cfa09a023edf3f409eac2866925a6f48e20e7097bf29508d630f
-
Filesize
746KB
MD501ae5c825521735198787d418917ea13
SHA1780f707f86d5450e6f9e559541a49cd63049bebb
SHA2562f568a194fdd45ab429e068921f190a6a0020b91492aa56602d768405aa27bcb
SHA512f2bfc7d9b6924d2aee5a3bcd4fd89c636c0bd26a49c36a6f0caa338d37fa6e087cad3b42ba2218d82a64f744ac116c50fcf989fc3a6ab7cba2ef1f9045da801a
-
Filesize
746KB
MD501ae5c825521735198787d418917ea13
SHA1780f707f86d5450e6f9e559541a49cd63049bebb
SHA2562f568a194fdd45ab429e068921f190a6a0020b91492aa56602d768405aa27bcb
SHA512f2bfc7d9b6924d2aee5a3bcd4fd89c636c0bd26a49c36a6f0caa338d37fa6e087cad3b42ba2218d82a64f744ac116c50fcf989fc3a6ab7cba2ef1f9045da801a
-
Filesize
494KB
MD5c5c97e3c67f31a0022840fc249b7a24c
SHA1a3f4ccf389ba66d0a951c12e6cce3d37feec173e
SHA25696cd25869cefef1723035cf40189a831e6c4c9b03d63501941389a72a70b6f0f
SHA512bd3ae1641033d10cf0d3e12e3572f9bce08f0514a08e1de5999fc4a1617c4d1a8b480a54f41587ffab511f1a9ef10fb27836aadb5bc73a83f024bfd9b22b132c
-
Filesize
494KB
MD5c5c97e3c67f31a0022840fc249b7a24c
SHA1a3f4ccf389ba66d0a951c12e6cce3d37feec173e
SHA25696cd25869cefef1723035cf40189a831e6c4c9b03d63501941389a72a70b6f0f
SHA512bd3ae1641033d10cf0d3e12e3572f9bce08f0514a08e1de5999fc4a1617c4d1a8b480a54f41587ffab511f1a9ef10fb27836aadb5bc73a83f024bfd9b22b132c
-
Filesize
194KB
MD56241b03d68a610324ecda52f0f84e287
SHA1da80280b6e3925e455925efd6c6e59a6118269c4
SHA256ec74de9416b8ef2c3bdb1a9835e54548b3185524210d1aeffa91c98f74f751e2
SHA512a60fe447cb0bed8e6cbd7c344b19a4602553209cbda7a40993f0fdf01e096bda4b79de0b528ecebf2efa0007f81d7bd6c7ef84252b2a160c93d642a78f0095f9
-
Filesize
194KB
MD56241b03d68a610324ecda52f0f84e287
SHA1da80280b6e3925e455925efd6c6e59a6118269c4
SHA256ec74de9416b8ef2c3bdb1a9835e54548b3185524210d1aeffa91c98f74f751e2
SHA512a60fe447cb0bed8e6cbd7c344b19a4602553209cbda7a40993f0fdf01e096bda4b79de0b528ecebf2efa0007f81d7bd6c7ef84252b2a160c93d642a78f0095f9
-
Filesize
448KB
MD556cd66f1a3c78995a4d023eb8ce9c3a1
SHA17f04ff61b511aed1815e9072303fdd9f17b4816c
SHA2567b8d1cb5e8219a890d7b6aa91414c91d1bdaed8f809eb54646a0ef3ed326ff04
SHA512e4ab2f678352ca26436de71540015165e42d7831aab6d903ee15848cd51ee093ca3196664dcf262f52f9a6ffc93370c89f791967308511e7c127abb25cda6279
-
Filesize
448KB
MD556cd66f1a3c78995a4d023eb8ce9c3a1
SHA17f04ff61b511aed1815e9072303fdd9f17b4816c
SHA2567b8d1cb5e8219a890d7b6aa91414c91d1bdaed8f809eb54646a0ef3ed326ff04
SHA512e4ab2f678352ca26436de71540015165e42d7831aab6d903ee15848cd51ee093ca3196664dcf262f52f9a6ffc93370c89f791967308511e7c127abb25cda6279
-
Filesize
1.0MB
MD512daf0738431ec28bf0b3c14a6c5bb15
SHA1189b854ae1dac9aae9158392a9bb494be931908c
SHA2561dd4b0a2486b968c8eda5c225b462a9062a10016e8ef9602fb599fc5d363fe43
SHA5123a004206faa8c602564ca8c6dea8b8e3e01a97cbba0d054c2d2f0c4d825b50fd4bae48cd2793cfa09a023edf3f409eac2866925a6f48e20e7097bf29508d630f
-
Filesize
1.0MB
MD512daf0738431ec28bf0b3c14a6c5bb15
SHA1189b854ae1dac9aae9158392a9bb494be931908c
SHA2561dd4b0a2486b968c8eda5c225b462a9062a10016e8ef9602fb599fc5d363fe43
SHA5123a004206faa8c602564ca8c6dea8b8e3e01a97cbba0d054c2d2f0c4d825b50fd4bae48cd2793cfa09a023edf3f409eac2866925a6f48e20e7097bf29508d630f
-
Filesize
746KB
MD501ae5c825521735198787d418917ea13
SHA1780f707f86d5450e6f9e559541a49cd63049bebb
SHA2562f568a194fdd45ab429e068921f190a6a0020b91492aa56602d768405aa27bcb
SHA512f2bfc7d9b6924d2aee5a3bcd4fd89c636c0bd26a49c36a6f0caa338d37fa6e087cad3b42ba2218d82a64f744ac116c50fcf989fc3a6ab7cba2ef1f9045da801a
-
Filesize
746KB
MD501ae5c825521735198787d418917ea13
SHA1780f707f86d5450e6f9e559541a49cd63049bebb
SHA2562f568a194fdd45ab429e068921f190a6a0020b91492aa56602d768405aa27bcb
SHA512f2bfc7d9b6924d2aee5a3bcd4fd89c636c0bd26a49c36a6f0caa338d37fa6e087cad3b42ba2218d82a64f744ac116c50fcf989fc3a6ab7cba2ef1f9045da801a
-
Filesize
494KB
MD5c5c97e3c67f31a0022840fc249b7a24c
SHA1a3f4ccf389ba66d0a951c12e6cce3d37feec173e
SHA25696cd25869cefef1723035cf40189a831e6c4c9b03d63501941389a72a70b6f0f
SHA512bd3ae1641033d10cf0d3e12e3572f9bce08f0514a08e1de5999fc4a1617c4d1a8b480a54f41587ffab511f1a9ef10fb27836aadb5bc73a83f024bfd9b22b132c
-
Filesize
494KB
MD5c5c97e3c67f31a0022840fc249b7a24c
SHA1a3f4ccf389ba66d0a951c12e6cce3d37feec173e
SHA25696cd25869cefef1723035cf40189a831e6c4c9b03d63501941389a72a70b6f0f
SHA512bd3ae1641033d10cf0d3e12e3572f9bce08f0514a08e1de5999fc4a1617c4d1a8b480a54f41587ffab511f1a9ef10fb27836aadb5bc73a83f024bfd9b22b132c
-
Filesize
194KB
MD56241b03d68a610324ecda52f0f84e287
SHA1da80280b6e3925e455925efd6c6e59a6118269c4
SHA256ec74de9416b8ef2c3bdb1a9835e54548b3185524210d1aeffa91c98f74f751e2
SHA512a60fe447cb0bed8e6cbd7c344b19a4602553209cbda7a40993f0fdf01e096bda4b79de0b528ecebf2efa0007f81d7bd6c7ef84252b2a160c93d642a78f0095f9
-
Filesize
194KB
MD56241b03d68a610324ecda52f0f84e287
SHA1da80280b6e3925e455925efd6c6e59a6118269c4
SHA256ec74de9416b8ef2c3bdb1a9835e54548b3185524210d1aeffa91c98f74f751e2
SHA512a60fe447cb0bed8e6cbd7c344b19a4602553209cbda7a40993f0fdf01e096bda4b79de0b528ecebf2efa0007f81d7bd6c7ef84252b2a160c93d642a78f0095f9
-
Filesize
448KB
MD556cd66f1a3c78995a4d023eb8ce9c3a1
SHA17f04ff61b511aed1815e9072303fdd9f17b4816c
SHA2567b8d1cb5e8219a890d7b6aa91414c91d1bdaed8f809eb54646a0ef3ed326ff04
SHA512e4ab2f678352ca26436de71540015165e42d7831aab6d903ee15848cd51ee093ca3196664dcf262f52f9a6ffc93370c89f791967308511e7c127abb25cda6279
-
Filesize
448KB
MD556cd66f1a3c78995a4d023eb8ce9c3a1
SHA17f04ff61b511aed1815e9072303fdd9f17b4816c
SHA2567b8d1cb5e8219a890d7b6aa91414c91d1bdaed8f809eb54646a0ef3ed326ff04
SHA512e4ab2f678352ca26436de71540015165e42d7831aab6d903ee15848cd51ee093ca3196664dcf262f52f9a6ffc93370c89f791967308511e7c127abb25cda6279
-
Filesize
448KB
MD556cd66f1a3c78995a4d023eb8ce9c3a1
SHA17f04ff61b511aed1815e9072303fdd9f17b4816c
SHA2567b8d1cb5e8219a890d7b6aa91414c91d1bdaed8f809eb54646a0ef3ed326ff04
SHA512e4ab2f678352ca26436de71540015165e42d7831aab6d903ee15848cd51ee093ca3196664dcf262f52f9a6ffc93370c89f791967308511e7c127abb25cda6279
-
Filesize
448KB
MD556cd66f1a3c78995a4d023eb8ce9c3a1
SHA17f04ff61b511aed1815e9072303fdd9f17b4816c
SHA2567b8d1cb5e8219a890d7b6aa91414c91d1bdaed8f809eb54646a0ef3ed326ff04
SHA512e4ab2f678352ca26436de71540015165e42d7831aab6d903ee15848cd51ee093ca3196664dcf262f52f9a6ffc93370c89f791967308511e7c127abb25cda6279
-
Filesize
448KB
MD556cd66f1a3c78995a4d023eb8ce9c3a1
SHA17f04ff61b511aed1815e9072303fdd9f17b4816c
SHA2567b8d1cb5e8219a890d7b6aa91414c91d1bdaed8f809eb54646a0ef3ed326ff04
SHA512e4ab2f678352ca26436de71540015165e42d7831aab6d903ee15848cd51ee093ca3196664dcf262f52f9a6ffc93370c89f791967308511e7c127abb25cda6279
-
Filesize
448KB
MD556cd66f1a3c78995a4d023eb8ce9c3a1
SHA17f04ff61b511aed1815e9072303fdd9f17b4816c
SHA2567b8d1cb5e8219a890d7b6aa91414c91d1bdaed8f809eb54646a0ef3ed326ff04
SHA512e4ab2f678352ca26436de71540015165e42d7831aab6d903ee15848cd51ee093ca3196664dcf262f52f9a6ffc93370c89f791967308511e7c127abb25cda6279