Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    118s
  • max time network
    121s
  • platform
    windows7_x64
  • resource
    win7-20230831-en
  • resource tags

    arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
  • submitted
    10/10/2023, 15:27

General

  • Target

    file.exe

  • Size

    1.2MB

  • MD5

    897127dfac0886c0274052ab24d9918d

  • SHA1

    8efc1d474978f286e331ed09556b713783fbef35

  • SHA256

    dff5fed9379297704bd5d47f41f95b6d6ec9771e7515218e5f2364701d5b1d06

  • SHA512

    3d0d639b00bfa7ccd96fb5b7e9099625a3d4d95bef88c832cba73dbea4efd783cd5f77ca31a24687221e75678fc008c33c798fc3d714a9a1e85f90478d084565

  • SSDEEP

    24576:2yRz1MwMjbeAdaebjsRRHJVyyGE7K+Z3ev:FRmlanDh7Kg3e

Malware Config

Signatures

  • Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs
  • Executes dropped EXE 5 IoCs
  • Loads dropped DLL 14 IoCs
  • Windows security modification 2 TTPs 2 IoCs
  • Adds Run key to start application 2 TTPs 4 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Program crash 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 63 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\file.exe
    "C:\Users\Admin\AppData\Local\Temp\file.exe"
    1⤵
    • Loads dropped DLL
    • Adds Run key to start application
    • Suspicious use of WriteProcessMemory
    PID:3028
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Sa0TB12.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Sa0TB12.exe
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Adds Run key to start application
      • Suspicious use of WriteProcessMemory
      PID:2988
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\ne3CY89.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\ne3CY89.exe
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Adds Run key to start application
        • Suspicious use of WriteProcessMemory
        PID:3040
        • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\EA8Hc99.exe
          C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\EA8Hc99.exe
          4⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • Adds Run key to start application
          • Suspicious use of WriteProcessMemory
          PID:2768
          • C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\1CB53aS4.exe
            C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\1CB53aS4.exe
            5⤵
            • Modifies Windows Defender Real-time Protection settings
            • Executes dropped EXE
            • Loads dropped DLL
            • Windows security modification
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:2772
          • C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\2Os9816.exe
            C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\2Os9816.exe
            5⤵
            • Executes dropped EXE
            • Loads dropped DLL
            • Suspicious use of SetThreadContext
            • Suspicious use of WriteProcessMemory
            PID:2964
            • C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
              "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
              6⤵
              • Suspicious use of WriteProcessMemory
              PID:2480
              • C:\Windows\SysWOW64\WerFault.exe
                C:\Windows\SysWOW64\WerFault.exe -u -p 2480 -s 268
                7⤵
                • Program crash
                PID:2980
            • C:\Windows\SysWOW64\WerFault.exe
              C:\Windows\SysWOW64\WerFault.exe -u -p 2964 -s 284
              6⤵
              • Loads dropped DLL
              • Program crash
              PID:2868

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Sa0TB12.exe

    Filesize

    1.0MB

    MD5

    fcde004e171c9f21e3c2e1a6083c3cb9

    SHA1

    d8a767a332bd9d5a6025860ab196cb5ae296b439

    SHA256

    6e77b6545643a6a7dd55846d92b678842e877cee98128dfa4f7207083b97f746

    SHA512

    b4973b8783a80010cdc0d06093d7045ce20f361f25f22dfe3b53cd0f5d830428eec2acc807a54c9792ad67478ec9a4ad2cf59742a0ed3f76d5c27e46dc91f074

  • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Sa0TB12.exe

    Filesize

    1.0MB

    MD5

    fcde004e171c9f21e3c2e1a6083c3cb9

    SHA1

    d8a767a332bd9d5a6025860ab196cb5ae296b439

    SHA256

    6e77b6545643a6a7dd55846d92b678842e877cee98128dfa4f7207083b97f746

    SHA512

    b4973b8783a80010cdc0d06093d7045ce20f361f25f22dfe3b53cd0f5d830428eec2acc807a54c9792ad67478ec9a4ad2cf59742a0ed3f76d5c27e46dc91f074

  • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\ne3CY89.exe

    Filesize

    748KB

    MD5

    3d614d40581481da30827fda66cb0dee

    SHA1

    a0e16a8ae869023c523c91a63585bd1bfc80ac11

    SHA256

    b828067f67649c65abced0741da16d56cea720d6696447ede84e5a3ff962f0fd

    SHA512

    4217ab19221e7b082a66633f0747ec66dd015a7da316466327d04383a64ef09d9542f249693aba4a27c8f7255ec1a2d273c1f81f686a362ac27d62e64e31f05d

  • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\ne3CY89.exe

    Filesize

    748KB

    MD5

    3d614d40581481da30827fda66cb0dee

    SHA1

    a0e16a8ae869023c523c91a63585bd1bfc80ac11

    SHA256

    b828067f67649c65abced0741da16d56cea720d6696447ede84e5a3ff962f0fd

    SHA512

    4217ab19221e7b082a66633f0747ec66dd015a7da316466327d04383a64ef09d9542f249693aba4a27c8f7255ec1a2d273c1f81f686a362ac27d62e64e31f05d

  • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\EA8Hc99.exe

    Filesize

    494KB

    MD5

    e5fd1ba85fd42c0864aa0903cde2eda0

    SHA1

    71d90c6296c7f36fb9ef3d9a3156d9446789b39b

    SHA256

    fad424b3fecaaf1ac24897784c205ef2d8cfc1292d5fc0e2b2e70b1fc9f233ab

    SHA512

    38ab7ac43ecba566e8376de75afe21608c04bc4bce1876caef4d3bed2dde0e00911a9d789a7ad558a523130429df0b09ab8323c24699bfb34d044db057cb1349

  • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\EA8Hc99.exe

    Filesize

    494KB

    MD5

    e5fd1ba85fd42c0864aa0903cde2eda0

    SHA1

    71d90c6296c7f36fb9ef3d9a3156d9446789b39b

    SHA256

    fad424b3fecaaf1ac24897784c205ef2d8cfc1292d5fc0e2b2e70b1fc9f233ab

    SHA512

    38ab7ac43ecba566e8376de75afe21608c04bc4bce1876caef4d3bed2dde0e00911a9d789a7ad558a523130429df0b09ab8323c24699bfb34d044db057cb1349

  • C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\1CB53aS4.exe

    Filesize

    194KB

    MD5

    6241b03d68a610324ecda52f0f84e287

    SHA1

    da80280b6e3925e455925efd6c6e59a6118269c4

    SHA256

    ec74de9416b8ef2c3bdb1a9835e54548b3185524210d1aeffa91c98f74f751e2

    SHA512

    a60fe447cb0bed8e6cbd7c344b19a4602553209cbda7a40993f0fdf01e096bda4b79de0b528ecebf2efa0007f81d7bd6c7ef84252b2a160c93d642a78f0095f9

  • C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\1CB53aS4.exe

    Filesize

    194KB

    MD5

    6241b03d68a610324ecda52f0f84e287

    SHA1

    da80280b6e3925e455925efd6c6e59a6118269c4

    SHA256

    ec74de9416b8ef2c3bdb1a9835e54548b3185524210d1aeffa91c98f74f751e2

    SHA512

    a60fe447cb0bed8e6cbd7c344b19a4602553209cbda7a40993f0fdf01e096bda4b79de0b528ecebf2efa0007f81d7bd6c7ef84252b2a160c93d642a78f0095f9

  • C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\2Os9816.exe

    Filesize

    449KB

    MD5

    1151e536087b41cdce4fbc427722d724

    SHA1

    c71342303d3b942f70631bc7ec66ccb9f9d2c393

    SHA256

    924a842bcc96ce934cbe356a817c079114af549fa578259e49934cd0bd1a4253

    SHA512

    af6e8002a3b8661bcd43dd95751332545d200179089558a478697c70ae2cbdb99e9624a3d59e2318468a8f9f44f9ac597aaaf56895e5bd68dd8db1af9c229b51

  • C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\2Os9816.exe

    Filesize

    449KB

    MD5

    1151e536087b41cdce4fbc427722d724

    SHA1

    c71342303d3b942f70631bc7ec66ccb9f9d2c393

    SHA256

    924a842bcc96ce934cbe356a817c079114af549fa578259e49934cd0bd1a4253

    SHA512

    af6e8002a3b8661bcd43dd95751332545d200179089558a478697c70ae2cbdb99e9624a3d59e2318468a8f9f44f9ac597aaaf56895e5bd68dd8db1af9c229b51

  • \Users\Admin\AppData\Local\Temp\IXP000.TMP\Sa0TB12.exe

    Filesize

    1.0MB

    MD5

    fcde004e171c9f21e3c2e1a6083c3cb9

    SHA1

    d8a767a332bd9d5a6025860ab196cb5ae296b439

    SHA256

    6e77b6545643a6a7dd55846d92b678842e877cee98128dfa4f7207083b97f746

    SHA512

    b4973b8783a80010cdc0d06093d7045ce20f361f25f22dfe3b53cd0f5d830428eec2acc807a54c9792ad67478ec9a4ad2cf59742a0ed3f76d5c27e46dc91f074

  • \Users\Admin\AppData\Local\Temp\IXP000.TMP\Sa0TB12.exe

    Filesize

    1.0MB

    MD5

    fcde004e171c9f21e3c2e1a6083c3cb9

    SHA1

    d8a767a332bd9d5a6025860ab196cb5ae296b439

    SHA256

    6e77b6545643a6a7dd55846d92b678842e877cee98128dfa4f7207083b97f746

    SHA512

    b4973b8783a80010cdc0d06093d7045ce20f361f25f22dfe3b53cd0f5d830428eec2acc807a54c9792ad67478ec9a4ad2cf59742a0ed3f76d5c27e46dc91f074

  • \Users\Admin\AppData\Local\Temp\IXP001.TMP\ne3CY89.exe

    Filesize

    748KB

    MD5

    3d614d40581481da30827fda66cb0dee

    SHA1

    a0e16a8ae869023c523c91a63585bd1bfc80ac11

    SHA256

    b828067f67649c65abced0741da16d56cea720d6696447ede84e5a3ff962f0fd

    SHA512

    4217ab19221e7b082a66633f0747ec66dd015a7da316466327d04383a64ef09d9542f249693aba4a27c8f7255ec1a2d273c1f81f686a362ac27d62e64e31f05d

  • \Users\Admin\AppData\Local\Temp\IXP001.TMP\ne3CY89.exe

    Filesize

    748KB

    MD5

    3d614d40581481da30827fda66cb0dee

    SHA1

    a0e16a8ae869023c523c91a63585bd1bfc80ac11

    SHA256

    b828067f67649c65abced0741da16d56cea720d6696447ede84e5a3ff962f0fd

    SHA512

    4217ab19221e7b082a66633f0747ec66dd015a7da316466327d04383a64ef09d9542f249693aba4a27c8f7255ec1a2d273c1f81f686a362ac27d62e64e31f05d

  • \Users\Admin\AppData\Local\Temp\IXP002.TMP\EA8Hc99.exe

    Filesize

    494KB

    MD5

    e5fd1ba85fd42c0864aa0903cde2eda0

    SHA1

    71d90c6296c7f36fb9ef3d9a3156d9446789b39b

    SHA256

    fad424b3fecaaf1ac24897784c205ef2d8cfc1292d5fc0e2b2e70b1fc9f233ab

    SHA512

    38ab7ac43ecba566e8376de75afe21608c04bc4bce1876caef4d3bed2dde0e00911a9d789a7ad558a523130429df0b09ab8323c24699bfb34d044db057cb1349

  • \Users\Admin\AppData\Local\Temp\IXP002.TMP\EA8Hc99.exe

    Filesize

    494KB

    MD5

    e5fd1ba85fd42c0864aa0903cde2eda0

    SHA1

    71d90c6296c7f36fb9ef3d9a3156d9446789b39b

    SHA256

    fad424b3fecaaf1ac24897784c205ef2d8cfc1292d5fc0e2b2e70b1fc9f233ab

    SHA512

    38ab7ac43ecba566e8376de75afe21608c04bc4bce1876caef4d3bed2dde0e00911a9d789a7ad558a523130429df0b09ab8323c24699bfb34d044db057cb1349

  • \Users\Admin\AppData\Local\Temp\IXP003.TMP\1CB53aS4.exe

    Filesize

    194KB

    MD5

    6241b03d68a610324ecda52f0f84e287

    SHA1

    da80280b6e3925e455925efd6c6e59a6118269c4

    SHA256

    ec74de9416b8ef2c3bdb1a9835e54548b3185524210d1aeffa91c98f74f751e2

    SHA512

    a60fe447cb0bed8e6cbd7c344b19a4602553209cbda7a40993f0fdf01e096bda4b79de0b528ecebf2efa0007f81d7bd6c7ef84252b2a160c93d642a78f0095f9

  • \Users\Admin\AppData\Local\Temp\IXP003.TMP\1CB53aS4.exe

    Filesize

    194KB

    MD5

    6241b03d68a610324ecda52f0f84e287

    SHA1

    da80280b6e3925e455925efd6c6e59a6118269c4

    SHA256

    ec74de9416b8ef2c3bdb1a9835e54548b3185524210d1aeffa91c98f74f751e2

    SHA512

    a60fe447cb0bed8e6cbd7c344b19a4602553209cbda7a40993f0fdf01e096bda4b79de0b528ecebf2efa0007f81d7bd6c7ef84252b2a160c93d642a78f0095f9

  • \Users\Admin\AppData\Local\Temp\IXP003.TMP\2Os9816.exe

    Filesize

    449KB

    MD5

    1151e536087b41cdce4fbc427722d724

    SHA1

    c71342303d3b942f70631bc7ec66ccb9f9d2c393

    SHA256

    924a842bcc96ce934cbe356a817c079114af549fa578259e49934cd0bd1a4253

    SHA512

    af6e8002a3b8661bcd43dd95751332545d200179089558a478697c70ae2cbdb99e9624a3d59e2318468a8f9f44f9ac597aaaf56895e5bd68dd8db1af9c229b51

  • \Users\Admin\AppData\Local\Temp\IXP003.TMP\2Os9816.exe

    Filesize

    449KB

    MD5

    1151e536087b41cdce4fbc427722d724

    SHA1

    c71342303d3b942f70631bc7ec66ccb9f9d2c393

    SHA256

    924a842bcc96ce934cbe356a817c079114af549fa578259e49934cd0bd1a4253

    SHA512

    af6e8002a3b8661bcd43dd95751332545d200179089558a478697c70ae2cbdb99e9624a3d59e2318468a8f9f44f9ac597aaaf56895e5bd68dd8db1af9c229b51

  • \Users\Admin\AppData\Local\Temp\IXP003.TMP\2Os9816.exe

    Filesize

    449KB

    MD5

    1151e536087b41cdce4fbc427722d724

    SHA1

    c71342303d3b942f70631bc7ec66ccb9f9d2c393

    SHA256

    924a842bcc96ce934cbe356a817c079114af549fa578259e49934cd0bd1a4253

    SHA512

    af6e8002a3b8661bcd43dd95751332545d200179089558a478697c70ae2cbdb99e9624a3d59e2318468a8f9f44f9ac597aaaf56895e5bd68dd8db1af9c229b51

  • \Users\Admin\AppData\Local\Temp\IXP003.TMP\2Os9816.exe

    Filesize

    449KB

    MD5

    1151e536087b41cdce4fbc427722d724

    SHA1

    c71342303d3b942f70631bc7ec66ccb9f9d2c393

    SHA256

    924a842bcc96ce934cbe356a817c079114af549fa578259e49934cd0bd1a4253

    SHA512

    af6e8002a3b8661bcd43dd95751332545d200179089558a478697c70ae2cbdb99e9624a3d59e2318468a8f9f44f9ac597aaaf56895e5bd68dd8db1af9c229b51

  • \Users\Admin\AppData\Local\Temp\IXP003.TMP\2Os9816.exe

    Filesize

    449KB

    MD5

    1151e536087b41cdce4fbc427722d724

    SHA1

    c71342303d3b942f70631bc7ec66ccb9f9d2c393

    SHA256

    924a842bcc96ce934cbe356a817c079114af549fa578259e49934cd0bd1a4253

    SHA512

    af6e8002a3b8661bcd43dd95751332545d200179089558a478697c70ae2cbdb99e9624a3d59e2318468a8f9f44f9ac597aaaf56895e5bd68dd8db1af9c229b51

  • \Users\Admin\AppData\Local\Temp\IXP003.TMP\2Os9816.exe

    Filesize

    449KB

    MD5

    1151e536087b41cdce4fbc427722d724

    SHA1

    c71342303d3b942f70631bc7ec66ccb9f9d2c393

    SHA256

    924a842bcc96ce934cbe356a817c079114af549fa578259e49934cd0bd1a4253

    SHA512

    af6e8002a3b8661bcd43dd95751332545d200179089558a478697c70ae2cbdb99e9624a3d59e2318468a8f9f44f9ac597aaaf56895e5bd68dd8db1af9c229b51

  • memory/2480-89-0x0000000000400000-0x0000000000433000-memory.dmp

    Filesize

    204KB

  • memory/2480-91-0x0000000000400000-0x0000000000433000-memory.dmp

    Filesize

    204KB

  • memory/2480-76-0x0000000000400000-0x0000000000433000-memory.dmp

    Filesize

    204KB

  • memory/2480-87-0x0000000000400000-0x0000000000433000-memory.dmp

    Filesize

    204KB

  • memory/2480-86-0x00000000FFFDE000-0x00000000FFFDF000-memory.dmp

    Filesize

    4KB

  • memory/2480-84-0x0000000000400000-0x0000000000433000-memory.dmp

    Filesize

    204KB

  • memory/2480-82-0x0000000000400000-0x0000000000433000-memory.dmp

    Filesize

    204KB

  • memory/2480-80-0x0000000000400000-0x0000000000433000-memory.dmp

    Filesize

    204KB

  • memory/2480-78-0x0000000000400000-0x0000000000433000-memory.dmp

    Filesize

    204KB

  • memory/2480-77-0x0000000000400000-0x0000000000433000-memory.dmp

    Filesize

    204KB

  • memory/2772-59-0x00000000004D0000-0x00000000004E6000-memory.dmp

    Filesize

    88KB

  • memory/2772-61-0x00000000004D0000-0x00000000004E6000-memory.dmp

    Filesize

    88KB

  • memory/2772-40-0x00000000003E0000-0x00000000003FE000-memory.dmp

    Filesize

    120KB

  • memory/2772-42-0x00000000004D0000-0x00000000004E6000-memory.dmp

    Filesize

    88KB

  • memory/2772-45-0x00000000004D0000-0x00000000004E6000-memory.dmp

    Filesize

    88KB

  • memory/2772-69-0x00000000004D0000-0x00000000004E6000-memory.dmp

    Filesize

    88KB

  • memory/2772-67-0x00000000004D0000-0x00000000004E6000-memory.dmp

    Filesize

    88KB

  • memory/2772-65-0x00000000004D0000-0x00000000004E6000-memory.dmp

    Filesize

    88KB

  • memory/2772-63-0x00000000004D0000-0x00000000004E6000-memory.dmp

    Filesize

    88KB

  • memory/2772-41-0x00000000004D0000-0x00000000004EC000-memory.dmp

    Filesize

    112KB

  • memory/2772-43-0x00000000004D0000-0x00000000004E6000-memory.dmp

    Filesize

    88KB

  • memory/2772-57-0x00000000004D0000-0x00000000004E6000-memory.dmp

    Filesize

    88KB

  • memory/2772-55-0x00000000004D0000-0x00000000004E6000-memory.dmp

    Filesize

    88KB

  • memory/2772-53-0x00000000004D0000-0x00000000004E6000-memory.dmp

    Filesize

    88KB

  • memory/2772-51-0x00000000004D0000-0x00000000004E6000-memory.dmp

    Filesize

    88KB

  • memory/2772-49-0x00000000004D0000-0x00000000004E6000-memory.dmp

    Filesize

    88KB

  • memory/2772-47-0x00000000004D0000-0x00000000004E6000-memory.dmp

    Filesize

    88KB