Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    122s
  • max time network
    129s
  • platform
    windows7_x64
  • resource
    win7-20230831-en
  • resource tags

    arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
  • submitted
    10/10/2023, 17:23

General

  • Target

    27c733286b9140453082d6fe1f316ae606b028e3ca8c955d75ff7e81d1618d9e_JC.exe

  • Size

    1.1MB

  • MD5

    8e6942cb28b58a01f4f56329503f4a1e

  • SHA1

    4ceb07a5c00e12a9d652399403c83bfff3ecc4c2

  • SHA256

    27c733286b9140453082d6fe1f316ae606b028e3ca8c955d75ff7e81d1618d9e

  • SHA512

    4890cdf73bfb40fd20bac3dbb7f736950ec4f590aff68ded402f380536bbd1611ba2dbdf2ee1f36827b6cf3adc8615a858468e1e3a00dfec9b12da0fbec8eecd

  • SSDEEP

    24576:jyVEpnvTKBMwdOPCU6h9En4GYKzmufht1/gMij:2OhmBMwdOz6h9EtYE1/7

Malware Config

Signatures

  • Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs
  • Executes dropped EXE 5 IoCs
  • Loads dropped DLL 15 IoCs
  • Windows security modification 2 TTPs 2 IoCs
  • Adds Run key to start application 2 TTPs 4 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Program crash 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 56 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\27c733286b9140453082d6fe1f316ae606b028e3ca8c955d75ff7e81d1618d9e_JC.exe
    "C:\Users\Admin\AppData\Local\Temp\27c733286b9140453082d6fe1f316ae606b028e3ca8c955d75ff7e81d1618d9e_JC.exe"
    1⤵
    • Loads dropped DLL
    • Adds Run key to start application
    • Suspicious use of WriteProcessMemory
    PID:1952
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Hu7Np02.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Hu7Np02.exe
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Adds Run key to start application
      • Suspicious use of WriteProcessMemory
      PID:1748
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\ii3CA20.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\ii3CA20.exe
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Adds Run key to start application
        • Suspicious use of WriteProcessMemory
        PID:2364
        • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\ab4KD68.exe
          C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\ab4KD68.exe
          4⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • Adds Run key to start application
          • Suspicious use of WriteProcessMemory
          PID:2736
          • C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\1xl47CY7.exe
            C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\1xl47CY7.exe
            5⤵
            • Modifies Windows Defender Real-time Protection settings
            • Executes dropped EXE
            • Loads dropped DLL
            • Windows security modification
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:2908
          • C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\2UX9827.exe
            C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\2UX9827.exe
            5⤵
            • Executes dropped EXE
            • Loads dropped DLL
            • Suspicious use of SetThreadContext
            • Suspicious use of WriteProcessMemory
            PID:2568
            • C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
              "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
              6⤵
                PID:2980
              • C:\Windows\SysWOW64\WerFault.exe
                C:\Windows\SysWOW64\WerFault.exe -u -p 2568 -s 284
                6⤵
                • Loads dropped DLL
                • Program crash
                PID:2668

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Hu7Np02.exe

      Filesize

      1021KB

      MD5

      ad09c959ce3d4014947d00216365a07e

      SHA1

      c9e35d01da562035eadb6428362aa06b81531baa

      SHA256

      cd0ca96da5b1fe00bf6ecabcb9812e046e94f96467b8f747324658a39202341a

      SHA512

      207683b95ca67aae9ae20c81ea6d6d51b60411f050dd1e0f1190b6487179bec2058dd8836865d1537bb1ed55b33bd152f0c296e29d0356aa519ca02d51af6b2b

    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Hu7Np02.exe

      Filesize

      1021KB

      MD5

      ad09c959ce3d4014947d00216365a07e

      SHA1

      c9e35d01da562035eadb6428362aa06b81531baa

      SHA256

      cd0ca96da5b1fe00bf6ecabcb9812e046e94f96467b8f747324658a39202341a

      SHA512

      207683b95ca67aae9ae20c81ea6d6d51b60411f050dd1e0f1190b6487179bec2058dd8836865d1537bb1ed55b33bd152f0c296e29d0356aa519ca02d51af6b2b

    • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\ii3CA20.exe

      Filesize

      725KB

      MD5

      ad9c546377c1065bcfa101a2c119fe5d

      SHA1

      b605b16258b9a82a9ac5b5843c634fd616a8a833

      SHA256

      f44b5f9266f84cd3e87c99188aa9162d6c26c75bdd5682cd3e9f42b035780d32

      SHA512

      f8779096cdde9fecb589cc650e634d3b4c6f73a8063c90bc2dfa9bf2cb8676f89866b580d21cf9db4b785e9fceba721695f8286ea478d43f827e9571c3f7e47f

    • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\ii3CA20.exe

      Filesize

      725KB

      MD5

      ad9c546377c1065bcfa101a2c119fe5d

      SHA1

      b605b16258b9a82a9ac5b5843c634fd616a8a833

      SHA256

      f44b5f9266f84cd3e87c99188aa9162d6c26c75bdd5682cd3e9f42b035780d32

      SHA512

      f8779096cdde9fecb589cc650e634d3b4c6f73a8063c90bc2dfa9bf2cb8676f89866b580d21cf9db4b785e9fceba721695f8286ea478d43f827e9571c3f7e47f

    • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\ab4KD68.exe

      Filesize

      479KB

      MD5

      10f33e2a2229c936af061a53932b6e30

      SHA1

      307dc3cf54262d1943ccc00b5df0d809a2d93d2a

      SHA256

      e68f4f41b7e4089e173a50720ffbc51e44227e16298aa35d639fc124eaec7df8

      SHA512

      850d9a94233a182669d12ae8a9531bfcffffd1d888ea30f4d1e87b63cc8f8fed4d8fbb1e9bdc68ce83b7ff5fad642e413e73ff5b0a329488ee6ae3057f61cbc3

    • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\ab4KD68.exe

      Filesize

      479KB

      MD5

      10f33e2a2229c936af061a53932b6e30

      SHA1

      307dc3cf54262d1943ccc00b5df0d809a2d93d2a

      SHA256

      e68f4f41b7e4089e173a50720ffbc51e44227e16298aa35d639fc124eaec7df8

      SHA512

      850d9a94233a182669d12ae8a9531bfcffffd1d888ea30f4d1e87b63cc8f8fed4d8fbb1e9bdc68ce83b7ff5fad642e413e73ff5b0a329488ee6ae3057f61cbc3

    • C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\1xl47CY7.exe

      Filesize

      194KB

      MD5

      35d718538c3e1346cb4fcf54aaa0f141

      SHA1

      234c0aa0465c27c190a83936e8e3aa3c4b991224

      SHA256

      97e62bfa90aca06c595fb150e36f56b4a285f58cc072b8c458ae79805523fc36

      SHA512

      4bcf5cabe93ec54608ccb95d80822f411bb32c2746be609873a493045913fb53e0a953e75f82dfe620d661f049437da7a70d34995dc915bb0b09426e97f0aec3

    • C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\1xl47CY7.exe

      Filesize

      194KB

      MD5

      35d718538c3e1346cb4fcf54aaa0f141

      SHA1

      234c0aa0465c27c190a83936e8e3aa3c4b991224

      SHA256

      97e62bfa90aca06c595fb150e36f56b4a285f58cc072b8c458ae79805523fc36

      SHA512

      4bcf5cabe93ec54608ccb95d80822f411bb32c2746be609873a493045913fb53e0a953e75f82dfe620d661f049437da7a70d34995dc915bb0b09426e97f0aec3

    • C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\2UX9827.exe

      Filesize

      423KB

      MD5

      7ed0cdc93b66eddf9964210348697da9

      SHA1

      5c7ac62be5290e6440ccf486d13a66aca5cc3624

      SHA256

      3283ee47aae3596704564d912a08365401af72d39083428e537e16b57e79e0da

      SHA512

      d2318ece279c4680e01750855b806b56d15ca6c7b4fc1642027cda2330800d36dfeb9681cf2b43f408b9010aa6ce8a96602c41982d0bc4fe5e76608d694f4085

    • C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\2UX9827.exe

      Filesize

      423KB

      MD5

      7ed0cdc93b66eddf9964210348697da9

      SHA1

      5c7ac62be5290e6440ccf486d13a66aca5cc3624

      SHA256

      3283ee47aae3596704564d912a08365401af72d39083428e537e16b57e79e0da

      SHA512

      d2318ece279c4680e01750855b806b56d15ca6c7b4fc1642027cda2330800d36dfeb9681cf2b43f408b9010aa6ce8a96602c41982d0bc4fe5e76608d694f4085

    • C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\2UX9827.exe

      Filesize

      423KB

      MD5

      7ed0cdc93b66eddf9964210348697da9

      SHA1

      5c7ac62be5290e6440ccf486d13a66aca5cc3624

      SHA256

      3283ee47aae3596704564d912a08365401af72d39083428e537e16b57e79e0da

      SHA512

      d2318ece279c4680e01750855b806b56d15ca6c7b4fc1642027cda2330800d36dfeb9681cf2b43f408b9010aa6ce8a96602c41982d0bc4fe5e76608d694f4085

    • \Users\Admin\AppData\Local\Temp\IXP000.TMP\Hu7Np02.exe

      Filesize

      1021KB

      MD5

      ad09c959ce3d4014947d00216365a07e

      SHA1

      c9e35d01da562035eadb6428362aa06b81531baa

      SHA256

      cd0ca96da5b1fe00bf6ecabcb9812e046e94f96467b8f747324658a39202341a

      SHA512

      207683b95ca67aae9ae20c81ea6d6d51b60411f050dd1e0f1190b6487179bec2058dd8836865d1537bb1ed55b33bd152f0c296e29d0356aa519ca02d51af6b2b

    • \Users\Admin\AppData\Local\Temp\IXP000.TMP\Hu7Np02.exe

      Filesize

      1021KB

      MD5

      ad09c959ce3d4014947d00216365a07e

      SHA1

      c9e35d01da562035eadb6428362aa06b81531baa

      SHA256

      cd0ca96da5b1fe00bf6ecabcb9812e046e94f96467b8f747324658a39202341a

      SHA512

      207683b95ca67aae9ae20c81ea6d6d51b60411f050dd1e0f1190b6487179bec2058dd8836865d1537bb1ed55b33bd152f0c296e29d0356aa519ca02d51af6b2b

    • \Users\Admin\AppData\Local\Temp\IXP001.TMP\ii3CA20.exe

      Filesize

      725KB

      MD5

      ad9c546377c1065bcfa101a2c119fe5d

      SHA1

      b605b16258b9a82a9ac5b5843c634fd616a8a833

      SHA256

      f44b5f9266f84cd3e87c99188aa9162d6c26c75bdd5682cd3e9f42b035780d32

      SHA512

      f8779096cdde9fecb589cc650e634d3b4c6f73a8063c90bc2dfa9bf2cb8676f89866b580d21cf9db4b785e9fceba721695f8286ea478d43f827e9571c3f7e47f

    • \Users\Admin\AppData\Local\Temp\IXP001.TMP\ii3CA20.exe

      Filesize

      725KB

      MD5

      ad9c546377c1065bcfa101a2c119fe5d

      SHA1

      b605b16258b9a82a9ac5b5843c634fd616a8a833

      SHA256

      f44b5f9266f84cd3e87c99188aa9162d6c26c75bdd5682cd3e9f42b035780d32

      SHA512

      f8779096cdde9fecb589cc650e634d3b4c6f73a8063c90bc2dfa9bf2cb8676f89866b580d21cf9db4b785e9fceba721695f8286ea478d43f827e9571c3f7e47f

    • \Users\Admin\AppData\Local\Temp\IXP002.TMP\ab4KD68.exe

      Filesize

      479KB

      MD5

      10f33e2a2229c936af061a53932b6e30

      SHA1

      307dc3cf54262d1943ccc00b5df0d809a2d93d2a

      SHA256

      e68f4f41b7e4089e173a50720ffbc51e44227e16298aa35d639fc124eaec7df8

      SHA512

      850d9a94233a182669d12ae8a9531bfcffffd1d888ea30f4d1e87b63cc8f8fed4d8fbb1e9bdc68ce83b7ff5fad642e413e73ff5b0a329488ee6ae3057f61cbc3

    • \Users\Admin\AppData\Local\Temp\IXP002.TMP\ab4KD68.exe

      Filesize

      479KB

      MD5

      10f33e2a2229c936af061a53932b6e30

      SHA1

      307dc3cf54262d1943ccc00b5df0d809a2d93d2a

      SHA256

      e68f4f41b7e4089e173a50720ffbc51e44227e16298aa35d639fc124eaec7df8

      SHA512

      850d9a94233a182669d12ae8a9531bfcffffd1d888ea30f4d1e87b63cc8f8fed4d8fbb1e9bdc68ce83b7ff5fad642e413e73ff5b0a329488ee6ae3057f61cbc3

    • \Users\Admin\AppData\Local\Temp\IXP003.TMP\1xl47CY7.exe

      Filesize

      194KB

      MD5

      35d718538c3e1346cb4fcf54aaa0f141

      SHA1

      234c0aa0465c27c190a83936e8e3aa3c4b991224

      SHA256

      97e62bfa90aca06c595fb150e36f56b4a285f58cc072b8c458ae79805523fc36

      SHA512

      4bcf5cabe93ec54608ccb95d80822f411bb32c2746be609873a493045913fb53e0a953e75f82dfe620d661f049437da7a70d34995dc915bb0b09426e97f0aec3

    • \Users\Admin\AppData\Local\Temp\IXP003.TMP\1xl47CY7.exe

      Filesize

      194KB

      MD5

      35d718538c3e1346cb4fcf54aaa0f141

      SHA1

      234c0aa0465c27c190a83936e8e3aa3c4b991224

      SHA256

      97e62bfa90aca06c595fb150e36f56b4a285f58cc072b8c458ae79805523fc36

      SHA512

      4bcf5cabe93ec54608ccb95d80822f411bb32c2746be609873a493045913fb53e0a953e75f82dfe620d661f049437da7a70d34995dc915bb0b09426e97f0aec3

    • \Users\Admin\AppData\Local\Temp\IXP003.TMP\2UX9827.exe

      Filesize

      423KB

      MD5

      7ed0cdc93b66eddf9964210348697da9

      SHA1

      5c7ac62be5290e6440ccf486d13a66aca5cc3624

      SHA256

      3283ee47aae3596704564d912a08365401af72d39083428e537e16b57e79e0da

      SHA512

      d2318ece279c4680e01750855b806b56d15ca6c7b4fc1642027cda2330800d36dfeb9681cf2b43f408b9010aa6ce8a96602c41982d0bc4fe5e76608d694f4085

    • \Users\Admin\AppData\Local\Temp\IXP003.TMP\2UX9827.exe

      Filesize

      423KB

      MD5

      7ed0cdc93b66eddf9964210348697da9

      SHA1

      5c7ac62be5290e6440ccf486d13a66aca5cc3624

      SHA256

      3283ee47aae3596704564d912a08365401af72d39083428e537e16b57e79e0da

      SHA512

      d2318ece279c4680e01750855b806b56d15ca6c7b4fc1642027cda2330800d36dfeb9681cf2b43f408b9010aa6ce8a96602c41982d0bc4fe5e76608d694f4085

    • \Users\Admin\AppData\Local\Temp\IXP003.TMP\2UX9827.exe

      Filesize

      423KB

      MD5

      7ed0cdc93b66eddf9964210348697da9

      SHA1

      5c7ac62be5290e6440ccf486d13a66aca5cc3624

      SHA256

      3283ee47aae3596704564d912a08365401af72d39083428e537e16b57e79e0da

      SHA512

      d2318ece279c4680e01750855b806b56d15ca6c7b4fc1642027cda2330800d36dfeb9681cf2b43f408b9010aa6ce8a96602c41982d0bc4fe5e76608d694f4085

    • \Users\Admin\AppData\Local\Temp\IXP003.TMP\2UX9827.exe

      Filesize

      423KB

      MD5

      7ed0cdc93b66eddf9964210348697da9

      SHA1

      5c7ac62be5290e6440ccf486d13a66aca5cc3624

      SHA256

      3283ee47aae3596704564d912a08365401af72d39083428e537e16b57e79e0da

      SHA512

      d2318ece279c4680e01750855b806b56d15ca6c7b4fc1642027cda2330800d36dfeb9681cf2b43f408b9010aa6ce8a96602c41982d0bc4fe5e76608d694f4085

    • \Users\Admin\AppData\Local\Temp\IXP003.TMP\2UX9827.exe

      Filesize

      423KB

      MD5

      7ed0cdc93b66eddf9964210348697da9

      SHA1

      5c7ac62be5290e6440ccf486d13a66aca5cc3624

      SHA256

      3283ee47aae3596704564d912a08365401af72d39083428e537e16b57e79e0da

      SHA512

      d2318ece279c4680e01750855b806b56d15ca6c7b4fc1642027cda2330800d36dfeb9681cf2b43f408b9010aa6ce8a96602c41982d0bc4fe5e76608d694f4085

    • \Users\Admin\AppData\Local\Temp\IXP003.TMP\2UX9827.exe

      Filesize

      423KB

      MD5

      7ed0cdc93b66eddf9964210348697da9

      SHA1

      5c7ac62be5290e6440ccf486d13a66aca5cc3624

      SHA256

      3283ee47aae3596704564d912a08365401af72d39083428e537e16b57e79e0da

      SHA512

      d2318ece279c4680e01750855b806b56d15ca6c7b4fc1642027cda2330800d36dfeb9681cf2b43f408b9010aa6ce8a96602c41982d0bc4fe5e76608d694f4085

    • \Users\Admin\AppData\Local\Temp\IXP003.TMP\2UX9827.exe

      Filesize

      423KB

      MD5

      7ed0cdc93b66eddf9964210348697da9

      SHA1

      5c7ac62be5290e6440ccf486d13a66aca5cc3624

      SHA256

      3283ee47aae3596704564d912a08365401af72d39083428e537e16b57e79e0da

      SHA512

      d2318ece279c4680e01750855b806b56d15ca6c7b4fc1642027cda2330800d36dfeb9681cf2b43f408b9010aa6ce8a96602c41982d0bc4fe5e76608d694f4085

    • memory/2908-59-0x0000000002010000-0x0000000002026000-memory.dmp

      Filesize

      88KB

    • memory/2908-49-0x0000000002010000-0x0000000002026000-memory.dmp

      Filesize

      88KB

    • memory/2908-61-0x0000000002010000-0x0000000002026000-memory.dmp

      Filesize

      88KB

    • memory/2908-63-0x0000000002010000-0x0000000002026000-memory.dmp

      Filesize

      88KB

    • memory/2908-67-0x0000000002010000-0x0000000002026000-memory.dmp

      Filesize

      88KB

    • memory/2908-65-0x0000000002010000-0x0000000002026000-memory.dmp

      Filesize

      88KB

    • memory/2908-69-0x0000000002010000-0x0000000002026000-memory.dmp

      Filesize

      88KB

    • memory/2908-53-0x0000000002010000-0x0000000002026000-memory.dmp

      Filesize

      88KB

    • memory/2908-55-0x0000000002010000-0x0000000002026000-memory.dmp

      Filesize

      88KB

    • memory/2908-43-0x0000000002010000-0x0000000002026000-memory.dmp

      Filesize

      88KB

    • memory/2908-51-0x0000000002010000-0x0000000002026000-memory.dmp

      Filesize

      88KB

    • memory/2908-47-0x0000000002010000-0x0000000002026000-memory.dmp

      Filesize

      88KB

    • memory/2908-45-0x0000000002010000-0x0000000002026000-memory.dmp

      Filesize

      88KB

    • memory/2908-40-0x00000000003E0000-0x00000000003FE000-memory.dmp

      Filesize

      120KB

    • memory/2908-41-0x0000000002010000-0x000000000202C000-memory.dmp

      Filesize

      112KB

    • memory/2908-57-0x0000000002010000-0x0000000002026000-memory.dmp

      Filesize

      88KB

    • memory/2908-42-0x0000000002010000-0x0000000002026000-memory.dmp

      Filesize

      88KB

    • memory/2980-85-0x0000000000400000-0x0000000000433000-memory.dmp

      Filesize

      204KB

    • memory/2980-83-0x0000000000400000-0x0000000000433000-memory.dmp

      Filesize

      204KB

    • memory/2980-88-0x0000000000400000-0x0000000000433000-memory.dmp

      Filesize

      204KB

    • memory/2980-87-0x00000000FFFDE000-0x00000000FFFDF000-memory.dmp

      Filesize

      4KB

    • memory/2980-90-0x0000000000400000-0x0000000000433000-memory.dmp

      Filesize

      204KB

    • memory/2980-92-0x0000000000400000-0x0000000000433000-memory.dmp

      Filesize

      204KB

    • memory/2980-93-0x0000000000400000-0x0000000000433000-memory.dmp

      Filesize

      204KB

    • memory/2980-84-0x0000000000400000-0x0000000000433000-memory.dmp

      Filesize

      204KB

    • memory/2980-86-0x0000000000400000-0x0000000000433000-memory.dmp

      Filesize

      204KB

    • memory/2980-79-0x0000000000400000-0x0000000000433000-memory.dmp

      Filesize

      204KB

    • memory/2980-81-0x0000000000400000-0x0000000000433000-memory.dmp

      Filesize

      204KB

    • memory/2980-98-0x0000000000400000-0x0000000000433000-memory.dmp

      Filesize

      204KB