Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    118s
  • max time network
    123s
  • platform
    windows7_x64
  • resource
    win7-20230831-en
  • resource tags

    arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
  • submitted
    10/10/2023, 17:22

General

  • Target

    240e4e5fd45927007eaa291ebb8b8626cbe1bf13578c7143e045d62e5bb01448_JC.exe

  • Size

    1.1MB

  • MD5

    5b81dda47c6f5be922830501405079ef

  • SHA1

    61daa398b8a419f5e6f848354ecd219835e74626

  • SHA256

    240e4e5fd45927007eaa291ebb8b8626cbe1bf13578c7143e045d62e5bb01448

  • SHA512

    0375d604c6cecdd1a8ef33fdfd57b8398e154423611a8b129f61ce4216105c32d1993e0582def000212e1d0f3db158d729b159c76106f81a4ea3a40faa56e283

  • SSDEEP

    24576:Ny/eUxSgVS9KVcr8TYqBP8RQrJzC+vittkn6hl77xwQ:o/e5gU9KVz8qtbNOXtkn6h

Malware Config

Signatures

  • Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs
  • Executes dropped EXE 5 IoCs
  • Loads dropped DLL 15 IoCs
  • Windows security modification 2 TTPs 2 IoCs
  • Adds Run key to start application 2 TTPs 4 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Program crash 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 56 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\240e4e5fd45927007eaa291ebb8b8626cbe1bf13578c7143e045d62e5bb01448_JC.exe
    "C:\Users\Admin\AppData\Local\Temp\240e4e5fd45927007eaa291ebb8b8626cbe1bf13578c7143e045d62e5bb01448_JC.exe"
    1⤵
    • Loads dropped DLL
    • Adds Run key to start application
    • Suspicious use of WriteProcessMemory
    PID:1720
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\xu7zj38.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\xu7zj38.exe
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Adds Run key to start application
      • Suspicious use of WriteProcessMemory
      PID:1688
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\Ei1Zr79.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\Ei1Zr79.exe
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Adds Run key to start application
        • Suspicious use of WriteProcessMemory
        PID:3052
        • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\gu9xK89.exe
          C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\gu9xK89.exe
          4⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • Adds Run key to start application
          • Suspicious use of WriteProcessMemory
          PID:2752
          • C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\1QV84EJ5.exe
            C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\1QV84EJ5.exe
            5⤵
            • Modifies Windows Defender Real-time Protection settings
            • Executes dropped EXE
            • Loads dropped DLL
            • Windows security modification
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:2720
          • C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\2PQ8906.exe
            C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\2PQ8906.exe
            5⤵
            • Executes dropped EXE
            • Loads dropped DLL
            • Suspicious use of SetThreadContext
            • Suspicious use of WriteProcessMemory
            PID:2992
            • C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
              "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
              6⤵
                PID:596
              • C:\Windows\SysWOW64\WerFault.exe
                C:\Windows\SysWOW64\WerFault.exe -u -p 2992 -s 284
                6⤵
                • Loads dropped DLL
                • Program crash
                PID:548

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\xu7zj38.exe

      Filesize

      1022KB

      MD5

      6efc1f946bd94b447853a96cdc2151b4

      SHA1

      789b80fa545c7472e62efee585e153e9db9c745d

      SHA256

      87b8cdfd75dfc1689bfc645491ad65d6e23e37871e6a9dd0ef29a3af827256b3

      SHA512

      2ef72ab043d45dd93bcf87f31db41585d308775cfc2674f59a23c9077769f3fc678a3cd833e0bc903d3dc1eea3d920a950ef3959e4eab38d77d3a7c1b1560d91

    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\xu7zj38.exe

      Filesize

      1022KB

      MD5

      6efc1f946bd94b447853a96cdc2151b4

      SHA1

      789b80fa545c7472e62efee585e153e9db9c745d

      SHA256

      87b8cdfd75dfc1689bfc645491ad65d6e23e37871e6a9dd0ef29a3af827256b3

      SHA512

      2ef72ab043d45dd93bcf87f31db41585d308775cfc2674f59a23c9077769f3fc678a3cd833e0bc903d3dc1eea3d920a950ef3959e4eab38d77d3a7c1b1560d91

    • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\Ei1Zr79.exe

      Filesize

      727KB

      MD5

      31cb7313e8c2a4f1b98058cf50e22489

      SHA1

      95f8d2d1c194fb076dfd3fe23ac1863857c45de1

      SHA256

      7defbdbc403a1eb0f7ff409066c03a48eeff5327af67be2309c9a441d8d12373

      SHA512

      8ff7c8257233cf0c5b63591abb046ab9024b3a27e7388ed75328f02d7028f8e645a9ba9efc1700304fae9be310832420dbd4a2108b623fb9e96c08b2daf9a1dc

    • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\Ei1Zr79.exe

      Filesize

      727KB

      MD5

      31cb7313e8c2a4f1b98058cf50e22489

      SHA1

      95f8d2d1c194fb076dfd3fe23ac1863857c45de1

      SHA256

      7defbdbc403a1eb0f7ff409066c03a48eeff5327af67be2309c9a441d8d12373

      SHA512

      8ff7c8257233cf0c5b63591abb046ab9024b3a27e7388ed75328f02d7028f8e645a9ba9efc1700304fae9be310832420dbd4a2108b623fb9e96c08b2daf9a1dc

    • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\gu9xK89.exe

      Filesize

      482KB

      MD5

      18520ab69da50d52542b4c7e82324547

      SHA1

      1c147f48432084f869d5367951d060eee326ab8e

      SHA256

      179107bbb60b095a96a60f30b59043e6d877cb84fc75a37577212acdc25f3280

      SHA512

      9b76a94a37fa243986bda7e95107e35ffa6af602600c8f59e4a8ec4fabed05c16961c65d54ba799edb5b415450534757506d3fd34449f5571ff15a89f3e686e7

    • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\gu9xK89.exe

      Filesize

      482KB

      MD5

      18520ab69da50d52542b4c7e82324547

      SHA1

      1c147f48432084f869d5367951d060eee326ab8e

      SHA256

      179107bbb60b095a96a60f30b59043e6d877cb84fc75a37577212acdc25f3280

      SHA512

      9b76a94a37fa243986bda7e95107e35ffa6af602600c8f59e4a8ec4fabed05c16961c65d54ba799edb5b415450534757506d3fd34449f5571ff15a89f3e686e7

    • C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\1QV84EJ5.exe

      Filesize

      194KB

      MD5

      35d718538c3e1346cb4fcf54aaa0f141

      SHA1

      234c0aa0465c27c190a83936e8e3aa3c4b991224

      SHA256

      97e62bfa90aca06c595fb150e36f56b4a285f58cc072b8c458ae79805523fc36

      SHA512

      4bcf5cabe93ec54608ccb95d80822f411bb32c2746be609873a493045913fb53e0a953e75f82dfe620d661f049437da7a70d34995dc915bb0b09426e97f0aec3

    • C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\1QV84EJ5.exe

      Filesize

      194KB

      MD5

      35d718538c3e1346cb4fcf54aaa0f141

      SHA1

      234c0aa0465c27c190a83936e8e3aa3c4b991224

      SHA256

      97e62bfa90aca06c595fb150e36f56b4a285f58cc072b8c458ae79805523fc36

      SHA512

      4bcf5cabe93ec54608ccb95d80822f411bb32c2746be609873a493045913fb53e0a953e75f82dfe620d661f049437da7a70d34995dc915bb0b09426e97f0aec3

    • C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\2PQ8906.exe

      Filesize

      422KB

      MD5

      d8f015fcc4b6e5d99719310b113afad1

      SHA1

      66d4b5f96ad6cf85ee292c5f2e1bc06d8e70f539

      SHA256

      649975a8c659a873655484a87b93b0227ed11b24031dd0f5bbb5dc062a3963fc

      SHA512

      00eafb0d26e167a999fda9d084196bc855e148917b1a46efedf4d6380573f29f33f99dc77bf251a2fac8ad7746b0ceb36282cb1d09dd7d96b40d437e5123cca7

    • C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\2PQ8906.exe

      Filesize

      422KB

      MD5

      d8f015fcc4b6e5d99719310b113afad1

      SHA1

      66d4b5f96ad6cf85ee292c5f2e1bc06d8e70f539

      SHA256

      649975a8c659a873655484a87b93b0227ed11b24031dd0f5bbb5dc062a3963fc

      SHA512

      00eafb0d26e167a999fda9d084196bc855e148917b1a46efedf4d6380573f29f33f99dc77bf251a2fac8ad7746b0ceb36282cb1d09dd7d96b40d437e5123cca7

    • C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\2PQ8906.exe

      Filesize

      422KB

      MD5

      d8f015fcc4b6e5d99719310b113afad1

      SHA1

      66d4b5f96ad6cf85ee292c5f2e1bc06d8e70f539

      SHA256

      649975a8c659a873655484a87b93b0227ed11b24031dd0f5bbb5dc062a3963fc

      SHA512

      00eafb0d26e167a999fda9d084196bc855e148917b1a46efedf4d6380573f29f33f99dc77bf251a2fac8ad7746b0ceb36282cb1d09dd7d96b40d437e5123cca7

    • \Users\Admin\AppData\Local\Temp\IXP000.TMP\xu7zj38.exe

      Filesize

      1022KB

      MD5

      6efc1f946bd94b447853a96cdc2151b4

      SHA1

      789b80fa545c7472e62efee585e153e9db9c745d

      SHA256

      87b8cdfd75dfc1689bfc645491ad65d6e23e37871e6a9dd0ef29a3af827256b3

      SHA512

      2ef72ab043d45dd93bcf87f31db41585d308775cfc2674f59a23c9077769f3fc678a3cd833e0bc903d3dc1eea3d920a950ef3959e4eab38d77d3a7c1b1560d91

    • \Users\Admin\AppData\Local\Temp\IXP000.TMP\xu7zj38.exe

      Filesize

      1022KB

      MD5

      6efc1f946bd94b447853a96cdc2151b4

      SHA1

      789b80fa545c7472e62efee585e153e9db9c745d

      SHA256

      87b8cdfd75dfc1689bfc645491ad65d6e23e37871e6a9dd0ef29a3af827256b3

      SHA512

      2ef72ab043d45dd93bcf87f31db41585d308775cfc2674f59a23c9077769f3fc678a3cd833e0bc903d3dc1eea3d920a950ef3959e4eab38d77d3a7c1b1560d91

    • \Users\Admin\AppData\Local\Temp\IXP001.TMP\Ei1Zr79.exe

      Filesize

      727KB

      MD5

      31cb7313e8c2a4f1b98058cf50e22489

      SHA1

      95f8d2d1c194fb076dfd3fe23ac1863857c45de1

      SHA256

      7defbdbc403a1eb0f7ff409066c03a48eeff5327af67be2309c9a441d8d12373

      SHA512

      8ff7c8257233cf0c5b63591abb046ab9024b3a27e7388ed75328f02d7028f8e645a9ba9efc1700304fae9be310832420dbd4a2108b623fb9e96c08b2daf9a1dc

    • \Users\Admin\AppData\Local\Temp\IXP001.TMP\Ei1Zr79.exe

      Filesize

      727KB

      MD5

      31cb7313e8c2a4f1b98058cf50e22489

      SHA1

      95f8d2d1c194fb076dfd3fe23ac1863857c45de1

      SHA256

      7defbdbc403a1eb0f7ff409066c03a48eeff5327af67be2309c9a441d8d12373

      SHA512

      8ff7c8257233cf0c5b63591abb046ab9024b3a27e7388ed75328f02d7028f8e645a9ba9efc1700304fae9be310832420dbd4a2108b623fb9e96c08b2daf9a1dc

    • \Users\Admin\AppData\Local\Temp\IXP002.TMP\gu9xK89.exe

      Filesize

      482KB

      MD5

      18520ab69da50d52542b4c7e82324547

      SHA1

      1c147f48432084f869d5367951d060eee326ab8e

      SHA256

      179107bbb60b095a96a60f30b59043e6d877cb84fc75a37577212acdc25f3280

      SHA512

      9b76a94a37fa243986bda7e95107e35ffa6af602600c8f59e4a8ec4fabed05c16961c65d54ba799edb5b415450534757506d3fd34449f5571ff15a89f3e686e7

    • \Users\Admin\AppData\Local\Temp\IXP002.TMP\gu9xK89.exe

      Filesize

      482KB

      MD5

      18520ab69da50d52542b4c7e82324547

      SHA1

      1c147f48432084f869d5367951d060eee326ab8e

      SHA256

      179107bbb60b095a96a60f30b59043e6d877cb84fc75a37577212acdc25f3280

      SHA512

      9b76a94a37fa243986bda7e95107e35ffa6af602600c8f59e4a8ec4fabed05c16961c65d54ba799edb5b415450534757506d3fd34449f5571ff15a89f3e686e7

    • \Users\Admin\AppData\Local\Temp\IXP003.TMP\1QV84EJ5.exe

      Filesize

      194KB

      MD5

      35d718538c3e1346cb4fcf54aaa0f141

      SHA1

      234c0aa0465c27c190a83936e8e3aa3c4b991224

      SHA256

      97e62bfa90aca06c595fb150e36f56b4a285f58cc072b8c458ae79805523fc36

      SHA512

      4bcf5cabe93ec54608ccb95d80822f411bb32c2746be609873a493045913fb53e0a953e75f82dfe620d661f049437da7a70d34995dc915bb0b09426e97f0aec3

    • \Users\Admin\AppData\Local\Temp\IXP003.TMP\1QV84EJ5.exe

      Filesize

      194KB

      MD5

      35d718538c3e1346cb4fcf54aaa0f141

      SHA1

      234c0aa0465c27c190a83936e8e3aa3c4b991224

      SHA256

      97e62bfa90aca06c595fb150e36f56b4a285f58cc072b8c458ae79805523fc36

      SHA512

      4bcf5cabe93ec54608ccb95d80822f411bb32c2746be609873a493045913fb53e0a953e75f82dfe620d661f049437da7a70d34995dc915bb0b09426e97f0aec3

    • \Users\Admin\AppData\Local\Temp\IXP003.TMP\2PQ8906.exe

      Filesize

      422KB

      MD5

      d8f015fcc4b6e5d99719310b113afad1

      SHA1

      66d4b5f96ad6cf85ee292c5f2e1bc06d8e70f539

      SHA256

      649975a8c659a873655484a87b93b0227ed11b24031dd0f5bbb5dc062a3963fc

      SHA512

      00eafb0d26e167a999fda9d084196bc855e148917b1a46efedf4d6380573f29f33f99dc77bf251a2fac8ad7746b0ceb36282cb1d09dd7d96b40d437e5123cca7

    • \Users\Admin\AppData\Local\Temp\IXP003.TMP\2PQ8906.exe

      Filesize

      422KB

      MD5

      d8f015fcc4b6e5d99719310b113afad1

      SHA1

      66d4b5f96ad6cf85ee292c5f2e1bc06d8e70f539

      SHA256

      649975a8c659a873655484a87b93b0227ed11b24031dd0f5bbb5dc062a3963fc

      SHA512

      00eafb0d26e167a999fda9d084196bc855e148917b1a46efedf4d6380573f29f33f99dc77bf251a2fac8ad7746b0ceb36282cb1d09dd7d96b40d437e5123cca7

    • \Users\Admin\AppData\Local\Temp\IXP003.TMP\2PQ8906.exe

      Filesize

      422KB

      MD5

      d8f015fcc4b6e5d99719310b113afad1

      SHA1

      66d4b5f96ad6cf85ee292c5f2e1bc06d8e70f539

      SHA256

      649975a8c659a873655484a87b93b0227ed11b24031dd0f5bbb5dc062a3963fc

      SHA512

      00eafb0d26e167a999fda9d084196bc855e148917b1a46efedf4d6380573f29f33f99dc77bf251a2fac8ad7746b0ceb36282cb1d09dd7d96b40d437e5123cca7

    • \Users\Admin\AppData\Local\Temp\IXP003.TMP\2PQ8906.exe

      Filesize

      422KB

      MD5

      d8f015fcc4b6e5d99719310b113afad1

      SHA1

      66d4b5f96ad6cf85ee292c5f2e1bc06d8e70f539

      SHA256

      649975a8c659a873655484a87b93b0227ed11b24031dd0f5bbb5dc062a3963fc

      SHA512

      00eafb0d26e167a999fda9d084196bc855e148917b1a46efedf4d6380573f29f33f99dc77bf251a2fac8ad7746b0ceb36282cb1d09dd7d96b40d437e5123cca7

    • \Users\Admin\AppData\Local\Temp\IXP003.TMP\2PQ8906.exe

      Filesize

      422KB

      MD5

      d8f015fcc4b6e5d99719310b113afad1

      SHA1

      66d4b5f96ad6cf85ee292c5f2e1bc06d8e70f539

      SHA256

      649975a8c659a873655484a87b93b0227ed11b24031dd0f5bbb5dc062a3963fc

      SHA512

      00eafb0d26e167a999fda9d084196bc855e148917b1a46efedf4d6380573f29f33f99dc77bf251a2fac8ad7746b0ceb36282cb1d09dd7d96b40d437e5123cca7

    • \Users\Admin\AppData\Local\Temp\IXP003.TMP\2PQ8906.exe

      Filesize

      422KB

      MD5

      d8f015fcc4b6e5d99719310b113afad1

      SHA1

      66d4b5f96ad6cf85ee292c5f2e1bc06d8e70f539

      SHA256

      649975a8c659a873655484a87b93b0227ed11b24031dd0f5bbb5dc062a3963fc

      SHA512

      00eafb0d26e167a999fda9d084196bc855e148917b1a46efedf4d6380573f29f33f99dc77bf251a2fac8ad7746b0ceb36282cb1d09dd7d96b40d437e5123cca7

    • \Users\Admin\AppData\Local\Temp\IXP003.TMP\2PQ8906.exe

      Filesize

      422KB

      MD5

      d8f015fcc4b6e5d99719310b113afad1

      SHA1

      66d4b5f96ad6cf85ee292c5f2e1bc06d8e70f539

      SHA256

      649975a8c659a873655484a87b93b0227ed11b24031dd0f5bbb5dc062a3963fc

      SHA512

      00eafb0d26e167a999fda9d084196bc855e148917b1a46efedf4d6380573f29f33f99dc77bf251a2fac8ad7746b0ceb36282cb1d09dd7d96b40d437e5123cca7

    • memory/596-81-0x0000000000400000-0x0000000000433000-memory.dmp

      Filesize

      204KB

    • memory/596-93-0x0000000000400000-0x0000000000433000-memory.dmp

      Filesize

      204KB

    • memory/596-99-0x0000000000400000-0x0000000000433000-memory.dmp

      Filesize

      204KB

    • memory/596-94-0x0000000000400000-0x0000000000433000-memory.dmp

      Filesize

      204KB

    • memory/596-91-0x0000000000400000-0x0000000000433000-memory.dmp

      Filesize

      204KB

    • memory/596-89-0x0000000000400000-0x0000000000433000-memory.dmp

      Filesize

      204KB

    • memory/596-88-0x00000000FFFDE000-0x00000000FFFDF000-memory.dmp

      Filesize

      4KB

    • memory/596-87-0x0000000000400000-0x0000000000433000-memory.dmp

      Filesize

      204KB

    • memory/596-83-0x0000000000400000-0x0000000000433000-memory.dmp

      Filesize

      204KB

    • memory/596-86-0x0000000000400000-0x0000000000433000-memory.dmp

      Filesize

      204KB

    • memory/596-85-0x0000000000400000-0x0000000000433000-memory.dmp

      Filesize

      204KB

    • memory/596-79-0x0000000000400000-0x0000000000433000-memory.dmp

      Filesize

      204KB

    • memory/2720-69-0x00000000006B0000-0x00000000006C6000-memory.dmp

      Filesize

      88KB

    • memory/2720-63-0x00000000006B0000-0x00000000006C6000-memory.dmp

      Filesize

      88KB

    • memory/2720-47-0x00000000006B0000-0x00000000006C6000-memory.dmp

      Filesize

      88KB

    • memory/2720-53-0x00000000006B0000-0x00000000006C6000-memory.dmp

      Filesize

      88KB

    • memory/2720-51-0x00000000006B0000-0x00000000006C6000-memory.dmp

      Filesize

      88KB

    • memory/2720-57-0x00000000006B0000-0x00000000006C6000-memory.dmp

      Filesize

      88KB

    • memory/2720-55-0x00000000006B0000-0x00000000006C6000-memory.dmp

      Filesize

      88KB

    • memory/2720-67-0x00000000006B0000-0x00000000006C6000-memory.dmp

      Filesize

      88KB

    • memory/2720-45-0x00000000006B0000-0x00000000006C6000-memory.dmp

      Filesize

      88KB

    • memory/2720-61-0x00000000006B0000-0x00000000006C6000-memory.dmp

      Filesize

      88KB

    • memory/2720-49-0x00000000006B0000-0x00000000006C6000-memory.dmp

      Filesize

      88KB

    • memory/2720-65-0x00000000006B0000-0x00000000006C6000-memory.dmp

      Filesize

      88KB

    • memory/2720-43-0x00000000006B0000-0x00000000006C6000-memory.dmp

      Filesize

      88KB

    • memory/2720-42-0x00000000006B0000-0x00000000006C6000-memory.dmp

      Filesize

      88KB

    • memory/2720-41-0x00000000006B0000-0x00000000006CC000-memory.dmp

      Filesize

      112KB

    • memory/2720-40-0x00000000003D0000-0x00000000003EE000-memory.dmp

      Filesize

      120KB

    • memory/2720-59-0x00000000006B0000-0x00000000006C6000-memory.dmp

      Filesize

      88KB