Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    119s
  • max time network
    121s
  • platform
    windows7_x64
  • resource
    win7-20230831-en
  • resource tags

    arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
  • submitted
    10/10/2023, 18:23

General

  • Target

    e70b38efc72706e14600b330bb06720d0ca007600c4cba58892ff443f7f0bd91_JC.exe

  • Size

    1.1MB

  • MD5

    81da2731ca515a49f288a3f599aefd07

  • SHA1

    27877572608380c815681ab922001aef6e1c5218

  • SHA256

    e70b38efc72706e14600b330bb06720d0ca007600c4cba58892ff443f7f0bd91

  • SHA512

    71e91f8bc6a6c40c7376bcfe610a3ce3d51c747c15cb11994a293e4d62bd66a30f44568d4d9592f01e7ddd216c30b76cacd4a38888e35a2d703182f1e9f0f8eb

  • SSDEEP

    24576:cyMdrGpJ/aGAmGmEmBDIuBNfRLbXYA0qukKQQDizI5VSm0Wow:LoGpVgmEmyurRfRN0lizI5VhS

Malware Config

Signatures

  • Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs
  • Executes dropped EXE 5 IoCs
  • Loads dropped DLL 15 IoCs
  • Windows security modification 2 TTPs 2 IoCs
  • Adds Run key to start application 2 TTPs 4 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Program crash 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 63 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\e70b38efc72706e14600b330bb06720d0ca007600c4cba58892ff443f7f0bd91_JC.exe
    "C:\Users\Admin\AppData\Local\Temp\e70b38efc72706e14600b330bb06720d0ca007600c4cba58892ff443f7f0bd91_JC.exe"
    1⤵
    • Loads dropped DLL
    • Adds Run key to start application
    • Suspicious use of WriteProcessMemory
    PID:2224
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\zS5Ok44.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\zS5Ok44.exe
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Adds Run key to start application
      • Suspicious use of WriteProcessMemory
      PID:1672
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\Qw2HD23.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\Qw2HD23.exe
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Adds Run key to start application
        • Suspicious use of WriteProcessMemory
        PID:2156
        • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\DP0Oi52.exe
          C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\DP0Oi52.exe
          4⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • Adds Run key to start application
          • Suspicious use of WriteProcessMemory
          PID:2704
          • C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\1BP08jF6.exe
            C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\1BP08jF6.exe
            5⤵
            • Modifies Windows Defender Real-time Protection settings
            • Executes dropped EXE
            • Loads dropped DLL
            • Windows security modification
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:2660
          • C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\2wE3273.exe
            C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\2wE3273.exe
            5⤵
            • Executes dropped EXE
            • Loads dropped DLL
            • Suspicious use of SetThreadContext
            • Suspicious use of WriteProcessMemory
            PID:2680
            • C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
              "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
              6⤵
              • Suspicious use of WriteProcessMemory
              PID:2556
              • C:\Windows\SysWOW64\WerFault.exe
                C:\Windows\SysWOW64\WerFault.exe -u -p 2556 -s 268
                7⤵
                • Program crash
                PID:3028
            • C:\Windows\SysWOW64\WerFault.exe
              C:\Windows\SysWOW64\WerFault.exe -u -p 2680 -s 284
              6⤵
              • Loads dropped DLL
              • Program crash
              PID:3068

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\zS5Ok44.exe

    Filesize

    1021KB

    MD5

    3d092422925cb8451eb659c1ed8d2a18

    SHA1

    d4662c5b8e13d10fc82d8597b5e5aa37fcf0c3e3

    SHA256

    260bc2c41009fda167c7e2f08fef0a66737c392970a93db93e77b4c452a89b38

    SHA512

    62297b2a8587bdb47e8acd259588b3e02c403ef24c3276022bfe59423202e84ad0d5b44ae3645cfca57d088baca1736b482a3214d0883a292f96c37e5a482be5

  • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\zS5Ok44.exe

    Filesize

    1021KB

    MD5

    3d092422925cb8451eb659c1ed8d2a18

    SHA1

    d4662c5b8e13d10fc82d8597b5e5aa37fcf0c3e3

    SHA256

    260bc2c41009fda167c7e2f08fef0a66737c392970a93db93e77b4c452a89b38

    SHA512

    62297b2a8587bdb47e8acd259588b3e02c403ef24c3276022bfe59423202e84ad0d5b44ae3645cfca57d088baca1736b482a3214d0883a292f96c37e5a482be5

  • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\Qw2HD23.exe

    Filesize

    725KB

    MD5

    6f59310239a4d61ff16456ae5bde9dcb

    SHA1

    ecc55b8d8142e13deebd091732e89ae3e3756219

    SHA256

    7cbd2c88041c8e645e456c8cd48677113bcd8801144424aeae91808aab8dca2e

    SHA512

    2a863b7a3479c61456385c777d27fa95231b5b87159da1ca9f8d2fa352ff15066638014cc4cea8bfb0823cf3999b72c0d4bdb7cf138e91b7428fdfb744ea68ea

  • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\Qw2HD23.exe

    Filesize

    725KB

    MD5

    6f59310239a4d61ff16456ae5bde9dcb

    SHA1

    ecc55b8d8142e13deebd091732e89ae3e3756219

    SHA256

    7cbd2c88041c8e645e456c8cd48677113bcd8801144424aeae91808aab8dca2e

    SHA512

    2a863b7a3479c61456385c777d27fa95231b5b87159da1ca9f8d2fa352ff15066638014cc4cea8bfb0823cf3999b72c0d4bdb7cf138e91b7428fdfb744ea68ea

  • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\DP0Oi52.exe

    Filesize

    479KB

    MD5

    934b9f55125ecfa9b670acdcf9382f77

    SHA1

    2f306ea1a399361369094e2acf0f6d407c042102

    SHA256

    3b43d9e7659828b07d73cbcfd0168b369df0b147ffe4c30915e23f6972405443

    SHA512

    5ecf62b8723ae1e4127102b157c31cb9f4fbc35c6fd57c304b667f098cccc1a89fb7e6fd35177815b4998242dd6e5b0149adef64e915ac4f391aa486f48ead5f

  • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\DP0Oi52.exe

    Filesize

    479KB

    MD5

    934b9f55125ecfa9b670acdcf9382f77

    SHA1

    2f306ea1a399361369094e2acf0f6d407c042102

    SHA256

    3b43d9e7659828b07d73cbcfd0168b369df0b147ffe4c30915e23f6972405443

    SHA512

    5ecf62b8723ae1e4127102b157c31cb9f4fbc35c6fd57c304b667f098cccc1a89fb7e6fd35177815b4998242dd6e5b0149adef64e915ac4f391aa486f48ead5f

  • C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\1BP08jF6.exe

    Filesize

    194KB

    MD5

    35d718538c3e1346cb4fcf54aaa0f141

    SHA1

    234c0aa0465c27c190a83936e8e3aa3c4b991224

    SHA256

    97e62bfa90aca06c595fb150e36f56b4a285f58cc072b8c458ae79805523fc36

    SHA512

    4bcf5cabe93ec54608ccb95d80822f411bb32c2746be609873a493045913fb53e0a953e75f82dfe620d661f049437da7a70d34995dc915bb0b09426e97f0aec3

  • C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\1BP08jF6.exe

    Filesize

    194KB

    MD5

    35d718538c3e1346cb4fcf54aaa0f141

    SHA1

    234c0aa0465c27c190a83936e8e3aa3c4b991224

    SHA256

    97e62bfa90aca06c595fb150e36f56b4a285f58cc072b8c458ae79805523fc36

    SHA512

    4bcf5cabe93ec54608ccb95d80822f411bb32c2746be609873a493045913fb53e0a953e75f82dfe620d661f049437da7a70d34995dc915bb0b09426e97f0aec3

  • C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\2wE3273.exe

    Filesize

    423KB

    MD5

    c877d64e849131795b2e5e16360c8568

    SHA1

    8a0f863f64d55014647e1a072ea8f581e9ddc4b7

    SHA256

    c53a90de77e3f21bd4cf1ef2ff4be091091836c73c3dc899a9361ed418f15bc9

    SHA512

    e82e428faed2c87ab9186558d0aa0cb728309de0413b7a5fa4d9bb7f9b4c3bd535fc3746f0f04a7ddb2d86d9081941d7cb0132f5186846a11836fea9947aaaa1

  • C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\2wE3273.exe

    Filesize

    423KB

    MD5

    c877d64e849131795b2e5e16360c8568

    SHA1

    8a0f863f64d55014647e1a072ea8f581e9ddc4b7

    SHA256

    c53a90de77e3f21bd4cf1ef2ff4be091091836c73c3dc899a9361ed418f15bc9

    SHA512

    e82e428faed2c87ab9186558d0aa0cb728309de0413b7a5fa4d9bb7f9b4c3bd535fc3746f0f04a7ddb2d86d9081941d7cb0132f5186846a11836fea9947aaaa1

  • C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\2wE3273.exe

    Filesize

    423KB

    MD5

    c877d64e849131795b2e5e16360c8568

    SHA1

    8a0f863f64d55014647e1a072ea8f581e9ddc4b7

    SHA256

    c53a90de77e3f21bd4cf1ef2ff4be091091836c73c3dc899a9361ed418f15bc9

    SHA512

    e82e428faed2c87ab9186558d0aa0cb728309de0413b7a5fa4d9bb7f9b4c3bd535fc3746f0f04a7ddb2d86d9081941d7cb0132f5186846a11836fea9947aaaa1

  • \Users\Admin\AppData\Local\Temp\IXP000.TMP\zS5Ok44.exe

    Filesize

    1021KB

    MD5

    3d092422925cb8451eb659c1ed8d2a18

    SHA1

    d4662c5b8e13d10fc82d8597b5e5aa37fcf0c3e3

    SHA256

    260bc2c41009fda167c7e2f08fef0a66737c392970a93db93e77b4c452a89b38

    SHA512

    62297b2a8587bdb47e8acd259588b3e02c403ef24c3276022bfe59423202e84ad0d5b44ae3645cfca57d088baca1736b482a3214d0883a292f96c37e5a482be5

  • \Users\Admin\AppData\Local\Temp\IXP000.TMP\zS5Ok44.exe

    Filesize

    1021KB

    MD5

    3d092422925cb8451eb659c1ed8d2a18

    SHA1

    d4662c5b8e13d10fc82d8597b5e5aa37fcf0c3e3

    SHA256

    260bc2c41009fda167c7e2f08fef0a66737c392970a93db93e77b4c452a89b38

    SHA512

    62297b2a8587bdb47e8acd259588b3e02c403ef24c3276022bfe59423202e84ad0d5b44ae3645cfca57d088baca1736b482a3214d0883a292f96c37e5a482be5

  • \Users\Admin\AppData\Local\Temp\IXP001.TMP\Qw2HD23.exe

    Filesize

    725KB

    MD5

    6f59310239a4d61ff16456ae5bde9dcb

    SHA1

    ecc55b8d8142e13deebd091732e89ae3e3756219

    SHA256

    7cbd2c88041c8e645e456c8cd48677113bcd8801144424aeae91808aab8dca2e

    SHA512

    2a863b7a3479c61456385c777d27fa95231b5b87159da1ca9f8d2fa352ff15066638014cc4cea8bfb0823cf3999b72c0d4bdb7cf138e91b7428fdfb744ea68ea

  • \Users\Admin\AppData\Local\Temp\IXP001.TMP\Qw2HD23.exe

    Filesize

    725KB

    MD5

    6f59310239a4d61ff16456ae5bde9dcb

    SHA1

    ecc55b8d8142e13deebd091732e89ae3e3756219

    SHA256

    7cbd2c88041c8e645e456c8cd48677113bcd8801144424aeae91808aab8dca2e

    SHA512

    2a863b7a3479c61456385c777d27fa95231b5b87159da1ca9f8d2fa352ff15066638014cc4cea8bfb0823cf3999b72c0d4bdb7cf138e91b7428fdfb744ea68ea

  • \Users\Admin\AppData\Local\Temp\IXP002.TMP\DP0Oi52.exe

    Filesize

    479KB

    MD5

    934b9f55125ecfa9b670acdcf9382f77

    SHA1

    2f306ea1a399361369094e2acf0f6d407c042102

    SHA256

    3b43d9e7659828b07d73cbcfd0168b369df0b147ffe4c30915e23f6972405443

    SHA512

    5ecf62b8723ae1e4127102b157c31cb9f4fbc35c6fd57c304b667f098cccc1a89fb7e6fd35177815b4998242dd6e5b0149adef64e915ac4f391aa486f48ead5f

  • \Users\Admin\AppData\Local\Temp\IXP002.TMP\DP0Oi52.exe

    Filesize

    479KB

    MD5

    934b9f55125ecfa9b670acdcf9382f77

    SHA1

    2f306ea1a399361369094e2acf0f6d407c042102

    SHA256

    3b43d9e7659828b07d73cbcfd0168b369df0b147ffe4c30915e23f6972405443

    SHA512

    5ecf62b8723ae1e4127102b157c31cb9f4fbc35c6fd57c304b667f098cccc1a89fb7e6fd35177815b4998242dd6e5b0149adef64e915ac4f391aa486f48ead5f

  • \Users\Admin\AppData\Local\Temp\IXP003.TMP\1BP08jF6.exe

    Filesize

    194KB

    MD5

    35d718538c3e1346cb4fcf54aaa0f141

    SHA1

    234c0aa0465c27c190a83936e8e3aa3c4b991224

    SHA256

    97e62bfa90aca06c595fb150e36f56b4a285f58cc072b8c458ae79805523fc36

    SHA512

    4bcf5cabe93ec54608ccb95d80822f411bb32c2746be609873a493045913fb53e0a953e75f82dfe620d661f049437da7a70d34995dc915bb0b09426e97f0aec3

  • \Users\Admin\AppData\Local\Temp\IXP003.TMP\1BP08jF6.exe

    Filesize

    194KB

    MD5

    35d718538c3e1346cb4fcf54aaa0f141

    SHA1

    234c0aa0465c27c190a83936e8e3aa3c4b991224

    SHA256

    97e62bfa90aca06c595fb150e36f56b4a285f58cc072b8c458ae79805523fc36

    SHA512

    4bcf5cabe93ec54608ccb95d80822f411bb32c2746be609873a493045913fb53e0a953e75f82dfe620d661f049437da7a70d34995dc915bb0b09426e97f0aec3

  • \Users\Admin\AppData\Local\Temp\IXP003.TMP\2wE3273.exe

    Filesize

    423KB

    MD5

    c877d64e849131795b2e5e16360c8568

    SHA1

    8a0f863f64d55014647e1a072ea8f581e9ddc4b7

    SHA256

    c53a90de77e3f21bd4cf1ef2ff4be091091836c73c3dc899a9361ed418f15bc9

    SHA512

    e82e428faed2c87ab9186558d0aa0cb728309de0413b7a5fa4d9bb7f9b4c3bd535fc3746f0f04a7ddb2d86d9081941d7cb0132f5186846a11836fea9947aaaa1

  • \Users\Admin\AppData\Local\Temp\IXP003.TMP\2wE3273.exe

    Filesize

    423KB

    MD5

    c877d64e849131795b2e5e16360c8568

    SHA1

    8a0f863f64d55014647e1a072ea8f581e9ddc4b7

    SHA256

    c53a90de77e3f21bd4cf1ef2ff4be091091836c73c3dc899a9361ed418f15bc9

    SHA512

    e82e428faed2c87ab9186558d0aa0cb728309de0413b7a5fa4d9bb7f9b4c3bd535fc3746f0f04a7ddb2d86d9081941d7cb0132f5186846a11836fea9947aaaa1

  • \Users\Admin\AppData\Local\Temp\IXP003.TMP\2wE3273.exe

    Filesize

    423KB

    MD5

    c877d64e849131795b2e5e16360c8568

    SHA1

    8a0f863f64d55014647e1a072ea8f581e9ddc4b7

    SHA256

    c53a90de77e3f21bd4cf1ef2ff4be091091836c73c3dc899a9361ed418f15bc9

    SHA512

    e82e428faed2c87ab9186558d0aa0cb728309de0413b7a5fa4d9bb7f9b4c3bd535fc3746f0f04a7ddb2d86d9081941d7cb0132f5186846a11836fea9947aaaa1

  • \Users\Admin\AppData\Local\Temp\IXP003.TMP\2wE3273.exe

    Filesize

    423KB

    MD5

    c877d64e849131795b2e5e16360c8568

    SHA1

    8a0f863f64d55014647e1a072ea8f581e9ddc4b7

    SHA256

    c53a90de77e3f21bd4cf1ef2ff4be091091836c73c3dc899a9361ed418f15bc9

    SHA512

    e82e428faed2c87ab9186558d0aa0cb728309de0413b7a5fa4d9bb7f9b4c3bd535fc3746f0f04a7ddb2d86d9081941d7cb0132f5186846a11836fea9947aaaa1

  • \Users\Admin\AppData\Local\Temp\IXP003.TMP\2wE3273.exe

    Filesize

    423KB

    MD5

    c877d64e849131795b2e5e16360c8568

    SHA1

    8a0f863f64d55014647e1a072ea8f581e9ddc4b7

    SHA256

    c53a90de77e3f21bd4cf1ef2ff4be091091836c73c3dc899a9361ed418f15bc9

    SHA512

    e82e428faed2c87ab9186558d0aa0cb728309de0413b7a5fa4d9bb7f9b4c3bd535fc3746f0f04a7ddb2d86d9081941d7cb0132f5186846a11836fea9947aaaa1

  • \Users\Admin\AppData\Local\Temp\IXP003.TMP\2wE3273.exe

    Filesize

    423KB

    MD5

    c877d64e849131795b2e5e16360c8568

    SHA1

    8a0f863f64d55014647e1a072ea8f581e9ddc4b7

    SHA256

    c53a90de77e3f21bd4cf1ef2ff4be091091836c73c3dc899a9361ed418f15bc9

    SHA512

    e82e428faed2c87ab9186558d0aa0cb728309de0413b7a5fa4d9bb7f9b4c3bd535fc3746f0f04a7ddb2d86d9081941d7cb0132f5186846a11836fea9947aaaa1

  • \Users\Admin\AppData\Local\Temp\IXP003.TMP\2wE3273.exe

    Filesize

    423KB

    MD5

    c877d64e849131795b2e5e16360c8568

    SHA1

    8a0f863f64d55014647e1a072ea8f581e9ddc4b7

    SHA256

    c53a90de77e3f21bd4cf1ef2ff4be091091836c73c3dc899a9361ed418f15bc9

    SHA512

    e82e428faed2c87ab9186558d0aa0cb728309de0413b7a5fa4d9bb7f9b4c3bd535fc3746f0f04a7ddb2d86d9081941d7cb0132f5186846a11836fea9947aaaa1

  • memory/2556-80-0x0000000000400000-0x0000000000433000-memory.dmp

    Filesize

    204KB

  • memory/2556-81-0x0000000000400000-0x0000000000433000-memory.dmp

    Filesize

    204KB

  • memory/2556-90-0x0000000000400000-0x0000000000433000-memory.dmp

    Filesize

    204KB

  • memory/2556-88-0x0000000000400000-0x0000000000433000-memory.dmp

    Filesize

    204KB

  • memory/2556-79-0x0000000000400000-0x0000000000433000-memory.dmp

    Filesize

    204KB

  • memory/2556-82-0x0000000000400000-0x0000000000433000-memory.dmp

    Filesize

    204KB

  • memory/2556-84-0x0000000000400000-0x0000000000433000-memory.dmp

    Filesize

    204KB

  • memory/2556-86-0x0000000000400000-0x0000000000433000-memory.dmp

    Filesize

    204KB

  • memory/2556-85-0x00000000FFFDE000-0x00000000FFFDF000-memory.dmp

    Filesize

    4KB

  • memory/2556-83-0x0000000000400000-0x0000000000433000-memory.dmp

    Filesize

    204KB

  • memory/2660-61-0x00000000020D0000-0x00000000020E6000-memory.dmp

    Filesize

    88KB

  • memory/2660-47-0x00000000020D0000-0x00000000020E6000-memory.dmp

    Filesize

    88KB

  • memory/2660-57-0x00000000020D0000-0x00000000020E6000-memory.dmp

    Filesize

    88KB

  • memory/2660-49-0x00000000020D0000-0x00000000020E6000-memory.dmp

    Filesize

    88KB

  • memory/2660-69-0x00000000020D0000-0x00000000020E6000-memory.dmp

    Filesize

    88KB

  • memory/2660-67-0x00000000020D0000-0x00000000020E6000-memory.dmp

    Filesize

    88KB

  • memory/2660-65-0x00000000020D0000-0x00000000020E6000-memory.dmp

    Filesize

    88KB

  • memory/2660-59-0x00000000020D0000-0x00000000020E6000-memory.dmp

    Filesize

    88KB

  • memory/2660-45-0x00000000020D0000-0x00000000020E6000-memory.dmp

    Filesize

    88KB

  • memory/2660-63-0x00000000020D0000-0x00000000020E6000-memory.dmp

    Filesize

    88KB

  • memory/2660-51-0x00000000020D0000-0x00000000020E6000-memory.dmp

    Filesize

    88KB

  • memory/2660-53-0x00000000020D0000-0x00000000020E6000-memory.dmp

    Filesize

    88KB

  • memory/2660-55-0x00000000020D0000-0x00000000020E6000-memory.dmp

    Filesize

    88KB

  • memory/2660-43-0x00000000020D0000-0x00000000020E6000-memory.dmp

    Filesize

    88KB

  • memory/2660-42-0x00000000020D0000-0x00000000020E6000-memory.dmp

    Filesize

    88KB

  • memory/2660-41-0x00000000020D0000-0x00000000020EC000-memory.dmp

    Filesize

    112KB

  • memory/2660-40-0x00000000006E0000-0x00000000006FE000-memory.dmp

    Filesize

    120KB