Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    121s
  • max time network
    126s
  • platform
    windows7_x64
  • resource
    win7-20230831-en
  • resource tags

    arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
  • submitted
    11/10/2023, 23:24

General

  • Target

    11a8ae470687009f4f5f9f5cac01f4883923de60e70b34914b5d38fdb14dfdfa.exe

  • Size

    1.0MB

  • MD5

    d6eecce0b53344540cee927edd9a0c75

  • SHA1

    449d58b1f0e32e58914208b067cb7a7810061f50

  • SHA256

    11a8ae470687009f4f5f9f5cac01f4883923de60e70b34914b5d38fdb14dfdfa

  • SHA512

    d71eb288cd2b85afcaa26e09024aa6fb95da6a3ceddfffa48d4ff5fca4401bc2d4212de6dd2c7ab3573a8d50765c64ec5c60218fa4e2cb2ba8f376339874c1fa

  • SSDEEP

    24576:5yDNFeC35V6DZSp+28bZ5hE+5m9fHfowHrhfV:sJFevDUp+JbxE+eXo

Malware Config

Signatures

  • Detects Healer an antivirus disabler dropper 5 IoCs
  • Healer

    Healer an antivirus disabler dropper.

  • Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs
  • Executes dropped EXE 5 IoCs
  • Loads dropped DLL 15 IoCs
  • Adds Run key to start application 2 TTPs 5 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Program crash 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 54 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\11a8ae470687009f4f5f9f5cac01f4883923de60e70b34914b5d38fdb14dfdfa.exe
    "C:\Users\Admin\AppData\Local\Temp\11a8ae470687009f4f5f9f5cac01f4883923de60e70b34914b5d38fdb14dfdfa.exe"
    1⤵
    • Loads dropped DLL
    • Adds Run key to start application
    • Suspicious use of WriteProcessMemory
    PID:2480
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z5871958.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z5871958.exe
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Adds Run key to start application
      • Suspicious use of WriteProcessMemory
      PID:2828
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z3089294.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z3089294.exe
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Adds Run key to start application
        • Suspicious use of WriteProcessMemory
        PID:2684
        • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\z3546484.exe
          C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\z3546484.exe
          4⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • Adds Run key to start application
          • Suspicious use of WriteProcessMemory
          PID:2976
          • C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\z4468748.exe
            C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\z4468748.exe
            5⤵
            • Executes dropped EXE
            • Loads dropped DLL
            • Adds Run key to start application
            • Suspicious use of WriteProcessMemory
            PID:2784
            • C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q6975829.exe
              C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q6975829.exe
              6⤵
              • Executes dropped EXE
              • Loads dropped DLL
              • Suspicious use of SetThreadContext
              • Suspicious use of WriteProcessMemory
              PID:2704
              • C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
                "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
                7⤵
                • Modifies Windows Defender Real-time Protection settings
                • Suspicious behavior: EnumeratesProcesses
                • Suspicious use of AdjustPrivilegeToken
                PID:1296
              • C:\Windows\SysWOW64\WerFault.exe
                C:\Windows\SysWOW64\WerFault.exe -u -p 2704 -s 272
                7⤵
                • Loads dropped DLL
                • Program crash
                PID:1956

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z5871958.exe

    Filesize

    969KB

    MD5

    fe64209c5da9e12103cb456e6da6369f

    SHA1

    10861b83f740096f418aee2426910454ae30f432

    SHA256

    de308f9f41f565f4929d1c6b355d663a80402e54d4d13b681e2308faacaabfde

    SHA512

    898d476576c45ca167e90948dfad420dd16f39009690435e8b06f57d05ba0fd1b29c5a43fb57e52824cebd16925a233249f530902304be0db69e77da21982ca1

  • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z5871958.exe

    Filesize

    969KB

    MD5

    fe64209c5da9e12103cb456e6da6369f

    SHA1

    10861b83f740096f418aee2426910454ae30f432

    SHA256

    de308f9f41f565f4929d1c6b355d663a80402e54d4d13b681e2308faacaabfde

    SHA512

    898d476576c45ca167e90948dfad420dd16f39009690435e8b06f57d05ba0fd1b29c5a43fb57e52824cebd16925a233249f530902304be0db69e77da21982ca1

  • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z3089294.exe

    Filesize

    787KB

    MD5

    46080304f3fe6bbe8223d22a159fcfa8

    SHA1

    3b737f6533f9665afaca73c46c63776d3f6d88d7

    SHA256

    d4a55fe9ca67fa5af01faf88abb1a3e5adf042fd889f8870bb8aeb408f56c243

    SHA512

    f1af22244cb1c8150b6db5522478a327be446d82d9986ade4bdd52b7044ae188ef59426a7512fcd07aea5fd93d58692c9f2210efd6b1a86a8eda4f43c0eac641

  • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z3089294.exe

    Filesize

    787KB

    MD5

    46080304f3fe6bbe8223d22a159fcfa8

    SHA1

    3b737f6533f9665afaca73c46c63776d3f6d88d7

    SHA256

    d4a55fe9ca67fa5af01faf88abb1a3e5adf042fd889f8870bb8aeb408f56c243

    SHA512

    f1af22244cb1c8150b6db5522478a327be446d82d9986ade4bdd52b7044ae188ef59426a7512fcd07aea5fd93d58692c9f2210efd6b1a86a8eda4f43c0eac641

  • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\z3546484.exe

    Filesize

    603KB

    MD5

    0757c758ecd105d3408a2d534e0e0564

    SHA1

    81ed4f084c8c88111f4afb6d52e29e3859eff6e9

    SHA256

    3d50de1fe3759ade6804329052531f95dd9ac11a3749f2e3087a492c13be85a9

    SHA512

    9b13d7c41a1cdad7fa572d584fc482849ec4228e989139f4822dece940051fa901e55d306c2557aa2dd86184be00a86e98ab630170bbe810067d5c06544b4b17

  • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\z3546484.exe

    Filesize

    603KB

    MD5

    0757c758ecd105d3408a2d534e0e0564

    SHA1

    81ed4f084c8c88111f4afb6d52e29e3859eff6e9

    SHA256

    3d50de1fe3759ade6804329052531f95dd9ac11a3749f2e3087a492c13be85a9

    SHA512

    9b13d7c41a1cdad7fa572d584fc482849ec4228e989139f4822dece940051fa901e55d306c2557aa2dd86184be00a86e98ab630170bbe810067d5c06544b4b17

  • C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\z4468748.exe

    Filesize

    344KB

    MD5

    6a2b150961719edaa95558dde1217d43

    SHA1

    0d4bc05604d78b37e1d0e9d6311f74aa4770d958

    SHA256

    2bf1ba401fc9fd3a4a43e1429d5bd98350bf3ea4d4a1e67e2a4eac6b13507e3a

    SHA512

    0d27cd3ee001fd681816a50840b6d11ad9b5f025684a9a86df44430d4335b6f360e100ed8df8714fc07cc8a7cd5368ae7892f318a14eb2b3dac65582864d96d9

  • C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\z4468748.exe

    Filesize

    344KB

    MD5

    6a2b150961719edaa95558dde1217d43

    SHA1

    0d4bc05604d78b37e1d0e9d6311f74aa4770d958

    SHA256

    2bf1ba401fc9fd3a4a43e1429d5bd98350bf3ea4d4a1e67e2a4eac6b13507e3a

    SHA512

    0d27cd3ee001fd681816a50840b6d11ad9b5f025684a9a86df44430d4335b6f360e100ed8df8714fc07cc8a7cd5368ae7892f318a14eb2b3dac65582864d96d9

  • C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q6975829.exe

    Filesize

    220KB

    MD5

    e13574a07a51506136f7c42930873bc6

    SHA1

    b0ffd13395b41ff3ef04c30d237d0b523d33f869

    SHA256

    918b5984ce73aadcaccb78067dba347ad7d54191898b6bc3512e1b23837bd39d

    SHA512

    055189aeb960cb03ab121c0b6738c9fea3f0729959482ee12046d5d8196005a01a506b4d619d201d610a9fece55a53a5db26491cd46c7bb504f19eaac82d4aa4

  • C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q6975829.exe

    Filesize

    220KB

    MD5

    e13574a07a51506136f7c42930873bc6

    SHA1

    b0ffd13395b41ff3ef04c30d237d0b523d33f869

    SHA256

    918b5984ce73aadcaccb78067dba347ad7d54191898b6bc3512e1b23837bd39d

    SHA512

    055189aeb960cb03ab121c0b6738c9fea3f0729959482ee12046d5d8196005a01a506b4d619d201d610a9fece55a53a5db26491cd46c7bb504f19eaac82d4aa4

  • C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q6975829.exe

    Filesize

    220KB

    MD5

    e13574a07a51506136f7c42930873bc6

    SHA1

    b0ffd13395b41ff3ef04c30d237d0b523d33f869

    SHA256

    918b5984ce73aadcaccb78067dba347ad7d54191898b6bc3512e1b23837bd39d

    SHA512

    055189aeb960cb03ab121c0b6738c9fea3f0729959482ee12046d5d8196005a01a506b4d619d201d610a9fece55a53a5db26491cd46c7bb504f19eaac82d4aa4

  • \Users\Admin\AppData\Local\Temp\IXP000.TMP\z5871958.exe

    Filesize

    969KB

    MD5

    fe64209c5da9e12103cb456e6da6369f

    SHA1

    10861b83f740096f418aee2426910454ae30f432

    SHA256

    de308f9f41f565f4929d1c6b355d663a80402e54d4d13b681e2308faacaabfde

    SHA512

    898d476576c45ca167e90948dfad420dd16f39009690435e8b06f57d05ba0fd1b29c5a43fb57e52824cebd16925a233249f530902304be0db69e77da21982ca1

  • \Users\Admin\AppData\Local\Temp\IXP000.TMP\z5871958.exe

    Filesize

    969KB

    MD5

    fe64209c5da9e12103cb456e6da6369f

    SHA1

    10861b83f740096f418aee2426910454ae30f432

    SHA256

    de308f9f41f565f4929d1c6b355d663a80402e54d4d13b681e2308faacaabfde

    SHA512

    898d476576c45ca167e90948dfad420dd16f39009690435e8b06f57d05ba0fd1b29c5a43fb57e52824cebd16925a233249f530902304be0db69e77da21982ca1

  • \Users\Admin\AppData\Local\Temp\IXP001.TMP\z3089294.exe

    Filesize

    787KB

    MD5

    46080304f3fe6bbe8223d22a159fcfa8

    SHA1

    3b737f6533f9665afaca73c46c63776d3f6d88d7

    SHA256

    d4a55fe9ca67fa5af01faf88abb1a3e5adf042fd889f8870bb8aeb408f56c243

    SHA512

    f1af22244cb1c8150b6db5522478a327be446d82d9986ade4bdd52b7044ae188ef59426a7512fcd07aea5fd93d58692c9f2210efd6b1a86a8eda4f43c0eac641

  • \Users\Admin\AppData\Local\Temp\IXP001.TMP\z3089294.exe

    Filesize

    787KB

    MD5

    46080304f3fe6bbe8223d22a159fcfa8

    SHA1

    3b737f6533f9665afaca73c46c63776d3f6d88d7

    SHA256

    d4a55fe9ca67fa5af01faf88abb1a3e5adf042fd889f8870bb8aeb408f56c243

    SHA512

    f1af22244cb1c8150b6db5522478a327be446d82d9986ade4bdd52b7044ae188ef59426a7512fcd07aea5fd93d58692c9f2210efd6b1a86a8eda4f43c0eac641

  • \Users\Admin\AppData\Local\Temp\IXP002.TMP\z3546484.exe

    Filesize

    603KB

    MD5

    0757c758ecd105d3408a2d534e0e0564

    SHA1

    81ed4f084c8c88111f4afb6d52e29e3859eff6e9

    SHA256

    3d50de1fe3759ade6804329052531f95dd9ac11a3749f2e3087a492c13be85a9

    SHA512

    9b13d7c41a1cdad7fa572d584fc482849ec4228e989139f4822dece940051fa901e55d306c2557aa2dd86184be00a86e98ab630170bbe810067d5c06544b4b17

  • \Users\Admin\AppData\Local\Temp\IXP002.TMP\z3546484.exe

    Filesize

    603KB

    MD5

    0757c758ecd105d3408a2d534e0e0564

    SHA1

    81ed4f084c8c88111f4afb6d52e29e3859eff6e9

    SHA256

    3d50de1fe3759ade6804329052531f95dd9ac11a3749f2e3087a492c13be85a9

    SHA512

    9b13d7c41a1cdad7fa572d584fc482849ec4228e989139f4822dece940051fa901e55d306c2557aa2dd86184be00a86e98ab630170bbe810067d5c06544b4b17

  • \Users\Admin\AppData\Local\Temp\IXP003.TMP\z4468748.exe

    Filesize

    344KB

    MD5

    6a2b150961719edaa95558dde1217d43

    SHA1

    0d4bc05604d78b37e1d0e9d6311f74aa4770d958

    SHA256

    2bf1ba401fc9fd3a4a43e1429d5bd98350bf3ea4d4a1e67e2a4eac6b13507e3a

    SHA512

    0d27cd3ee001fd681816a50840b6d11ad9b5f025684a9a86df44430d4335b6f360e100ed8df8714fc07cc8a7cd5368ae7892f318a14eb2b3dac65582864d96d9

  • \Users\Admin\AppData\Local\Temp\IXP003.TMP\z4468748.exe

    Filesize

    344KB

    MD5

    6a2b150961719edaa95558dde1217d43

    SHA1

    0d4bc05604d78b37e1d0e9d6311f74aa4770d958

    SHA256

    2bf1ba401fc9fd3a4a43e1429d5bd98350bf3ea4d4a1e67e2a4eac6b13507e3a

    SHA512

    0d27cd3ee001fd681816a50840b6d11ad9b5f025684a9a86df44430d4335b6f360e100ed8df8714fc07cc8a7cd5368ae7892f318a14eb2b3dac65582864d96d9

  • \Users\Admin\AppData\Local\Temp\IXP004.TMP\q6975829.exe

    Filesize

    220KB

    MD5

    e13574a07a51506136f7c42930873bc6

    SHA1

    b0ffd13395b41ff3ef04c30d237d0b523d33f869

    SHA256

    918b5984ce73aadcaccb78067dba347ad7d54191898b6bc3512e1b23837bd39d

    SHA512

    055189aeb960cb03ab121c0b6738c9fea3f0729959482ee12046d5d8196005a01a506b4d619d201d610a9fece55a53a5db26491cd46c7bb504f19eaac82d4aa4

  • \Users\Admin\AppData\Local\Temp\IXP004.TMP\q6975829.exe

    Filesize

    220KB

    MD5

    e13574a07a51506136f7c42930873bc6

    SHA1

    b0ffd13395b41ff3ef04c30d237d0b523d33f869

    SHA256

    918b5984ce73aadcaccb78067dba347ad7d54191898b6bc3512e1b23837bd39d

    SHA512

    055189aeb960cb03ab121c0b6738c9fea3f0729959482ee12046d5d8196005a01a506b4d619d201d610a9fece55a53a5db26491cd46c7bb504f19eaac82d4aa4

  • \Users\Admin\AppData\Local\Temp\IXP004.TMP\q6975829.exe

    Filesize

    220KB

    MD5

    e13574a07a51506136f7c42930873bc6

    SHA1

    b0ffd13395b41ff3ef04c30d237d0b523d33f869

    SHA256

    918b5984ce73aadcaccb78067dba347ad7d54191898b6bc3512e1b23837bd39d

    SHA512

    055189aeb960cb03ab121c0b6738c9fea3f0729959482ee12046d5d8196005a01a506b4d619d201d610a9fece55a53a5db26491cd46c7bb504f19eaac82d4aa4

  • \Users\Admin\AppData\Local\Temp\IXP004.TMP\q6975829.exe

    Filesize

    220KB

    MD5

    e13574a07a51506136f7c42930873bc6

    SHA1

    b0ffd13395b41ff3ef04c30d237d0b523d33f869

    SHA256

    918b5984ce73aadcaccb78067dba347ad7d54191898b6bc3512e1b23837bd39d

    SHA512

    055189aeb960cb03ab121c0b6738c9fea3f0729959482ee12046d5d8196005a01a506b4d619d201d610a9fece55a53a5db26491cd46c7bb504f19eaac82d4aa4

  • \Users\Admin\AppData\Local\Temp\IXP004.TMP\q6975829.exe

    Filesize

    220KB

    MD5

    e13574a07a51506136f7c42930873bc6

    SHA1

    b0ffd13395b41ff3ef04c30d237d0b523d33f869

    SHA256

    918b5984ce73aadcaccb78067dba347ad7d54191898b6bc3512e1b23837bd39d

    SHA512

    055189aeb960cb03ab121c0b6738c9fea3f0729959482ee12046d5d8196005a01a506b4d619d201d610a9fece55a53a5db26491cd46c7bb504f19eaac82d4aa4

  • \Users\Admin\AppData\Local\Temp\IXP004.TMP\q6975829.exe

    Filesize

    220KB

    MD5

    e13574a07a51506136f7c42930873bc6

    SHA1

    b0ffd13395b41ff3ef04c30d237d0b523d33f869

    SHA256

    918b5984ce73aadcaccb78067dba347ad7d54191898b6bc3512e1b23837bd39d

    SHA512

    055189aeb960cb03ab121c0b6738c9fea3f0729959482ee12046d5d8196005a01a506b4d619d201d610a9fece55a53a5db26491cd46c7bb504f19eaac82d4aa4

  • \Users\Admin\AppData\Local\Temp\IXP004.TMP\q6975829.exe

    Filesize

    220KB

    MD5

    e13574a07a51506136f7c42930873bc6

    SHA1

    b0ffd13395b41ff3ef04c30d237d0b523d33f869

    SHA256

    918b5984ce73aadcaccb78067dba347ad7d54191898b6bc3512e1b23837bd39d

    SHA512

    055189aeb960cb03ab121c0b6738c9fea3f0729959482ee12046d5d8196005a01a506b4d619d201d610a9fece55a53a5db26491cd46c7bb504f19eaac82d4aa4

  • memory/1296-56-0x0000000000400000-0x000000000040A000-memory.dmp

    Filesize

    40KB

  • memory/1296-58-0x0000000000400000-0x000000000040A000-memory.dmp

    Filesize

    40KB

  • memory/1296-60-0x0000000000400000-0x000000000040A000-memory.dmp

    Filesize

    40KB

  • memory/1296-62-0x0000000000400000-0x000000000040A000-memory.dmp

    Filesize

    40KB

  • memory/1296-57-0x00000000FFFDE000-0x00000000FFFDF000-memory.dmp

    Filesize

    4KB

  • memory/1296-55-0x0000000000400000-0x000000000040A000-memory.dmp

    Filesize

    40KB

  • memory/1296-54-0x0000000000400000-0x000000000040A000-memory.dmp

    Filesize

    40KB

  • memory/1296-53-0x0000000000400000-0x000000000040A000-memory.dmp

    Filesize

    40KB