Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    117s
  • max time network
    135s
  • platform
    windows7_x64
  • resource
    win7-20230831-en
  • resource tags

    arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
  • submitted
    11/10/2023, 23:28

General

  • Target

    df7e285ea6b9e1a58685b9eddfa4440eafc60e7819af4eed2354d7335784b8a6.exe

  • Size

    1.2MB

  • MD5

    7cad47148c439a91296a9f1862ed9bbc

  • SHA1

    6cc4920d08637eb04f9cd19223f9741170849f1d

  • SHA256

    df7e285ea6b9e1a58685b9eddfa4440eafc60e7819af4eed2354d7335784b8a6

  • SHA512

    9ffc1a7ec0acb82447f63199d515f60072b9c51163e4ca6d7c2212fe82c05cf201d5f4074620bcbbc684aa5e5ccc1fde5f4d84146ccce4664783dde70c9a8fa3

  • SSDEEP

    24576:gymtSNvzsJJ7f+os2bvLQo4N9OTdPZPH2cs6vgaxqM:nmtAIJJ7fRHrLkN9OTd9Wt6nk

Malware Config

Signatures

  • Detects Healer an antivirus disabler dropper 5 IoCs
  • Healer

    Healer an antivirus disabler dropper.

  • Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs
  • Executes dropped EXE 6 IoCs
  • Loads dropped DLL 17 IoCs
  • Adds Run key to start application 2 TTPs 6 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Program crash 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 61 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\df7e285ea6b9e1a58685b9eddfa4440eafc60e7819af4eed2354d7335784b8a6.exe
    "C:\Users\Admin\AppData\Local\Temp\df7e285ea6b9e1a58685b9eddfa4440eafc60e7819af4eed2354d7335784b8a6.exe"
    1⤵
    • Loads dropped DLL
    • Adds Run key to start application
    • Suspicious use of WriteProcessMemory
    PID:1180
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v7128401.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v7128401.exe
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Adds Run key to start application
      • Suspicious use of WriteProcessMemory
      PID:1964
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v2260295.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v2260295.exe
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Adds Run key to start application
        • Suspicious use of WriteProcessMemory
        PID:2344
        • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\v5165409.exe
          C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\v5165409.exe
          4⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • Adds Run key to start application
          • Suspicious use of WriteProcessMemory
          PID:2728
          • C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\v2447008.exe
            C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\v2447008.exe
            5⤵
            • Executes dropped EXE
            • Loads dropped DLL
            • Adds Run key to start application
            • Suspicious use of WriteProcessMemory
            PID:2812
            • C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\v0253104.exe
              C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\v0253104.exe
              6⤵
              • Executes dropped EXE
              • Loads dropped DLL
              • Adds Run key to start application
              • Suspicious use of WriteProcessMemory
              PID:2744
              • C:\Users\Admin\AppData\Local\Temp\IXP005.TMP\a3933448.exe
                C:\Users\Admin\AppData\Local\Temp\IXP005.TMP\a3933448.exe
                7⤵
                • Executes dropped EXE
                • Loads dropped DLL
                • Suspicious use of SetThreadContext
                • Suspicious use of WriteProcessMemory
                PID:3028
                • C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
                  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
                  8⤵
                  • Modifies Windows Defender Real-time Protection settings
                  • Suspicious behavior: EnumeratesProcesses
                  • Suspicious use of AdjustPrivilegeToken
                  PID:1380
                • C:\Windows\SysWOW64\WerFault.exe
                  C:\Windows\SysWOW64\WerFault.exe -u -p 3028 -s 272
                  8⤵
                  • Loads dropped DLL
                  • Program crash
                  PID:2900

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v7128401.exe

    Filesize

    1.1MB

    MD5

    ec06ddc5d5b20ce8abe1d3ebce52bb75

    SHA1

    d36da451805eb8d8a4febe186ed6a0d59f8b2632

    SHA256

    67837ac1508f05b8a454d9efc578e7eb5a87602a8c5b5378a67cd72b94b7b84e

    SHA512

    7d61ddcf37aab37ba2f5047a2527dfd4cee229d7d50d6fd45d04452093481b7a0bf8ad1a2c5449b454dcb049c02f0f59b403df7e6d84200fba8abe5dcf8edc6d

  • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v7128401.exe

    Filesize

    1.1MB

    MD5

    ec06ddc5d5b20ce8abe1d3ebce52bb75

    SHA1

    d36da451805eb8d8a4febe186ed6a0d59f8b2632

    SHA256

    67837ac1508f05b8a454d9efc578e7eb5a87602a8c5b5378a67cd72b94b7b84e

    SHA512

    7d61ddcf37aab37ba2f5047a2527dfd4cee229d7d50d6fd45d04452093481b7a0bf8ad1a2c5449b454dcb049c02f0f59b403df7e6d84200fba8abe5dcf8edc6d

  • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v2260295.exe

    Filesize

    936KB

    MD5

    521e15044d968d8e4522415dfdaecce9

    SHA1

    d58e3f1758c38019504f6fd6ad06f7497cfe6ed8

    SHA256

    02a8c5e3703b207cf14fb1808418cc6a670fd80287a1eb371a34f0a8d2daef3a

    SHA512

    8710d79a5f0f1d9327528b58c9d024a3fb264beb15eb212c78cdc47c2b4959d086453bbfdd392dfcd54cf5ec067227598138076d0408813c985d3dfe11ab97df

  • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v2260295.exe

    Filesize

    936KB

    MD5

    521e15044d968d8e4522415dfdaecce9

    SHA1

    d58e3f1758c38019504f6fd6ad06f7497cfe6ed8

    SHA256

    02a8c5e3703b207cf14fb1808418cc6a670fd80287a1eb371a34f0a8d2daef3a

    SHA512

    8710d79a5f0f1d9327528b58c9d024a3fb264beb15eb212c78cdc47c2b4959d086453bbfdd392dfcd54cf5ec067227598138076d0408813c985d3dfe11ab97df

  • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\v5165409.exe

    Filesize

    780KB

    MD5

    a40f0200f000feb6d6f2be5eddc1973c

    SHA1

    1d69065c9e620e02f90c2ac7ecfc340663029382

    SHA256

    c4f6553963ad4fb383a3a3ca471539edecebfb2c92c21cf846e8364986e28112

    SHA512

    ba37e2a99a126fcef6699a406a71c6123644ed6c25c0986b581b37a8892c466a744793d4bd90885e84f6bdb79baed42c22823b22afa524b54ff50390da5a997d

  • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\v5165409.exe

    Filesize

    780KB

    MD5

    a40f0200f000feb6d6f2be5eddc1973c

    SHA1

    1d69065c9e620e02f90c2ac7ecfc340663029382

    SHA256

    c4f6553963ad4fb383a3a3ca471539edecebfb2c92c21cf846e8364986e28112

    SHA512

    ba37e2a99a126fcef6699a406a71c6123644ed6c25c0986b581b37a8892c466a744793d4bd90885e84f6bdb79baed42c22823b22afa524b54ff50390da5a997d

  • C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\v2447008.exe

    Filesize

    603KB

    MD5

    370e425e4bb97bce0292040667800481

    SHA1

    9db91d65558dd0bfc426f6ba4f6e4512ed1d9b9b

    SHA256

    84773e81c9c999d57ca66fef792aa2e33d44cd5c25b36d10eed32c557a06124a

    SHA512

    51905e7d5faa80f96446a72fba9ed03b67ecca88b58a22f152bbbfac1ea73c94be3357aa4540022f28ade4a0c5a5733818a050327359812f18a4de29776ff6d6

  • C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\v2447008.exe

    Filesize

    603KB

    MD5

    370e425e4bb97bce0292040667800481

    SHA1

    9db91d65558dd0bfc426f6ba4f6e4512ed1d9b9b

    SHA256

    84773e81c9c999d57ca66fef792aa2e33d44cd5c25b36d10eed32c557a06124a

    SHA512

    51905e7d5faa80f96446a72fba9ed03b67ecca88b58a22f152bbbfac1ea73c94be3357aa4540022f28ade4a0c5a5733818a050327359812f18a4de29776ff6d6

  • C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\v0253104.exe

    Filesize

    344KB

    MD5

    03af1e3d984bbf04f3e1a53b07628cce

    SHA1

    d18a68c6e986b263603ee99b7ba8b3b5966bd9ed

    SHA256

    0cad60d3fd481caf8350edb062fcbe88d977a43d4c05199986470180db6df557

    SHA512

    a6fa77842ab66102b6b202968d95a30c01a0826fed294f69290a8e9d5ebd7de95b29b96a508cecc9d86929c17da9d11f7bfb792a0b9e9457f6c336dd38482ac3

  • C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\v0253104.exe

    Filesize

    344KB

    MD5

    03af1e3d984bbf04f3e1a53b07628cce

    SHA1

    d18a68c6e986b263603ee99b7ba8b3b5966bd9ed

    SHA256

    0cad60d3fd481caf8350edb062fcbe88d977a43d4c05199986470180db6df557

    SHA512

    a6fa77842ab66102b6b202968d95a30c01a0826fed294f69290a8e9d5ebd7de95b29b96a508cecc9d86929c17da9d11f7bfb792a0b9e9457f6c336dd38482ac3

  • C:\Users\Admin\AppData\Local\Temp\IXP005.TMP\a3933448.exe

    Filesize

    220KB

    MD5

    50e51b4add0556507ae3d434c58cb6b6

    SHA1

    52b0ee31cdb239974954a6706038ac11885249f7

    SHA256

    e373bb8edc3bc7f391d052ebef7b14a6cfb518e9401057e932ac89ddb0442f34

    SHA512

    a66f2544fde0163504925f3f35859f1f0fd66918e0109b1c2cd6a38518b2491662aec5b9d28c02c36fbb2ddd14798bc70094d20367cb890e133da2b16455fa5c

  • C:\Users\Admin\AppData\Local\Temp\IXP005.TMP\a3933448.exe

    Filesize

    220KB

    MD5

    50e51b4add0556507ae3d434c58cb6b6

    SHA1

    52b0ee31cdb239974954a6706038ac11885249f7

    SHA256

    e373bb8edc3bc7f391d052ebef7b14a6cfb518e9401057e932ac89ddb0442f34

    SHA512

    a66f2544fde0163504925f3f35859f1f0fd66918e0109b1c2cd6a38518b2491662aec5b9d28c02c36fbb2ddd14798bc70094d20367cb890e133da2b16455fa5c

  • C:\Users\Admin\AppData\Local\Temp\IXP005.TMP\a3933448.exe

    Filesize

    220KB

    MD5

    50e51b4add0556507ae3d434c58cb6b6

    SHA1

    52b0ee31cdb239974954a6706038ac11885249f7

    SHA256

    e373bb8edc3bc7f391d052ebef7b14a6cfb518e9401057e932ac89ddb0442f34

    SHA512

    a66f2544fde0163504925f3f35859f1f0fd66918e0109b1c2cd6a38518b2491662aec5b9d28c02c36fbb2ddd14798bc70094d20367cb890e133da2b16455fa5c

  • \Users\Admin\AppData\Local\Temp\IXP000.TMP\v7128401.exe

    Filesize

    1.1MB

    MD5

    ec06ddc5d5b20ce8abe1d3ebce52bb75

    SHA1

    d36da451805eb8d8a4febe186ed6a0d59f8b2632

    SHA256

    67837ac1508f05b8a454d9efc578e7eb5a87602a8c5b5378a67cd72b94b7b84e

    SHA512

    7d61ddcf37aab37ba2f5047a2527dfd4cee229d7d50d6fd45d04452093481b7a0bf8ad1a2c5449b454dcb049c02f0f59b403df7e6d84200fba8abe5dcf8edc6d

  • \Users\Admin\AppData\Local\Temp\IXP000.TMP\v7128401.exe

    Filesize

    1.1MB

    MD5

    ec06ddc5d5b20ce8abe1d3ebce52bb75

    SHA1

    d36da451805eb8d8a4febe186ed6a0d59f8b2632

    SHA256

    67837ac1508f05b8a454d9efc578e7eb5a87602a8c5b5378a67cd72b94b7b84e

    SHA512

    7d61ddcf37aab37ba2f5047a2527dfd4cee229d7d50d6fd45d04452093481b7a0bf8ad1a2c5449b454dcb049c02f0f59b403df7e6d84200fba8abe5dcf8edc6d

  • \Users\Admin\AppData\Local\Temp\IXP001.TMP\v2260295.exe

    Filesize

    936KB

    MD5

    521e15044d968d8e4522415dfdaecce9

    SHA1

    d58e3f1758c38019504f6fd6ad06f7497cfe6ed8

    SHA256

    02a8c5e3703b207cf14fb1808418cc6a670fd80287a1eb371a34f0a8d2daef3a

    SHA512

    8710d79a5f0f1d9327528b58c9d024a3fb264beb15eb212c78cdc47c2b4959d086453bbfdd392dfcd54cf5ec067227598138076d0408813c985d3dfe11ab97df

  • \Users\Admin\AppData\Local\Temp\IXP001.TMP\v2260295.exe

    Filesize

    936KB

    MD5

    521e15044d968d8e4522415dfdaecce9

    SHA1

    d58e3f1758c38019504f6fd6ad06f7497cfe6ed8

    SHA256

    02a8c5e3703b207cf14fb1808418cc6a670fd80287a1eb371a34f0a8d2daef3a

    SHA512

    8710d79a5f0f1d9327528b58c9d024a3fb264beb15eb212c78cdc47c2b4959d086453bbfdd392dfcd54cf5ec067227598138076d0408813c985d3dfe11ab97df

  • \Users\Admin\AppData\Local\Temp\IXP002.TMP\v5165409.exe

    Filesize

    780KB

    MD5

    a40f0200f000feb6d6f2be5eddc1973c

    SHA1

    1d69065c9e620e02f90c2ac7ecfc340663029382

    SHA256

    c4f6553963ad4fb383a3a3ca471539edecebfb2c92c21cf846e8364986e28112

    SHA512

    ba37e2a99a126fcef6699a406a71c6123644ed6c25c0986b581b37a8892c466a744793d4bd90885e84f6bdb79baed42c22823b22afa524b54ff50390da5a997d

  • \Users\Admin\AppData\Local\Temp\IXP002.TMP\v5165409.exe

    Filesize

    780KB

    MD5

    a40f0200f000feb6d6f2be5eddc1973c

    SHA1

    1d69065c9e620e02f90c2ac7ecfc340663029382

    SHA256

    c4f6553963ad4fb383a3a3ca471539edecebfb2c92c21cf846e8364986e28112

    SHA512

    ba37e2a99a126fcef6699a406a71c6123644ed6c25c0986b581b37a8892c466a744793d4bd90885e84f6bdb79baed42c22823b22afa524b54ff50390da5a997d

  • \Users\Admin\AppData\Local\Temp\IXP003.TMP\v2447008.exe

    Filesize

    603KB

    MD5

    370e425e4bb97bce0292040667800481

    SHA1

    9db91d65558dd0bfc426f6ba4f6e4512ed1d9b9b

    SHA256

    84773e81c9c999d57ca66fef792aa2e33d44cd5c25b36d10eed32c557a06124a

    SHA512

    51905e7d5faa80f96446a72fba9ed03b67ecca88b58a22f152bbbfac1ea73c94be3357aa4540022f28ade4a0c5a5733818a050327359812f18a4de29776ff6d6

  • \Users\Admin\AppData\Local\Temp\IXP003.TMP\v2447008.exe

    Filesize

    603KB

    MD5

    370e425e4bb97bce0292040667800481

    SHA1

    9db91d65558dd0bfc426f6ba4f6e4512ed1d9b9b

    SHA256

    84773e81c9c999d57ca66fef792aa2e33d44cd5c25b36d10eed32c557a06124a

    SHA512

    51905e7d5faa80f96446a72fba9ed03b67ecca88b58a22f152bbbfac1ea73c94be3357aa4540022f28ade4a0c5a5733818a050327359812f18a4de29776ff6d6

  • \Users\Admin\AppData\Local\Temp\IXP004.TMP\v0253104.exe

    Filesize

    344KB

    MD5

    03af1e3d984bbf04f3e1a53b07628cce

    SHA1

    d18a68c6e986b263603ee99b7ba8b3b5966bd9ed

    SHA256

    0cad60d3fd481caf8350edb062fcbe88d977a43d4c05199986470180db6df557

    SHA512

    a6fa77842ab66102b6b202968d95a30c01a0826fed294f69290a8e9d5ebd7de95b29b96a508cecc9d86929c17da9d11f7bfb792a0b9e9457f6c336dd38482ac3

  • \Users\Admin\AppData\Local\Temp\IXP004.TMP\v0253104.exe

    Filesize

    344KB

    MD5

    03af1e3d984bbf04f3e1a53b07628cce

    SHA1

    d18a68c6e986b263603ee99b7ba8b3b5966bd9ed

    SHA256

    0cad60d3fd481caf8350edb062fcbe88d977a43d4c05199986470180db6df557

    SHA512

    a6fa77842ab66102b6b202968d95a30c01a0826fed294f69290a8e9d5ebd7de95b29b96a508cecc9d86929c17da9d11f7bfb792a0b9e9457f6c336dd38482ac3

  • \Users\Admin\AppData\Local\Temp\IXP005.TMP\a3933448.exe

    Filesize

    220KB

    MD5

    50e51b4add0556507ae3d434c58cb6b6

    SHA1

    52b0ee31cdb239974954a6706038ac11885249f7

    SHA256

    e373bb8edc3bc7f391d052ebef7b14a6cfb518e9401057e932ac89ddb0442f34

    SHA512

    a66f2544fde0163504925f3f35859f1f0fd66918e0109b1c2cd6a38518b2491662aec5b9d28c02c36fbb2ddd14798bc70094d20367cb890e133da2b16455fa5c

  • \Users\Admin\AppData\Local\Temp\IXP005.TMP\a3933448.exe

    Filesize

    220KB

    MD5

    50e51b4add0556507ae3d434c58cb6b6

    SHA1

    52b0ee31cdb239974954a6706038ac11885249f7

    SHA256

    e373bb8edc3bc7f391d052ebef7b14a6cfb518e9401057e932ac89ddb0442f34

    SHA512

    a66f2544fde0163504925f3f35859f1f0fd66918e0109b1c2cd6a38518b2491662aec5b9d28c02c36fbb2ddd14798bc70094d20367cb890e133da2b16455fa5c

  • \Users\Admin\AppData\Local\Temp\IXP005.TMP\a3933448.exe

    Filesize

    220KB

    MD5

    50e51b4add0556507ae3d434c58cb6b6

    SHA1

    52b0ee31cdb239974954a6706038ac11885249f7

    SHA256

    e373bb8edc3bc7f391d052ebef7b14a6cfb518e9401057e932ac89ddb0442f34

    SHA512

    a66f2544fde0163504925f3f35859f1f0fd66918e0109b1c2cd6a38518b2491662aec5b9d28c02c36fbb2ddd14798bc70094d20367cb890e133da2b16455fa5c

  • \Users\Admin\AppData\Local\Temp\IXP005.TMP\a3933448.exe

    Filesize

    220KB

    MD5

    50e51b4add0556507ae3d434c58cb6b6

    SHA1

    52b0ee31cdb239974954a6706038ac11885249f7

    SHA256

    e373bb8edc3bc7f391d052ebef7b14a6cfb518e9401057e932ac89ddb0442f34

    SHA512

    a66f2544fde0163504925f3f35859f1f0fd66918e0109b1c2cd6a38518b2491662aec5b9d28c02c36fbb2ddd14798bc70094d20367cb890e133da2b16455fa5c

  • \Users\Admin\AppData\Local\Temp\IXP005.TMP\a3933448.exe

    Filesize

    220KB

    MD5

    50e51b4add0556507ae3d434c58cb6b6

    SHA1

    52b0ee31cdb239974954a6706038ac11885249f7

    SHA256

    e373bb8edc3bc7f391d052ebef7b14a6cfb518e9401057e932ac89ddb0442f34

    SHA512

    a66f2544fde0163504925f3f35859f1f0fd66918e0109b1c2cd6a38518b2491662aec5b9d28c02c36fbb2ddd14798bc70094d20367cb890e133da2b16455fa5c

  • \Users\Admin\AppData\Local\Temp\IXP005.TMP\a3933448.exe

    Filesize

    220KB

    MD5

    50e51b4add0556507ae3d434c58cb6b6

    SHA1

    52b0ee31cdb239974954a6706038ac11885249f7

    SHA256

    e373bb8edc3bc7f391d052ebef7b14a6cfb518e9401057e932ac89ddb0442f34

    SHA512

    a66f2544fde0163504925f3f35859f1f0fd66918e0109b1c2cd6a38518b2491662aec5b9d28c02c36fbb2ddd14798bc70094d20367cb890e133da2b16455fa5c

  • \Users\Admin\AppData\Local\Temp\IXP005.TMP\a3933448.exe

    Filesize

    220KB

    MD5

    50e51b4add0556507ae3d434c58cb6b6

    SHA1

    52b0ee31cdb239974954a6706038ac11885249f7

    SHA256

    e373bb8edc3bc7f391d052ebef7b14a6cfb518e9401057e932ac89ddb0442f34

    SHA512

    a66f2544fde0163504925f3f35859f1f0fd66918e0109b1c2cd6a38518b2491662aec5b9d28c02c36fbb2ddd14798bc70094d20367cb890e133da2b16455fa5c

  • memory/1380-66-0x0000000000400000-0x000000000040A000-memory.dmp

    Filesize

    40KB

  • memory/1380-68-0x0000000000400000-0x000000000040A000-memory.dmp

    Filesize

    40KB

  • memory/1380-72-0x0000000000400000-0x000000000040A000-memory.dmp

    Filesize

    40KB

  • memory/1380-70-0x0000000000400000-0x000000000040A000-memory.dmp

    Filesize

    40KB

  • memory/1380-67-0x00000000FFFDE000-0x00000000FFFDF000-memory.dmp

    Filesize

    4KB

  • memory/1380-65-0x0000000000400000-0x000000000040A000-memory.dmp

    Filesize

    40KB

  • memory/1380-64-0x0000000000400000-0x000000000040A000-memory.dmp

    Filesize

    40KB

  • memory/1380-63-0x0000000000400000-0x000000000040A000-memory.dmp

    Filesize

    40KB