Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
120s -
max time network
144s -
platform
windows7_x64 -
resource
win7-20230831-en -
resource tags
arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system -
submitted
11/10/2023, 07:20
Static task
static1
Behavioral task
behavioral1
Sample
file.exe
Resource
win7-20230831-en
Behavioral task
behavioral2
Sample
file.exe
Resource
win10v2004-20230915-en
General
-
Target
file.exe
-
Size
1.0MB
-
MD5
b5d80d5030a54b3a706f1bb652703afa
-
SHA1
9ab741673eebccd9016f14a7d3aabf27bbdecae0
-
SHA256
27a47245082a440db35670871859b73ae51e364019887c2018bcc6fb0ae60910
-
SHA512
d3319b939393e9006fd78b1bde4ebc5557eb3bb372b2edde67c6b0502bfe16858854305ecab0cd1acd05d44fb8db49d1106b2c7ac567d19ffdca0d08f6f786a7
-
SSDEEP
24576:my/L86ZZQCtVDxFoyPmvUj5Ry+IpRV6e220ezD7oRBd8:1/L8ChHNFoyOwLIppbzHoR
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection AppLaunch.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" AppLaunch.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" AppLaunch.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" AppLaunch.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" AppLaunch.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" AppLaunch.exe -
Executes dropped EXE 4 IoCs
pid Process 2320 Dj1HV83.exe 2740 QA6kT40.exe 2908 IZ1FB65.exe 2620 1TZ06am6.exe -
Loads dropped DLL 12 IoCs
pid Process 2692 file.exe 2320 Dj1HV83.exe 2320 Dj1HV83.exe 2740 QA6kT40.exe 2740 QA6kT40.exe 2908 IZ1FB65.exe 2908 IZ1FB65.exe 2620 1TZ06am6.exe 2676 WerFault.exe 2676 WerFault.exe 2676 WerFault.exe 2676 WerFault.exe -
Adds Run key to start application 2 TTPs 4 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" file.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" Dj1HV83.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\"" QA6kT40.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup3 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP003.TMP\\\"" IZ1FB65.exe -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 2620 set thread context of 2444 2620 1TZ06am6.exe 33 -
Program crash 1 IoCs
pid pid_target Process procid_target 2676 2620 WerFault.exe 31 -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 2444 AppLaunch.exe 2444 AppLaunch.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 2444 AppLaunch.exe -
Suspicious use of WriteProcessMemory 47 IoCs
description pid Process procid_target PID 2692 wrote to memory of 2320 2692 file.exe 28 PID 2692 wrote to memory of 2320 2692 file.exe 28 PID 2692 wrote to memory of 2320 2692 file.exe 28 PID 2692 wrote to memory of 2320 2692 file.exe 28 PID 2692 wrote to memory of 2320 2692 file.exe 28 PID 2692 wrote to memory of 2320 2692 file.exe 28 PID 2692 wrote to memory of 2320 2692 file.exe 28 PID 2320 wrote to memory of 2740 2320 Dj1HV83.exe 29 PID 2320 wrote to memory of 2740 2320 Dj1HV83.exe 29 PID 2320 wrote to memory of 2740 2320 Dj1HV83.exe 29 PID 2320 wrote to memory of 2740 2320 Dj1HV83.exe 29 PID 2320 wrote to memory of 2740 2320 Dj1HV83.exe 29 PID 2320 wrote to memory of 2740 2320 Dj1HV83.exe 29 PID 2320 wrote to memory of 2740 2320 Dj1HV83.exe 29 PID 2740 wrote to memory of 2908 2740 QA6kT40.exe 30 PID 2740 wrote to memory of 2908 2740 QA6kT40.exe 30 PID 2740 wrote to memory of 2908 2740 QA6kT40.exe 30 PID 2740 wrote to memory of 2908 2740 QA6kT40.exe 30 PID 2740 wrote to memory of 2908 2740 QA6kT40.exe 30 PID 2740 wrote to memory of 2908 2740 QA6kT40.exe 30 PID 2740 wrote to memory of 2908 2740 QA6kT40.exe 30 PID 2908 wrote to memory of 2620 2908 IZ1FB65.exe 31 PID 2908 wrote to memory of 2620 2908 IZ1FB65.exe 31 PID 2908 wrote to memory of 2620 2908 IZ1FB65.exe 31 PID 2908 wrote to memory of 2620 2908 IZ1FB65.exe 31 PID 2908 wrote to memory of 2620 2908 IZ1FB65.exe 31 PID 2908 wrote to memory of 2620 2908 IZ1FB65.exe 31 PID 2908 wrote to memory of 2620 2908 IZ1FB65.exe 31 PID 2620 wrote to memory of 2444 2620 1TZ06am6.exe 33 PID 2620 wrote to memory of 2444 2620 1TZ06am6.exe 33 PID 2620 wrote to memory of 2444 2620 1TZ06am6.exe 33 PID 2620 wrote to memory of 2444 2620 1TZ06am6.exe 33 PID 2620 wrote to memory of 2444 2620 1TZ06am6.exe 33 PID 2620 wrote to memory of 2444 2620 1TZ06am6.exe 33 PID 2620 wrote to memory of 2444 2620 1TZ06am6.exe 33 PID 2620 wrote to memory of 2444 2620 1TZ06am6.exe 33 PID 2620 wrote to memory of 2444 2620 1TZ06am6.exe 33 PID 2620 wrote to memory of 2444 2620 1TZ06am6.exe 33 PID 2620 wrote to memory of 2444 2620 1TZ06am6.exe 33 PID 2620 wrote to memory of 2444 2620 1TZ06am6.exe 33 PID 2620 wrote to memory of 2676 2620 1TZ06am6.exe 34 PID 2620 wrote to memory of 2676 2620 1TZ06am6.exe 34 PID 2620 wrote to memory of 2676 2620 1TZ06am6.exe 34 PID 2620 wrote to memory of 2676 2620 1TZ06am6.exe 34 PID 2620 wrote to memory of 2676 2620 1TZ06am6.exe 34 PID 2620 wrote to memory of 2676 2620 1TZ06am6.exe 34 PID 2620 wrote to memory of 2676 2620 1TZ06am6.exe 34
Processes
-
C:\Users\Admin\AppData\Local\Temp\file.exe"C:\Users\Admin\AppData\Local\Temp\file.exe"1⤵
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:2692 -
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Dj1HV83.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Dj1HV83.exe2⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:2320 -
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\QA6kT40.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\QA6kT40.exe3⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:2740 -
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\IZ1FB65.exeC:\Users\Admin\AppData\Local\Temp\IXP002.TMP\IZ1FB65.exe4⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:2908 -
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\1TZ06am6.exeC:\Users\Admin\AppData\Local\Temp\IXP003.TMP\1TZ06am6.exe5⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2620 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"6⤵
- Modifies Windows Defender Real-time Protection settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2444
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2620 -s 2686⤵
- Loads dropped DLL
- Program crash
PID:2676
-
-
-
-
-
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
903KB
MD5fdd272a472a7c5d9c2ca2094950d913a
SHA145fddbe0c050f7e9bc59032973e341bb4e2b427e
SHA256483563bc9f3c481d77e2cea48cc7edf7d69e64abd65c61f26c23abf8393c96a2
SHA512686fd67f8064abb2ce1067dfd4da067d2d48aa9b2699b531cc66dd165e11220b4f40bb5597d099d0942ed8f47654553042b6f9dda7c395eb56aa662ffa708efc
-
Filesize
903KB
MD5fdd272a472a7c5d9c2ca2094950d913a
SHA145fddbe0c050f7e9bc59032973e341bb4e2b427e
SHA256483563bc9f3c481d77e2cea48cc7edf7d69e64abd65c61f26c23abf8393c96a2
SHA512686fd67f8064abb2ce1067dfd4da067d2d48aa9b2699b531cc66dd165e11220b4f40bb5597d099d0942ed8f47654553042b6f9dda7c395eb56aa662ffa708efc
-
Filesize
614KB
MD5f7dd5bc28aa77f6356f01c087001f693
SHA1a53ef6f1e5f094e434ddf5f80ca2d99cd1e83b21
SHA256cceef8511a0c9c9aee91e3dacdcbf00a72e4e3697597898d7e44c3b0be8d3932
SHA51252d08c9dbf50d3d276556ae792a2413cf23e1d50c1e20d5aab2f136f73e655297b7c756232f38f9e9b08d5e7938415bc868273d822fd80e145de12757f6e86d8
-
Filesize
614KB
MD5f7dd5bc28aa77f6356f01c087001f693
SHA1a53ef6f1e5f094e434ddf5f80ca2d99cd1e83b21
SHA256cceef8511a0c9c9aee91e3dacdcbf00a72e4e3697597898d7e44c3b0be8d3932
SHA51252d08c9dbf50d3d276556ae792a2413cf23e1d50c1e20d5aab2f136f73e655297b7c756232f38f9e9b08d5e7938415bc868273d822fd80e145de12757f6e86d8
-
Filesize
376KB
MD521e7614be49712c9464de7e65d1a6830
SHA1dfa28ef8e0aa2c6104c15e182f4036f854352cf0
SHA256a717b44ea5b66a10a34fb697485915d1b08450237ca130f430f30320003c4b4c
SHA512e971043258dc91e9a93a0d036df3c87e0a2bfa858ec8bb4af9eed2822db3952710382243dc94be91ca5d038c5f459d6ef085af862c500a51ac5c0e54dd3cc2db
-
Filesize
376KB
MD521e7614be49712c9464de7e65d1a6830
SHA1dfa28ef8e0aa2c6104c15e182f4036f854352cf0
SHA256a717b44ea5b66a10a34fb697485915d1b08450237ca130f430f30320003c4b4c
SHA512e971043258dc91e9a93a0d036df3c87e0a2bfa858ec8bb4af9eed2822db3952710382243dc94be91ca5d038c5f459d6ef085af862c500a51ac5c0e54dd3cc2db
-
Filesize
237KB
MD5a9fa89bb6fc40774e0d712cc9b5e8935
SHA1e8aae5bb86f7728cec0cbae197b77b1ab80dccf2
SHA2560033e15d31835c1c8e30a08193720c5f14843c79154bd866514e3897d7f19e31
SHA512045a4a3972ce8624052ed3019aaeb8dc20d958c5a94bf77f1024b3cb961ac994b5ffec6126d51df1955790827eb212e86d8208740d5cda7b64a3432f45acc3bf
-
Filesize
237KB
MD5a9fa89bb6fc40774e0d712cc9b5e8935
SHA1e8aae5bb86f7728cec0cbae197b77b1ab80dccf2
SHA2560033e15d31835c1c8e30a08193720c5f14843c79154bd866514e3897d7f19e31
SHA512045a4a3972ce8624052ed3019aaeb8dc20d958c5a94bf77f1024b3cb961ac994b5ffec6126d51df1955790827eb212e86d8208740d5cda7b64a3432f45acc3bf
-
Filesize
903KB
MD5fdd272a472a7c5d9c2ca2094950d913a
SHA145fddbe0c050f7e9bc59032973e341bb4e2b427e
SHA256483563bc9f3c481d77e2cea48cc7edf7d69e64abd65c61f26c23abf8393c96a2
SHA512686fd67f8064abb2ce1067dfd4da067d2d48aa9b2699b531cc66dd165e11220b4f40bb5597d099d0942ed8f47654553042b6f9dda7c395eb56aa662ffa708efc
-
Filesize
903KB
MD5fdd272a472a7c5d9c2ca2094950d913a
SHA145fddbe0c050f7e9bc59032973e341bb4e2b427e
SHA256483563bc9f3c481d77e2cea48cc7edf7d69e64abd65c61f26c23abf8393c96a2
SHA512686fd67f8064abb2ce1067dfd4da067d2d48aa9b2699b531cc66dd165e11220b4f40bb5597d099d0942ed8f47654553042b6f9dda7c395eb56aa662ffa708efc
-
Filesize
614KB
MD5f7dd5bc28aa77f6356f01c087001f693
SHA1a53ef6f1e5f094e434ddf5f80ca2d99cd1e83b21
SHA256cceef8511a0c9c9aee91e3dacdcbf00a72e4e3697597898d7e44c3b0be8d3932
SHA51252d08c9dbf50d3d276556ae792a2413cf23e1d50c1e20d5aab2f136f73e655297b7c756232f38f9e9b08d5e7938415bc868273d822fd80e145de12757f6e86d8
-
Filesize
614KB
MD5f7dd5bc28aa77f6356f01c087001f693
SHA1a53ef6f1e5f094e434ddf5f80ca2d99cd1e83b21
SHA256cceef8511a0c9c9aee91e3dacdcbf00a72e4e3697597898d7e44c3b0be8d3932
SHA51252d08c9dbf50d3d276556ae792a2413cf23e1d50c1e20d5aab2f136f73e655297b7c756232f38f9e9b08d5e7938415bc868273d822fd80e145de12757f6e86d8
-
Filesize
376KB
MD521e7614be49712c9464de7e65d1a6830
SHA1dfa28ef8e0aa2c6104c15e182f4036f854352cf0
SHA256a717b44ea5b66a10a34fb697485915d1b08450237ca130f430f30320003c4b4c
SHA512e971043258dc91e9a93a0d036df3c87e0a2bfa858ec8bb4af9eed2822db3952710382243dc94be91ca5d038c5f459d6ef085af862c500a51ac5c0e54dd3cc2db
-
Filesize
376KB
MD521e7614be49712c9464de7e65d1a6830
SHA1dfa28ef8e0aa2c6104c15e182f4036f854352cf0
SHA256a717b44ea5b66a10a34fb697485915d1b08450237ca130f430f30320003c4b4c
SHA512e971043258dc91e9a93a0d036df3c87e0a2bfa858ec8bb4af9eed2822db3952710382243dc94be91ca5d038c5f459d6ef085af862c500a51ac5c0e54dd3cc2db
-
Filesize
237KB
MD5a9fa89bb6fc40774e0d712cc9b5e8935
SHA1e8aae5bb86f7728cec0cbae197b77b1ab80dccf2
SHA2560033e15d31835c1c8e30a08193720c5f14843c79154bd866514e3897d7f19e31
SHA512045a4a3972ce8624052ed3019aaeb8dc20d958c5a94bf77f1024b3cb961ac994b5ffec6126d51df1955790827eb212e86d8208740d5cda7b64a3432f45acc3bf
-
Filesize
237KB
MD5a9fa89bb6fc40774e0d712cc9b5e8935
SHA1e8aae5bb86f7728cec0cbae197b77b1ab80dccf2
SHA2560033e15d31835c1c8e30a08193720c5f14843c79154bd866514e3897d7f19e31
SHA512045a4a3972ce8624052ed3019aaeb8dc20d958c5a94bf77f1024b3cb961ac994b5ffec6126d51df1955790827eb212e86d8208740d5cda7b64a3432f45acc3bf
-
Filesize
237KB
MD5a9fa89bb6fc40774e0d712cc9b5e8935
SHA1e8aae5bb86f7728cec0cbae197b77b1ab80dccf2
SHA2560033e15d31835c1c8e30a08193720c5f14843c79154bd866514e3897d7f19e31
SHA512045a4a3972ce8624052ed3019aaeb8dc20d958c5a94bf77f1024b3cb961ac994b5ffec6126d51df1955790827eb212e86d8208740d5cda7b64a3432f45acc3bf
-
Filesize
237KB
MD5a9fa89bb6fc40774e0d712cc9b5e8935
SHA1e8aae5bb86f7728cec0cbae197b77b1ab80dccf2
SHA2560033e15d31835c1c8e30a08193720c5f14843c79154bd866514e3897d7f19e31
SHA512045a4a3972ce8624052ed3019aaeb8dc20d958c5a94bf77f1024b3cb961ac994b5ffec6126d51df1955790827eb212e86d8208740d5cda7b64a3432f45acc3bf
-
Filesize
237KB
MD5a9fa89bb6fc40774e0d712cc9b5e8935
SHA1e8aae5bb86f7728cec0cbae197b77b1ab80dccf2
SHA2560033e15d31835c1c8e30a08193720c5f14843c79154bd866514e3897d7f19e31
SHA512045a4a3972ce8624052ed3019aaeb8dc20d958c5a94bf77f1024b3cb961ac994b5ffec6126d51df1955790827eb212e86d8208740d5cda7b64a3432f45acc3bf
-
Filesize
237KB
MD5a9fa89bb6fc40774e0d712cc9b5e8935
SHA1e8aae5bb86f7728cec0cbae197b77b1ab80dccf2
SHA2560033e15d31835c1c8e30a08193720c5f14843c79154bd866514e3897d7f19e31
SHA512045a4a3972ce8624052ed3019aaeb8dc20d958c5a94bf77f1024b3cb961ac994b5ffec6126d51df1955790827eb212e86d8208740d5cda7b64a3432f45acc3bf