Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    122s
  • max time network
    125s
  • platform
    windows7_x64
  • resource
    win7-20230831-en
  • resource tags

    arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
  • submitted
    11/10/2023, 09:09

General

  • Target

    0905ecc2e29a66245e718f2f52b25ee6a31db3e002cdfd047a20cc940c882338.exe

  • Size

    1.3MB

  • MD5

    f385384fd849ff6aaf187105960cc093

  • SHA1

    2c88b6d58b799ae6003bc439e18e32ba4336b942

  • SHA256

    0905ecc2e29a66245e718f2f52b25ee6a31db3e002cdfd047a20cc940c882338

  • SHA512

    5e12ab16287b4a9186932812cdecb59886ef9ebcb2c0b20d478168265c8867b4370568292e41ccaad10918302e0f0c3465adb8bfee84831452870aee00f0b8f6

  • SSDEEP

    24576:jyR7G4iFeCjm3jzZx2gfT6Yfk+vTHNJ2Gqq716w4vKS8XcUkEEP5+1p7o03276g+:2h4tjAzZMgfT1fk+vyTLsMUkE8o27

Malware Config

Signatures

  • Detects Healer an antivirus disabler dropper 5 IoCs
  • Healer

    Healer an antivirus disabler dropper.

  • Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs
  • Executes dropped EXE 5 IoCs
  • Loads dropped DLL 15 IoCs
  • Adds Run key to start application 2 TTPs 5 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Program crash 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 54 IoCs

Processes

  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2772 -s 268
    1⤵
    • Loads dropped DLL
    • Program crash
    PID:2524
  • C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
    1⤵
    • Modifies Windows Defender Real-time Protection settings
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    PID:2272
  • C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q5629605.exe
    C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q5629605.exe
    1⤵
    • Executes dropped EXE
    • Loads dropped DLL
    • Suspicious use of SetThreadContext
    • Suspicious use of WriteProcessMemory
    PID:2772
  • C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\z4542077.exe
    C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\z4542077.exe
    1⤵
    • Executes dropped EXE
    • Loads dropped DLL
    • Adds Run key to start application
    • Suspicious use of WriteProcessMemory
    PID:2636
  • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\z7932444.exe
    C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\z7932444.exe
    1⤵
    • Executes dropped EXE
    • Loads dropped DLL
    • Adds Run key to start application
    • Suspicious use of WriteProcessMemory
    PID:2956
  • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z1703803.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z1703803.exe
    1⤵
    • Executes dropped EXE
    • Loads dropped DLL
    • Adds Run key to start application
    • Suspicious use of WriteProcessMemory
    PID:2148
  • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z0312415.exe
    C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z0312415.exe
    1⤵
    • Executes dropped EXE
    • Loads dropped DLL
    • Adds Run key to start application
    • Suspicious use of WriteProcessMemory
    PID:2184
  • C:\Users\Admin\AppData\Local\Temp\0905ecc2e29a66245e718f2f52b25ee6a31db3e002cdfd047a20cc940c882338.exe
    "C:\Users\Admin\AppData\Local\Temp\0905ecc2e29a66245e718f2f52b25ee6a31db3e002cdfd047a20cc940c882338.exe"
    1⤵
    • Loads dropped DLL
    • Adds Run key to start application
    • Suspicious use of WriteProcessMemory
    PID:2928

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z0312415.exe

    Filesize

    1.2MB

    MD5

    c607eb7887e11d53e789a652f1d19fbf

    SHA1

    54f4cac57ec19c0afe699ae2f7c96eafbbeb77f1

    SHA256

    da1cae1f47b371a02d0ddba24dd820185e9d30942e076fdc75eeec1eb3e2855a

    SHA512

    b1f4d004cfa306f26ea0174ec277be78a69c2ca2d74b255e58aafcdfce3ecb355442bc65da9d110c9607a0f3a3e608fb173d1e1f8901c0df910deabc9b263e56

  • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z0312415.exe

    Filesize

    1.2MB

    MD5

    c607eb7887e11d53e789a652f1d19fbf

    SHA1

    54f4cac57ec19c0afe699ae2f7c96eafbbeb77f1

    SHA256

    da1cae1f47b371a02d0ddba24dd820185e9d30942e076fdc75eeec1eb3e2855a

    SHA512

    b1f4d004cfa306f26ea0174ec277be78a69c2ca2d74b255e58aafcdfce3ecb355442bc65da9d110c9607a0f3a3e608fb173d1e1f8901c0df910deabc9b263e56

  • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z1703803.exe

    Filesize

    1.0MB

    MD5

    2ef3250f8e0a931a3c1abba919864e28

    SHA1

    1e7dbdf88a3a061ab8e2afe2ae73063832515d42

    SHA256

    3ba44a202d1ad29717d832aa4ef18e9f53c8bfaa83f3e009ffb24888900ad826

    SHA512

    cae16fd7054015bdf3840825e978dffcc644dfb2bf1707fc70e90dcf04484c244bf03e7ba8e4a4d7e1135bbe78293b87a9551aeb0d88c7832c19ef87748d969c

  • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z1703803.exe

    Filesize

    1.0MB

    MD5

    2ef3250f8e0a931a3c1abba919864e28

    SHA1

    1e7dbdf88a3a061ab8e2afe2ae73063832515d42

    SHA256

    3ba44a202d1ad29717d832aa4ef18e9f53c8bfaa83f3e009ffb24888900ad826

    SHA512

    cae16fd7054015bdf3840825e978dffcc644dfb2bf1707fc70e90dcf04484c244bf03e7ba8e4a4d7e1135bbe78293b87a9551aeb0d88c7832c19ef87748d969c

  • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\z7932444.exe

    Filesize

    887KB

    MD5

    4d260090bc7d2b6f61b8bf8576562c0b

    SHA1

    113c749fc9d061381b720f8206605828030e8eaf

    SHA256

    9239b4b0033786a75fb1efe183acffa2df167041d7cae88971115fdb586bd9e9

    SHA512

    a2d19a4c7aff5e674178597ad4606e067d3ed08b5e57be2dc9f2d16434c4b4e69775feefcbdcf230eeaa4e228838d634aebda1fcbba7572ea6cee6bf747127f5

  • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\z7932444.exe

    Filesize

    887KB

    MD5

    4d260090bc7d2b6f61b8bf8576562c0b

    SHA1

    113c749fc9d061381b720f8206605828030e8eaf

    SHA256

    9239b4b0033786a75fb1efe183acffa2df167041d7cae88971115fdb586bd9e9

    SHA512

    a2d19a4c7aff5e674178597ad4606e067d3ed08b5e57be2dc9f2d16434c4b4e69775feefcbdcf230eeaa4e228838d634aebda1fcbba7572ea6cee6bf747127f5

  • C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\z4542077.exe

    Filesize

    496KB

    MD5

    af19632b59b0d27e6868693b809ddb13

    SHA1

    b83e60525bbe1a8060bbb2b4df071e4b1181141e

    SHA256

    9e7e43074c363993753bac3ae8aa0cf4a5cec7ee7ce9e454834504a1d4142c32

    SHA512

    3523174704f20ae41e15c61ab6293617d7df73c8fa1ac4e130397066e3639a454b3fb7a1706853cdacb1fedb55e6424e1d9ea3d0f386b2d522c5defe23d7ac5d

  • C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\z4542077.exe

    Filesize

    496KB

    MD5

    af19632b59b0d27e6868693b809ddb13

    SHA1

    b83e60525bbe1a8060bbb2b4df071e4b1181141e

    SHA256

    9e7e43074c363993753bac3ae8aa0cf4a5cec7ee7ce9e454834504a1d4142c32

    SHA512

    3523174704f20ae41e15c61ab6293617d7df73c8fa1ac4e130397066e3639a454b3fb7a1706853cdacb1fedb55e6424e1d9ea3d0f386b2d522c5defe23d7ac5d

  • C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q5629605.exe

    Filesize

    860KB

    MD5

    a2bcbcb38aab5f804b58b33c08d767b5

    SHA1

    38b5d1d0cd59a1deb9c1920c7d6d27144db90658

    SHA256

    69f3681fdb69029aa783260ccf61ee433bfd1252538b41c372ba204ec360cf3f

    SHA512

    9ebcef807316b4edfe4021b3d16b704f8b420bbbbd6c175647435a7a0578f83af81f5c3779e97d98403291721e8cf8a3093d8ed8b29140f573f01b4f747089f9

  • C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q5629605.exe

    Filesize

    860KB

    MD5

    a2bcbcb38aab5f804b58b33c08d767b5

    SHA1

    38b5d1d0cd59a1deb9c1920c7d6d27144db90658

    SHA256

    69f3681fdb69029aa783260ccf61ee433bfd1252538b41c372ba204ec360cf3f

    SHA512

    9ebcef807316b4edfe4021b3d16b704f8b420bbbbd6c175647435a7a0578f83af81f5c3779e97d98403291721e8cf8a3093d8ed8b29140f573f01b4f747089f9

  • C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q5629605.exe

    Filesize

    860KB

    MD5

    a2bcbcb38aab5f804b58b33c08d767b5

    SHA1

    38b5d1d0cd59a1deb9c1920c7d6d27144db90658

    SHA256

    69f3681fdb69029aa783260ccf61ee433bfd1252538b41c372ba204ec360cf3f

    SHA512

    9ebcef807316b4edfe4021b3d16b704f8b420bbbbd6c175647435a7a0578f83af81f5c3779e97d98403291721e8cf8a3093d8ed8b29140f573f01b4f747089f9

  • \Users\Admin\AppData\Local\Temp\IXP000.TMP\z0312415.exe

    Filesize

    1.2MB

    MD5

    c607eb7887e11d53e789a652f1d19fbf

    SHA1

    54f4cac57ec19c0afe699ae2f7c96eafbbeb77f1

    SHA256

    da1cae1f47b371a02d0ddba24dd820185e9d30942e076fdc75eeec1eb3e2855a

    SHA512

    b1f4d004cfa306f26ea0174ec277be78a69c2ca2d74b255e58aafcdfce3ecb355442bc65da9d110c9607a0f3a3e608fb173d1e1f8901c0df910deabc9b263e56

  • \Users\Admin\AppData\Local\Temp\IXP000.TMP\z0312415.exe

    Filesize

    1.2MB

    MD5

    c607eb7887e11d53e789a652f1d19fbf

    SHA1

    54f4cac57ec19c0afe699ae2f7c96eafbbeb77f1

    SHA256

    da1cae1f47b371a02d0ddba24dd820185e9d30942e076fdc75eeec1eb3e2855a

    SHA512

    b1f4d004cfa306f26ea0174ec277be78a69c2ca2d74b255e58aafcdfce3ecb355442bc65da9d110c9607a0f3a3e608fb173d1e1f8901c0df910deabc9b263e56

  • \Users\Admin\AppData\Local\Temp\IXP001.TMP\z1703803.exe

    Filesize

    1.0MB

    MD5

    2ef3250f8e0a931a3c1abba919864e28

    SHA1

    1e7dbdf88a3a061ab8e2afe2ae73063832515d42

    SHA256

    3ba44a202d1ad29717d832aa4ef18e9f53c8bfaa83f3e009ffb24888900ad826

    SHA512

    cae16fd7054015bdf3840825e978dffcc644dfb2bf1707fc70e90dcf04484c244bf03e7ba8e4a4d7e1135bbe78293b87a9551aeb0d88c7832c19ef87748d969c

  • \Users\Admin\AppData\Local\Temp\IXP001.TMP\z1703803.exe

    Filesize

    1.0MB

    MD5

    2ef3250f8e0a931a3c1abba919864e28

    SHA1

    1e7dbdf88a3a061ab8e2afe2ae73063832515d42

    SHA256

    3ba44a202d1ad29717d832aa4ef18e9f53c8bfaa83f3e009ffb24888900ad826

    SHA512

    cae16fd7054015bdf3840825e978dffcc644dfb2bf1707fc70e90dcf04484c244bf03e7ba8e4a4d7e1135bbe78293b87a9551aeb0d88c7832c19ef87748d969c

  • \Users\Admin\AppData\Local\Temp\IXP002.TMP\z7932444.exe

    Filesize

    887KB

    MD5

    4d260090bc7d2b6f61b8bf8576562c0b

    SHA1

    113c749fc9d061381b720f8206605828030e8eaf

    SHA256

    9239b4b0033786a75fb1efe183acffa2df167041d7cae88971115fdb586bd9e9

    SHA512

    a2d19a4c7aff5e674178597ad4606e067d3ed08b5e57be2dc9f2d16434c4b4e69775feefcbdcf230eeaa4e228838d634aebda1fcbba7572ea6cee6bf747127f5

  • \Users\Admin\AppData\Local\Temp\IXP002.TMP\z7932444.exe

    Filesize

    887KB

    MD5

    4d260090bc7d2b6f61b8bf8576562c0b

    SHA1

    113c749fc9d061381b720f8206605828030e8eaf

    SHA256

    9239b4b0033786a75fb1efe183acffa2df167041d7cae88971115fdb586bd9e9

    SHA512

    a2d19a4c7aff5e674178597ad4606e067d3ed08b5e57be2dc9f2d16434c4b4e69775feefcbdcf230eeaa4e228838d634aebda1fcbba7572ea6cee6bf747127f5

  • \Users\Admin\AppData\Local\Temp\IXP003.TMP\z4542077.exe

    Filesize

    496KB

    MD5

    af19632b59b0d27e6868693b809ddb13

    SHA1

    b83e60525bbe1a8060bbb2b4df071e4b1181141e

    SHA256

    9e7e43074c363993753bac3ae8aa0cf4a5cec7ee7ce9e454834504a1d4142c32

    SHA512

    3523174704f20ae41e15c61ab6293617d7df73c8fa1ac4e130397066e3639a454b3fb7a1706853cdacb1fedb55e6424e1d9ea3d0f386b2d522c5defe23d7ac5d

  • \Users\Admin\AppData\Local\Temp\IXP003.TMP\z4542077.exe

    Filesize

    496KB

    MD5

    af19632b59b0d27e6868693b809ddb13

    SHA1

    b83e60525bbe1a8060bbb2b4df071e4b1181141e

    SHA256

    9e7e43074c363993753bac3ae8aa0cf4a5cec7ee7ce9e454834504a1d4142c32

    SHA512

    3523174704f20ae41e15c61ab6293617d7df73c8fa1ac4e130397066e3639a454b3fb7a1706853cdacb1fedb55e6424e1d9ea3d0f386b2d522c5defe23d7ac5d

  • \Users\Admin\AppData\Local\Temp\IXP004.TMP\q5629605.exe

    Filesize

    860KB

    MD5

    a2bcbcb38aab5f804b58b33c08d767b5

    SHA1

    38b5d1d0cd59a1deb9c1920c7d6d27144db90658

    SHA256

    69f3681fdb69029aa783260ccf61ee433bfd1252538b41c372ba204ec360cf3f

    SHA512

    9ebcef807316b4edfe4021b3d16b704f8b420bbbbd6c175647435a7a0578f83af81f5c3779e97d98403291721e8cf8a3093d8ed8b29140f573f01b4f747089f9

  • \Users\Admin\AppData\Local\Temp\IXP004.TMP\q5629605.exe

    Filesize

    860KB

    MD5

    a2bcbcb38aab5f804b58b33c08d767b5

    SHA1

    38b5d1d0cd59a1deb9c1920c7d6d27144db90658

    SHA256

    69f3681fdb69029aa783260ccf61ee433bfd1252538b41c372ba204ec360cf3f

    SHA512

    9ebcef807316b4edfe4021b3d16b704f8b420bbbbd6c175647435a7a0578f83af81f5c3779e97d98403291721e8cf8a3093d8ed8b29140f573f01b4f747089f9

  • \Users\Admin\AppData\Local\Temp\IXP004.TMP\q5629605.exe

    Filesize

    860KB

    MD5

    a2bcbcb38aab5f804b58b33c08d767b5

    SHA1

    38b5d1d0cd59a1deb9c1920c7d6d27144db90658

    SHA256

    69f3681fdb69029aa783260ccf61ee433bfd1252538b41c372ba204ec360cf3f

    SHA512

    9ebcef807316b4edfe4021b3d16b704f8b420bbbbd6c175647435a7a0578f83af81f5c3779e97d98403291721e8cf8a3093d8ed8b29140f573f01b4f747089f9

  • \Users\Admin\AppData\Local\Temp\IXP004.TMP\q5629605.exe

    Filesize

    860KB

    MD5

    a2bcbcb38aab5f804b58b33c08d767b5

    SHA1

    38b5d1d0cd59a1deb9c1920c7d6d27144db90658

    SHA256

    69f3681fdb69029aa783260ccf61ee433bfd1252538b41c372ba204ec360cf3f

    SHA512

    9ebcef807316b4edfe4021b3d16b704f8b420bbbbd6c175647435a7a0578f83af81f5c3779e97d98403291721e8cf8a3093d8ed8b29140f573f01b4f747089f9

  • \Users\Admin\AppData\Local\Temp\IXP004.TMP\q5629605.exe

    Filesize

    860KB

    MD5

    a2bcbcb38aab5f804b58b33c08d767b5

    SHA1

    38b5d1d0cd59a1deb9c1920c7d6d27144db90658

    SHA256

    69f3681fdb69029aa783260ccf61ee433bfd1252538b41c372ba204ec360cf3f

    SHA512

    9ebcef807316b4edfe4021b3d16b704f8b420bbbbd6c175647435a7a0578f83af81f5c3779e97d98403291721e8cf8a3093d8ed8b29140f573f01b4f747089f9

  • \Users\Admin\AppData\Local\Temp\IXP004.TMP\q5629605.exe

    Filesize

    860KB

    MD5

    a2bcbcb38aab5f804b58b33c08d767b5

    SHA1

    38b5d1d0cd59a1deb9c1920c7d6d27144db90658

    SHA256

    69f3681fdb69029aa783260ccf61ee433bfd1252538b41c372ba204ec360cf3f

    SHA512

    9ebcef807316b4edfe4021b3d16b704f8b420bbbbd6c175647435a7a0578f83af81f5c3779e97d98403291721e8cf8a3093d8ed8b29140f573f01b4f747089f9

  • \Users\Admin\AppData\Local\Temp\IXP004.TMP\q5629605.exe

    Filesize

    860KB

    MD5

    a2bcbcb38aab5f804b58b33c08d767b5

    SHA1

    38b5d1d0cd59a1deb9c1920c7d6d27144db90658

    SHA256

    69f3681fdb69029aa783260ccf61ee433bfd1252538b41c372ba204ec360cf3f

    SHA512

    9ebcef807316b4edfe4021b3d16b704f8b420bbbbd6c175647435a7a0578f83af81f5c3779e97d98403291721e8cf8a3093d8ed8b29140f573f01b4f747089f9

  • memory/2272-56-0x0000000000400000-0x000000000040A000-memory.dmp

    Filesize

    40KB

  • memory/2272-57-0x00000000FFFDE000-0x00000000FFFDF000-memory.dmp

    Filesize

    4KB

  • memory/2272-58-0x0000000000400000-0x000000000040A000-memory.dmp

    Filesize

    40KB

  • memory/2272-60-0x0000000000400000-0x000000000040A000-memory.dmp

    Filesize

    40KB

  • memory/2272-62-0x0000000000400000-0x000000000040A000-memory.dmp

    Filesize

    40KB

  • memory/2272-55-0x0000000000400000-0x000000000040A000-memory.dmp

    Filesize

    40KB

  • memory/2272-54-0x0000000000400000-0x000000000040A000-memory.dmp

    Filesize

    40KB

  • memory/2272-53-0x0000000000400000-0x000000000040A000-memory.dmp

    Filesize

    40KB