Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
120s -
max time network
125s -
platform
windows7_x64 -
resource
win7-20230831-en -
resource tags
arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system -
submitted
11/10/2023, 08:38
Static task
static1
Behavioral task
behavioral1
Sample
7ff61e14ecaa3f9e04d53c3ca6715831fa07aab4f623c3584adc19674f0cf808.exe
Resource
win7-20230831-en
Behavioral task
behavioral2
Sample
7ff61e14ecaa3f9e04d53c3ca6715831fa07aab4f623c3584adc19674f0cf808.exe
Resource
win10v2004-20230915-en
General
-
Target
7ff61e14ecaa3f9e04d53c3ca6715831fa07aab4f623c3584adc19674f0cf808.exe
-
Size
1.1MB
-
MD5
234ac8ef3f6d889a19ee5a59f526bd61
-
SHA1
2804c73a7e8afaeee876e3d964a2584b98f579bf
-
SHA256
7ff61e14ecaa3f9e04d53c3ca6715831fa07aab4f623c3584adc19674f0cf808
-
SHA512
f051ac977d6a238bdd442bf97bd16ad87f7e3a18140c12faf1c9f846d1d3463c9909dc559d1e80446812d70357a5595bccef10b4f521b3f5b4cc0ac68631187c
-
SSDEEP
24576:1yr/ensDN3YBrtIqJHzR19euLMY0bI865HXr:QrWspIRtIwlft/0s8kX
Malware Config
Signatures
-
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" AppLaunch.exe Key created \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection AppLaunch.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" AppLaunch.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" AppLaunch.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" AppLaunch.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" AppLaunch.exe -
Executes dropped EXE 4 IoCs
pid Process 1740 sO7gV29.exe 2268 CE2lf88.exe 1644 JO6eZ81.exe 2768 1OL45Uy7.exe -
Loads dropped DLL 12 IoCs
pid Process 2272 7ff61e14ecaa3f9e04d53c3ca6715831fa07aab4f623c3584adc19674f0cf808.exe 1740 sO7gV29.exe 1740 sO7gV29.exe 2268 CE2lf88.exe 2268 CE2lf88.exe 1644 JO6eZ81.exe 1644 JO6eZ81.exe 2768 1OL45Uy7.exe 2668 WerFault.exe 2668 WerFault.exe 2668 WerFault.exe 2668 WerFault.exe -
Adds Run key to start application 2 TTPs 4 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" 7ff61e14ecaa3f9e04d53c3ca6715831fa07aab4f623c3584adc19674f0cf808.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" sO7gV29.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\"" CE2lf88.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup3 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP003.TMP\\\"" JO6eZ81.exe -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 2768 set thread context of 2648 2768 1OL45Uy7.exe 32 -
Program crash 1 IoCs
pid pid_target Process procid_target 2668 2768 WerFault.exe 31 -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 2648 AppLaunch.exe 2648 AppLaunch.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 2648 AppLaunch.exe -
Suspicious use of WriteProcessMemory 47 IoCs
description pid Process procid_target PID 2272 wrote to memory of 1740 2272 7ff61e14ecaa3f9e04d53c3ca6715831fa07aab4f623c3584adc19674f0cf808.exe 28 PID 2272 wrote to memory of 1740 2272 7ff61e14ecaa3f9e04d53c3ca6715831fa07aab4f623c3584adc19674f0cf808.exe 28 PID 2272 wrote to memory of 1740 2272 7ff61e14ecaa3f9e04d53c3ca6715831fa07aab4f623c3584adc19674f0cf808.exe 28 PID 2272 wrote to memory of 1740 2272 7ff61e14ecaa3f9e04d53c3ca6715831fa07aab4f623c3584adc19674f0cf808.exe 28 PID 2272 wrote to memory of 1740 2272 7ff61e14ecaa3f9e04d53c3ca6715831fa07aab4f623c3584adc19674f0cf808.exe 28 PID 2272 wrote to memory of 1740 2272 7ff61e14ecaa3f9e04d53c3ca6715831fa07aab4f623c3584adc19674f0cf808.exe 28 PID 2272 wrote to memory of 1740 2272 7ff61e14ecaa3f9e04d53c3ca6715831fa07aab4f623c3584adc19674f0cf808.exe 28 PID 1740 wrote to memory of 2268 1740 sO7gV29.exe 29 PID 1740 wrote to memory of 2268 1740 sO7gV29.exe 29 PID 1740 wrote to memory of 2268 1740 sO7gV29.exe 29 PID 1740 wrote to memory of 2268 1740 sO7gV29.exe 29 PID 1740 wrote to memory of 2268 1740 sO7gV29.exe 29 PID 1740 wrote to memory of 2268 1740 sO7gV29.exe 29 PID 1740 wrote to memory of 2268 1740 sO7gV29.exe 29 PID 2268 wrote to memory of 1644 2268 CE2lf88.exe 30 PID 2268 wrote to memory of 1644 2268 CE2lf88.exe 30 PID 2268 wrote to memory of 1644 2268 CE2lf88.exe 30 PID 2268 wrote to memory of 1644 2268 CE2lf88.exe 30 PID 2268 wrote to memory of 1644 2268 CE2lf88.exe 30 PID 2268 wrote to memory of 1644 2268 CE2lf88.exe 30 PID 2268 wrote to memory of 1644 2268 CE2lf88.exe 30 PID 1644 wrote to memory of 2768 1644 JO6eZ81.exe 31 PID 1644 wrote to memory of 2768 1644 JO6eZ81.exe 31 PID 1644 wrote to memory of 2768 1644 JO6eZ81.exe 31 PID 1644 wrote to memory of 2768 1644 JO6eZ81.exe 31 PID 1644 wrote to memory of 2768 1644 JO6eZ81.exe 31 PID 1644 wrote to memory of 2768 1644 JO6eZ81.exe 31 PID 1644 wrote to memory of 2768 1644 JO6eZ81.exe 31 PID 2768 wrote to memory of 2648 2768 1OL45Uy7.exe 32 PID 2768 wrote to memory of 2648 2768 1OL45Uy7.exe 32 PID 2768 wrote to memory of 2648 2768 1OL45Uy7.exe 32 PID 2768 wrote to memory of 2648 2768 1OL45Uy7.exe 32 PID 2768 wrote to memory of 2648 2768 1OL45Uy7.exe 32 PID 2768 wrote to memory of 2648 2768 1OL45Uy7.exe 32 PID 2768 wrote to memory of 2648 2768 1OL45Uy7.exe 32 PID 2768 wrote to memory of 2648 2768 1OL45Uy7.exe 32 PID 2768 wrote to memory of 2648 2768 1OL45Uy7.exe 32 PID 2768 wrote to memory of 2648 2768 1OL45Uy7.exe 32 PID 2768 wrote to memory of 2648 2768 1OL45Uy7.exe 32 PID 2768 wrote to memory of 2648 2768 1OL45Uy7.exe 32 PID 2768 wrote to memory of 2668 2768 1OL45Uy7.exe 33 PID 2768 wrote to memory of 2668 2768 1OL45Uy7.exe 33 PID 2768 wrote to memory of 2668 2768 1OL45Uy7.exe 33 PID 2768 wrote to memory of 2668 2768 1OL45Uy7.exe 33 PID 2768 wrote to memory of 2668 2768 1OL45Uy7.exe 33 PID 2768 wrote to memory of 2668 2768 1OL45Uy7.exe 33 PID 2768 wrote to memory of 2668 2768 1OL45Uy7.exe 33
Processes
-
C:\Users\Admin\AppData\Local\Temp\7ff61e14ecaa3f9e04d53c3ca6715831fa07aab4f623c3584adc19674f0cf808.exe"C:\Users\Admin\AppData\Local\Temp\7ff61e14ecaa3f9e04d53c3ca6715831fa07aab4f623c3584adc19674f0cf808.exe"1⤵
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:2272 -
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\sO7gV29.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\sO7gV29.exe2⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:1740 -
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\CE2lf88.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\CE2lf88.exe3⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:2268 -
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\JO6eZ81.exeC:\Users\Admin\AppData\Local\Temp\IXP002.TMP\JO6eZ81.exe4⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:1644 -
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\1OL45Uy7.exeC:\Users\Admin\AppData\Local\Temp\IXP003.TMP\1OL45Uy7.exe5⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2768 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"6⤵
- Modifies Windows Defender Real-time Protection settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2648
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2768 -s 2846⤵
- Loads dropped DLL
- Program crash
PID:2668
-
-
-
-
-
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
955KB
MD50c1cea060133bd39118c3e8a1879a717
SHA18efdbe4bf8ab2646d195c92b3668dda01d8cce29
SHA256345bbf1dd645248e0ee42821e50b6c264b3cde47647da660a1e70bfe3388d58d
SHA51206a38b8d25f8b8e9bf54330cb68fecc41dfee7d62d8247e825b24cd33c19a340b4bb141e02c1da8c88e2acfe787f71543f191b260a49fe2358e3c587af91bdd3
-
Filesize
955KB
MD50c1cea060133bd39118c3e8a1879a717
SHA18efdbe4bf8ab2646d195c92b3668dda01d8cce29
SHA256345bbf1dd645248e0ee42821e50b6c264b3cde47647da660a1e70bfe3388d58d
SHA51206a38b8d25f8b8e9bf54330cb68fecc41dfee7d62d8247e825b24cd33c19a340b4bb141e02c1da8c88e2acfe787f71543f191b260a49fe2358e3c587af91bdd3
-
Filesize
653KB
MD5404f801b501eb3577ad20add796a18e8
SHA1a2c041518b4261fc090982c0264d630caccaa86f
SHA256be773f2ddb911e33d4e1b6c643759dc5dfd130ebf9b275a8e2949874d316c6b3
SHA51228fc7ac8bbf84f6d27c95c17e841c79508183fed666d84dd3d02bfce70d63092efc1e3cdb71404cbb658c1c3611819f7bcdbd615237fca3c1f8a9ee56d5fc7f9
-
Filesize
653KB
MD5404f801b501eb3577ad20add796a18e8
SHA1a2c041518b4261fc090982c0264d630caccaa86f
SHA256be773f2ddb911e33d4e1b6c643759dc5dfd130ebf9b275a8e2949874d316c6b3
SHA51228fc7ac8bbf84f6d27c95c17e841c79508183fed666d84dd3d02bfce70d63092efc1e3cdb71404cbb658c1c3611819f7bcdbd615237fca3c1f8a9ee56d5fc7f9
-
Filesize
400KB
MD5b56d0d267a522c6c26fb8d13d5f2f225
SHA1c4315b6615264ef3247a28f3e360332fed4d9070
SHA25660d37c6e169554e4f3af50c6ed6195bed3fa9203a2bd846c6369ec6ad382e06f
SHA51246778ccbb96d91901dac64352da57184f1a0dc237455ccfefb438b97793953fd8a0f06de154135e784a8482ec78f28d56e2db6e475ee978c4c76bcfa17200172
-
Filesize
400KB
MD5b56d0d267a522c6c26fb8d13d5f2f225
SHA1c4315b6615264ef3247a28f3e360332fed4d9070
SHA25660d37c6e169554e4f3af50c6ed6195bed3fa9203a2bd846c6369ec6ad382e06f
SHA51246778ccbb96d91901dac64352da57184f1a0dc237455ccfefb438b97793953fd8a0f06de154135e784a8482ec78f28d56e2db6e475ee978c4c76bcfa17200172
-
Filesize
277KB
MD569b698bd9139a2a884820a62c8efd208
SHA18cd7f779cf00a281c5b6b7f098ab965fa8d12b8e
SHA256d49ef716c818978ba3d6eeb67f0ca1d9c8333f2d04c44516f036d46c27a69764
SHA512d7ea5c4c6eb94cdc484903d22f9c88c3296a1b6fda6fcec90f4472289d90650b0a0b04a4a41dede0473392e28ac0fa0b7649eddb787544f670aa9d8efce68b79
-
Filesize
277KB
MD569b698bd9139a2a884820a62c8efd208
SHA18cd7f779cf00a281c5b6b7f098ab965fa8d12b8e
SHA256d49ef716c818978ba3d6eeb67f0ca1d9c8333f2d04c44516f036d46c27a69764
SHA512d7ea5c4c6eb94cdc484903d22f9c88c3296a1b6fda6fcec90f4472289d90650b0a0b04a4a41dede0473392e28ac0fa0b7649eddb787544f670aa9d8efce68b79
-
Filesize
955KB
MD50c1cea060133bd39118c3e8a1879a717
SHA18efdbe4bf8ab2646d195c92b3668dda01d8cce29
SHA256345bbf1dd645248e0ee42821e50b6c264b3cde47647da660a1e70bfe3388d58d
SHA51206a38b8d25f8b8e9bf54330cb68fecc41dfee7d62d8247e825b24cd33c19a340b4bb141e02c1da8c88e2acfe787f71543f191b260a49fe2358e3c587af91bdd3
-
Filesize
955KB
MD50c1cea060133bd39118c3e8a1879a717
SHA18efdbe4bf8ab2646d195c92b3668dda01d8cce29
SHA256345bbf1dd645248e0ee42821e50b6c264b3cde47647da660a1e70bfe3388d58d
SHA51206a38b8d25f8b8e9bf54330cb68fecc41dfee7d62d8247e825b24cd33c19a340b4bb141e02c1da8c88e2acfe787f71543f191b260a49fe2358e3c587af91bdd3
-
Filesize
653KB
MD5404f801b501eb3577ad20add796a18e8
SHA1a2c041518b4261fc090982c0264d630caccaa86f
SHA256be773f2ddb911e33d4e1b6c643759dc5dfd130ebf9b275a8e2949874d316c6b3
SHA51228fc7ac8bbf84f6d27c95c17e841c79508183fed666d84dd3d02bfce70d63092efc1e3cdb71404cbb658c1c3611819f7bcdbd615237fca3c1f8a9ee56d5fc7f9
-
Filesize
653KB
MD5404f801b501eb3577ad20add796a18e8
SHA1a2c041518b4261fc090982c0264d630caccaa86f
SHA256be773f2ddb911e33d4e1b6c643759dc5dfd130ebf9b275a8e2949874d316c6b3
SHA51228fc7ac8bbf84f6d27c95c17e841c79508183fed666d84dd3d02bfce70d63092efc1e3cdb71404cbb658c1c3611819f7bcdbd615237fca3c1f8a9ee56d5fc7f9
-
Filesize
400KB
MD5b56d0d267a522c6c26fb8d13d5f2f225
SHA1c4315b6615264ef3247a28f3e360332fed4d9070
SHA25660d37c6e169554e4f3af50c6ed6195bed3fa9203a2bd846c6369ec6ad382e06f
SHA51246778ccbb96d91901dac64352da57184f1a0dc237455ccfefb438b97793953fd8a0f06de154135e784a8482ec78f28d56e2db6e475ee978c4c76bcfa17200172
-
Filesize
400KB
MD5b56d0d267a522c6c26fb8d13d5f2f225
SHA1c4315b6615264ef3247a28f3e360332fed4d9070
SHA25660d37c6e169554e4f3af50c6ed6195bed3fa9203a2bd846c6369ec6ad382e06f
SHA51246778ccbb96d91901dac64352da57184f1a0dc237455ccfefb438b97793953fd8a0f06de154135e784a8482ec78f28d56e2db6e475ee978c4c76bcfa17200172
-
Filesize
277KB
MD569b698bd9139a2a884820a62c8efd208
SHA18cd7f779cf00a281c5b6b7f098ab965fa8d12b8e
SHA256d49ef716c818978ba3d6eeb67f0ca1d9c8333f2d04c44516f036d46c27a69764
SHA512d7ea5c4c6eb94cdc484903d22f9c88c3296a1b6fda6fcec90f4472289d90650b0a0b04a4a41dede0473392e28ac0fa0b7649eddb787544f670aa9d8efce68b79
-
Filesize
277KB
MD569b698bd9139a2a884820a62c8efd208
SHA18cd7f779cf00a281c5b6b7f098ab965fa8d12b8e
SHA256d49ef716c818978ba3d6eeb67f0ca1d9c8333f2d04c44516f036d46c27a69764
SHA512d7ea5c4c6eb94cdc484903d22f9c88c3296a1b6fda6fcec90f4472289d90650b0a0b04a4a41dede0473392e28ac0fa0b7649eddb787544f670aa9d8efce68b79
-
Filesize
277KB
MD569b698bd9139a2a884820a62c8efd208
SHA18cd7f779cf00a281c5b6b7f098ab965fa8d12b8e
SHA256d49ef716c818978ba3d6eeb67f0ca1d9c8333f2d04c44516f036d46c27a69764
SHA512d7ea5c4c6eb94cdc484903d22f9c88c3296a1b6fda6fcec90f4472289d90650b0a0b04a4a41dede0473392e28ac0fa0b7649eddb787544f670aa9d8efce68b79
-
Filesize
277KB
MD569b698bd9139a2a884820a62c8efd208
SHA18cd7f779cf00a281c5b6b7f098ab965fa8d12b8e
SHA256d49ef716c818978ba3d6eeb67f0ca1d9c8333f2d04c44516f036d46c27a69764
SHA512d7ea5c4c6eb94cdc484903d22f9c88c3296a1b6fda6fcec90f4472289d90650b0a0b04a4a41dede0473392e28ac0fa0b7649eddb787544f670aa9d8efce68b79
-
Filesize
277KB
MD569b698bd9139a2a884820a62c8efd208
SHA18cd7f779cf00a281c5b6b7f098ab965fa8d12b8e
SHA256d49ef716c818978ba3d6eeb67f0ca1d9c8333f2d04c44516f036d46c27a69764
SHA512d7ea5c4c6eb94cdc484903d22f9c88c3296a1b6fda6fcec90f4472289d90650b0a0b04a4a41dede0473392e28ac0fa0b7649eddb787544f670aa9d8efce68b79
-
Filesize
277KB
MD569b698bd9139a2a884820a62c8efd208
SHA18cd7f779cf00a281c5b6b7f098ab965fa8d12b8e
SHA256d49ef716c818978ba3d6eeb67f0ca1d9c8333f2d04c44516f036d46c27a69764
SHA512d7ea5c4c6eb94cdc484903d22f9c88c3296a1b6fda6fcec90f4472289d90650b0a0b04a4a41dede0473392e28ac0fa0b7649eddb787544f670aa9d8efce68b79