Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    122s
  • max time network
    127s
  • platform
    windows7_x64
  • resource
    win7-20230831-en
  • resource tags

    arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
  • submitted
    11/10/2023, 08:57

General

  • Target

    cb5037901dccb439e6532ab96fac08146c8fd2f26939b9b8acca2b6afaf53ffe.exe

  • Size

    1.3MB

  • MD5

    3e26c8f2c4e0e45ff82a22a5ec602b6c

  • SHA1

    f24cda65492bc2d0571a4805bbc5945d63e610b5

  • SHA256

    cb5037901dccb439e6532ab96fac08146c8fd2f26939b9b8acca2b6afaf53ffe

  • SHA512

    4a873c0a2401ea9d3ea4e62438d22a8831fc5a2a42ff68e2039e521b288dfef9c8f02d13ed2fe6026d77ddba0a4faf987cbb4331b950ef9ac1b9b407c9ad0219

  • SSDEEP

    24576:gyywqrW5qN8cNHkviABz1RMAOVQ9YYjH8ns2AoGW/PylEqB:nDnmQi4z1RMAFpjcnhaC4L

Malware Config

Signatures

  • Detects Healer an antivirus disabler dropper 5 IoCs
  • Healer

    Healer an antivirus disabler dropper.

  • Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs
  • Executes dropped EXE 5 IoCs
  • Loads dropped DLL 15 IoCs
  • Adds Run key to start application 2 TTPs 5 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Program crash 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 54 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\cb5037901dccb439e6532ab96fac08146c8fd2f26939b9b8acca2b6afaf53ffe.exe
    "C:\Users\Admin\AppData\Local\Temp\cb5037901dccb439e6532ab96fac08146c8fd2f26939b9b8acca2b6afaf53ffe.exe"
    1⤵
    • Loads dropped DLL
    • Adds Run key to start application
    • Suspicious use of WriteProcessMemory
    PID:1916
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z7831972.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z7831972.exe
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Adds Run key to start application
      • Suspicious use of WriteProcessMemory
      PID:2392
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z2384936.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z2384936.exe
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Adds Run key to start application
        • Suspicious use of WriteProcessMemory
        PID:1116
        • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\z1583917.exe
          C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\z1583917.exe
          4⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • Adds Run key to start application
          • Suspicious use of WriteProcessMemory
          PID:1500
          • C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\z5936809.exe
            C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\z5936809.exe
            5⤵
            • Executes dropped EXE
            • Loads dropped DLL
            • Adds Run key to start application
            • Suspicious use of WriteProcessMemory
            PID:3036
            • C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q8612270.exe
              C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q8612270.exe
              6⤵
              • Executes dropped EXE
              • Loads dropped DLL
              • Suspicious use of SetThreadContext
              • Suspicious use of WriteProcessMemory
              PID:2660
              • C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
                "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
                7⤵
                • Modifies Windows Defender Real-time Protection settings
                • Suspicious behavior: EnumeratesProcesses
                • Suspicious use of AdjustPrivilegeToken
                PID:2676
              • C:\Windows\SysWOW64\WerFault.exe
                C:\Windows\SysWOW64\WerFault.exe -u -p 2660 -s 268
                7⤵
                • Loads dropped DLL
                • Program crash
                PID:2780

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z7831972.exe

    Filesize

    1.2MB

    MD5

    ca11e48110a9619a6fc38f62ca9133ab

    SHA1

    5f3f129c329d912a626ce229898759b9b9fc1ea3

    SHA256

    72858c74b353d1a3964f5a73da1ac3e97f91e3ed7f03aa71717a84520a42b52d

    SHA512

    d49a2ba5913184dea7232f1424d58425ceaa3aefa79f21b88e6840cf048fb70e00ead9c3d6844aebeebcbdd66f608994730dcd87deea9a7d09095afda9de56d2

  • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z7831972.exe

    Filesize

    1.2MB

    MD5

    ca11e48110a9619a6fc38f62ca9133ab

    SHA1

    5f3f129c329d912a626ce229898759b9b9fc1ea3

    SHA256

    72858c74b353d1a3964f5a73da1ac3e97f91e3ed7f03aa71717a84520a42b52d

    SHA512

    d49a2ba5913184dea7232f1424d58425ceaa3aefa79f21b88e6840cf048fb70e00ead9c3d6844aebeebcbdd66f608994730dcd87deea9a7d09095afda9de56d2

  • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z2384936.exe

    Filesize

    1.0MB

    MD5

    20ad71385e4b82c67427fa3a119e43c3

    SHA1

    7af16c42398fec423467ef6ac10a6e9cdcea0125

    SHA256

    fbe4c0e99a18dc1adff5da5c34b1197187021ded50bb72e39f2448105ab35bba

    SHA512

    920e5d3531f3878c62d22de3085d8e44139927f51341254a05cfe2006326901a033abdd2876d132ea1f8135a36507695914b55cab7c1018a2cdc4d7e71e06be5

  • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z2384936.exe

    Filesize

    1.0MB

    MD5

    20ad71385e4b82c67427fa3a119e43c3

    SHA1

    7af16c42398fec423467ef6ac10a6e9cdcea0125

    SHA256

    fbe4c0e99a18dc1adff5da5c34b1197187021ded50bb72e39f2448105ab35bba

    SHA512

    920e5d3531f3878c62d22de3085d8e44139927f51341254a05cfe2006326901a033abdd2876d132ea1f8135a36507695914b55cab7c1018a2cdc4d7e71e06be5

  • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\z1583917.exe

    Filesize

    883KB

    MD5

    968c86dde1f27058cc49539b9d205ff2

    SHA1

    07dcfd8742016f9a66fec4b6bcabc595dc5d16e9

    SHA256

    683dc82030aa7890b7bb49e822daf4348a77ade276cd888cfb9e5704c9924418

    SHA512

    f3344eac075efdb13e8e2076a6d37f69c3e179372c6bebe52399356fe100edcb48890d995e19454373711c7dc08faef906b9b1cee20026fcfc599537e0f1a7d0

  • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\z1583917.exe

    Filesize

    883KB

    MD5

    968c86dde1f27058cc49539b9d205ff2

    SHA1

    07dcfd8742016f9a66fec4b6bcabc595dc5d16e9

    SHA256

    683dc82030aa7890b7bb49e822daf4348a77ade276cd888cfb9e5704c9924418

    SHA512

    f3344eac075efdb13e8e2076a6d37f69c3e179372c6bebe52399356fe100edcb48890d995e19454373711c7dc08faef906b9b1cee20026fcfc599537e0f1a7d0

  • C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\z5936809.exe

    Filesize

    492KB

    MD5

    de701e13076d91c759b3c655988b87bc

    SHA1

    5491c695b2edd01a2518b615caa27a53c471a74a

    SHA256

    8c1e5b7805febbab30c71645f84ece4363d67771c56b1f4577df47b95f011d63

    SHA512

    0b68c338b47c61c6735e41d1e344e696c5939f105a9235e9de9d426140091f35d7073ecd9f58ef677edc37ae5b1e02e602f81c0d381c52de4ab9b8866dda22ed

  • C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\z5936809.exe

    Filesize

    492KB

    MD5

    de701e13076d91c759b3c655988b87bc

    SHA1

    5491c695b2edd01a2518b615caa27a53c471a74a

    SHA256

    8c1e5b7805febbab30c71645f84ece4363d67771c56b1f4577df47b95f011d63

    SHA512

    0b68c338b47c61c6735e41d1e344e696c5939f105a9235e9de9d426140091f35d7073ecd9f58ef677edc37ae5b1e02e602f81c0d381c52de4ab9b8866dda22ed

  • C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q8612270.exe

    Filesize

    860KB

    MD5

    3605fef60ebf770af1e48512a3797942

    SHA1

    2c15d9517bc29d3cfef79e2e2230d7bffe64d3e3

    SHA256

    b21c07eb11abf3843d566f6a4c55ada2dbb1f69e80e6305b5308a13820b40ae1

    SHA512

    c887944fd0c834511f31ac1013e4e81b9bb27e44c468fb76ef554a2d6d88724a7df3f69428c1ef10f960b073c5bc88667f2d0620f699fcc19d87be8267b86ce5

  • C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q8612270.exe

    Filesize

    860KB

    MD5

    3605fef60ebf770af1e48512a3797942

    SHA1

    2c15d9517bc29d3cfef79e2e2230d7bffe64d3e3

    SHA256

    b21c07eb11abf3843d566f6a4c55ada2dbb1f69e80e6305b5308a13820b40ae1

    SHA512

    c887944fd0c834511f31ac1013e4e81b9bb27e44c468fb76ef554a2d6d88724a7df3f69428c1ef10f960b073c5bc88667f2d0620f699fcc19d87be8267b86ce5

  • C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q8612270.exe

    Filesize

    860KB

    MD5

    3605fef60ebf770af1e48512a3797942

    SHA1

    2c15d9517bc29d3cfef79e2e2230d7bffe64d3e3

    SHA256

    b21c07eb11abf3843d566f6a4c55ada2dbb1f69e80e6305b5308a13820b40ae1

    SHA512

    c887944fd0c834511f31ac1013e4e81b9bb27e44c468fb76ef554a2d6d88724a7df3f69428c1ef10f960b073c5bc88667f2d0620f699fcc19d87be8267b86ce5

  • \Users\Admin\AppData\Local\Temp\IXP000.TMP\z7831972.exe

    Filesize

    1.2MB

    MD5

    ca11e48110a9619a6fc38f62ca9133ab

    SHA1

    5f3f129c329d912a626ce229898759b9b9fc1ea3

    SHA256

    72858c74b353d1a3964f5a73da1ac3e97f91e3ed7f03aa71717a84520a42b52d

    SHA512

    d49a2ba5913184dea7232f1424d58425ceaa3aefa79f21b88e6840cf048fb70e00ead9c3d6844aebeebcbdd66f608994730dcd87deea9a7d09095afda9de56d2

  • \Users\Admin\AppData\Local\Temp\IXP000.TMP\z7831972.exe

    Filesize

    1.2MB

    MD5

    ca11e48110a9619a6fc38f62ca9133ab

    SHA1

    5f3f129c329d912a626ce229898759b9b9fc1ea3

    SHA256

    72858c74b353d1a3964f5a73da1ac3e97f91e3ed7f03aa71717a84520a42b52d

    SHA512

    d49a2ba5913184dea7232f1424d58425ceaa3aefa79f21b88e6840cf048fb70e00ead9c3d6844aebeebcbdd66f608994730dcd87deea9a7d09095afda9de56d2

  • \Users\Admin\AppData\Local\Temp\IXP001.TMP\z2384936.exe

    Filesize

    1.0MB

    MD5

    20ad71385e4b82c67427fa3a119e43c3

    SHA1

    7af16c42398fec423467ef6ac10a6e9cdcea0125

    SHA256

    fbe4c0e99a18dc1adff5da5c34b1197187021ded50bb72e39f2448105ab35bba

    SHA512

    920e5d3531f3878c62d22de3085d8e44139927f51341254a05cfe2006326901a033abdd2876d132ea1f8135a36507695914b55cab7c1018a2cdc4d7e71e06be5

  • \Users\Admin\AppData\Local\Temp\IXP001.TMP\z2384936.exe

    Filesize

    1.0MB

    MD5

    20ad71385e4b82c67427fa3a119e43c3

    SHA1

    7af16c42398fec423467ef6ac10a6e9cdcea0125

    SHA256

    fbe4c0e99a18dc1adff5da5c34b1197187021ded50bb72e39f2448105ab35bba

    SHA512

    920e5d3531f3878c62d22de3085d8e44139927f51341254a05cfe2006326901a033abdd2876d132ea1f8135a36507695914b55cab7c1018a2cdc4d7e71e06be5

  • \Users\Admin\AppData\Local\Temp\IXP002.TMP\z1583917.exe

    Filesize

    883KB

    MD5

    968c86dde1f27058cc49539b9d205ff2

    SHA1

    07dcfd8742016f9a66fec4b6bcabc595dc5d16e9

    SHA256

    683dc82030aa7890b7bb49e822daf4348a77ade276cd888cfb9e5704c9924418

    SHA512

    f3344eac075efdb13e8e2076a6d37f69c3e179372c6bebe52399356fe100edcb48890d995e19454373711c7dc08faef906b9b1cee20026fcfc599537e0f1a7d0

  • \Users\Admin\AppData\Local\Temp\IXP002.TMP\z1583917.exe

    Filesize

    883KB

    MD5

    968c86dde1f27058cc49539b9d205ff2

    SHA1

    07dcfd8742016f9a66fec4b6bcabc595dc5d16e9

    SHA256

    683dc82030aa7890b7bb49e822daf4348a77ade276cd888cfb9e5704c9924418

    SHA512

    f3344eac075efdb13e8e2076a6d37f69c3e179372c6bebe52399356fe100edcb48890d995e19454373711c7dc08faef906b9b1cee20026fcfc599537e0f1a7d0

  • \Users\Admin\AppData\Local\Temp\IXP003.TMP\z5936809.exe

    Filesize

    492KB

    MD5

    de701e13076d91c759b3c655988b87bc

    SHA1

    5491c695b2edd01a2518b615caa27a53c471a74a

    SHA256

    8c1e5b7805febbab30c71645f84ece4363d67771c56b1f4577df47b95f011d63

    SHA512

    0b68c338b47c61c6735e41d1e344e696c5939f105a9235e9de9d426140091f35d7073ecd9f58ef677edc37ae5b1e02e602f81c0d381c52de4ab9b8866dda22ed

  • \Users\Admin\AppData\Local\Temp\IXP003.TMP\z5936809.exe

    Filesize

    492KB

    MD5

    de701e13076d91c759b3c655988b87bc

    SHA1

    5491c695b2edd01a2518b615caa27a53c471a74a

    SHA256

    8c1e5b7805febbab30c71645f84ece4363d67771c56b1f4577df47b95f011d63

    SHA512

    0b68c338b47c61c6735e41d1e344e696c5939f105a9235e9de9d426140091f35d7073ecd9f58ef677edc37ae5b1e02e602f81c0d381c52de4ab9b8866dda22ed

  • \Users\Admin\AppData\Local\Temp\IXP004.TMP\q8612270.exe

    Filesize

    860KB

    MD5

    3605fef60ebf770af1e48512a3797942

    SHA1

    2c15d9517bc29d3cfef79e2e2230d7bffe64d3e3

    SHA256

    b21c07eb11abf3843d566f6a4c55ada2dbb1f69e80e6305b5308a13820b40ae1

    SHA512

    c887944fd0c834511f31ac1013e4e81b9bb27e44c468fb76ef554a2d6d88724a7df3f69428c1ef10f960b073c5bc88667f2d0620f699fcc19d87be8267b86ce5

  • \Users\Admin\AppData\Local\Temp\IXP004.TMP\q8612270.exe

    Filesize

    860KB

    MD5

    3605fef60ebf770af1e48512a3797942

    SHA1

    2c15d9517bc29d3cfef79e2e2230d7bffe64d3e3

    SHA256

    b21c07eb11abf3843d566f6a4c55ada2dbb1f69e80e6305b5308a13820b40ae1

    SHA512

    c887944fd0c834511f31ac1013e4e81b9bb27e44c468fb76ef554a2d6d88724a7df3f69428c1ef10f960b073c5bc88667f2d0620f699fcc19d87be8267b86ce5

  • \Users\Admin\AppData\Local\Temp\IXP004.TMP\q8612270.exe

    Filesize

    860KB

    MD5

    3605fef60ebf770af1e48512a3797942

    SHA1

    2c15d9517bc29d3cfef79e2e2230d7bffe64d3e3

    SHA256

    b21c07eb11abf3843d566f6a4c55ada2dbb1f69e80e6305b5308a13820b40ae1

    SHA512

    c887944fd0c834511f31ac1013e4e81b9bb27e44c468fb76ef554a2d6d88724a7df3f69428c1ef10f960b073c5bc88667f2d0620f699fcc19d87be8267b86ce5

  • \Users\Admin\AppData\Local\Temp\IXP004.TMP\q8612270.exe

    Filesize

    860KB

    MD5

    3605fef60ebf770af1e48512a3797942

    SHA1

    2c15d9517bc29d3cfef79e2e2230d7bffe64d3e3

    SHA256

    b21c07eb11abf3843d566f6a4c55ada2dbb1f69e80e6305b5308a13820b40ae1

    SHA512

    c887944fd0c834511f31ac1013e4e81b9bb27e44c468fb76ef554a2d6d88724a7df3f69428c1ef10f960b073c5bc88667f2d0620f699fcc19d87be8267b86ce5

  • \Users\Admin\AppData\Local\Temp\IXP004.TMP\q8612270.exe

    Filesize

    860KB

    MD5

    3605fef60ebf770af1e48512a3797942

    SHA1

    2c15d9517bc29d3cfef79e2e2230d7bffe64d3e3

    SHA256

    b21c07eb11abf3843d566f6a4c55ada2dbb1f69e80e6305b5308a13820b40ae1

    SHA512

    c887944fd0c834511f31ac1013e4e81b9bb27e44c468fb76ef554a2d6d88724a7df3f69428c1ef10f960b073c5bc88667f2d0620f699fcc19d87be8267b86ce5

  • \Users\Admin\AppData\Local\Temp\IXP004.TMP\q8612270.exe

    Filesize

    860KB

    MD5

    3605fef60ebf770af1e48512a3797942

    SHA1

    2c15d9517bc29d3cfef79e2e2230d7bffe64d3e3

    SHA256

    b21c07eb11abf3843d566f6a4c55ada2dbb1f69e80e6305b5308a13820b40ae1

    SHA512

    c887944fd0c834511f31ac1013e4e81b9bb27e44c468fb76ef554a2d6d88724a7df3f69428c1ef10f960b073c5bc88667f2d0620f699fcc19d87be8267b86ce5

  • \Users\Admin\AppData\Local\Temp\IXP004.TMP\q8612270.exe

    Filesize

    860KB

    MD5

    3605fef60ebf770af1e48512a3797942

    SHA1

    2c15d9517bc29d3cfef79e2e2230d7bffe64d3e3

    SHA256

    b21c07eb11abf3843d566f6a4c55ada2dbb1f69e80e6305b5308a13820b40ae1

    SHA512

    c887944fd0c834511f31ac1013e4e81b9bb27e44c468fb76ef554a2d6d88724a7df3f69428c1ef10f960b073c5bc88667f2d0620f699fcc19d87be8267b86ce5

  • memory/2676-59-0x00000000FFFDE000-0x00000000FFFDF000-memory.dmp

    Filesize

    4KB

  • memory/2676-60-0x0000000000400000-0x000000000040A000-memory.dmp

    Filesize

    40KB

  • memory/2676-62-0x0000000000400000-0x000000000040A000-memory.dmp

    Filesize

    40KB

  • memory/2676-64-0x0000000000400000-0x000000000040A000-memory.dmp

    Filesize

    40KB

  • memory/2676-58-0x0000000000400000-0x000000000040A000-memory.dmp

    Filesize

    40KB

  • memory/2676-57-0x0000000000400000-0x000000000040A000-memory.dmp

    Filesize

    40KB

  • memory/2676-55-0x0000000000400000-0x000000000040A000-memory.dmp

    Filesize

    40KB

  • memory/2676-53-0x0000000000400000-0x000000000040A000-memory.dmp

    Filesize

    40KB