Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
118s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20230831-en -
resource tags
arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system -
submitted
11/10/2023, 10:07
Static task
static1
Behavioral task
behavioral1
Sample
file.exe
Resource
win7-20230831-en
Behavioral task
behavioral2
Sample
file.exe
Resource
win10v2004-20230915-en
General
-
Target
file.exe
-
Size
1.0MB
-
MD5
b34aa61738f03ba0bb2c7db303f056be
-
SHA1
20a0e8915cdcf8650fd5828bdd84074533e04ced
-
SHA256
3ff20844cf25c1a7745f5a06ba8c681b4b203c46977b21d4b5b8303d043e13a6
-
SHA512
be5cb928abb8303a2e9b43ae79471fba238e452f8df30d6c1d7297a141feb110bc8c7e23ebf30ff61643f174e12389ebf8537c2b34928ef4ce0b4f0c6a8021e8
-
SSDEEP
24576:pySlcqW16tnPxKTWbCWozzDNUSnBRw578AzPCMsb1Z3f+:cUcpEPw5J7BRwCA2Z
Malware Config
Signatures
-
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" AppLaunch.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" AppLaunch.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" AppLaunch.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" AppLaunch.exe Key created \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection AppLaunch.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" AppLaunch.exe -
Executes dropped EXE 4 IoCs
pid Process 2204 CG5gm86.exe 2120 Gw3Rg64.exe 2308 MX4HI14.exe 2704 1cN47Fl5.exe -
Loads dropped DLL 12 IoCs
pid Process 1704 file.exe 2204 CG5gm86.exe 2204 CG5gm86.exe 2120 Gw3Rg64.exe 2120 Gw3Rg64.exe 2308 MX4HI14.exe 2308 MX4HI14.exe 2704 1cN47Fl5.exe 2616 WerFault.exe 2616 WerFault.exe 2616 WerFault.exe 2616 WerFault.exe -
Adds Run key to start application 2 TTPs 4 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup3 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP003.TMP\\\"" MX4HI14.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" file.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" CG5gm86.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\"" Gw3Rg64.exe -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 2704 set thread context of 2728 2704 1cN47Fl5.exe 33 -
Program crash 1 IoCs
pid pid_target Process procid_target 2616 2704 WerFault.exe 31 -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 2728 AppLaunch.exe 2728 AppLaunch.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 2728 AppLaunch.exe -
Suspicious use of WriteProcessMemory 47 IoCs
description pid Process procid_target PID 1704 wrote to memory of 2204 1704 file.exe 28 PID 1704 wrote to memory of 2204 1704 file.exe 28 PID 1704 wrote to memory of 2204 1704 file.exe 28 PID 1704 wrote to memory of 2204 1704 file.exe 28 PID 1704 wrote to memory of 2204 1704 file.exe 28 PID 1704 wrote to memory of 2204 1704 file.exe 28 PID 1704 wrote to memory of 2204 1704 file.exe 28 PID 2204 wrote to memory of 2120 2204 CG5gm86.exe 29 PID 2204 wrote to memory of 2120 2204 CG5gm86.exe 29 PID 2204 wrote to memory of 2120 2204 CG5gm86.exe 29 PID 2204 wrote to memory of 2120 2204 CG5gm86.exe 29 PID 2204 wrote to memory of 2120 2204 CG5gm86.exe 29 PID 2204 wrote to memory of 2120 2204 CG5gm86.exe 29 PID 2204 wrote to memory of 2120 2204 CG5gm86.exe 29 PID 2120 wrote to memory of 2308 2120 Gw3Rg64.exe 30 PID 2120 wrote to memory of 2308 2120 Gw3Rg64.exe 30 PID 2120 wrote to memory of 2308 2120 Gw3Rg64.exe 30 PID 2120 wrote to memory of 2308 2120 Gw3Rg64.exe 30 PID 2120 wrote to memory of 2308 2120 Gw3Rg64.exe 30 PID 2120 wrote to memory of 2308 2120 Gw3Rg64.exe 30 PID 2120 wrote to memory of 2308 2120 Gw3Rg64.exe 30 PID 2308 wrote to memory of 2704 2308 MX4HI14.exe 31 PID 2308 wrote to memory of 2704 2308 MX4HI14.exe 31 PID 2308 wrote to memory of 2704 2308 MX4HI14.exe 31 PID 2308 wrote to memory of 2704 2308 MX4HI14.exe 31 PID 2308 wrote to memory of 2704 2308 MX4HI14.exe 31 PID 2308 wrote to memory of 2704 2308 MX4HI14.exe 31 PID 2308 wrote to memory of 2704 2308 MX4HI14.exe 31 PID 2704 wrote to memory of 2728 2704 1cN47Fl5.exe 33 PID 2704 wrote to memory of 2728 2704 1cN47Fl5.exe 33 PID 2704 wrote to memory of 2728 2704 1cN47Fl5.exe 33 PID 2704 wrote to memory of 2728 2704 1cN47Fl5.exe 33 PID 2704 wrote to memory of 2728 2704 1cN47Fl5.exe 33 PID 2704 wrote to memory of 2728 2704 1cN47Fl5.exe 33 PID 2704 wrote to memory of 2728 2704 1cN47Fl5.exe 33 PID 2704 wrote to memory of 2728 2704 1cN47Fl5.exe 33 PID 2704 wrote to memory of 2728 2704 1cN47Fl5.exe 33 PID 2704 wrote to memory of 2728 2704 1cN47Fl5.exe 33 PID 2704 wrote to memory of 2728 2704 1cN47Fl5.exe 33 PID 2704 wrote to memory of 2728 2704 1cN47Fl5.exe 33 PID 2704 wrote to memory of 2616 2704 1cN47Fl5.exe 34 PID 2704 wrote to memory of 2616 2704 1cN47Fl5.exe 34 PID 2704 wrote to memory of 2616 2704 1cN47Fl5.exe 34 PID 2704 wrote to memory of 2616 2704 1cN47Fl5.exe 34 PID 2704 wrote to memory of 2616 2704 1cN47Fl5.exe 34 PID 2704 wrote to memory of 2616 2704 1cN47Fl5.exe 34 PID 2704 wrote to memory of 2616 2704 1cN47Fl5.exe 34
Processes
-
C:\Users\Admin\AppData\Local\Temp\file.exe"C:\Users\Admin\AppData\Local\Temp\file.exe"1⤵
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:1704 -
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\CG5gm86.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\CG5gm86.exe2⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:2204 -
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\Gw3Rg64.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\Gw3Rg64.exe3⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:2120 -
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\MX4HI14.exeC:\Users\Admin\AppData\Local\Temp\IXP002.TMP\MX4HI14.exe4⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:2308 -
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\1cN47Fl5.exeC:\Users\Admin\AppData\Local\Temp\IXP003.TMP\1cN47Fl5.exe5⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2704 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"6⤵
- Modifies Windows Defender Real-time Protection settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2728
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2704 -s 2686⤵
- Loads dropped DLL
- Program crash
PID:2616
-
-
-
-
-
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
909KB
MD5cdef7e9e4abb299aec3457e5f70b8f70
SHA19929f81b9ff7585bb2b4bd1e2372fa4801d76640
SHA25655c470361627fa33d80192588292aded6130001e328921dccd53e11f2d974c9f
SHA51299ef8fc2482d420aff7e4d325f81440bd8e75dd73ebdeec1edf08d56ecb36e3181df9ccb7e4fda2225175bbeaa90325856a76b82ff2df8b6a52f89458025b70c
-
Filesize
909KB
MD5cdef7e9e4abb299aec3457e5f70b8f70
SHA19929f81b9ff7585bb2b4bd1e2372fa4801d76640
SHA25655c470361627fa33d80192588292aded6130001e328921dccd53e11f2d974c9f
SHA51299ef8fc2482d420aff7e4d325f81440bd8e75dd73ebdeec1edf08d56ecb36e3181df9ccb7e4fda2225175bbeaa90325856a76b82ff2df8b6a52f89458025b70c
-
Filesize
620KB
MD5ad524aa581a38b78069bf4a11a6f3f3e
SHA187ac23d2912db4bca4f857bf177d1bc008219bac
SHA2560621911e980cba9641636efffa148e52f3c94a1dc53346a2fe30f3a6e4810104
SHA512ef49470ce77a9c49806a50b0f6bd2841f373bc0e5fbf492b9ce18628b05c6dd6b08f26d611226fe9ac271daf394ec9fe71da0154b75f0d119ba2bb20bf3d5895
-
Filesize
620KB
MD5ad524aa581a38b78069bf4a11a6f3f3e
SHA187ac23d2912db4bca4f857bf177d1bc008219bac
SHA2560621911e980cba9641636efffa148e52f3c94a1dc53346a2fe30f3a6e4810104
SHA512ef49470ce77a9c49806a50b0f6bd2841f373bc0e5fbf492b9ce18628b05c6dd6b08f26d611226fe9ac271daf394ec9fe71da0154b75f0d119ba2bb20bf3d5895
-
Filesize
382KB
MD545d10f29b83323b8527ba77ca7fe9b71
SHA187a2d2affa8f43cd5c7ee4de44a8a704e9da39fc
SHA25638926bfe231441b3e38ae55b8ebd3656b137b9002b70a6abda3ea1739d1dc773
SHA51221ad23a29a0e995bb0bd794e37271eedd96a63a2b0865d8621019353460deb1ea3189349dc8c78b6588a1c5004047cac654cbb21193eac716fb7ffd78c7f5096
-
Filesize
382KB
MD545d10f29b83323b8527ba77ca7fe9b71
SHA187a2d2affa8f43cd5c7ee4de44a8a704e9da39fc
SHA25638926bfe231441b3e38ae55b8ebd3656b137b9002b70a6abda3ea1739d1dc773
SHA51221ad23a29a0e995bb0bd794e37271eedd96a63a2b0865d8621019353460deb1ea3189349dc8c78b6588a1c5004047cac654cbb21193eac716fb7ffd78c7f5096
-
Filesize
237KB
MD5310b4ad6995eed7530a6491ac81b079f
SHA14e02ed6fb9733a1e93fa10afdbed038253d1c412
SHA256d635ad9a5a273d2f3a5438afce9d096c904c6e36a9af1ead48c45a0a92c8851f
SHA5123a28dd60987a78c8843018e716c80eddb2a25ee5033304fa20c8c0a83d3eae56a90d703f987ea709c45f0ec79df9f76527e7c4ba33ecb319e63c7bb4be11006f
-
Filesize
237KB
MD5310b4ad6995eed7530a6491ac81b079f
SHA14e02ed6fb9733a1e93fa10afdbed038253d1c412
SHA256d635ad9a5a273d2f3a5438afce9d096c904c6e36a9af1ead48c45a0a92c8851f
SHA5123a28dd60987a78c8843018e716c80eddb2a25ee5033304fa20c8c0a83d3eae56a90d703f987ea709c45f0ec79df9f76527e7c4ba33ecb319e63c7bb4be11006f
-
Filesize
909KB
MD5cdef7e9e4abb299aec3457e5f70b8f70
SHA19929f81b9ff7585bb2b4bd1e2372fa4801d76640
SHA25655c470361627fa33d80192588292aded6130001e328921dccd53e11f2d974c9f
SHA51299ef8fc2482d420aff7e4d325f81440bd8e75dd73ebdeec1edf08d56ecb36e3181df9ccb7e4fda2225175bbeaa90325856a76b82ff2df8b6a52f89458025b70c
-
Filesize
909KB
MD5cdef7e9e4abb299aec3457e5f70b8f70
SHA19929f81b9ff7585bb2b4bd1e2372fa4801d76640
SHA25655c470361627fa33d80192588292aded6130001e328921dccd53e11f2d974c9f
SHA51299ef8fc2482d420aff7e4d325f81440bd8e75dd73ebdeec1edf08d56ecb36e3181df9ccb7e4fda2225175bbeaa90325856a76b82ff2df8b6a52f89458025b70c
-
Filesize
620KB
MD5ad524aa581a38b78069bf4a11a6f3f3e
SHA187ac23d2912db4bca4f857bf177d1bc008219bac
SHA2560621911e980cba9641636efffa148e52f3c94a1dc53346a2fe30f3a6e4810104
SHA512ef49470ce77a9c49806a50b0f6bd2841f373bc0e5fbf492b9ce18628b05c6dd6b08f26d611226fe9ac271daf394ec9fe71da0154b75f0d119ba2bb20bf3d5895
-
Filesize
620KB
MD5ad524aa581a38b78069bf4a11a6f3f3e
SHA187ac23d2912db4bca4f857bf177d1bc008219bac
SHA2560621911e980cba9641636efffa148e52f3c94a1dc53346a2fe30f3a6e4810104
SHA512ef49470ce77a9c49806a50b0f6bd2841f373bc0e5fbf492b9ce18628b05c6dd6b08f26d611226fe9ac271daf394ec9fe71da0154b75f0d119ba2bb20bf3d5895
-
Filesize
382KB
MD545d10f29b83323b8527ba77ca7fe9b71
SHA187a2d2affa8f43cd5c7ee4de44a8a704e9da39fc
SHA25638926bfe231441b3e38ae55b8ebd3656b137b9002b70a6abda3ea1739d1dc773
SHA51221ad23a29a0e995bb0bd794e37271eedd96a63a2b0865d8621019353460deb1ea3189349dc8c78b6588a1c5004047cac654cbb21193eac716fb7ffd78c7f5096
-
Filesize
382KB
MD545d10f29b83323b8527ba77ca7fe9b71
SHA187a2d2affa8f43cd5c7ee4de44a8a704e9da39fc
SHA25638926bfe231441b3e38ae55b8ebd3656b137b9002b70a6abda3ea1739d1dc773
SHA51221ad23a29a0e995bb0bd794e37271eedd96a63a2b0865d8621019353460deb1ea3189349dc8c78b6588a1c5004047cac654cbb21193eac716fb7ffd78c7f5096
-
Filesize
237KB
MD5310b4ad6995eed7530a6491ac81b079f
SHA14e02ed6fb9733a1e93fa10afdbed038253d1c412
SHA256d635ad9a5a273d2f3a5438afce9d096c904c6e36a9af1ead48c45a0a92c8851f
SHA5123a28dd60987a78c8843018e716c80eddb2a25ee5033304fa20c8c0a83d3eae56a90d703f987ea709c45f0ec79df9f76527e7c4ba33ecb319e63c7bb4be11006f
-
Filesize
237KB
MD5310b4ad6995eed7530a6491ac81b079f
SHA14e02ed6fb9733a1e93fa10afdbed038253d1c412
SHA256d635ad9a5a273d2f3a5438afce9d096c904c6e36a9af1ead48c45a0a92c8851f
SHA5123a28dd60987a78c8843018e716c80eddb2a25ee5033304fa20c8c0a83d3eae56a90d703f987ea709c45f0ec79df9f76527e7c4ba33ecb319e63c7bb4be11006f
-
Filesize
237KB
MD5310b4ad6995eed7530a6491ac81b079f
SHA14e02ed6fb9733a1e93fa10afdbed038253d1c412
SHA256d635ad9a5a273d2f3a5438afce9d096c904c6e36a9af1ead48c45a0a92c8851f
SHA5123a28dd60987a78c8843018e716c80eddb2a25ee5033304fa20c8c0a83d3eae56a90d703f987ea709c45f0ec79df9f76527e7c4ba33ecb319e63c7bb4be11006f
-
Filesize
237KB
MD5310b4ad6995eed7530a6491ac81b079f
SHA14e02ed6fb9733a1e93fa10afdbed038253d1c412
SHA256d635ad9a5a273d2f3a5438afce9d096c904c6e36a9af1ead48c45a0a92c8851f
SHA5123a28dd60987a78c8843018e716c80eddb2a25ee5033304fa20c8c0a83d3eae56a90d703f987ea709c45f0ec79df9f76527e7c4ba33ecb319e63c7bb4be11006f
-
Filesize
237KB
MD5310b4ad6995eed7530a6491ac81b079f
SHA14e02ed6fb9733a1e93fa10afdbed038253d1c412
SHA256d635ad9a5a273d2f3a5438afce9d096c904c6e36a9af1ead48c45a0a92c8851f
SHA5123a28dd60987a78c8843018e716c80eddb2a25ee5033304fa20c8c0a83d3eae56a90d703f987ea709c45f0ec79df9f76527e7c4ba33ecb319e63c7bb4be11006f
-
Filesize
237KB
MD5310b4ad6995eed7530a6491ac81b079f
SHA14e02ed6fb9733a1e93fa10afdbed038253d1c412
SHA256d635ad9a5a273d2f3a5438afce9d096c904c6e36a9af1ead48c45a0a92c8851f
SHA5123a28dd60987a78c8843018e716c80eddb2a25ee5033304fa20c8c0a83d3eae56a90d703f987ea709c45f0ec79df9f76527e7c4ba33ecb319e63c7bb4be11006f