Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    118s
  • max time network
    122s
  • platform
    windows7_x64
  • resource
    win7-20230831-en
  • resource tags

    arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
  • submitted
    11/10/2023, 10:07

General

  • Target

    file.exe

  • Size

    1.0MB

  • MD5

    b34aa61738f03ba0bb2c7db303f056be

  • SHA1

    20a0e8915cdcf8650fd5828bdd84074533e04ced

  • SHA256

    3ff20844cf25c1a7745f5a06ba8c681b4b203c46977b21d4b5b8303d043e13a6

  • SHA512

    be5cb928abb8303a2e9b43ae79471fba238e452f8df30d6c1d7297a141feb110bc8c7e23ebf30ff61643f174e12389ebf8537c2b34928ef4ce0b4f0c6a8021e8

  • SSDEEP

    24576:pySlcqW16tnPxKTWbCWozzDNUSnBRw578AzPCMsb1Z3f+:cUcpEPw5J7BRwCA2Z

Malware Config

Signatures

  • Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs
  • Executes dropped EXE 4 IoCs
  • Loads dropped DLL 12 IoCs
  • Adds Run key to start application 2 TTPs 4 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Program crash 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 47 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\file.exe
    "C:\Users\Admin\AppData\Local\Temp\file.exe"
    1⤵
    • Loads dropped DLL
    • Adds Run key to start application
    • Suspicious use of WriteProcessMemory
    PID:1704
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\CG5gm86.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\CG5gm86.exe
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Adds Run key to start application
      • Suspicious use of WriteProcessMemory
      PID:2204
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\Gw3Rg64.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\Gw3Rg64.exe
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Adds Run key to start application
        • Suspicious use of WriteProcessMemory
        PID:2120
        • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\MX4HI14.exe
          C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\MX4HI14.exe
          4⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • Adds Run key to start application
          • Suspicious use of WriteProcessMemory
          PID:2308
          • C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\1cN47Fl5.exe
            C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\1cN47Fl5.exe
            5⤵
            • Executes dropped EXE
            • Loads dropped DLL
            • Suspicious use of SetThreadContext
            • Suspicious use of WriteProcessMemory
            PID:2704
            • C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
              "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
              6⤵
              • Modifies Windows Defender Real-time Protection settings
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of AdjustPrivilegeToken
              PID:2728
            • C:\Windows\SysWOW64\WerFault.exe
              C:\Windows\SysWOW64\WerFault.exe -u -p 2704 -s 268
              6⤵
              • Loads dropped DLL
              • Program crash
              PID:2616

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\CG5gm86.exe

    Filesize

    909KB

    MD5

    cdef7e9e4abb299aec3457e5f70b8f70

    SHA1

    9929f81b9ff7585bb2b4bd1e2372fa4801d76640

    SHA256

    55c470361627fa33d80192588292aded6130001e328921dccd53e11f2d974c9f

    SHA512

    99ef8fc2482d420aff7e4d325f81440bd8e75dd73ebdeec1edf08d56ecb36e3181df9ccb7e4fda2225175bbeaa90325856a76b82ff2df8b6a52f89458025b70c

  • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\CG5gm86.exe

    Filesize

    909KB

    MD5

    cdef7e9e4abb299aec3457e5f70b8f70

    SHA1

    9929f81b9ff7585bb2b4bd1e2372fa4801d76640

    SHA256

    55c470361627fa33d80192588292aded6130001e328921dccd53e11f2d974c9f

    SHA512

    99ef8fc2482d420aff7e4d325f81440bd8e75dd73ebdeec1edf08d56ecb36e3181df9ccb7e4fda2225175bbeaa90325856a76b82ff2df8b6a52f89458025b70c

  • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\Gw3Rg64.exe

    Filesize

    620KB

    MD5

    ad524aa581a38b78069bf4a11a6f3f3e

    SHA1

    87ac23d2912db4bca4f857bf177d1bc008219bac

    SHA256

    0621911e980cba9641636efffa148e52f3c94a1dc53346a2fe30f3a6e4810104

    SHA512

    ef49470ce77a9c49806a50b0f6bd2841f373bc0e5fbf492b9ce18628b05c6dd6b08f26d611226fe9ac271daf394ec9fe71da0154b75f0d119ba2bb20bf3d5895

  • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\Gw3Rg64.exe

    Filesize

    620KB

    MD5

    ad524aa581a38b78069bf4a11a6f3f3e

    SHA1

    87ac23d2912db4bca4f857bf177d1bc008219bac

    SHA256

    0621911e980cba9641636efffa148e52f3c94a1dc53346a2fe30f3a6e4810104

    SHA512

    ef49470ce77a9c49806a50b0f6bd2841f373bc0e5fbf492b9ce18628b05c6dd6b08f26d611226fe9ac271daf394ec9fe71da0154b75f0d119ba2bb20bf3d5895

  • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\MX4HI14.exe

    Filesize

    382KB

    MD5

    45d10f29b83323b8527ba77ca7fe9b71

    SHA1

    87a2d2affa8f43cd5c7ee4de44a8a704e9da39fc

    SHA256

    38926bfe231441b3e38ae55b8ebd3656b137b9002b70a6abda3ea1739d1dc773

    SHA512

    21ad23a29a0e995bb0bd794e37271eedd96a63a2b0865d8621019353460deb1ea3189349dc8c78b6588a1c5004047cac654cbb21193eac716fb7ffd78c7f5096

  • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\MX4HI14.exe

    Filesize

    382KB

    MD5

    45d10f29b83323b8527ba77ca7fe9b71

    SHA1

    87a2d2affa8f43cd5c7ee4de44a8a704e9da39fc

    SHA256

    38926bfe231441b3e38ae55b8ebd3656b137b9002b70a6abda3ea1739d1dc773

    SHA512

    21ad23a29a0e995bb0bd794e37271eedd96a63a2b0865d8621019353460deb1ea3189349dc8c78b6588a1c5004047cac654cbb21193eac716fb7ffd78c7f5096

  • C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\1cN47Fl5.exe

    Filesize

    237KB

    MD5

    310b4ad6995eed7530a6491ac81b079f

    SHA1

    4e02ed6fb9733a1e93fa10afdbed038253d1c412

    SHA256

    d635ad9a5a273d2f3a5438afce9d096c904c6e36a9af1ead48c45a0a92c8851f

    SHA512

    3a28dd60987a78c8843018e716c80eddb2a25ee5033304fa20c8c0a83d3eae56a90d703f987ea709c45f0ec79df9f76527e7c4ba33ecb319e63c7bb4be11006f

  • C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\1cN47Fl5.exe

    Filesize

    237KB

    MD5

    310b4ad6995eed7530a6491ac81b079f

    SHA1

    4e02ed6fb9733a1e93fa10afdbed038253d1c412

    SHA256

    d635ad9a5a273d2f3a5438afce9d096c904c6e36a9af1ead48c45a0a92c8851f

    SHA512

    3a28dd60987a78c8843018e716c80eddb2a25ee5033304fa20c8c0a83d3eae56a90d703f987ea709c45f0ec79df9f76527e7c4ba33ecb319e63c7bb4be11006f

  • \Users\Admin\AppData\Local\Temp\IXP000.TMP\CG5gm86.exe

    Filesize

    909KB

    MD5

    cdef7e9e4abb299aec3457e5f70b8f70

    SHA1

    9929f81b9ff7585bb2b4bd1e2372fa4801d76640

    SHA256

    55c470361627fa33d80192588292aded6130001e328921dccd53e11f2d974c9f

    SHA512

    99ef8fc2482d420aff7e4d325f81440bd8e75dd73ebdeec1edf08d56ecb36e3181df9ccb7e4fda2225175bbeaa90325856a76b82ff2df8b6a52f89458025b70c

  • \Users\Admin\AppData\Local\Temp\IXP000.TMP\CG5gm86.exe

    Filesize

    909KB

    MD5

    cdef7e9e4abb299aec3457e5f70b8f70

    SHA1

    9929f81b9ff7585bb2b4bd1e2372fa4801d76640

    SHA256

    55c470361627fa33d80192588292aded6130001e328921dccd53e11f2d974c9f

    SHA512

    99ef8fc2482d420aff7e4d325f81440bd8e75dd73ebdeec1edf08d56ecb36e3181df9ccb7e4fda2225175bbeaa90325856a76b82ff2df8b6a52f89458025b70c

  • \Users\Admin\AppData\Local\Temp\IXP001.TMP\Gw3Rg64.exe

    Filesize

    620KB

    MD5

    ad524aa581a38b78069bf4a11a6f3f3e

    SHA1

    87ac23d2912db4bca4f857bf177d1bc008219bac

    SHA256

    0621911e980cba9641636efffa148e52f3c94a1dc53346a2fe30f3a6e4810104

    SHA512

    ef49470ce77a9c49806a50b0f6bd2841f373bc0e5fbf492b9ce18628b05c6dd6b08f26d611226fe9ac271daf394ec9fe71da0154b75f0d119ba2bb20bf3d5895

  • \Users\Admin\AppData\Local\Temp\IXP001.TMP\Gw3Rg64.exe

    Filesize

    620KB

    MD5

    ad524aa581a38b78069bf4a11a6f3f3e

    SHA1

    87ac23d2912db4bca4f857bf177d1bc008219bac

    SHA256

    0621911e980cba9641636efffa148e52f3c94a1dc53346a2fe30f3a6e4810104

    SHA512

    ef49470ce77a9c49806a50b0f6bd2841f373bc0e5fbf492b9ce18628b05c6dd6b08f26d611226fe9ac271daf394ec9fe71da0154b75f0d119ba2bb20bf3d5895

  • \Users\Admin\AppData\Local\Temp\IXP002.TMP\MX4HI14.exe

    Filesize

    382KB

    MD5

    45d10f29b83323b8527ba77ca7fe9b71

    SHA1

    87a2d2affa8f43cd5c7ee4de44a8a704e9da39fc

    SHA256

    38926bfe231441b3e38ae55b8ebd3656b137b9002b70a6abda3ea1739d1dc773

    SHA512

    21ad23a29a0e995bb0bd794e37271eedd96a63a2b0865d8621019353460deb1ea3189349dc8c78b6588a1c5004047cac654cbb21193eac716fb7ffd78c7f5096

  • \Users\Admin\AppData\Local\Temp\IXP002.TMP\MX4HI14.exe

    Filesize

    382KB

    MD5

    45d10f29b83323b8527ba77ca7fe9b71

    SHA1

    87a2d2affa8f43cd5c7ee4de44a8a704e9da39fc

    SHA256

    38926bfe231441b3e38ae55b8ebd3656b137b9002b70a6abda3ea1739d1dc773

    SHA512

    21ad23a29a0e995bb0bd794e37271eedd96a63a2b0865d8621019353460deb1ea3189349dc8c78b6588a1c5004047cac654cbb21193eac716fb7ffd78c7f5096

  • \Users\Admin\AppData\Local\Temp\IXP003.TMP\1cN47Fl5.exe

    Filesize

    237KB

    MD5

    310b4ad6995eed7530a6491ac81b079f

    SHA1

    4e02ed6fb9733a1e93fa10afdbed038253d1c412

    SHA256

    d635ad9a5a273d2f3a5438afce9d096c904c6e36a9af1ead48c45a0a92c8851f

    SHA512

    3a28dd60987a78c8843018e716c80eddb2a25ee5033304fa20c8c0a83d3eae56a90d703f987ea709c45f0ec79df9f76527e7c4ba33ecb319e63c7bb4be11006f

  • \Users\Admin\AppData\Local\Temp\IXP003.TMP\1cN47Fl5.exe

    Filesize

    237KB

    MD5

    310b4ad6995eed7530a6491ac81b079f

    SHA1

    4e02ed6fb9733a1e93fa10afdbed038253d1c412

    SHA256

    d635ad9a5a273d2f3a5438afce9d096c904c6e36a9af1ead48c45a0a92c8851f

    SHA512

    3a28dd60987a78c8843018e716c80eddb2a25ee5033304fa20c8c0a83d3eae56a90d703f987ea709c45f0ec79df9f76527e7c4ba33ecb319e63c7bb4be11006f

  • \Users\Admin\AppData\Local\Temp\IXP003.TMP\1cN47Fl5.exe

    Filesize

    237KB

    MD5

    310b4ad6995eed7530a6491ac81b079f

    SHA1

    4e02ed6fb9733a1e93fa10afdbed038253d1c412

    SHA256

    d635ad9a5a273d2f3a5438afce9d096c904c6e36a9af1ead48c45a0a92c8851f

    SHA512

    3a28dd60987a78c8843018e716c80eddb2a25ee5033304fa20c8c0a83d3eae56a90d703f987ea709c45f0ec79df9f76527e7c4ba33ecb319e63c7bb4be11006f

  • \Users\Admin\AppData\Local\Temp\IXP003.TMP\1cN47Fl5.exe

    Filesize

    237KB

    MD5

    310b4ad6995eed7530a6491ac81b079f

    SHA1

    4e02ed6fb9733a1e93fa10afdbed038253d1c412

    SHA256

    d635ad9a5a273d2f3a5438afce9d096c904c6e36a9af1ead48c45a0a92c8851f

    SHA512

    3a28dd60987a78c8843018e716c80eddb2a25ee5033304fa20c8c0a83d3eae56a90d703f987ea709c45f0ec79df9f76527e7c4ba33ecb319e63c7bb4be11006f

  • \Users\Admin\AppData\Local\Temp\IXP003.TMP\1cN47Fl5.exe

    Filesize

    237KB

    MD5

    310b4ad6995eed7530a6491ac81b079f

    SHA1

    4e02ed6fb9733a1e93fa10afdbed038253d1c412

    SHA256

    d635ad9a5a273d2f3a5438afce9d096c904c6e36a9af1ead48c45a0a92c8851f

    SHA512

    3a28dd60987a78c8843018e716c80eddb2a25ee5033304fa20c8c0a83d3eae56a90d703f987ea709c45f0ec79df9f76527e7c4ba33ecb319e63c7bb4be11006f

  • \Users\Admin\AppData\Local\Temp\IXP003.TMP\1cN47Fl5.exe

    Filesize

    237KB

    MD5

    310b4ad6995eed7530a6491ac81b079f

    SHA1

    4e02ed6fb9733a1e93fa10afdbed038253d1c412

    SHA256

    d635ad9a5a273d2f3a5438afce9d096c904c6e36a9af1ead48c45a0a92c8851f

    SHA512

    3a28dd60987a78c8843018e716c80eddb2a25ee5033304fa20c8c0a83d3eae56a90d703f987ea709c45f0ec79df9f76527e7c4ba33ecb319e63c7bb4be11006f

  • memory/2728-41-0x0000000000400000-0x000000000040A000-memory.dmp

    Filesize

    40KB

  • memory/2728-44-0x00000000FFFDE000-0x00000000FFFDF000-memory.dmp

    Filesize

    4KB

  • memory/2728-49-0x0000000000400000-0x000000000040A000-memory.dmp

    Filesize

    40KB

  • memory/2728-47-0x0000000000400000-0x000000000040A000-memory.dmp

    Filesize

    40KB

  • memory/2728-45-0x0000000000400000-0x000000000040A000-memory.dmp

    Filesize

    40KB

  • memory/2728-40-0x0000000000400000-0x000000000040A000-memory.dmp

    Filesize

    40KB

  • memory/2728-43-0x0000000000400000-0x000000000040A000-memory.dmp

    Filesize

    40KB

  • memory/2728-42-0x0000000000400000-0x000000000040A000-memory.dmp

    Filesize

    40KB