Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    119s
  • max time network
    131s
  • platform
    windows7_x64
  • resource
    win7-20230831-en
  • resource tags

    arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
  • submitted
    11/10/2023, 09:54

General

  • Target

    67f7ec01f0097430554252708324ccd837268be66f78d17cf533e65e497ec8b5.exe

  • Size

    1.0MB

  • MD5

    e767bbeb6e8148b867a7d852c506268e

  • SHA1

    21eb1e99770befd91c04b781066388c583cdf87f

  • SHA256

    67f7ec01f0097430554252708324ccd837268be66f78d17cf533e65e497ec8b5

  • SHA512

    77d69923156a9765cdd0e0dfee4d1a212bcd0d132c74f658cb07bc92c0e08b30ee7c70db9f415acdce143b079c5b44bbabe13efcf02a050968e30d31a42414ad

  • SSDEEP

    24576:6yS31DyhN2Z6A896RaCB1NvkgWI5UnX9WocaWFiXM9:BSNyhMFaCbNdUnUrFY

Malware Config

Signatures

  • Detects Healer an antivirus disabler dropper 5 IoCs
  • Healer

    Healer an antivirus disabler dropper.

  • Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs
  • Executes dropped EXE 5 IoCs
  • Loads dropped DLL 15 IoCs
  • Adds Run key to start application 2 TTPs 5 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Program crash 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 54 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\67f7ec01f0097430554252708324ccd837268be66f78d17cf533e65e497ec8b5.exe
    "C:\Users\Admin\AppData\Local\Temp\67f7ec01f0097430554252708324ccd837268be66f78d17cf533e65e497ec8b5.exe"
    1⤵
    • Loads dropped DLL
    • Adds Run key to start application
    • Suspicious use of WriteProcessMemory
    PID:2080
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z8483101.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z8483101.exe
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Adds Run key to start application
      • Suspicious use of WriteProcessMemory
      PID:2972
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z4286774.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z4286774.exe
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Adds Run key to start application
        • Suspicious use of WriteProcessMemory
        PID:2572
        • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\z4970870.exe
          C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\z4970870.exe
          4⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • Adds Run key to start application
          • Suspicious use of WriteProcessMemory
          PID:2784
          • C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\z2071286.exe
            C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\z2071286.exe
            5⤵
            • Executes dropped EXE
            • Loads dropped DLL
            • Adds Run key to start application
            • Suspicious use of WriteProcessMemory
            PID:2680
            • C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q1336364.exe
              C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q1336364.exe
              6⤵
              • Executes dropped EXE
              • Loads dropped DLL
              • Suspicious use of SetThreadContext
              • Suspicious use of WriteProcessMemory
              PID:2268
              • C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
                "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
                7⤵
                • Modifies Windows Defender Real-time Protection settings
                • Suspicious behavior: EnumeratesProcesses
                • Suspicious use of AdjustPrivilegeToken
                PID:2632
              • C:\Windows\SysWOW64\WerFault.exe
                C:\Windows\SysWOW64\WerFault.exe -u -p 2268 -s 272
                7⤵
                • Loads dropped DLL
                • Program crash
                PID:1256

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z8483101.exe

    Filesize

    961KB

    MD5

    02d0d9d822e8948f4991555619254df1

    SHA1

    e7c4ebbb5fc5941436f7bed7e6fff02348c0d62a

    SHA256

    0decee1470b5bdfe85655d71ae0fa96bd661ccabd4a85996b254694a18ef5b78

    SHA512

    ddbebcd38a6352e86406bc52ab2d28cefc3da0ae690658cb2914d8bfb40b65a30adf0f0ab4a170a6b59ba9ae9d4004b3d9df9295783d3ef2475622afb1b2cf72

  • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z8483101.exe

    Filesize

    961KB

    MD5

    02d0d9d822e8948f4991555619254df1

    SHA1

    e7c4ebbb5fc5941436f7bed7e6fff02348c0d62a

    SHA256

    0decee1470b5bdfe85655d71ae0fa96bd661ccabd4a85996b254694a18ef5b78

    SHA512

    ddbebcd38a6352e86406bc52ab2d28cefc3da0ae690658cb2914d8bfb40b65a30adf0f0ab4a170a6b59ba9ae9d4004b3d9df9295783d3ef2475622afb1b2cf72

  • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z4286774.exe

    Filesize

    778KB

    MD5

    d2819530f328c2912ffec8ae40399365

    SHA1

    d2ef6a52af538e36f360b2f3a7bea7c519cd73c1

    SHA256

    4cfe5aba9f1eaff494a0f83ed0a29d7d3dce09974a8ce1a315b231b5518eb22d

    SHA512

    ce6d71038e320ab06ad2748841ad79d49d2f89cbcc4fd7f0b966a042bed2517d73b15209e49a85e503ab073b4fafddeaeafc02ba44cab1484c464b4bc630ddb4

  • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z4286774.exe

    Filesize

    778KB

    MD5

    d2819530f328c2912ffec8ae40399365

    SHA1

    d2ef6a52af538e36f360b2f3a7bea7c519cd73c1

    SHA256

    4cfe5aba9f1eaff494a0f83ed0a29d7d3dce09974a8ce1a315b231b5518eb22d

    SHA512

    ce6d71038e320ab06ad2748841ad79d49d2f89cbcc4fd7f0b966a042bed2517d73b15209e49a85e503ab073b4fafddeaeafc02ba44cab1484c464b4bc630ddb4

  • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\z4970870.exe

    Filesize

    595KB

    MD5

    27ca490eb4e94680b2a40c644e228e24

    SHA1

    adb6b8023580628be2c3a58626e99fc74ce32729

    SHA256

    a7490b6ff9eec4fa6f9b8cca282c7d279d1f1189cc08c8abc9347fcbcb03f811

    SHA512

    28d0354085ee23bbbc61a6bcbbfecbdfcb089f8e0b02d6379bfd629bf9b03c33b30f03a07c13105b3c676e7b9f8f7ce6368efc4b5b74c380cbaac59167d434f9

  • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\z4970870.exe

    Filesize

    595KB

    MD5

    27ca490eb4e94680b2a40c644e228e24

    SHA1

    adb6b8023580628be2c3a58626e99fc74ce32729

    SHA256

    a7490b6ff9eec4fa6f9b8cca282c7d279d1f1189cc08c8abc9347fcbcb03f811

    SHA512

    28d0354085ee23bbbc61a6bcbbfecbdfcb089f8e0b02d6379bfd629bf9b03c33b30f03a07c13105b3c676e7b9f8f7ce6368efc4b5b74c380cbaac59167d434f9

  • C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\z2071286.exe

    Filesize

    334KB

    MD5

    ffc2cc41ffef64d475d67ca5404849cc

    SHA1

    bed908787b08867e0fe875976e7d75fb8bf6c2a5

    SHA256

    23d7f987df2e955c87e46b5c3758599091b7e2471330e383bec4df490d71261c

    SHA512

    d2b6ddb50100db8e1977986e233af285ca86b6169d52a673a1bdabe145b739a51e22834a807189f1c383037d049738386f93e7f18d2b420cdbf9c5b68167d98b

  • C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\z2071286.exe

    Filesize

    334KB

    MD5

    ffc2cc41ffef64d475d67ca5404849cc

    SHA1

    bed908787b08867e0fe875976e7d75fb8bf6c2a5

    SHA256

    23d7f987df2e955c87e46b5c3758599091b7e2471330e383bec4df490d71261c

    SHA512

    d2b6ddb50100db8e1977986e233af285ca86b6169d52a673a1bdabe145b739a51e22834a807189f1c383037d049738386f93e7f18d2b420cdbf9c5b68167d98b

  • C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q1336364.exe

    Filesize

    221KB

    MD5

    fdd83f4f9832fb2cfcd569d32b611fb8

    SHA1

    9ce30d9380ae8fa315b2145a578a51c7550c2fcb

    SHA256

    f3da943420f4ceed4255ec789f610b597fed6d0435ee25f079b7ab6fac6c6e84

    SHA512

    175cc210274ff407a2fba51390e4f65438cee626b789c2c8f71d6c874a10a6b90186c970a4371d65964c7a2e6a2629e918ec6d18d91d0f39e75ac3b852a6baf3

  • C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q1336364.exe

    Filesize

    221KB

    MD5

    fdd83f4f9832fb2cfcd569d32b611fb8

    SHA1

    9ce30d9380ae8fa315b2145a578a51c7550c2fcb

    SHA256

    f3da943420f4ceed4255ec789f610b597fed6d0435ee25f079b7ab6fac6c6e84

    SHA512

    175cc210274ff407a2fba51390e4f65438cee626b789c2c8f71d6c874a10a6b90186c970a4371d65964c7a2e6a2629e918ec6d18d91d0f39e75ac3b852a6baf3

  • C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q1336364.exe

    Filesize

    221KB

    MD5

    fdd83f4f9832fb2cfcd569d32b611fb8

    SHA1

    9ce30d9380ae8fa315b2145a578a51c7550c2fcb

    SHA256

    f3da943420f4ceed4255ec789f610b597fed6d0435ee25f079b7ab6fac6c6e84

    SHA512

    175cc210274ff407a2fba51390e4f65438cee626b789c2c8f71d6c874a10a6b90186c970a4371d65964c7a2e6a2629e918ec6d18d91d0f39e75ac3b852a6baf3

  • \Users\Admin\AppData\Local\Temp\IXP000.TMP\z8483101.exe

    Filesize

    961KB

    MD5

    02d0d9d822e8948f4991555619254df1

    SHA1

    e7c4ebbb5fc5941436f7bed7e6fff02348c0d62a

    SHA256

    0decee1470b5bdfe85655d71ae0fa96bd661ccabd4a85996b254694a18ef5b78

    SHA512

    ddbebcd38a6352e86406bc52ab2d28cefc3da0ae690658cb2914d8bfb40b65a30adf0f0ab4a170a6b59ba9ae9d4004b3d9df9295783d3ef2475622afb1b2cf72

  • \Users\Admin\AppData\Local\Temp\IXP000.TMP\z8483101.exe

    Filesize

    961KB

    MD5

    02d0d9d822e8948f4991555619254df1

    SHA1

    e7c4ebbb5fc5941436f7bed7e6fff02348c0d62a

    SHA256

    0decee1470b5bdfe85655d71ae0fa96bd661ccabd4a85996b254694a18ef5b78

    SHA512

    ddbebcd38a6352e86406bc52ab2d28cefc3da0ae690658cb2914d8bfb40b65a30adf0f0ab4a170a6b59ba9ae9d4004b3d9df9295783d3ef2475622afb1b2cf72

  • \Users\Admin\AppData\Local\Temp\IXP001.TMP\z4286774.exe

    Filesize

    778KB

    MD5

    d2819530f328c2912ffec8ae40399365

    SHA1

    d2ef6a52af538e36f360b2f3a7bea7c519cd73c1

    SHA256

    4cfe5aba9f1eaff494a0f83ed0a29d7d3dce09974a8ce1a315b231b5518eb22d

    SHA512

    ce6d71038e320ab06ad2748841ad79d49d2f89cbcc4fd7f0b966a042bed2517d73b15209e49a85e503ab073b4fafddeaeafc02ba44cab1484c464b4bc630ddb4

  • \Users\Admin\AppData\Local\Temp\IXP001.TMP\z4286774.exe

    Filesize

    778KB

    MD5

    d2819530f328c2912ffec8ae40399365

    SHA1

    d2ef6a52af538e36f360b2f3a7bea7c519cd73c1

    SHA256

    4cfe5aba9f1eaff494a0f83ed0a29d7d3dce09974a8ce1a315b231b5518eb22d

    SHA512

    ce6d71038e320ab06ad2748841ad79d49d2f89cbcc4fd7f0b966a042bed2517d73b15209e49a85e503ab073b4fafddeaeafc02ba44cab1484c464b4bc630ddb4

  • \Users\Admin\AppData\Local\Temp\IXP002.TMP\z4970870.exe

    Filesize

    595KB

    MD5

    27ca490eb4e94680b2a40c644e228e24

    SHA1

    adb6b8023580628be2c3a58626e99fc74ce32729

    SHA256

    a7490b6ff9eec4fa6f9b8cca282c7d279d1f1189cc08c8abc9347fcbcb03f811

    SHA512

    28d0354085ee23bbbc61a6bcbbfecbdfcb089f8e0b02d6379bfd629bf9b03c33b30f03a07c13105b3c676e7b9f8f7ce6368efc4b5b74c380cbaac59167d434f9

  • \Users\Admin\AppData\Local\Temp\IXP002.TMP\z4970870.exe

    Filesize

    595KB

    MD5

    27ca490eb4e94680b2a40c644e228e24

    SHA1

    adb6b8023580628be2c3a58626e99fc74ce32729

    SHA256

    a7490b6ff9eec4fa6f9b8cca282c7d279d1f1189cc08c8abc9347fcbcb03f811

    SHA512

    28d0354085ee23bbbc61a6bcbbfecbdfcb089f8e0b02d6379bfd629bf9b03c33b30f03a07c13105b3c676e7b9f8f7ce6368efc4b5b74c380cbaac59167d434f9

  • \Users\Admin\AppData\Local\Temp\IXP003.TMP\z2071286.exe

    Filesize

    334KB

    MD5

    ffc2cc41ffef64d475d67ca5404849cc

    SHA1

    bed908787b08867e0fe875976e7d75fb8bf6c2a5

    SHA256

    23d7f987df2e955c87e46b5c3758599091b7e2471330e383bec4df490d71261c

    SHA512

    d2b6ddb50100db8e1977986e233af285ca86b6169d52a673a1bdabe145b739a51e22834a807189f1c383037d049738386f93e7f18d2b420cdbf9c5b68167d98b

  • \Users\Admin\AppData\Local\Temp\IXP003.TMP\z2071286.exe

    Filesize

    334KB

    MD5

    ffc2cc41ffef64d475d67ca5404849cc

    SHA1

    bed908787b08867e0fe875976e7d75fb8bf6c2a5

    SHA256

    23d7f987df2e955c87e46b5c3758599091b7e2471330e383bec4df490d71261c

    SHA512

    d2b6ddb50100db8e1977986e233af285ca86b6169d52a673a1bdabe145b739a51e22834a807189f1c383037d049738386f93e7f18d2b420cdbf9c5b68167d98b

  • \Users\Admin\AppData\Local\Temp\IXP004.TMP\q1336364.exe

    Filesize

    221KB

    MD5

    fdd83f4f9832fb2cfcd569d32b611fb8

    SHA1

    9ce30d9380ae8fa315b2145a578a51c7550c2fcb

    SHA256

    f3da943420f4ceed4255ec789f610b597fed6d0435ee25f079b7ab6fac6c6e84

    SHA512

    175cc210274ff407a2fba51390e4f65438cee626b789c2c8f71d6c874a10a6b90186c970a4371d65964c7a2e6a2629e918ec6d18d91d0f39e75ac3b852a6baf3

  • \Users\Admin\AppData\Local\Temp\IXP004.TMP\q1336364.exe

    Filesize

    221KB

    MD5

    fdd83f4f9832fb2cfcd569d32b611fb8

    SHA1

    9ce30d9380ae8fa315b2145a578a51c7550c2fcb

    SHA256

    f3da943420f4ceed4255ec789f610b597fed6d0435ee25f079b7ab6fac6c6e84

    SHA512

    175cc210274ff407a2fba51390e4f65438cee626b789c2c8f71d6c874a10a6b90186c970a4371d65964c7a2e6a2629e918ec6d18d91d0f39e75ac3b852a6baf3

  • \Users\Admin\AppData\Local\Temp\IXP004.TMP\q1336364.exe

    Filesize

    221KB

    MD5

    fdd83f4f9832fb2cfcd569d32b611fb8

    SHA1

    9ce30d9380ae8fa315b2145a578a51c7550c2fcb

    SHA256

    f3da943420f4ceed4255ec789f610b597fed6d0435ee25f079b7ab6fac6c6e84

    SHA512

    175cc210274ff407a2fba51390e4f65438cee626b789c2c8f71d6c874a10a6b90186c970a4371d65964c7a2e6a2629e918ec6d18d91d0f39e75ac3b852a6baf3

  • \Users\Admin\AppData\Local\Temp\IXP004.TMP\q1336364.exe

    Filesize

    221KB

    MD5

    fdd83f4f9832fb2cfcd569d32b611fb8

    SHA1

    9ce30d9380ae8fa315b2145a578a51c7550c2fcb

    SHA256

    f3da943420f4ceed4255ec789f610b597fed6d0435ee25f079b7ab6fac6c6e84

    SHA512

    175cc210274ff407a2fba51390e4f65438cee626b789c2c8f71d6c874a10a6b90186c970a4371d65964c7a2e6a2629e918ec6d18d91d0f39e75ac3b852a6baf3

  • \Users\Admin\AppData\Local\Temp\IXP004.TMP\q1336364.exe

    Filesize

    221KB

    MD5

    fdd83f4f9832fb2cfcd569d32b611fb8

    SHA1

    9ce30d9380ae8fa315b2145a578a51c7550c2fcb

    SHA256

    f3da943420f4ceed4255ec789f610b597fed6d0435ee25f079b7ab6fac6c6e84

    SHA512

    175cc210274ff407a2fba51390e4f65438cee626b789c2c8f71d6c874a10a6b90186c970a4371d65964c7a2e6a2629e918ec6d18d91d0f39e75ac3b852a6baf3

  • \Users\Admin\AppData\Local\Temp\IXP004.TMP\q1336364.exe

    Filesize

    221KB

    MD5

    fdd83f4f9832fb2cfcd569d32b611fb8

    SHA1

    9ce30d9380ae8fa315b2145a578a51c7550c2fcb

    SHA256

    f3da943420f4ceed4255ec789f610b597fed6d0435ee25f079b7ab6fac6c6e84

    SHA512

    175cc210274ff407a2fba51390e4f65438cee626b789c2c8f71d6c874a10a6b90186c970a4371d65964c7a2e6a2629e918ec6d18d91d0f39e75ac3b852a6baf3

  • \Users\Admin\AppData\Local\Temp\IXP004.TMP\q1336364.exe

    Filesize

    221KB

    MD5

    fdd83f4f9832fb2cfcd569d32b611fb8

    SHA1

    9ce30d9380ae8fa315b2145a578a51c7550c2fcb

    SHA256

    f3da943420f4ceed4255ec789f610b597fed6d0435ee25f079b7ab6fac6c6e84

    SHA512

    175cc210274ff407a2fba51390e4f65438cee626b789c2c8f71d6c874a10a6b90186c970a4371d65964c7a2e6a2629e918ec6d18d91d0f39e75ac3b852a6baf3

  • memory/2632-59-0x0000000000400000-0x000000000040A000-memory.dmp

    Filesize

    40KB

  • memory/2632-53-0x0000000000400000-0x000000000040A000-memory.dmp

    Filesize

    40KB

  • memory/2632-64-0x0000000000400000-0x000000000040A000-memory.dmp

    Filesize

    40KB

  • memory/2632-66-0x0000000000400000-0x000000000040A000-memory.dmp

    Filesize

    40KB

  • memory/2632-55-0x0000000000400000-0x000000000040A000-memory.dmp

    Filesize

    40KB

  • memory/2632-57-0x0000000000400000-0x000000000040A000-memory.dmp

    Filesize

    40KB

  • memory/2632-61-0x00000000FFFDE000-0x00000000FFFDF000-memory.dmp

    Filesize

    4KB

  • memory/2632-62-0x0000000000400000-0x000000000040A000-memory.dmp

    Filesize

    40KB