Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    122s
  • max time network
    126s
  • platform
    windows7_x64
  • resource
    win7-20230831-en
  • resource tags

    arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
  • submitted
    11/10/2023, 13:18

General

  • Target

    adguardInstaller.exe

  • Size

    142KB

  • MD5

    9eaa763d63fe86e7b34d89a974a0ed90

  • SHA1

    9ea8333364aac4b58dd1bcc4b49044c8b483548a

  • SHA256

    81f8509d29fc364108116d679515d2a3a109d9acbdaa0c9b9c73a19e41c1c047

  • SHA512

    cfe7b9bde2836671739c384c794794b6795605f62caeefeaa16388bb3309435926f08eec0c261ee9fc5fe2f4da0ce2fe3e34db17d56cd777c64f6417f7519adb

  • SSDEEP

    3072:44qZHnMyBV3vrhLFvGyfmKvK9MkBrf8wpLxHX:44qZHdV3vlvK9Mkhvpt

Score
8/10

Malware Config

Signatures

  • Downloads MZ/PE file
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Executes dropped EXE 2 IoCs
  • Loads dropped DLL 19 IoCs
  • Modifies system certificate store 2 TTPs 6 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 14 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\adguardInstaller.exe
    "C:\Users\Admin\AppData\Local\Temp\adguardInstaller.exe"
    1⤵
    • Loads dropped DLL
    • Modifies system certificate store
    • Suspicious use of WriteProcessMemory
    PID:2132
    • C:\Users\Admin\AppData\Local\Temp\adguard\setup.exe
      C:\Users\Admin\AppData\Local\Temp\adguard\setup.exe "AID=18675_page_en_welcome"
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Suspicious use of WriteProcessMemory
      PID:3000
      • C:\Windows\Temp\{30BA2C44-32D3-4D16-9D15-B9720BFC3630}\.cr\setup.exe
        "C:\Windows\Temp\{30BA2C44-32D3-4D16-9D15-B9720BFC3630}\.cr\setup.exe" -burn.clean.room="C:\Users\Admin\AppData\Local\Temp\adguard\setup.exe" -burn.filehandle.attached=284 -burn.filehandle.self=292 "AID=18675_page_en_welcome"
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Suspicious use of AdjustPrivilegeToken
        PID:1732

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    344B

    MD5

    d5b3fc1955ebad76c8265b8f48eee7a5

    SHA1

    d3f4dc6739c3cbb972aaa3995da57afac2aba8e5

    SHA256

    4bc5932c15b5bc50184e14293c882d335b9e3a0b91d35e69c9456d7623049b59

    SHA512

    7c228f2450974d129aac11493824299da67c1edb80a65ccc232685d98cdabf7385675dc7bff054285bf63efa7d024872f6ee65c79ad89af619ab5b3312cd158f

  • C:\Users\Admin\AppData\Local\Temp\Cab3C57.tmp

    Filesize

    61KB

    MD5

    f3441b8572aae8801c04f3060b550443

    SHA1

    4ef0a35436125d6821831ef36c28ffaf196cda15

    SHA256

    6720349e7d82ee0a8e73920d3c2b7cb2912d9fcf2edb6fd98f2f12820158b0bf

    SHA512

    5ba01ba421b50030e380ae6bbcd2f681f2a91947fe7fedb3c8e6b5f24dce9517abf57b1cf26cc6078d4bb53bde6fcfb2561591337c841f8f2cb121a3d71661b9

  • C:\Users\Admin\AppData\Local\Temp\Tar3DD0.tmp

    Filesize

    163KB

    MD5

    9441737383d21192400eca82fda910ec

    SHA1

    725e0d606a4fc9ba44aa8ffde65bed15e65367e4

    SHA256

    bc3a6e84e41faeb57e7c21aa3b60c2a64777107009727c5b7c0ed8fe658909e5

    SHA512

    7608dd653a66cd364392a78d4711b48d1707768d36996e4d38871c6843b5714e1d7da4b4cc6db969e6000cfa182bcb74216ef6823d1063f036fc5c3413fb8dcf

  • C:\Users\Admin\AppData\Local\Temp\adguard\setup.exe

    Filesize

    34.9MB

    MD5

    f6c033d77be4ad6fa0610727e1056dd1

    SHA1

    5bbe6d4f8a15eb34e2c8ded75ea7d379e9333ed2

    SHA256

    51ea9b79789de4d6f53e2c53c196e5003a11d8942f90ea6816ce994e8e54a6fa

    SHA512

    45cd8f3b38e5065a0ddc9677d8fa2ef45bafd55ebf2a6e08d61bfcb5bf7cad0fb281f486500d84f1d254aa33a640b23de9e86ee72828699004a599ee2524d251

  • C:\Users\Admin\AppData\Local\Temp\adguard\setup.exe

    Filesize

    34.9MB

    MD5

    f6c033d77be4ad6fa0610727e1056dd1

    SHA1

    5bbe6d4f8a15eb34e2c8ded75ea7d379e9333ed2

    SHA256

    51ea9b79789de4d6f53e2c53c196e5003a11d8942f90ea6816ce994e8e54a6fa

    SHA512

    45cd8f3b38e5065a0ddc9677d8fa2ef45bafd55ebf2a6e08d61bfcb5bf7cad0fb281f486500d84f1d254aa33a640b23de9e86ee72828699004a599ee2524d251

  • C:\Windows\Temp\{30BA2C44-32D3-4D16-9D15-B9720BFC3630}\.cr\setup.exe

    Filesize

    2.8MB

    MD5

    9139cb178f9fc4930597bf4464678a01

    SHA1

    307adf537e166118495bfc75e560e03fda3864ef

    SHA256

    947644da599a10679d0e39532e9361a2b2a24e51adec87ca222cbd79b530d55a

    SHA512

    f301d1bde17522af7da3305f236d94ff1a053d64e9ac807f2049f8ca6a83ee27869a097b2fe33710c9782a5ff983645ab54c380b1a6a46c4a0827e339d2a1893

  • C:\Windows\Temp\{30BA2C44-32D3-4D16-9D15-B9720BFC3630}\.cr\setup.exe

    Filesize

    2.8MB

    MD5

    9139cb178f9fc4930597bf4464678a01

    SHA1

    307adf537e166118495bfc75e560e03fda3864ef

    SHA256

    947644da599a10679d0e39532e9361a2b2a24e51adec87ca222cbd79b530d55a

    SHA512

    f301d1bde17522af7da3305f236d94ff1a053d64e9ac807f2049f8ca6a83ee27869a097b2fe33710c9782a5ff983645ab54c380b1a6a46c4a0827e339d2a1893

  • C:\Windows\Temp\{7303C1D7-E684-490A-8F35-0C278B81D70E}\.ba\BootstrapperCore.config

    Filesize

    1KB

    MD5

    898c2a320bea0580f37beeccda8f2378

    SHA1

    eccab214a148e6a7a9535bf1c83b714c756dabf2

    SHA256

    4440270efc95c694150a665b62ca89b8b93b1271dfb2757e8dd1a68ef2705498

    SHA512

    e4608aab984c6e97b00e80d2635a283392f1eb24bdb65f5fce92851eb63ad474e5050ac46e5cafe2dbd438dd026269253bd4ec427f08b2a09788d6b1d49bcc84

  • \Users\Admin\AppData\Local\Temp\adguard\setup.exe

    Filesize

    34.9MB

    MD5

    f6c033d77be4ad6fa0610727e1056dd1

    SHA1

    5bbe6d4f8a15eb34e2c8ded75ea7d379e9333ed2

    SHA256

    51ea9b79789de4d6f53e2c53c196e5003a11d8942f90ea6816ce994e8e54a6fa

    SHA512

    45cd8f3b38e5065a0ddc9677d8fa2ef45bafd55ebf2a6e08d61bfcb5bf7cad0fb281f486500d84f1d254aa33a640b23de9e86ee72828699004a599ee2524d251

  • \Windows\Temp\{30BA2C44-32D3-4D16-9D15-B9720BFC3630}\.cr\setup.exe

    Filesize

    2.8MB

    MD5

    9139cb178f9fc4930597bf4464678a01

    SHA1

    307adf537e166118495bfc75e560e03fda3864ef

    SHA256

    947644da599a10679d0e39532e9361a2b2a24e51adec87ca222cbd79b530d55a

    SHA512

    f301d1bde17522af7da3305f236d94ff1a053d64e9ac807f2049f8ca6a83ee27869a097b2fe33710c9782a5ff983645ab54c380b1a6a46c4a0827e339d2a1893

  • \Windows\Temp\{7303C1D7-E684-490A-8F35-0C278B81D70E}\.ba\AdGuard.Utils.Installer.dll

    Filesize

    53KB

    MD5

    c9d2bc23bab3488d90a7d5401b1fb443

    SHA1

    4b7b28a47bc943770c867f910ffc96f9d2c8f88f

    SHA256

    b8164bb0506424055da50b25ad884ff0ad9c5cc5ce639892c113cbb43a2f97b7

    SHA512

    dd3f052321e4fba28d0ddd4fa611292b818ac90d90b53ae9310ec9d04a49d80f33e14bc46899d6d284c3c7a4ca5c46cf44cd95799f1b5e20e17aba1f15aa4653

  • \Windows\Temp\{7303C1D7-E684-490A-8F35-0C278B81D70E}\.ba\AdGuard.Utils.Installer.dll

    Filesize

    53KB

    MD5

    c9d2bc23bab3488d90a7d5401b1fb443

    SHA1

    4b7b28a47bc943770c867f910ffc96f9d2c8f88f

    SHA256

    b8164bb0506424055da50b25ad884ff0ad9c5cc5ce639892c113cbb43a2f97b7

    SHA512

    dd3f052321e4fba28d0ddd4fa611292b818ac90d90b53ae9310ec9d04a49d80f33e14bc46899d6d284c3c7a4ca5c46cf44cd95799f1b5e20e17aba1f15aa4653

  • \Windows\Temp\{7303C1D7-E684-490A-8F35-0C278B81D70E}\.ba\AdGuard.Utils.UI.dll

    Filesize

    566KB

    MD5

    4c65d91bf72cf4cc0b72df60b3870434

    SHA1

    9f757d57ddfcd695915a32e235a0d72d01431196

    SHA256

    c94fe6b07c638cce3e17ac191987af6b9c3af81bcf772a39912be34241b34f4f

    SHA512

    fa48bbc4648776c8c49a74b259940b7b54ce6eed0f0e7ea9a2d0c7d427230f58d89c9949934bc76177bb8e70194060656c0f590119f54ead3137214401ce882b

  • \Windows\Temp\{7303C1D7-E684-490A-8F35-0C278B81D70E}\.ba\AdGuard.Utils.UI.dll

    Filesize

    566KB

    MD5

    4c65d91bf72cf4cc0b72df60b3870434

    SHA1

    9f757d57ddfcd695915a32e235a0d72d01431196

    SHA256

    c94fe6b07c638cce3e17ac191987af6b9c3af81bcf772a39912be34241b34f4f

    SHA512

    fa48bbc4648776c8c49a74b259940b7b54ce6eed0f0e7ea9a2d0c7d427230f58d89c9949934bc76177bb8e70194060656c0f590119f54ead3137214401ce882b

  • \Windows\Temp\{7303C1D7-E684-490A-8F35-0C278B81D70E}\.ba\AdGuard.Utils.dll

    Filesize

    2.0MB

    MD5

    5940d6d2c8ca412ace239c975735e182

    SHA1

    38a7c5cbd7723a1d9f06872ece668286a5784d21

    SHA256

    5e374bf9f71dbc331164ef1e114a163fff3821db2d49f9b4536906999084a9af

    SHA512

    6723c867ca925557382ad31d0d514b11dd23f0d654b2b9015126c2168148287e4c183f7965539331c2333b8ed3fdf9db849c5d27c773aeb8517e71b318f45dbd

  • \Windows\Temp\{7303C1D7-E684-490A-8F35-0C278B81D70E}\.ba\AdGuard.Utils.dll

    Filesize

    2.0MB

    MD5

    5940d6d2c8ca412ace239c975735e182

    SHA1

    38a7c5cbd7723a1d9f06872ece668286a5784d21

    SHA256

    5e374bf9f71dbc331164ef1e114a163fff3821db2d49f9b4536906999084a9af

    SHA512

    6723c867ca925557382ad31d0d514b11dd23f0d654b2b9015126c2168148287e4c183f7965539331c2333b8ed3fdf9db849c5d27c773aeb8517e71b318f45dbd

  • \Windows\Temp\{7303C1D7-E684-490A-8F35-0C278B81D70E}\.ba\Adguard.Burn.dll

    Filesize

    277KB

    MD5

    72f5737e86b1e83ca13ef6f74ad6767e

    SHA1

    71aa708c8058901fc149b405eb776aa6079b3922

    SHA256

    88583fe5b3b093134d6047c134a09d9b14d03668da279a1026c188c5a150918c

    SHA512

    0f0ef277a417124ebf2a2ec8030160d25a36290435a59fbb238611ae8ac339ddedb0c96e0d8a367cecc97aed3ea34817df4af220a79a517e5a583bef5b515089

  • \Windows\Temp\{7303C1D7-E684-490A-8F35-0C278B81D70E}\.ba\Adguard.Burn.dll

    Filesize

    277KB

    MD5

    72f5737e86b1e83ca13ef6f74ad6767e

    SHA1

    71aa708c8058901fc149b405eb776aa6079b3922

    SHA256

    88583fe5b3b093134d6047c134a09d9b14d03668da279a1026c188c5a150918c

    SHA512

    0f0ef277a417124ebf2a2ec8030160d25a36290435a59fbb238611ae8ac339ddedb0c96e0d8a367cecc97aed3ea34817df4af220a79a517e5a583bef5b515089

  • \Windows\Temp\{7303C1D7-E684-490A-8F35-0C278B81D70E}\.ba\BootstrapperCore.dll

    Filesize

    87KB

    MD5

    b0d10a2a622a322788780e7a3cbb85f3

    SHA1

    04d90b16fa7b47a545c1133d5c0ca9e490f54633

    SHA256

    f2c2b3ce2df70a3206f3111391ffc7b791b32505fa97aef22c0c2dbf6f3b0426

    SHA512

    62b0aa09234067e67969c5f785736d92cd7907f1f680a07f6b44a1caf43bfeb2df96f29034016f3345c4580c6c9bc1b04bea932d06e53621da4fcf7b8c0a489f

  • \Windows\Temp\{7303C1D7-E684-490A-8F35-0C278B81D70E}\.ba\BootstrapperCore.dll

    Filesize

    87KB

    MD5

    b0d10a2a622a322788780e7a3cbb85f3

    SHA1

    04d90b16fa7b47a545c1133d5c0ca9e490f54633

    SHA256

    f2c2b3ce2df70a3206f3111391ffc7b791b32505fa97aef22c0c2dbf6f3b0426

    SHA512

    62b0aa09234067e67969c5f785736d92cd7907f1f680a07f6b44a1caf43bfeb2df96f29034016f3345c4580c6c9bc1b04bea932d06e53621da4fcf7b8c0a489f

  • \Windows\Temp\{7303C1D7-E684-490A-8F35-0C278B81D70E}\.ba\Newtonsoft.Json.dll

    Filesize

    647KB

    MD5

    5afda7c7d4f7085e744c2e7599279db3

    SHA1

    3a833eb7c6be203f16799d7b7ccd8b8c9d439261

    SHA256

    f58c374ffcaae4e36d740d90fbf7fe70d0abb7328cd9af3a0a7b70803e994ba4

    SHA512

    7cbbbef742f56af80f1012d7da86fe5375ac05813045756fb45d0691c36ef13c069361457500ba4200157d5ee7922fd118bf4c0635e5192e3f8c6183fd580944

  • \Windows\Temp\{7303C1D7-E684-490A-8F35-0C278B81D70E}\.ba\Newtonsoft.Json.dll

    Filesize

    647KB

    MD5

    5afda7c7d4f7085e744c2e7599279db3

    SHA1

    3a833eb7c6be203f16799d7b7ccd8b8c9d439261

    SHA256

    f58c374ffcaae4e36d740d90fbf7fe70d0abb7328cd9af3a0a7b70803e994ba4

    SHA512

    7cbbbef742f56af80f1012d7da86fe5375ac05813045756fb45d0691c36ef13c069361457500ba4200157d5ee7922fd118bf4c0635e5192e3f8c6183fd580944

  • \Windows\Temp\{7303C1D7-E684-490A-8F35-0C278B81D70E}\.ba\Newtonsoft.Json.dll

    Filesize

    647KB

    MD5

    5afda7c7d4f7085e744c2e7599279db3

    SHA1

    3a833eb7c6be203f16799d7b7ccd8b8c9d439261

    SHA256

    f58c374ffcaae4e36d740d90fbf7fe70d0abb7328cd9af3a0a7b70803e994ba4

    SHA512

    7cbbbef742f56af80f1012d7da86fe5375ac05813045756fb45d0691c36ef13c069361457500ba4200157d5ee7922fd118bf4c0635e5192e3f8c6183fd580944

  • \Windows\Temp\{7303C1D7-E684-490A-8F35-0C278B81D70E}\.ba\Newtonsoft.Json.dll

    Filesize

    647KB

    MD5

    5afda7c7d4f7085e744c2e7599279db3

    SHA1

    3a833eb7c6be203f16799d7b7ccd8b8c9d439261

    SHA256

    f58c374ffcaae4e36d740d90fbf7fe70d0abb7328cd9af3a0a7b70803e994ba4

    SHA512

    7cbbbef742f56af80f1012d7da86fe5375ac05813045756fb45d0691c36ef13c069361457500ba4200157d5ee7922fd118bf4c0635e5192e3f8c6183fd580944

  • \Windows\Temp\{7303C1D7-E684-490A-8F35-0C278B81D70E}\.ba\SharpRaven.dll

    Filesize

    96KB

    MD5

    1bd677bea16cf6490c6cf35c0d1c0174

    SHA1

    dd7b027aa51433c824e99cac7b7a8c5c27a28a3f

    SHA256

    d738249c61afd4dba39302a79422d3a34ec9b3807c9f5f973d1a385a0ff44955

    SHA512

    ee4b0dc1c9d862eb597227c8860739ac87269656e952d4609c7befce4ea08345e3e5693b1d95f1c6c70ec79f681d31321798ef0eac52954fbeaf44764a265a82

  • \Windows\Temp\{7303C1D7-E684-490A-8F35-0C278B81D70E}\.ba\SharpRaven.dll

    Filesize

    96KB

    MD5

    1bd677bea16cf6490c6cf35c0d1c0174

    SHA1

    dd7b027aa51433c824e99cac7b7a8c5c27a28a3f

    SHA256

    d738249c61afd4dba39302a79422d3a34ec9b3807c9f5f973d1a385a0ff44955

    SHA512

    ee4b0dc1c9d862eb597227c8860739ac87269656e952d4609c7befce4ea08345e3e5693b1d95f1c6c70ec79f681d31321798ef0eac52954fbeaf44764a265a82

  • \Windows\Temp\{7303C1D7-E684-490A-8F35-0C278B81D70E}\.ba\mbahost.dll

    Filesize

    119KB

    MD5

    c59832217903ce88793a6c40888e3cae

    SHA1

    6d9facabf41dcf53281897764d467696780623b8

    SHA256

    9dfa1bc5d2ab4c652304976978749141b8c312784b05cb577f338a0aa91330db

    SHA512

    1b1f4cb2e3fa57cb481e28a967b19a6fefa74f3c77a3f3214a6b09e11ceb20ae428d036929f000710b4eb24a2c57d5d7dfe39661d5a1f48ee69a02d83381d1a9

  • memory/1732-209-0x0000000006B60000-0x0000000006BF2000-memory.dmp

    Filesize

    584KB

  • memory/1732-188-0x0000000003340000-0x0000000003380000-memory.dmp

    Filesize

    256KB

  • memory/1732-193-0x0000000002710000-0x000000000272E000-memory.dmp

    Filesize

    120KB

  • memory/1732-171-0x0000000003340000-0x0000000003380000-memory.dmp

    Filesize

    256KB

  • memory/1732-169-0x0000000000CA0000-0x0000000000CB8000-memory.dmp

    Filesize

    96KB

  • memory/1732-170-0x0000000003340000-0x0000000003380000-memory.dmp

    Filesize

    256KB

  • memory/1732-222-0x0000000003340000-0x0000000003380000-memory.dmp

    Filesize

    256KB

  • memory/1732-178-0x0000000001000000-0x000000000104C000-memory.dmp

    Filesize

    304KB

  • memory/1732-164-0x00000000739E0000-0x00000000740CE000-memory.dmp

    Filesize

    6.9MB

  • memory/1732-205-0x0000000003340000-0x0000000003380000-memory.dmp

    Filesize

    256KB

  • memory/1732-186-0x0000000006110000-0x0000000006314000-memory.dmp

    Filesize

    2.0MB

  • memory/1732-199-0x0000000005EF0000-0x0000000005F98000-memory.dmp

    Filesize

    672KB

  • memory/1732-215-0x0000000006D30000-0x0000000006E30000-memory.dmp

    Filesize

    1024KB

  • memory/1732-211-0x00000000028D0000-0x00000000028DA000-memory.dmp

    Filesize

    40KB

  • memory/1732-212-0x00000000028D0000-0x00000000028DA000-memory.dmp

    Filesize

    40KB

  • memory/1732-210-0x00000000739E0000-0x00000000740CE000-memory.dmp

    Filesize

    6.9MB

  • memory/1732-182-0x0000000000EB0000-0x0000000000EC0000-memory.dmp

    Filesize

    64KB

  • memory/1732-217-0x0000000003340000-0x0000000003380000-memory.dmp

    Filesize

    256KB

  • memory/1732-216-0x0000000002CE0000-0x0000000002CE1000-memory.dmp

    Filesize

    4KB

  • memory/1732-218-0x0000000003340000-0x0000000003380000-memory.dmp

    Filesize

    256KB

  • memory/1732-219-0x00000000028D0000-0x00000000028DA000-memory.dmp

    Filesize

    40KB

  • memory/1732-220-0x00000000028D0000-0x00000000028DA000-memory.dmp

    Filesize

    40KB

  • memory/1732-221-0x0000000006D30000-0x0000000006E30000-memory.dmp

    Filesize

    1024KB

  • memory/2132-80-0x0000000000BB0000-0x0000000000BD7000-memory.dmp

    Filesize

    156KB