Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
121s -
max time network
125s -
platform
windows7_x64 -
resource
win7-20230831-en -
resource tags
arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system -
submitted
11/10/2023, 13:19
Static task
static1
Behavioral task
behavioral1
Sample
file.exe
Resource
win7-20230831-en
Behavioral task
behavioral2
Sample
file.exe
Resource
win10v2004-20230915-en
General
-
Target
file.exe
-
Size
1.0MB
-
MD5
b2f180eae64c9bb156415af8df3cb7a5
-
SHA1
f3131863be3c7ff615ef429998337a2027128216
-
SHA256
2781d82c9e3393e5b8a6fb1815e9a07372eb96b2afa749c9068a666f6fab8186
-
SHA512
871f1f1a85a6f07961f178bdd470122d71c6a207e1225c656925bc0160d433099aaa358bc3a07d3bf18294ef58c279761a7ec5d45cbdc3f80c9c47abeb736b4b
-
SSDEEP
24576:gyh0xw/oxl7FUKci67+j9iA7Y1R4BEz3gyNFCicIuHeWClOHf:nh6q+Fjk+ZKaBcJyW
Malware Config
Signatures
-
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" AppLaunch.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" AppLaunch.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" AppLaunch.exe Key created \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection AppLaunch.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" AppLaunch.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" AppLaunch.exe -
Executes dropped EXE 4 IoCs
pid Process 2196 Bv0Fi99.exe 2656 aB4EC62.exe 2608 DG5dj16.exe 2872 1fG92iV7.exe -
Loads dropped DLL 12 IoCs
pid Process 1900 file.exe 2196 Bv0Fi99.exe 2196 Bv0Fi99.exe 2656 aB4EC62.exe 2656 aB4EC62.exe 2608 DG5dj16.exe 2608 DG5dj16.exe 2872 1fG92iV7.exe 2648 WerFault.exe 2648 WerFault.exe 2648 WerFault.exe 2648 WerFault.exe -
Adds Run key to start application 2 TTPs 4 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" file.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" Bv0Fi99.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\"" aB4EC62.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup3 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP003.TMP\\\"" DG5dj16.exe -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 2872 set thread context of 2572 2872 1fG92iV7.exe 32 -
Program crash 1 IoCs
pid pid_target Process procid_target 2648 2872 WerFault.exe 31 -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 2572 AppLaunch.exe 2572 AppLaunch.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 2572 AppLaunch.exe -
Suspicious use of WriteProcessMemory 47 IoCs
description pid Process procid_target PID 1900 wrote to memory of 2196 1900 file.exe 28 PID 1900 wrote to memory of 2196 1900 file.exe 28 PID 1900 wrote to memory of 2196 1900 file.exe 28 PID 1900 wrote to memory of 2196 1900 file.exe 28 PID 1900 wrote to memory of 2196 1900 file.exe 28 PID 1900 wrote to memory of 2196 1900 file.exe 28 PID 1900 wrote to memory of 2196 1900 file.exe 28 PID 2196 wrote to memory of 2656 2196 Bv0Fi99.exe 29 PID 2196 wrote to memory of 2656 2196 Bv0Fi99.exe 29 PID 2196 wrote to memory of 2656 2196 Bv0Fi99.exe 29 PID 2196 wrote to memory of 2656 2196 Bv0Fi99.exe 29 PID 2196 wrote to memory of 2656 2196 Bv0Fi99.exe 29 PID 2196 wrote to memory of 2656 2196 Bv0Fi99.exe 29 PID 2196 wrote to memory of 2656 2196 Bv0Fi99.exe 29 PID 2656 wrote to memory of 2608 2656 aB4EC62.exe 30 PID 2656 wrote to memory of 2608 2656 aB4EC62.exe 30 PID 2656 wrote to memory of 2608 2656 aB4EC62.exe 30 PID 2656 wrote to memory of 2608 2656 aB4EC62.exe 30 PID 2656 wrote to memory of 2608 2656 aB4EC62.exe 30 PID 2656 wrote to memory of 2608 2656 aB4EC62.exe 30 PID 2656 wrote to memory of 2608 2656 aB4EC62.exe 30 PID 2608 wrote to memory of 2872 2608 DG5dj16.exe 31 PID 2608 wrote to memory of 2872 2608 DG5dj16.exe 31 PID 2608 wrote to memory of 2872 2608 DG5dj16.exe 31 PID 2608 wrote to memory of 2872 2608 DG5dj16.exe 31 PID 2608 wrote to memory of 2872 2608 DG5dj16.exe 31 PID 2608 wrote to memory of 2872 2608 DG5dj16.exe 31 PID 2608 wrote to memory of 2872 2608 DG5dj16.exe 31 PID 2872 wrote to memory of 2572 2872 1fG92iV7.exe 32 PID 2872 wrote to memory of 2572 2872 1fG92iV7.exe 32 PID 2872 wrote to memory of 2572 2872 1fG92iV7.exe 32 PID 2872 wrote to memory of 2572 2872 1fG92iV7.exe 32 PID 2872 wrote to memory of 2572 2872 1fG92iV7.exe 32 PID 2872 wrote to memory of 2572 2872 1fG92iV7.exe 32 PID 2872 wrote to memory of 2572 2872 1fG92iV7.exe 32 PID 2872 wrote to memory of 2572 2872 1fG92iV7.exe 32 PID 2872 wrote to memory of 2572 2872 1fG92iV7.exe 32 PID 2872 wrote to memory of 2572 2872 1fG92iV7.exe 32 PID 2872 wrote to memory of 2572 2872 1fG92iV7.exe 32 PID 2872 wrote to memory of 2572 2872 1fG92iV7.exe 32 PID 2872 wrote to memory of 2648 2872 1fG92iV7.exe 33 PID 2872 wrote to memory of 2648 2872 1fG92iV7.exe 33 PID 2872 wrote to memory of 2648 2872 1fG92iV7.exe 33 PID 2872 wrote to memory of 2648 2872 1fG92iV7.exe 33 PID 2872 wrote to memory of 2648 2872 1fG92iV7.exe 33 PID 2872 wrote to memory of 2648 2872 1fG92iV7.exe 33 PID 2872 wrote to memory of 2648 2872 1fG92iV7.exe 33
Processes
-
C:\Users\Admin\AppData\Local\Temp\file.exe"C:\Users\Admin\AppData\Local\Temp\file.exe"1⤵
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:1900 -
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Bv0Fi99.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Bv0Fi99.exe2⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:2196 -
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\aB4EC62.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\aB4EC62.exe3⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:2656 -
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\DG5dj16.exeC:\Users\Admin\AppData\Local\Temp\IXP002.TMP\DG5dj16.exe4⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:2608 -
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\1fG92iV7.exeC:\Users\Admin\AppData\Local\Temp\IXP003.TMP\1fG92iV7.exe5⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2872 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"6⤵
- Modifies Windows Defender Real-time Protection settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2572
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2872 -s 2726⤵
- Loads dropped DLL
- Program crash
PID:2648
-
-
-
-
-
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
920KB
MD5d4caf07b845ef9be6737bc2926e0d7b3
SHA10f08d844fd15deccebf7c9fb551a64cecb57c9d0
SHA2566f3181b498ba9d696571a823df2f532dd6ee920bc0c9746b9757f73c62daa431
SHA51216e36b7c6696f640e3e333ac19cc7e5f83856575b2bccecf90af7f96ec17547868182d2ad87768a5d1ea3d01899670dd15f05c9ffaba7c49c78cebc468d9dffd
-
Filesize
920KB
MD5d4caf07b845ef9be6737bc2926e0d7b3
SHA10f08d844fd15deccebf7c9fb551a64cecb57c9d0
SHA2566f3181b498ba9d696571a823df2f532dd6ee920bc0c9746b9757f73c62daa431
SHA51216e36b7c6696f640e3e333ac19cc7e5f83856575b2bccecf90af7f96ec17547868182d2ad87768a5d1ea3d01899670dd15f05c9ffaba7c49c78cebc468d9dffd
-
Filesize
631KB
MD537dc8986e6d8d688df714a2f646b416d
SHA118b6465cb836336415d4e11ed4625047d7543fa3
SHA2561fca82be4f4c6ce00af84b0302098d1f40b360eec27908a1fcb14c1dd13c7b1b
SHA5123f735366e352a498b92c278a2938fc83730064210d41b7c5a0f4248531790032d0b11264db9ac0d0c7e34b422465f4164ea03df6a499d44c19470aa7a0de35f4
-
Filesize
631KB
MD537dc8986e6d8d688df714a2f646b416d
SHA118b6465cb836336415d4e11ed4625047d7543fa3
SHA2561fca82be4f4c6ce00af84b0302098d1f40b360eec27908a1fcb14c1dd13c7b1b
SHA5123f735366e352a498b92c278a2938fc83730064210d41b7c5a0f4248531790032d0b11264db9ac0d0c7e34b422465f4164ea03df6a499d44c19470aa7a0de35f4
-
Filesize
393KB
MD5db78e98de5c2dd4cdfecc9dee6d16dfc
SHA15f0bfde3b21a9631d6ecec8589faaf3402ed7804
SHA2562250ef8f74a80c79081bc2b3a1aaa995363684cc13219736360f272c06b36782
SHA5121b60c676e88e76a5d14d75fd8738eaf75a529b1ac816c45213db49eb1c89bee423bfd17d75d8c73a4ceb80b8621a80fc1e256e0063f483cb4497f2c7e4b20a10
-
Filesize
393KB
MD5db78e98de5c2dd4cdfecc9dee6d16dfc
SHA15f0bfde3b21a9631d6ecec8589faaf3402ed7804
SHA2562250ef8f74a80c79081bc2b3a1aaa995363684cc13219736360f272c06b36782
SHA5121b60c676e88e76a5d14d75fd8738eaf75a529b1ac816c45213db49eb1c89bee423bfd17d75d8c73a4ceb80b8621a80fc1e256e0063f483cb4497f2c7e4b20a10
-
Filesize
232KB
MD53ff825411b1fe07e712a5dcae34f80eb
SHA1e3e4358cabfa74d6e36e26754b01ed78434a6877
SHA25669bba958a5dcd8650921b25d978c4847819eb83adc143ba2bd396811d7d73739
SHA512325c098b5a0a0ffee16a6074616126f9f4c7930b74507d38c63a294f659ab26fe1674af85a8ff495bd268aa821cc9d85f80f11ab1e7f828015920220e456ab81
-
Filesize
232KB
MD53ff825411b1fe07e712a5dcae34f80eb
SHA1e3e4358cabfa74d6e36e26754b01ed78434a6877
SHA25669bba958a5dcd8650921b25d978c4847819eb83adc143ba2bd396811d7d73739
SHA512325c098b5a0a0ffee16a6074616126f9f4c7930b74507d38c63a294f659ab26fe1674af85a8ff495bd268aa821cc9d85f80f11ab1e7f828015920220e456ab81
-
Filesize
920KB
MD5d4caf07b845ef9be6737bc2926e0d7b3
SHA10f08d844fd15deccebf7c9fb551a64cecb57c9d0
SHA2566f3181b498ba9d696571a823df2f532dd6ee920bc0c9746b9757f73c62daa431
SHA51216e36b7c6696f640e3e333ac19cc7e5f83856575b2bccecf90af7f96ec17547868182d2ad87768a5d1ea3d01899670dd15f05c9ffaba7c49c78cebc468d9dffd
-
Filesize
920KB
MD5d4caf07b845ef9be6737bc2926e0d7b3
SHA10f08d844fd15deccebf7c9fb551a64cecb57c9d0
SHA2566f3181b498ba9d696571a823df2f532dd6ee920bc0c9746b9757f73c62daa431
SHA51216e36b7c6696f640e3e333ac19cc7e5f83856575b2bccecf90af7f96ec17547868182d2ad87768a5d1ea3d01899670dd15f05c9ffaba7c49c78cebc468d9dffd
-
Filesize
631KB
MD537dc8986e6d8d688df714a2f646b416d
SHA118b6465cb836336415d4e11ed4625047d7543fa3
SHA2561fca82be4f4c6ce00af84b0302098d1f40b360eec27908a1fcb14c1dd13c7b1b
SHA5123f735366e352a498b92c278a2938fc83730064210d41b7c5a0f4248531790032d0b11264db9ac0d0c7e34b422465f4164ea03df6a499d44c19470aa7a0de35f4
-
Filesize
631KB
MD537dc8986e6d8d688df714a2f646b416d
SHA118b6465cb836336415d4e11ed4625047d7543fa3
SHA2561fca82be4f4c6ce00af84b0302098d1f40b360eec27908a1fcb14c1dd13c7b1b
SHA5123f735366e352a498b92c278a2938fc83730064210d41b7c5a0f4248531790032d0b11264db9ac0d0c7e34b422465f4164ea03df6a499d44c19470aa7a0de35f4
-
Filesize
393KB
MD5db78e98de5c2dd4cdfecc9dee6d16dfc
SHA15f0bfde3b21a9631d6ecec8589faaf3402ed7804
SHA2562250ef8f74a80c79081bc2b3a1aaa995363684cc13219736360f272c06b36782
SHA5121b60c676e88e76a5d14d75fd8738eaf75a529b1ac816c45213db49eb1c89bee423bfd17d75d8c73a4ceb80b8621a80fc1e256e0063f483cb4497f2c7e4b20a10
-
Filesize
393KB
MD5db78e98de5c2dd4cdfecc9dee6d16dfc
SHA15f0bfde3b21a9631d6ecec8589faaf3402ed7804
SHA2562250ef8f74a80c79081bc2b3a1aaa995363684cc13219736360f272c06b36782
SHA5121b60c676e88e76a5d14d75fd8738eaf75a529b1ac816c45213db49eb1c89bee423bfd17d75d8c73a4ceb80b8621a80fc1e256e0063f483cb4497f2c7e4b20a10
-
Filesize
232KB
MD53ff825411b1fe07e712a5dcae34f80eb
SHA1e3e4358cabfa74d6e36e26754b01ed78434a6877
SHA25669bba958a5dcd8650921b25d978c4847819eb83adc143ba2bd396811d7d73739
SHA512325c098b5a0a0ffee16a6074616126f9f4c7930b74507d38c63a294f659ab26fe1674af85a8ff495bd268aa821cc9d85f80f11ab1e7f828015920220e456ab81
-
Filesize
232KB
MD53ff825411b1fe07e712a5dcae34f80eb
SHA1e3e4358cabfa74d6e36e26754b01ed78434a6877
SHA25669bba958a5dcd8650921b25d978c4847819eb83adc143ba2bd396811d7d73739
SHA512325c098b5a0a0ffee16a6074616126f9f4c7930b74507d38c63a294f659ab26fe1674af85a8ff495bd268aa821cc9d85f80f11ab1e7f828015920220e456ab81
-
Filesize
232KB
MD53ff825411b1fe07e712a5dcae34f80eb
SHA1e3e4358cabfa74d6e36e26754b01ed78434a6877
SHA25669bba958a5dcd8650921b25d978c4847819eb83adc143ba2bd396811d7d73739
SHA512325c098b5a0a0ffee16a6074616126f9f4c7930b74507d38c63a294f659ab26fe1674af85a8ff495bd268aa821cc9d85f80f11ab1e7f828015920220e456ab81
-
Filesize
232KB
MD53ff825411b1fe07e712a5dcae34f80eb
SHA1e3e4358cabfa74d6e36e26754b01ed78434a6877
SHA25669bba958a5dcd8650921b25d978c4847819eb83adc143ba2bd396811d7d73739
SHA512325c098b5a0a0ffee16a6074616126f9f4c7930b74507d38c63a294f659ab26fe1674af85a8ff495bd268aa821cc9d85f80f11ab1e7f828015920220e456ab81
-
Filesize
232KB
MD53ff825411b1fe07e712a5dcae34f80eb
SHA1e3e4358cabfa74d6e36e26754b01ed78434a6877
SHA25669bba958a5dcd8650921b25d978c4847819eb83adc143ba2bd396811d7d73739
SHA512325c098b5a0a0ffee16a6074616126f9f4c7930b74507d38c63a294f659ab26fe1674af85a8ff495bd268aa821cc9d85f80f11ab1e7f828015920220e456ab81
-
Filesize
232KB
MD53ff825411b1fe07e712a5dcae34f80eb
SHA1e3e4358cabfa74d6e36e26754b01ed78434a6877
SHA25669bba958a5dcd8650921b25d978c4847819eb83adc143ba2bd396811d7d73739
SHA512325c098b5a0a0ffee16a6074616126f9f4c7930b74507d38c63a294f659ab26fe1674af85a8ff495bd268aa821cc9d85f80f11ab1e7f828015920220e456ab81