Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    122s
  • max time network
    148s
  • platform
    windows7_x64
  • resource
    win7-20230831-en
  • resource tags

    arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
  • submitted
    11/10/2023, 14:05

General

  • Target

    047cf15a8e4734cf7661837e11e8e75a299e1773338fbe9f35d69d309373db38.exe

  • Size

    1.1MB

  • MD5

    48bdbf90ef52d4c7b4fc0c6d9417bd77

  • SHA1

    9ad8ac12f1aa0798158fbc15f9e54dbed711d841

  • SHA256

    047cf15a8e4734cf7661837e11e8e75a299e1773338fbe9f35d69d309373db38

  • SHA512

    c36818909719968a89e9309d70e745bc130adf8edb830afeec6804aeaa05970b22797ed698e08f37109f8d4b41d64bc2eda93c6741e6badd93d8b8f608e6ca8e

  • SSDEEP

    24576:Yy8AKA94fAyLszjKO9QyUWC/ZsnucjgdebVI/4I+2Be4Y7:fbD9WIvKcQ4COnucjgdeb+fBe4Y

Malware Config

Signatures

  • Detects Healer an antivirus disabler dropper 5 IoCs
  • Healer

    Healer an antivirus disabler dropper.

  • Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs
  • Executes dropped EXE 5 IoCs
  • Loads dropped DLL 15 IoCs
  • Adds Run key to start application 2 TTPs 5 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Program crash 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 54 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\047cf15a8e4734cf7661837e11e8e75a299e1773338fbe9f35d69d309373db38.exe
    "C:\Users\Admin\AppData\Local\Temp\047cf15a8e4734cf7661837e11e8e75a299e1773338fbe9f35d69d309373db38.exe"
    1⤵
    • Loads dropped DLL
    • Adds Run key to start application
    • Suspicious use of WriteProcessMemory
    PID:3016
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z0635678.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z0635678.exe
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Adds Run key to start application
      • Suspicious use of WriteProcessMemory
      PID:2380
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z0033722.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z0033722.exe
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Adds Run key to start application
        • Suspicious use of WriteProcessMemory
        PID:2708
        • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\z6587543.exe
          C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\z6587543.exe
          4⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • Adds Run key to start application
          • Suspicious use of WriteProcessMemory
          PID:2956
          • C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\z1808959.exe
            C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\z1808959.exe
            5⤵
            • Executes dropped EXE
            • Loads dropped DLL
            • Adds Run key to start application
            • Suspicious use of WriteProcessMemory
            PID:2832
            • C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q5036221.exe
              C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q5036221.exe
              6⤵
              • Executes dropped EXE
              • Loads dropped DLL
              • Suspicious use of SetThreadContext
              • Suspicious use of WriteProcessMemory
              PID:2756
              • C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
                "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
                7⤵
                • Modifies Windows Defender Real-time Protection settings
                • Suspicious behavior: EnumeratesProcesses
                • Suspicious use of AdjustPrivilegeToken
                PID:2812
              • C:\Windows\SysWOW64\WerFault.exe
                C:\Windows\SysWOW64\WerFault.exe -u -p 2756 -s 272
                7⤵
                • Loads dropped DLL
                • Program crash
                PID:2596

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z0635678.exe

    Filesize

    997KB

    MD5

    0802125400ea271c5d8e8f17d0ff38b1

    SHA1

    0b037c861b65d7176a2035c336a393ac588c1bb4

    SHA256

    91f2214632ce648474b98335002df9094f1027729c5a9e1da448c498e472cae7

    SHA512

    54be3d4d64bbcee193a5744f19af157b5911479868571148c9fff896d283959263cd235e28ea1e822bdb8481bf3ad4b040f54a5d81aab8d3c246cdde78d06970

  • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z0635678.exe

    Filesize

    997KB

    MD5

    0802125400ea271c5d8e8f17d0ff38b1

    SHA1

    0b037c861b65d7176a2035c336a393ac588c1bb4

    SHA256

    91f2214632ce648474b98335002df9094f1027729c5a9e1da448c498e472cae7

    SHA512

    54be3d4d64bbcee193a5744f19af157b5911479868571148c9fff896d283959263cd235e28ea1e822bdb8481bf3ad4b040f54a5d81aab8d3c246cdde78d06970

  • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z0033722.exe

    Filesize

    814KB

    MD5

    6420559d9aa1f43213ecb01f580c2745

    SHA1

    09b77fef4d4b27d19d424307d8af2eb035d503c8

    SHA256

    2bb342a01307ea7afea023b573af96a4079f68db5b3a2d871ca1130013fe00eb

    SHA512

    82571384118f496adc5f286d3b7ecf8adcf558a353e428af321d32e1e6fc82449687ce114d1536ae462a564275a26bf430c40aebd2175dead63f2ee089951b2e

  • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z0033722.exe

    Filesize

    814KB

    MD5

    6420559d9aa1f43213ecb01f580c2745

    SHA1

    09b77fef4d4b27d19d424307d8af2eb035d503c8

    SHA256

    2bb342a01307ea7afea023b573af96a4079f68db5b3a2d871ca1130013fe00eb

    SHA512

    82571384118f496adc5f286d3b7ecf8adcf558a353e428af321d32e1e6fc82449687ce114d1536ae462a564275a26bf430c40aebd2175dead63f2ee089951b2e

  • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\z6587543.exe

    Filesize

    631KB

    MD5

    d2efc864623bcce35eda19e7bb05196b

    SHA1

    882fb4a7c61a165daa9266ff1444f5fb5a35250a

    SHA256

    c71e0db3ce7f33680b12c1a63945d51961ce5397c8843fc0f56876f92d07f18b

    SHA512

    1d59a06121738cb993d92941e98844d6bdfcfe1388ccaa7c173b512cf8d0fe75526adba9ce40ce18d07da0fc4a2baa4398b7739d7d2fabcf0fb88fb12aa45a1c

  • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\z6587543.exe

    Filesize

    631KB

    MD5

    d2efc864623bcce35eda19e7bb05196b

    SHA1

    882fb4a7c61a165daa9266ff1444f5fb5a35250a

    SHA256

    c71e0db3ce7f33680b12c1a63945d51961ce5397c8843fc0f56876f92d07f18b

    SHA512

    1d59a06121738cb993d92941e98844d6bdfcfe1388ccaa7c173b512cf8d0fe75526adba9ce40ce18d07da0fc4a2baa4398b7739d7d2fabcf0fb88fb12aa45a1c

  • C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\z1808959.exe

    Filesize

    354KB

    MD5

    9bd775059b43ff6a15fcb4b866d93180

    SHA1

    79772457e568c06d44bfbb98b79a012bd5357c4c

    SHA256

    6ff3e1623da8e2beb776e15d0f4f04589b93ce56fef5e5d595dbee635ce22a21

    SHA512

    83e083ede04ccd7706ae4e6abc7966ea2a35a54e4c331f945b8ecf469956582fe2e3d82b348bb55b08a4ab786ca5c22c0a0e56d3f1fdee6b24864737647f5bc8

  • C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\z1808959.exe

    Filesize

    354KB

    MD5

    9bd775059b43ff6a15fcb4b866d93180

    SHA1

    79772457e568c06d44bfbb98b79a012bd5357c4c

    SHA256

    6ff3e1623da8e2beb776e15d0f4f04589b93ce56fef5e5d595dbee635ce22a21

    SHA512

    83e083ede04ccd7706ae4e6abc7966ea2a35a54e4c331f945b8ecf469956582fe2e3d82b348bb55b08a4ab786ca5c22c0a0e56d3f1fdee6b24864737647f5bc8

  • C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q5036221.exe

    Filesize

    250KB

    MD5

    251d219726764c7e3cb1626a696cabbd

    SHA1

    2e76168047f7dead33da811c35f7e079ccc089e6

    SHA256

    4c7a09ff3cc433ecf919875e1cef8e42c2898de5e55d0d585bd7994d552f107e

    SHA512

    54b5b7f5ba40ccc3c18dd842c9241235b7b5860e42f5738b7bd8385d365063f2958daadf5ffac640500fdd3018d1f68f704714fda85c7794b19a84da356afd5c

  • C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q5036221.exe

    Filesize

    250KB

    MD5

    251d219726764c7e3cb1626a696cabbd

    SHA1

    2e76168047f7dead33da811c35f7e079ccc089e6

    SHA256

    4c7a09ff3cc433ecf919875e1cef8e42c2898de5e55d0d585bd7994d552f107e

    SHA512

    54b5b7f5ba40ccc3c18dd842c9241235b7b5860e42f5738b7bd8385d365063f2958daadf5ffac640500fdd3018d1f68f704714fda85c7794b19a84da356afd5c

  • C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q5036221.exe

    Filesize

    250KB

    MD5

    251d219726764c7e3cb1626a696cabbd

    SHA1

    2e76168047f7dead33da811c35f7e079ccc089e6

    SHA256

    4c7a09ff3cc433ecf919875e1cef8e42c2898de5e55d0d585bd7994d552f107e

    SHA512

    54b5b7f5ba40ccc3c18dd842c9241235b7b5860e42f5738b7bd8385d365063f2958daadf5ffac640500fdd3018d1f68f704714fda85c7794b19a84da356afd5c

  • \Users\Admin\AppData\Local\Temp\IXP000.TMP\z0635678.exe

    Filesize

    997KB

    MD5

    0802125400ea271c5d8e8f17d0ff38b1

    SHA1

    0b037c861b65d7176a2035c336a393ac588c1bb4

    SHA256

    91f2214632ce648474b98335002df9094f1027729c5a9e1da448c498e472cae7

    SHA512

    54be3d4d64bbcee193a5744f19af157b5911479868571148c9fff896d283959263cd235e28ea1e822bdb8481bf3ad4b040f54a5d81aab8d3c246cdde78d06970

  • \Users\Admin\AppData\Local\Temp\IXP000.TMP\z0635678.exe

    Filesize

    997KB

    MD5

    0802125400ea271c5d8e8f17d0ff38b1

    SHA1

    0b037c861b65d7176a2035c336a393ac588c1bb4

    SHA256

    91f2214632ce648474b98335002df9094f1027729c5a9e1da448c498e472cae7

    SHA512

    54be3d4d64bbcee193a5744f19af157b5911479868571148c9fff896d283959263cd235e28ea1e822bdb8481bf3ad4b040f54a5d81aab8d3c246cdde78d06970

  • \Users\Admin\AppData\Local\Temp\IXP001.TMP\z0033722.exe

    Filesize

    814KB

    MD5

    6420559d9aa1f43213ecb01f580c2745

    SHA1

    09b77fef4d4b27d19d424307d8af2eb035d503c8

    SHA256

    2bb342a01307ea7afea023b573af96a4079f68db5b3a2d871ca1130013fe00eb

    SHA512

    82571384118f496adc5f286d3b7ecf8adcf558a353e428af321d32e1e6fc82449687ce114d1536ae462a564275a26bf430c40aebd2175dead63f2ee089951b2e

  • \Users\Admin\AppData\Local\Temp\IXP001.TMP\z0033722.exe

    Filesize

    814KB

    MD5

    6420559d9aa1f43213ecb01f580c2745

    SHA1

    09b77fef4d4b27d19d424307d8af2eb035d503c8

    SHA256

    2bb342a01307ea7afea023b573af96a4079f68db5b3a2d871ca1130013fe00eb

    SHA512

    82571384118f496adc5f286d3b7ecf8adcf558a353e428af321d32e1e6fc82449687ce114d1536ae462a564275a26bf430c40aebd2175dead63f2ee089951b2e

  • \Users\Admin\AppData\Local\Temp\IXP002.TMP\z6587543.exe

    Filesize

    631KB

    MD5

    d2efc864623bcce35eda19e7bb05196b

    SHA1

    882fb4a7c61a165daa9266ff1444f5fb5a35250a

    SHA256

    c71e0db3ce7f33680b12c1a63945d51961ce5397c8843fc0f56876f92d07f18b

    SHA512

    1d59a06121738cb993d92941e98844d6bdfcfe1388ccaa7c173b512cf8d0fe75526adba9ce40ce18d07da0fc4a2baa4398b7739d7d2fabcf0fb88fb12aa45a1c

  • \Users\Admin\AppData\Local\Temp\IXP002.TMP\z6587543.exe

    Filesize

    631KB

    MD5

    d2efc864623bcce35eda19e7bb05196b

    SHA1

    882fb4a7c61a165daa9266ff1444f5fb5a35250a

    SHA256

    c71e0db3ce7f33680b12c1a63945d51961ce5397c8843fc0f56876f92d07f18b

    SHA512

    1d59a06121738cb993d92941e98844d6bdfcfe1388ccaa7c173b512cf8d0fe75526adba9ce40ce18d07da0fc4a2baa4398b7739d7d2fabcf0fb88fb12aa45a1c

  • \Users\Admin\AppData\Local\Temp\IXP003.TMP\z1808959.exe

    Filesize

    354KB

    MD5

    9bd775059b43ff6a15fcb4b866d93180

    SHA1

    79772457e568c06d44bfbb98b79a012bd5357c4c

    SHA256

    6ff3e1623da8e2beb776e15d0f4f04589b93ce56fef5e5d595dbee635ce22a21

    SHA512

    83e083ede04ccd7706ae4e6abc7966ea2a35a54e4c331f945b8ecf469956582fe2e3d82b348bb55b08a4ab786ca5c22c0a0e56d3f1fdee6b24864737647f5bc8

  • \Users\Admin\AppData\Local\Temp\IXP003.TMP\z1808959.exe

    Filesize

    354KB

    MD5

    9bd775059b43ff6a15fcb4b866d93180

    SHA1

    79772457e568c06d44bfbb98b79a012bd5357c4c

    SHA256

    6ff3e1623da8e2beb776e15d0f4f04589b93ce56fef5e5d595dbee635ce22a21

    SHA512

    83e083ede04ccd7706ae4e6abc7966ea2a35a54e4c331f945b8ecf469956582fe2e3d82b348bb55b08a4ab786ca5c22c0a0e56d3f1fdee6b24864737647f5bc8

  • \Users\Admin\AppData\Local\Temp\IXP004.TMP\q5036221.exe

    Filesize

    250KB

    MD5

    251d219726764c7e3cb1626a696cabbd

    SHA1

    2e76168047f7dead33da811c35f7e079ccc089e6

    SHA256

    4c7a09ff3cc433ecf919875e1cef8e42c2898de5e55d0d585bd7994d552f107e

    SHA512

    54b5b7f5ba40ccc3c18dd842c9241235b7b5860e42f5738b7bd8385d365063f2958daadf5ffac640500fdd3018d1f68f704714fda85c7794b19a84da356afd5c

  • \Users\Admin\AppData\Local\Temp\IXP004.TMP\q5036221.exe

    Filesize

    250KB

    MD5

    251d219726764c7e3cb1626a696cabbd

    SHA1

    2e76168047f7dead33da811c35f7e079ccc089e6

    SHA256

    4c7a09ff3cc433ecf919875e1cef8e42c2898de5e55d0d585bd7994d552f107e

    SHA512

    54b5b7f5ba40ccc3c18dd842c9241235b7b5860e42f5738b7bd8385d365063f2958daadf5ffac640500fdd3018d1f68f704714fda85c7794b19a84da356afd5c

  • \Users\Admin\AppData\Local\Temp\IXP004.TMP\q5036221.exe

    Filesize

    250KB

    MD5

    251d219726764c7e3cb1626a696cabbd

    SHA1

    2e76168047f7dead33da811c35f7e079ccc089e6

    SHA256

    4c7a09ff3cc433ecf919875e1cef8e42c2898de5e55d0d585bd7994d552f107e

    SHA512

    54b5b7f5ba40ccc3c18dd842c9241235b7b5860e42f5738b7bd8385d365063f2958daadf5ffac640500fdd3018d1f68f704714fda85c7794b19a84da356afd5c

  • \Users\Admin\AppData\Local\Temp\IXP004.TMP\q5036221.exe

    Filesize

    250KB

    MD5

    251d219726764c7e3cb1626a696cabbd

    SHA1

    2e76168047f7dead33da811c35f7e079ccc089e6

    SHA256

    4c7a09ff3cc433ecf919875e1cef8e42c2898de5e55d0d585bd7994d552f107e

    SHA512

    54b5b7f5ba40ccc3c18dd842c9241235b7b5860e42f5738b7bd8385d365063f2958daadf5ffac640500fdd3018d1f68f704714fda85c7794b19a84da356afd5c

  • \Users\Admin\AppData\Local\Temp\IXP004.TMP\q5036221.exe

    Filesize

    250KB

    MD5

    251d219726764c7e3cb1626a696cabbd

    SHA1

    2e76168047f7dead33da811c35f7e079ccc089e6

    SHA256

    4c7a09ff3cc433ecf919875e1cef8e42c2898de5e55d0d585bd7994d552f107e

    SHA512

    54b5b7f5ba40ccc3c18dd842c9241235b7b5860e42f5738b7bd8385d365063f2958daadf5ffac640500fdd3018d1f68f704714fda85c7794b19a84da356afd5c

  • \Users\Admin\AppData\Local\Temp\IXP004.TMP\q5036221.exe

    Filesize

    250KB

    MD5

    251d219726764c7e3cb1626a696cabbd

    SHA1

    2e76168047f7dead33da811c35f7e079ccc089e6

    SHA256

    4c7a09ff3cc433ecf919875e1cef8e42c2898de5e55d0d585bd7994d552f107e

    SHA512

    54b5b7f5ba40ccc3c18dd842c9241235b7b5860e42f5738b7bd8385d365063f2958daadf5ffac640500fdd3018d1f68f704714fda85c7794b19a84da356afd5c

  • \Users\Admin\AppData\Local\Temp\IXP004.TMP\q5036221.exe

    Filesize

    250KB

    MD5

    251d219726764c7e3cb1626a696cabbd

    SHA1

    2e76168047f7dead33da811c35f7e079ccc089e6

    SHA256

    4c7a09ff3cc433ecf919875e1cef8e42c2898de5e55d0d585bd7994d552f107e

    SHA512

    54b5b7f5ba40ccc3c18dd842c9241235b7b5860e42f5738b7bd8385d365063f2958daadf5ffac640500fdd3018d1f68f704714fda85c7794b19a84da356afd5c

  • memory/2812-54-0x0000000000400000-0x000000000040A000-memory.dmp

    Filesize

    40KB

  • memory/2812-53-0x0000000000400000-0x000000000040A000-memory.dmp

    Filesize

    40KB

  • memory/2812-60-0x0000000000400000-0x000000000040A000-memory.dmp

    Filesize

    40KB

  • memory/2812-62-0x0000000000400000-0x000000000040A000-memory.dmp

    Filesize

    40KB

  • memory/2812-58-0x0000000000400000-0x000000000040A000-memory.dmp

    Filesize

    40KB

  • memory/2812-55-0x0000000000400000-0x000000000040A000-memory.dmp

    Filesize

    40KB

  • memory/2812-57-0x00000000FFFDE000-0x00000000FFFDF000-memory.dmp

    Filesize

    4KB

  • memory/2812-56-0x0000000000400000-0x000000000040A000-memory.dmp

    Filesize

    40KB