Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    118s
  • max time network
    123s
  • platform
    windows7_x64
  • resource
    win7-20230831-en
  • resource tags

    arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
  • submitted
    12/10/2023, 00:16

General

  • Target

    62f589c2ca5d02bffe0d537af6a3b8900e9a47bdfa1c28e97ea492615ec94e7b.exe

  • Size

    934KB

  • MD5

    82e43de3dd20254529b783332a895cbb

  • SHA1

    5dd98c2333fcdca71231b61fb373c37a7abe760f

  • SHA256

    62f589c2ca5d02bffe0d537af6a3b8900e9a47bdfa1c28e97ea492615ec94e7b

  • SHA512

    56fd7681e465ee465ff362fe3d2a44d43aaefe1eaf80654ba0c62481a69428f4746fcdd64dd695ed8ca3e6d9290527f483fb56dafa969fbf03755bb52ea65396

  • SSDEEP

    24576:8y/oaQBK7nRzSRICqf4V1ftxKmkSCjtLHH:rwaiecqfq1FZk7

Malware Config

Signatures

  • Detects Healer an antivirus disabler dropper 5 IoCs
  • Healer

    Healer an antivirus disabler dropper.

  • Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs
  • Executes dropped EXE 4 IoCs
  • Loads dropped DLL 13 IoCs
  • Adds Run key to start application 2 TTPs 4 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Program crash 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\62f589c2ca5d02bffe0d537af6a3b8900e9a47bdfa1c28e97ea492615ec94e7b.exe
    "C:\Users\Admin\AppData\Local\Temp\62f589c2ca5d02bffe0d537af6a3b8900e9a47bdfa1c28e97ea492615ec94e7b.exe"
    1⤵
    • Loads dropped DLL
    • Adds Run key to start application
    • Suspicious use of WriteProcessMemory
    PID:1736
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v1411746.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v1411746.exe
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Adds Run key to start application
      • Suspicious use of WriteProcessMemory
      PID:2256
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v5912721.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v5912721.exe
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Adds Run key to start application
        • Suspicious use of WriteProcessMemory
        PID:2624
        • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\v8061104.exe
          C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\v8061104.exe
          4⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • Adds Run key to start application
          • Suspicious use of WriteProcessMemory
          PID:2708
          • C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\a9339055.exe
            C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\a9339055.exe
            5⤵
            • Executes dropped EXE
            • Loads dropped DLL
            • Suspicious use of SetThreadContext
            • Suspicious use of WriteProcessMemory
            PID:2504
            • C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
              "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
              6⤵
                PID:2524
              • C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
                "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
                6⤵
                  PID:2884
                • C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
                  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
                  6⤵
                    PID:2876
                  • C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
                    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
                    6⤵
                    • Modifies Windows Defender Real-time Protection settings
                    • Suspicious behavior: EnumeratesProcesses
                    • Suspicious use of AdjustPrivilegeToken
                    PID:3028
                  • C:\Windows\SysWOW64\WerFault.exe
                    C:\Windows\SysWOW64\WerFault.exe -u -p 2504 -s 296
                    6⤵
                    • Loads dropped DLL
                    • Program crash
                    PID:2492

        Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v1411746.exe

          Filesize

          832KB

          MD5

          d6ca95f4f1c1b08213e364daa7078175

          SHA1

          53384e19bc16b1fedcd41c561f42f0889aaa0df1

          SHA256

          c55eb26398d45d4908303c781e720a202ed81b17a30953748bcb0b86c8b6e8c7

          SHA512

          e7e332ecfb84ee0a115236582578d60b538be7540a0801403c3e6a6a9b03a3e227820d2021ac5257ae75057cf8cfc08327af3884d1a27c4d4ff8b7e3b464f763

        • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v1411746.exe

          Filesize

          832KB

          MD5

          d6ca95f4f1c1b08213e364daa7078175

          SHA1

          53384e19bc16b1fedcd41c561f42f0889aaa0df1

          SHA256

          c55eb26398d45d4908303c781e720a202ed81b17a30953748bcb0b86c8b6e8c7

          SHA512

          e7e332ecfb84ee0a115236582578d60b538be7540a0801403c3e6a6a9b03a3e227820d2021ac5257ae75057cf8cfc08327af3884d1a27c4d4ff8b7e3b464f763

        • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v5912721.exe

          Filesize

          604KB

          MD5

          278d1c3ad40070ba1097cdf5dd8bbfcc

          SHA1

          a3b0ec1616221bc26fd5536b55fbf3e57d0274d9

          SHA256

          1efe4d48347001b9a682ef9efa811fbf0a36b1222e884aa51e038902314a2ca2

          SHA512

          74e9c7e233e53841645893c7a520ef6c3998dcd18147682b536ec5aaa9e1569b0451afe42228eb57c2250f7bc79afe30316b00d8e9090df08a91dda4d519c880

        • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v5912721.exe

          Filesize

          604KB

          MD5

          278d1c3ad40070ba1097cdf5dd8bbfcc

          SHA1

          a3b0ec1616221bc26fd5536b55fbf3e57d0274d9

          SHA256

          1efe4d48347001b9a682ef9efa811fbf0a36b1222e884aa51e038902314a2ca2

          SHA512

          74e9c7e233e53841645893c7a520ef6c3998dcd18147682b536ec5aaa9e1569b0451afe42228eb57c2250f7bc79afe30316b00d8e9090df08a91dda4d519c880

        • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\v8061104.exe

          Filesize

          344KB

          MD5

          bf8df48bb6ef944b65b16f2d409fa35f

          SHA1

          0392c20413252c0e7d8343a782786a526f0dd971

          SHA256

          ad9736e37bfeeb8ae162359f904cef5332f3224b0a6c2f60af7305fe4731ce0e

          SHA512

          6b80fa93958a0af1b48d63a44808ce3a5f0a97428058888c49596fdd689c08b7702c3dca8d99bebc887d3d2370c80574b9fbc8ebecf746fde7395bdc249f2d5f

        • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\v8061104.exe

          Filesize

          344KB

          MD5

          bf8df48bb6ef944b65b16f2d409fa35f

          SHA1

          0392c20413252c0e7d8343a782786a526f0dd971

          SHA256

          ad9736e37bfeeb8ae162359f904cef5332f3224b0a6c2f60af7305fe4731ce0e

          SHA512

          6b80fa93958a0af1b48d63a44808ce3a5f0a97428058888c49596fdd689c08b7702c3dca8d99bebc887d3d2370c80574b9fbc8ebecf746fde7395bdc249f2d5f

        • C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\a9339055.exe

          Filesize

          220KB

          MD5

          04242551431bb8fcd44391c0975f22d0

          SHA1

          ecb9f516396a95e689ec41e3b27d3cf8f3c349e5

          SHA256

          8867395120a3542c4b8017d0b498b0e04bb5663f83457e768d3ab4837d475ac9

          SHA512

          8a32c5ad21219a97f302616521b580c9b3fa7d5abba3e66702cf1aab3f2a0f9948002d183da2f026b457ba821c765cf0aa054b15e7512ffe5a0899f7e93822d8

        • C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\a9339055.exe

          Filesize

          220KB

          MD5

          04242551431bb8fcd44391c0975f22d0

          SHA1

          ecb9f516396a95e689ec41e3b27d3cf8f3c349e5

          SHA256

          8867395120a3542c4b8017d0b498b0e04bb5663f83457e768d3ab4837d475ac9

          SHA512

          8a32c5ad21219a97f302616521b580c9b3fa7d5abba3e66702cf1aab3f2a0f9948002d183da2f026b457ba821c765cf0aa054b15e7512ffe5a0899f7e93822d8

        • C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\a9339055.exe

          Filesize

          220KB

          MD5

          04242551431bb8fcd44391c0975f22d0

          SHA1

          ecb9f516396a95e689ec41e3b27d3cf8f3c349e5

          SHA256

          8867395120a3542c4b8017d0b498b0e04bb5663f83457e768d3ab4837d475ac9

          SHA512

          8a32c5ad21219a97f302616521b580c9b3fa7d5abba3e66702cf1aab3f2a0f9948002d183da2f026b457ba821c765cf0aa054b15e7512ffe5a0899f7e93822d8

        • \Users\Admin\AppData\Local\Temp\IXP000.TMP\v1411746.exe

          Filesize

          832KB

          MD5

          d6ca95f4f1c1b08213e364daa7078175

          SHA1

          53384e19bc16b1fedcd41c561f42f0889aaa0df1

          SHA256

          c55eb26398d45d4908303c781e720a202ed81b17a30953748bcb0b86c8b6e8c7

          SHA512

          e7e332ecfb84ee0a115236582578d60b538be7540a0801403c3e6a6a9b03a3e227820d2021ac5257ae75057cf8cfc08327af3884d1a27c4d4ff8b7e3b464f763

        • \Users\Admin\AppData\Local\Temp\IXP000.TMP\v1411746.exe

          Filesize

          832KB

          MD5

          d6ca95f4f1c1b08213e364daa7078175

          SHA1

          53384e19bc16b1fedcd41c561f42f0889aaa0df1

          SHA256

          c55eb26398d45d4908303c781e720a202ed81b17a30953748bcb0b86c8b6e8c7

          SHA512

          e7e332ecfb84ee0a115236582578d60b538be7540a0801403c3e6a6a9b03a3e227820d2021ac5257ae75057cf8cfc08327af3884d1a27c4d4ff8b7e3b464f763

        • \Users\Admin\AppData\Local\Temp\IXP001.TMP\v5912721.exe

          Filesize

          604KB

          MD5

          278d1c3ad40070ba1097cdf5dd8bbfcc

          SHA1

          a3b0ec1616221bc26fd5536b55fbf3e57d0274d9

          SHA256

          1efe4d48347001b9a682ef9efa811fbf0a36b1222e884aa51e038902314a2ca2

          SHA512

          74e9c7e233e53841645893c7a520ef6c3998dcd18147682b536ec5aaa9e1569b0451afe42228eb57c2250f7bc79afe30316b00d8e9090df08a91dda4d519c880

        • \Users\Admin\AppData\Local\Temp\IXP001.TMP\v5912721.exe

          Filesize

          604KB

          MD5

          278d1c3ad40070ba1097cdf5dd8bbfcc

          SHA1

          a3b0ec1616221bc26fd5536b55fbf3e57d0274d9

          SHA256

          1efe4d48347001b9a682ef9efa811fbf0a36b1222e884aa51e038902314a2ca2

          SHA512

          74e9c7e233e53841645893c7a520ef6c3998dcd18147682b536ec5aaa9e1569b0451afe42228eb57c2250f7bc79afe30316b00d8e9090df08a91dda4d519c880

        • \Users\Admin\AppData\Local\Temp\IXP002.TMP\v8061104.exe

          Filesize

          344KB

          MD5

          bf8df48bb6ef944b65b16f2d409fa35f

          SHA1

          0392c20413252c0e7d8343a782786a526f0dd971

          SHA256

          ad9736e37bfeeb8ae162359f904cef5332f3224b0a6c2f60af7305fe4731ce0e

          SHA512

          6b80fa93958a0af1b48d63a44808ce3a5f0a97428058888c49596fdd689c08b7702c3dca8d99bebc887d3d2370c80574b9fbc8ebecf746fde7395bdc249f2d5f

        • \Users\Admin\AppData\Local\Temp\IXP002.TMP\v8061104.exe

          Filesize

          344KB

          MD5

          bf8df48bb6ef944b65b16f2d409fa35f

          SHA1

          0392c20413252c0e7d8343a782786a526f0dd971

          SHA256

          ad9736e37bfeeb8ae162359f904cef5332f3224b0a6c2f60af7305fe4731ce0e

          SHA512

          6b80fa93958a0af1b48d63a44808ce3a5f0a97428058888c49596fdd689c08b7702c3dca8d99bebc887d3d2370c80574b9fbc8ebecf746fde7395bdc249f2d5f

        • \Users\Admin\AppData\Local\Temp\IXP003.TMP\a9339055.exe

          Filesize

          220KB

          MD5

          04242551431bb8fcd44391c0975f22d0

          SHA1

          ecb9f516396a95e689ec41e3b27d3cf8f3c349e5

          SHA256

          8867395120a3542c4b8017d0b498b0e04bb5663f83457e768d3ab4837d475ac9

          SHA512

          8a32c5ad21219a97f302616521b580c9b3fa7d5abba3e66702cf1aab3f2a0f9948002d183da2f026b457ba821c765cf0aa054b15e7512ffe5a0899f7e93822d8

        • \Users\Admin\AppData\Local\Temp\IXP003.TMP\a9339055.exe

          Filesize

          220KB

          MD5

          04242551431bb8fcd44391c0975f22d0

          SHA1

          ecb9f516396a95e689ec41e3b27d3cf8f3c349e5

          SHA256

          8867395120a3542c4b8017d0b498b0e04bb5663f83457e768d3ab4837d475ac9

          SHA512

          8a32c5ad21219a97f302616521b580c9b3fa7d5abba3e66702cf1aab3f2a0f9948002d183da2f026b457ba821c765cf0aa054b15e7512ffe5a0899f7e93822d8

        • \Users\Admin\AppData\Local\Temp\IXP003.TMP\a9339055.exe

          Filesize

          220KB

          MD5

          04242551431bb8fcd44391c0975f22d0

          SHA1

          ecb9f516396a95e689ec41e3b27d3cf8f3c349e5

          SHA256

          8867395120a3542c4b8017d0b498b0e04bb5663f83457e768d3ab4837d475ac9

          SHA512

          8a32c5ad21219a97f302616521b580c9b3fa7d5abba3e66702cf1aab3f2a0f9948002d183da2f026b457ba821c765cf0aa054b15e7512ffe5a0899f7e93822d8

        • \Users\Admin\AppData\Local\Temp\IXP003.TMP\a9339055.exe

          Filesize

          220KB

          MD5

          04242551431bb8fcd44391c0975f22d0

          SHA1

          ecb9f516396a95e689ec41e3b27d3cf8f3c349e5

          SHA256

          8867395120a3542c4b8017d0b498b0e04bb5663f83457e768d3ab4837d475ac9

          SHA512

          8a32c5ad21219a97f302616521b580c9b3fa7d5abba3e66702cf1aab3f2a0f9948002d183da2f026b457ba821c765cf0aa054b15e7512ffe5a0899f7e93822d8

        • \Users\Admin\AppData\Local\Temp\IXP003.TMP\a9339055.exe

          Filesize

          220KB

          MD5

          04242551431bb8fcd44391c0975f22d0

          SHA1

          ecb9f516396a95e689ec41e3b27d3cf8f3c349e5

          SHA256

          8867395120a3542c4b8017d0b498b0e04bb5663f83457e768d3ab4837d475ac9

          SHA512

          8a32c5ad21219a97f302616521b580c9b3fa7d5abba3e66702cf1aab3f2a0f9948002d183da2f026b457ba821c765cf0aa054b15e7512ffe5a0899f7e93822d8

        • \Users\Admin\AppData\Local\Temp\IXP003.TMP\a9339055.exe

          Filesize

          220KB

          MD5

          04242551431bb8fcd44391c0975f22d0

          SHA1

          ecb9f516396a95e689ec41e3b27d3cf8f3c349e5

          SHA256

          8867395120a3542c4b8017d0b498b0e04bb5663f83457e768d3ab4837d475ac9

          SHA512

          8a32c5ad21219a97f302616521b580c9b3fa7d5abba3e66702cf1aab3f2a0f9948002d183da2f026b457ba821c765cf0aa054b15e7512ffe5a0899f7e93822d8

        • \Users\Admin\AppData\Local\Temp\IXP003.TMP\a9339055.exe

          Filesize

          220KB

          MD5

          04242551431bb8fcd44391c0975f22d0

          SHA1

          ecb9f516396a95e689ec41e3b27d3cf8f3c349e5

          SHA256

          8867395120a3542c4b8017d0b498b0e04bb5663f83457e768d3ab4837d475ac9

          SHA512

          8a32c5ad21219a97f302616521b580c9b3fa7d5abba3e66702cf1aab3f2a0f9948002d183da2f026b457ba821c765cf0aa054b15e7512ffe5a0899f7e93822d8

        • memory/3028-47-0x00000000FFFDE000-0x00000000FFFDF000-memory.dmp

          Filesize

          4KB

        • memory/3028-48-0x0000000000400000-0x000000000040A000-memory.dmp

          Filesize

          40KB

        • memory/3028-50-0x0000000000400000-0x000000000040A000-memory.dmp

          Filesize

          40KB

        • memory/3028-52-0x0000000000400000-0x000000000040A000-memory.dmp

          Filesize

          40KB

        • memory/3028-46-0x0000000000400000-0x000000000040A000-memory.dmp

          Filesize

          40KB

        • memory/3028-45-0x0000000000400000-0x000000000040A000-memory.dmp

          Filesize

          40KB

        • memory/3028-44-0x0000000000400000-0x000000000040A000-memory.dmp

          Filesize

          40KB

        • memory/3028-43-0x0000000000400000-0x000000000040A000-memory.dmp

          Filesize

          40KB