Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
122s -
max time network
137s -
platform
windows7_x64 -
resource
win7-20230831-en -
resource tags
arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system -
submitted
12/10/2023, 06:20
Static task
static1
Behavioral task
behavioral1
Sample
81b0f02e80fad3040b997505f3392e43d51b693bbcdac9d386bf7acd029bfd96.exe
Resource
win7-20230831-en
Behavioral task
behavioral2
Sample
81b0f02e80fad3040b997505f3392e43d51b693bbcdac9d386bf7acd029bfd96.exe
Resource
win10v2004-20230915-en
General
-
Target
81b0f02e80fad3040b997505f3392e43d51b693bbcdac9d386bf7acd029bfd96.exe
-
Size
1.0MB
-
MD5
e0a2918fcba6822fb2533a5af0580ccd
-
SHA1
b26f693bb5c86c572b3c436f7be692877842794f
-
SHA256
81b0f02e80fad3040b997505f3392e43d51b693bbcdac9d386bf7acd029bfd96
-
SHA512
ef568993bcdbca45c8eda3f01489c03630523453dc04a25d266788d6c667a1ac09e66dd948a922809cac3373385bdd92b5e095f43448a0fb5b1b6f3375d3eefe
-
SSDEEP
12288:fMr/y90AK1aH4oyl7XlKTSyGOyuFR6OK/f+uuYfJw7cXWK4SRhRnX8fazlnQoktC:0ylCv5lpXPOy7fRjS7S5vRrnXb3Fh
Malware Config
Signatures
-
Executes dropped EXE 4 IoCs
pid Process 2612 x9353243.exe 2724 x9188298.exe 2664 x9087459.exe 2680 g5938105.exe -
Loads dropped DLL 13 IoCs
pid Process 2472 81b0f02e80fad3040b997505f3392e43d51b693bbcdac9d386bf7acd029bfd96.exe 2612 x9353243.exe 2612 x9353243.exe 2724 x9188298.exe 2724 x9188298.exe 2664 x9087459.exe 2664 x9087459.exe 2664 x9087459.exe 2680 g5938105.exe 2632 WerFault.exe 2632 WerFault.exe 2632 WerFault.exe 2632 WerFault.exe -
Adds Run key to start application 2 TTPs 4 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" 81b0f02e80fad3040b997505f3392e43d51b693bbcdac9d386bf7acd029bfd96.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" x9353243.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\"" x9188298.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup3 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP003.TMP\\\"" x9087459.exe -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 2680 set thread context of 2212 2680 g5938105.exe 33 -
Program crash 2 IoCs
pid pid_target Process procid_target 2632 2680 WerFault.exe 31 2536 2212 WerFault.exe 33 -
Suspicious use of WriteProcessMemory 56 IoCs
description pid Process procid_target PID 2472 wrote to memory of 2612 2472 81b0f02e80fad3040b997505f3392e43d51b693bbcdac9d386bf7acd029bfd96.exe 28 PID 2472 wrote to memory of 2612 2472 81b0f02e80fad3040b997505f3392e43d51b693bbcdac9d386bf7acd029bfd96.exe 28 PID 2472 wrote to memory of 2612 2472 81b0f02e80fad3040b997505f3392e43d51b693bbcdac9d386bf7acd029bfd96.exe 28 PID 2472 wrote to memory of 2612 2472 81b0f02e80fad3040b997505f3392e43d51b693bbcdac9d386bf7acd029bfd96.exe 28 PID 2472 wrote to memory of 2612 2472 81b0f02e80fad3040b997505f3392e43d51b693bbcdac9d386bf7acd029bfd96.exe 28 PID 2472 wrote to memory of 2612 2472 81b0f02e80fad3040b997505f3392e43d51b693bbcdac9d386bf7acd029bfd96.exe 28 PID 2472 wrote to memory of 2612 2472 81b0f02e80fad3040b997505f3392e43d51b693bbcdac9d386bf7acd029bfd96.exe 28 PID 2612 wrote to memory of 2724 2612 x9353243.exe 29 PID 2612 wrote to memory of 2724 2612 x9353243.exe 29 PID 2612 wrote to memory of 2724 2612 x9353243.exe 29 PID 2612 wrote to memory of 2724 2612 x9353243.exe 29 PID 2612 wrote to memory of 2724 2612 x9353243.exe 29 PID 2612 wrote to memory of 2724 2612 x9353243.exe 29 PID 2612 wrote to memory of 2724 2612 x9353243.exe 29 PID 2724 wrote to memory of 2664 2724 x9188298.exe 30 PID 2724 wrote to memory of 2664 2724 x9188298.exe 30 PID 2724 wrote to memory of 2664 2724 x9188298.exe 30 PID 2724 wrote to memory of 2664 2724 x9188298.exe 30 PID 2724 wrote to memory of 2664 2724 x9188298.exe 30 PID 2724 wrote to memory of 2664 2724 x9188298.exe 30 PID 2724 wrote to memory of 2664 2724 x9188298.exe 30 PID 2664 wrote to memory of 2680 2664 x9087459.exe 31 PID 2664 wrote to memory of 2680 2664 x9087459.exe 31 PID 2664 wrote to memory of 2680 2664 x9087459.exe 31 PID 2664 wrote to memory of 2680 2664 x9087459.exe 31 PID 2664 wrote to memory of 2680 2664 x9087459.exe 31 PID 2664 wrote to memory of 2680 2664 x9087459.exe 31 PID 2664 wrote to memory of 2680 2664 x9087459.exe 31 PID 2680 wrote to memory of 2212 2680 g5938105.exe 33 PID 2680 wrote to memory of 2212 2680 g5938105.exe 33 PID 2680 wrote to memory of 2212 2680 g5938105.exe 33 PID 2680 wrote to memory of 2212 2680 g5938105.exe 33 PID 2680 wrote to memory of 2212 2680 g5938105.exe 33 PID 2680 wrote to memory of 2212 2680 g5938105.exe 33 PID 2680 wrote to memory of 2212 2680 g5938105.exe 33 PID 2680 wrote to memory of 2212 2680 g5938105.exe 33 PID 2680 wrote to memory of 2212 2680 g5938105.exe 33 PID 2680 wrote to memory of 2212 2680 g5938105.exe 33 PID 2680 wrote to memory of 2212 2680 g5938105.exe 33 PID 2680 wrote to memory of 2212 2680 g5938105.exe 33 PID 2680 wrote to memory of 2212 2680 g5938105.exe 33 PID 2680 wrote to memory of 2212 2680 g5938105.exe 33 PID 2680 wrote to memory of 2632 2680 g5938105.exe 34 PID 2680 wrote to memory of 2632 2680 g5938105.exe 34 PID 2680 wrote to memory of 2632 2680 g5938105.exe 34 PID 2680 wrote to memory of 2632 2680 g5938105.exe 34 PID 2680 wrote to memory of 2632 2680 g5938105.exe 34 PID 2680 wrote to memory of 2632 2680 g5938105.exe 34 PID 2680 wrote to memory of 2632 2680 g5938105.exe 34 PID 2212 wrote to memory of 2536 2212 AppLaunch.exe 35 PID 2212 wrote to memory of 2536 2212 AppLaunch.exe 35 PID 2212 wrote to memory of 2536 2212 AppLaunch.exe 35 PID 2212 wrote to memory of 2536 2212 AppLaunch.exe 35 PID 2212 wrote to memory of 2536 2212 AppLaunch.exe 35 PID 2212 wrote to memory of 2536 2212 AppLaunch.exe 35 PID 2212 wrote to memory of 2536 2212 AppLaunch.exe 35
Processes
-
C:\Users\Admin\AppData\Local\Temp\81b0f02e80fad3040b997505f3392e43d51b693bbcdac9d386bf7acd029bfd96.exe"C:\Users\Admin\AppData\Local\Temp\81b0f02e80fad3040b997505f3392e43d51b693bbcdac9d386bf7acd029bfd96.exe"1⤵
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:2472 -
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x9353243.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x9353243.exe2⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:2612 -
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\x9188298.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\x9188298.exe3⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:2724 -
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\x9087459.exeC:\Users\Admin\AppData\Local\Temp\IXP002.TMP\x9087459.exe4⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:2664 -
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\g5938105.exeC:\Users\Admin\AppData\Local\Temp\IXP003.TMP\g5938105.exe5⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2680 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"6⤵
- Suspicious use of WriteProcessMemory
PID:2212 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2212 -s 2687⤵
- Program crash
PID:2536
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2680 -s 2686⤵
- Loads dropped DLL
- Program crash
PID:2632
-
-
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
931KB
MD5a870485f365e8a01b7532083ff8b0f7a
SHA1959ba03311c86eb1a72b79f0df5a984bf54f6849
SHA256133e678479d814dae4ae5d3f3a0fc63e0ff92a6a3b2b3c34b71f0f066bd97489
SHA512ce7469b3ce64a84e0ff1c305c381d27c65e985fe230a9088fb1bf78e5890dc942fa57fdca1cb93af92e70e01de27aec295ade543189e250d753edf006e828aca
-
Filesize
931KB
MD5a870485f365e8a01b7532083ff8b0f7a
SHA1959ba03311c86eb1a72b79f0df5a984bf54f6849
SHA256133e678479d814dae4ae5d3f3a0fc63e0ff92a6a3b2b3c34b71f0f066bd97489
SHA512ce7469b3ce64a84e0ff1c305c381d27c65e985fe230a9088fb1bf78e5890dc942fa57fdca1cb93af92e70e01de27aec295ade543189e250d753edf006e828aca
-
Filesize
627KB
MD5f7907029e57999954ccdf5068f3a8911
SHA15c73a2c4c2be2b6400400e6cac4dcdb0e4a0a3d4
SHA256fc489c25d3ed7170bca4bf11d85afb49fa81765f0065edb4cff1283b4d68fd58
SHA5121b36013cc324c378f40424854389c0af707c610758705548d30ee3a6c51d6c84b923a3e9794829b6cac823a10b17ae27362b58d68923314ccdce82ed510a8118
-
Filesize
627KB
MD5f7907029e57999954ccdf5068f3a8911
SHA15c73a2c4c2be2b6400400e6cac4dcdb0e4a0a3d4
SHA256fc489c25d3ed7170bca4bf11d85afb49fa81765f0065edb4cff1283b4d68fd58
SHA5121b36013cc324c378f40424854389c0af707c610758705548d30ee3a6c51d6c84b923a3e9794829b6cac823a10b17ae27362b58d68923314ccdce82ed510a8118
-
Filesize
442KB
MD598119a485257c911d702e7eeab290d0a
SHA11c519a4fd81c370ab08dd0e04868ae9051339900
SHA25633d5841f3020a2f1590cd5f1c39432d50cc33705defc676e4dbef8d509926e99
SHA512a87d483837019196e5d1943e748ad18fd504d64a7fca7c81806d47c9172495115388666be369ace013355158f970eb7e1edf0c32a3f1c1d5ce9afbd2acc4eeec
-
Filesize
442KB
MD598119a485257c911d702e7eeab290d0a
SHA11c519a4fd81c370ab08dd0e04868ae9051339900
SHA25633d5841f3020a2f1590cd5f1c39432d50cc33705defc676e4dbef8d509926e99
SHA512a87d483837019196e5d1943e748ad18fd504d64a7fca7c81806d47c9172495115388666be369ace013355158f970eb7e1edf0c32a3f1c1d5ce9afbd2acc4eeec
-
Filesize
700KB
MD55341fee73b3c4a59bdc2858129668b8e
SHA14a4c6f726ae7fbe6a96fac3fd4087b856af9a15b
SHA2562a25ec2ee146dcd301f6f0379ad16d33fc380ead38d7235c1625a03132bc1d7a
SHA512cbf1dce34eb0a00213572ca8a7ca560882b07d715654436799f2cd8d6fb90f28a2ff3d0535cfd7e7a32354b1642210c21d90dbad591fae408fc98cd9b3c8e3a5
-
Filesize
700KB
MD55341fee73b3c4a59bdc2858129668b8e
SHA14a4c6f726ae7fbe6a96fac3fd4087b856af9a15b
SHA2562a25ec2ee146dcd301f6f0379ad16d33fc380ead38d7235c1625a03132bc1d7a
SHA512cbf1dce34eb0a00213572ca8a7ca560882b07d715654436799f2cd8d6fb90f28a2ff3d0535cfd7e7a32354b1642210c21d90dbad591fae408fc98cd9b3c8e3a5
-
Filesize
700KB
MD55341fee73b3c4a59bdc2858129668b8e
SHA14a4c6f726ae7fbe6a96fac3fd4087b856af9a15b
SHA2562a25ec2ee146dcd301f6f0379ad16d33fc380ead38d7235c1625a03132bc1d7a
SHA512cbf1dce34eb0a00213572ca8a7ca560882b07d715654436799f2cd8d6fb90f28a2ff3d0535cfd7e7a32354b1642210c21d90dbad591fae408fc98cd9b3c8e3a5
-
Filesize
931KB
MD5a870485f365e8a01b7532083ff8b0f7a
SHA1959ba03311c86eb1a72b79f0df5a984bf54f6849
SHA256133e678479d814dae4ae5d3f3a0fc63e0ff92a6a3b2b3c34b71f0f066bd97489
SHA512ce7469b3ce64a84e0ff1c305c381d27c65e985fe230a9088fb1bf78e5890dc942fa57fdca1cb93af92e70e01de27aec295ade543189e250d753edf006e828aca
-
Filesize
931KB
MD5a870485f365e8a01b7532083ff8b0f7a
SHA1959ba03311c86eb1a72b79f0df5a984bf54f6849
SHA256133e678479d814dae4ae5d3f3a0fc63e0ff92a6a3b2b3c34b71f0f066bd97489
SHA512ce7469b3ce64a84e0ff1c305c381d27c65e985fe230a9088fb1bf78e5890dc942fa57fdca1cb93af92e70e01de27aec295ade543189e250d753edf006e828aca
-
Filesize
627KB
MD5f7907029e57999954ccdf5068f3a8911
SHA15c73a2c4c2be2b6400400e6cac4dcdb0e4a0a3d4
SHA256fc489c25d3ed7170bca4bf11d85afb49fa81765f0065edb4cff1283b4d68fd58
SHA5121b36013cc324c378f40424854389c0af707c610758705548d30ee3a6c51d6c84b923a3e9794829b6cac823a10b17ae27362b58d68923314ccdce82ed510a8118
-
Filesize
627KB
MD5f7907029e57999954ccdf5068f3a8911
SHA15c73a2c4c2be2b6400400e6cac4dcdb0e4a0a3d4
SHA256fc489c25d3ed7170bca4bf11d85afb49fa81765f0065edb4cff1283b4d68fd58
SHA5121b36013cc324c378f40424854389c0af707c610758705548d30ee3a6c51d6c84b923a3e9794829b6cac823a10b17ae27362b58d68923314ccdce82ed510a8118
-
Filesize
442KB
MD598119a485257c911d702e7eeab290d0a
SHA11c519a4fd81c370ab08dd0e04868ae9051339900
SHA25633d5841f3020a2f1590cd5f1c39432d50cc33705defc676e4dbef8d509926e99
SHA512a87d483837019196e5d1943e748ad18fd504d64a7fca7c81806d47c9172495115388666be369ace013355158f970eb7e1edf0c32a3f1c1d5ce9afbd2acc4eeec
-
Filesize
442KB
MD598119a485257c911d702e7eeab290d0a
SHA11c519a4fd81c370ab08dd0e04868ae9051339900
SHA25633d5841f3020a2f1590cd5f1c39432d50cc33705defc676e4dbef8d509926e99
SHA512a87d483837019196e5d1943e748ad18fd504d64a7fca7c81806d47c9172495115388666be369ace013355158f970eb7e1edf0c32a3f1c1d5ce9afbd2acc4eeec
-
Filesize
700KB
MD55341fee73b3c4a59bdc2858129668b8e
SHA14a4c6f726ae7fbe6a96fac3fd4087b856af9a15b
SHA2562a25ec2ee146dcd301f6f0379ad16d33fc380ead38d7235c1625a03132bc1d7a
SHA512cbf1dce34eb0a00213572ca8a7ca560882b07d715654436799f2cd8d6fb90f28a2ff3d0535cfd7e7a32354b1642210c21d90dbad591fae408fc98cd9b3c8e3a5
-
Filesize
700KB
MD55341fee73b3c4a59bdc2858129668b8e
SHA14a4c6f726ae7fbe6a96fac3fd4087b856af9a15b
SHA2562a25ec2ee146dcd301f6f0379ad16d33fc380ead38d7235c1625a03132bc1d7a
SHA512cbf1dce34eb0a00213572ca8a7ca560882b07d715654436799f2cd8d6fb90f28a2ff3d0535cfd7e7a32354b1642210c21d90dbad591fae408fc98cd9b3c8e3a5
-
Filesize
700KB
MD55341fee73b3c4a59bdc2858129668b8e
SHA14a4c6f726ae7fbe6a96fac3fd4087b856af9a15b
SHA2562a25ec2ee146dcd301f6f0379ad16d33fc380ead38d7235c1625a03132bc1d7a
SHA512cbf1dce34eb0a00213572ca8a7ca560882b07d715654436799f2cd8d6fb90f28a2ff3d0535cfd7e7a32354b1642210c21d90dbad591fae408fc98cd9b3c8e3a5
-
Filesize
700KB
MD55341fee73b3c4a59bdc2858129668b8e
SHA14a4c6f726ae7fbe6a96fac3fd4087b856af9a15b
SHA2562a25ec2ee146dcd301f6f0379ad16d33fc380ead38d7235c1625a03132bc1d7a
SHA512cbf1dce34eb0a00213572ca8a7ca560882b07d715654436799f2cd8d6fb90f28a2ff3d0535cfd7e7a32354b1642210c21d90dbad591fae408fc98cd9b3c8e3a5
-
Filesize
700KB
MD55341fee73b3c4a59bdc2858129668b8e
SHA14a4c6f726ae7fbe6a96fac3fd4087b856af9a15b
SHA2562a25ec2ee146dcd301f6f0379ad16d33fc380ead38d7235c1625a03132bc1d7a
SHA512cbf1dce34eb0a00213572ca8a7ca560882b07d715654436799f2cd8d6fb90f28a2ff3d0535cfd7e7a32354b1642210c21d90dbad591fae408fc98cd9b3c8e3a5
-
Filesize
700KB
MD55341fee73b3c4a59bdc2858129668b8e
SHA14a4c6f726ae7fbe6a96fac3fd4087b856af9a15b
SHA2562a25ec2ee146dcd301f6f0379ad16d33fc380ead38d7235c1625a03132bc1d7a
SHA512cbf1dce34eb0a00213572ca8a7ca560882b07d715654436799f2cd8d6fb90f28a2ff3d0535cfd7e7a32354b1642210c21d90dbad591fae408fc98cd9b3c8e3a5
-
Filesize
700KB
MD55341fee73b3c4a59bdc2858129668b8e
SHA14a4c6f726ae7fbe6a96fac3fd4087b856af9a15b
SHA2562a25ec2ee146dcd301f6f0379ad16d33fc380ead38d7235c1625a03132bc1d7a
SHA512cbf1dce34eb0a00213572ca8a7ca560882b07d715654436799f2cd8d6fb90f28a2ff3d0535cfd7e7a32354b1642210c21d90dbad591fae408fc98cd9b3c8e3a5