Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
121s -
max time network
148s -
platform
windows7_x64 -
resource
win7-20230831-en -
resource tags
arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system -
submitted
13/10/2023, 04:36
Static task
static1
Behavioral task
behavioral1
Sample
db5268c43d753b67233bef775db184b7.exe
Resource
win7-20230831-en
Behavioral task
behavioral2
Sample
db5268c43d753b67233bef775db184b7.exe
Resource
win10v2004-20230915-en
General
-
Target
db5268c43d753b67233bef775db184b7.exe
-
Size
1.2MB
-
MD5
db5268c43d753b67233bef775db184b7
-
SHA1
c65d3a36915a9f54be30611334b6387e96329bce
-
SHA256
629241c8629ef1de31f6a3c44238a1a80f6181d73dec9a21be18c8247ae2185f
-
SHA512
c1bd01986df6b78f061ea7159fb51d90fea1333716b0aa63b0bd1e5e9d4f47c3f3f09ab6fa46b87efa32bcfeeb2ce78ef57bba27577b8dc2def6d1c47ed8df25
-
SSDEEP
24576:Fyj5HO2btCiTFzOd273jji+ao1DcU9z2hHsEKSO+lQgUmHpk2gSf5LcEpGgvKvpQ:gjN/4i5zn3n9aoFh9zA2Sx9LpFgS5cEB
Malware Config
Signatures
-
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" AppLaunch.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" AppLaunch.exe Key created \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection AppLaunch.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" AppLaunch.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" AppLaunch.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" AppLaunch.exe -
Executes dropped EXE 4 IoCs
pid Process 2692 nc0ST66.exe 2632 YZ3HP62.exe 1448 zA8Sk17.exe 2688 1kA40ES0.exe -
Loads dropped DLL 12 IoCs
pid Process 2036 db5268c43d753b67233bef775db184b7.exe 2692 nc0ST66.exe 2692 nc0ST66.exe 2632 YZ3HP62.exe 2632 YZ3HP62.exe 1448 zA8Sk17.exe 1448 zA8Sk17.exe 2688 1kA40ES0.exe 2504 WerFault.exe 2504 WerFault.exe 2504 WerFault.exe 2504 WerFault.exe -
Adds Run key to start application 2 TTPs 4 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\"" YZ3HP62.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup3 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP003.TMP\\\"" zA8Sk17.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" db5268c43d753b67233bef775db184b7.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" nc0ST66.exe -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 2688 set thread context of 2600 2688 1kA40ES0.exe 34 -
Program crash 1 IoCs
pid pid_target Process procid_target 2504 2688 WerFault.exe 32 -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 2600 AppLaunch.exe 2600 AppLaunch.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 2600 AppLaunch.exe -
Suspicious use of WriteProcessMemory 54 IoCs
description pid Process procid_target PID 2036 wrote to memory of 2692 2036 db5268c43d753b67233bef775db184b7.exe 29 PID 2036 wrote to memory of 2692 2036 db5268c43d753b67233bef775db184b7.exe 29 PID 2036 wrote to memory of 2692 2036 db5268c43d753b67233bef775db184b7.exe 29 PID 2036 wrote to memory of 2692 2036 db5268c43d753b67233bef775db184b7.exe 29 PID 2036 wrote to memory of 2692 2036 db5268c43d753b67233bef775db184b7.exe 29 PID 2036 wrote to memory of 2692 2036 db5268c43d753b67233bef775db184b7.exe 29 PID 2036 wrote to memory of 2692 2036 db5268c43d753b67233bef775db184b7.exe 29 PID 2692 wrote to memory of 2632 2692 nc0ST66.exe 30 PID 2692 wrote to memory of 2632 2692 nc0ST66.exe 30 PID 2692 wrote to memory of 2632 2692 nc0ST66.exe 30 PID 2692 wrote to memory of 2632 2692 nc0ST66.exe 30 PID 2692 wrote to memory of 2632 2692 nc0ST66.exe 30 PID 2692 wrote to memory of 2632 2692 nc0ST66.exe 30 PID 2692 wrote to memory of 2632 2692 nc0ST66.exe 30 PID 2632 wrote to memory of 1448 2632 YZ3HP62.exe 31 PID 2632 wrote to memory of 1448 2632 YZ3HP62.exe 31 PID 2632 wrote to memory of 1448 2632 YZ3HP62.exe 31 PID 2632 wrote to memory of 1448 2632 YZ3HP62.exe 31 PID 2632 wrote to memory of 1448 2632 YZ3HP62.exe 31 PID 2632 wrote to memory of 1448 2632 YZ3HP62.exe 31 PID 2632 wrote to memory of 1448 2632 YZ3HP62.exe 31 PID 1448 wrote to memory of 2688 1448 zA8Sk17.exe 32 PID 1448 wrote to memory of 2688 1448 zA8Sk17.exe 32 PID 1448 wrote to memory of 2688 1448 zA8Sk17.exe 32 PID 1448 wrote to memory of 2688 1448 zA8Sk17.exe 32 PID 1448 wrote to memory of 2688 1448 zA8Sk17.exe 32 PID 1448 wrote to memory of 2688 1448 zA8Sk17.exe 32 PID 1448 wrote to memory of 2688 1448 zA8Sk17.exe 32 PID 2688 wrote to memory of 2656 2688 1kA40ES0.exe 33 PID 2688 wrote to memory of 2656 2688 1kA40ES0.exe 33 PID 2688 wrote to memory of 2656 2688 1kA40ES0.exe 33 PID 2688 wrote to memory of 2656 2688 1kA40ES0.exe 33 PID 2688 wrote to memory of 2656 2688 1kA40ES0.exe 33 PID 2688 wrote to memory of 2656 2688 1kA40ES0.exe 33 PID 2688 wrote to memory of 2656 2688 1kA40ES0.exe 33 PID 2688 wrote to memory of 2600 2688 1kA40ES0.exe 34 PID 2688 wrote to memory of 2600 2688 1kA40ES0.exe 34 PID 2688 wrote to memory of 2600 2688 1kA40ES0.exe 34 PID 2688 wrote to memory of 2600 2688 1kA40ES0.exe 34 PID 2688 wrote to memory of 2600 2688 1kA40ES0.exe 34 PID 2688 wrote to memory of 2600 2688 1kA40ES0.exe 34 PID 2688 wrote to memory of 2600 2688 1kA40ES0.exe 34 PID 2688 wrote to memory of 2600 2688 1kA40ES0.exe 34 PID 2688 wrote to memory of 2600 2688 1kA40ES0.exe 34 PID 2688 wrote to memory of 2600 2688 1kA40ES0.exe 34 PID 2688 wrote to memory of 2600 2688 1kA40ES0.exe 34 PID 2688 wrote to memory of 2600 2688 1kA40ES0.exe 34 PID 2688 wrote to memory of 2504 2688 1kA40ES0.exe 35 PID 2688 wrote to memory of 2504 2688 1kA40ES0.exe 35 PID 2688 wrote to memory of 2504 2688 1kA40ES0.exe 35 PID 2688 wrote to memory of 2504 2688 1kA40ES0.exe 35 PID 2688 wrote to memory of 2504 2688 1kA40ES0.exe 35 PID 2688 wrote to memory of 2504 2688 1kA40ES0.exe 35 PID 2688 wrote to memory of 2504 2688 1kA40ES0.exe 35
Processes
-
C:\Users\Admin\AppData\Local\Temp\db5268c43d753b67233bef775db184b7.exe"C:\Users\Admin\AppData\Local\Temp\db5268c43d753b67233bef775db184b7.exe"1⤵
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:2036 -
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\nc0ST66.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\nc0ST66.exe2⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:2692 -
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\YZ3HP62.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\YZ3HP62.exe3⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:2632 -
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\zA8Sk17.exeC:\Users\Admin\AppData\Local\Temp\IXP002.TMP\zA8Sk17.exe4⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:1448 -
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\1kA40ES0.exeC:\Users\Admin\AppData\Local\Temp\IXP003.TMP\1kA40ES0.exe5⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2688 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"6⤵PID:2656
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"6⤵
- Modifies Windows Defender Real-time Protection settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2600
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2688 -s 2806⤵
- Loads dropped DLL
- Program crash
PID:2504
-
-
-
-
-
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.1MB
MD57277c7f58ab32a173a94dc3841cb0eaf
SHA1cbfde0aa8f66ddaa431e0b613c7cf4d2c88e9cfb
SHA25619e32c071eb08ac418fc5f5074dc1c7179a88a1bd4b86ba42c30dd0265909ab7
SHA51297ad226b85ee809ba24f6348ab83ad38d831412371296bf5e8ec55430b4ab1bb9f195e4d12bf05b47dfd573d368c7d4c00b2531ff9c165614030769ff2c2f62d
-
Filesize
1.1MB
MD57277c7f58ab32a173a94dc3841cb0eaf
SHA1cbfde0aa8f66ddaa431e0b613c7cf4d2c88e9cfb
SHA25619e32c071eb08ac418fc5f5074dc1c7179a88a1bd4b86ba42c30dd0265909ab7
SHA51297ad226b85ee809ba24f6348ab83ad38d831412371296bf5e8ec55430b4ab1bb9f195e4d12bf05b47dfd573d368c7d4c00b2531ff9c165614030769ff2c2f62d
-
Filesize
690KB
MD5bd8c5b198b9dc09709cde41b375c57c9
SHA16442d2aeef42eb4299a942e51a1bdf24d4e016a7
SHA256acf74279398cea73abde823b950d0f4c8fbf5790f25c24248cab5b4ba2de2321
SHA512fea07e5129dff4df77c587c432908b8b9c1c5ec735aff40e9c2cf2efcff7f4216bf5dbe6053b3c0794eda12879bea43a4bdf2662979871cb130ada3fdb48c77c
-
Filesize
690KB
MD5bd8c5b198b9dc09709cde41b375c57c9
SHA16442d2aeef42eb4299a942e51a1bdf24d4e016a7
SHA256acf74279398cea73abde823b950d0f4c8fbf5790f25c24248cab5b4ba2de2321
SHA512fea07e5129dff4df77c587c432908b8b9c1c5ec735aff40e9c2cf2efcff7f4216bf5dbe6053b3c0794eda12879bea43a4bdf2662979871cb130ada3fdb48c77c
-
Filesize
330KB
MD5c675af41b0d362b58e8796d97ef637f0
SHA1d70dff9c2c678eb036f051bf8ec89d25169d8a18
SHA256b8a131ce8a4b47d2dedd85359f76fc971d233ecc3c02911df0e4a2f9c58358ac
SHA5129ee27776faebaf2e896b3d8141f4c2be0b3cc00e1fe82fc97f1532b3451900c7fd9eecb5b7afdad8405b0110b3af09c325f9ae08baf24580eeddf0080e41a9b3
-
Filesize
330KB
MD5c675af41b0d362b58e8796d97ef637f0
SHA1d70dff9c2c678eb036f051bf8ec89d25169d8a18
SHA256b8a131ce8a4b47d2dedd85359f76fc971d233ecc3c02911df0e4a2f9c58358ac
SHA5129ee27776faebaf2e896b3d8141f4c2be0b3cc00e1fe82fc97f1532b3451900c7fd9eecb5b7afdad8405b0110b3af09c325f9ae08baf24580eeddf0080e41a9b3
-
Filesize
232KB
MD53ff825411b1fe07e712a5dcae34f80eb
SHA1e3e4358cabfa74d6e36e26754b01ed78434a6877
SHA25669bba958a5dcd8650921b25d978c4847819eb83adc143ba2bd396811d7d73739
SHA512325c098b5a0a0ffee16a6074616126f9f4c7930b74507d38c63a294f659ab26fe1674af85a8ff495bd268aa821cc9d85f80f11ab1e7f828015920220e456ab81
-
Filesize
232KB
MD53ff825411b1fe07e712a5dcae34f80eb
SHA1e3e4358cabfa74d6e36e26754b01ed78434a6877
SHA25669bba958a5dcd8650921b25d978c4847819eb83adc143ba2bd396811d7d73739
SHA512325c098b5a0a0ffee16a6074616126f9f4c7930b74507d38c63a294f659ab26fe1674af85a8ff495bd268aa821cc9d85f80f11ab1e7f828015920220e456ab81
-
Filesize
1.1MB
MD57277c7f58ab32a173a94dc3841cb0eaf
SHA1cbfde0aa8f66ddaa431e0b613c7cf4d2c88e9cfb
SHA25619e32c071eb08ac418fc5f5074dc1c7179a88a1bd4b86ba42c30dd0265909ab7
SHA51297ad226b85ee809ba24f6348ab83ad38d831412371296bf5e8ec55430b4ab1bb9f195e4d12bf05b47dfd573d368c7d4c00b2531ff9c165614030769ff2c2f62d
-
Filesize
1.1MB
MD57277c7f58ab32a173a94dc3841cb0eaf
SHA1cbfde0aa8f66ddaa431e0b613c7cf4d2c88e9cfb
SHA25619e32c071eb08ac418fc5f5074dc1c7179a88a1bd4b86ba42c30dd0265909ab7
SHA51297ad226b85ee809ba24f6348ab83ad38d831412371296bf5e8ec55430b4ab1bb9f195e4d12bf05b47dfd573d368c7d4c00b2531ff9c165614030769ff2c2f62d
-
Filesize
690KB
MD5bd8c5b198b9dc09709cde41b375c57c9
SHA16442d2aeef42eb4299a942e51a1bdf24d4e016a7
SHA256acf74279398cea73abde823b950d0f4c8fbf5790f25c24248cab5b4ba2de2321
SHA512fea07e5129dff4df77c587c432908b8b9c1c5ec735aff40e9c2cf2efcff7f4216bf5dbe6053b3c0794eda12879bea43a4bdf2662979871cb130ada3fdb48c77c
-
Filesize
690KB
MD5bd8c5b198b9dc09709cde41b375c57c9
SHA16442d2aeef42eb4299a942e51a1bdf24d4e016a7
SHA256acf74279398cea73abde823b950d0f4c8fbf5790f25c24248cab5b4ba2de2321
SHA512fea07e5129dff4df77c587c432908b8b9c1c5ec735aff40e9c2cf2efcff7f4216bf5dbe6053b3c0794eda12879bea43a4bdf2662979871cb130ada3fdb48c77c
-
Filesize
330KB
MD5c675af41b0d362b58e8796d97ef637f0
SHA1d70dff9c2c678eb036f051bf8ec89d25169d8a18
SHA256b8a131ce8a4b47d2dedd85359f76fc971d233ecc3c02911df0e4a2f9c58358ac
SHA5129ee27776faebaf2e896b3d8141f4c2be0b3cc00e1fe82fc97f1532b3451900c7fd9eecb5b7afdad8405b0110b3af09c325f9ae08baf24580eeddf0080e41a9b3
-
Filesize
330KB
MD5c675af41b0d362b58e8796d97ef637f0
SHA1d70dff9c2c678eb036f051bf8ec89d25169d8a18
SHA256b8a131ce8a4b47d2dedd85359f76fc971d233ecc3c02911df0e4a2f9c58358ac
SHA5129ee27776faebaf2e896b3d8141f4c2be0b3cc00e1fe82fc97f1532b3451900c7fd9eecb5b7afdad8405b0110b3af09c325f9ae08baf24580eeddf0080e41a9b3
-
Filesize
232KB
MD53ff825411b1fe07e712a5dcae34f80eb
SHA1e3e4358cabfa74d6e36e26754b01ed78434a6877
SHA25669bba958a5dcd8650921b25d978c4847819eb83adc143ba2bd396811d7d73739
SHA512325c098b5a0a0ffee16a6074616126f9f4c7930b74507d38c63a294f659ab26fe1674af85a8ff495bd268aa821cc9d85f80f11ab1e7f828015920220e456ab81
-
Filesize
232KB
MD53ff825411b1fe07e712a5dcae34f80eb
SHA1e3e4358cabfa74d6e36e26754b01ed78434a6877
SHA25669bba958a5dcd8650921b25d978c4847819eb83adc143ba2bd396811d7d73739
SHA512325c098b5a0a0ffee16a6074616126f9f4c7930b74507d38c63a294f659ab26fe1674af85a8ff495bd268aa821cc9d85f80f11ab1e7f828015920220e456ab81
-
Filesize
232KB
MD53ff825411b1fe07e712a5dcae34f80eb
SHA1e3e4358cabfa74d6e36e26754b01ed78434a6877
SHA25669bba958a5dcd8650921b25d978c4847819eb83adc143ba2bd396811d7d73739
SHA512325c098b5a0a0ffee16a6074616126f9f4c7930b74507d38c63a294f659ab26fe1674af85a8ff495bd268aa821cc9d85f80f11ab1e7f828015920220e456ab81
-
Filesize
232KB
MD53ff825411b1fe07e712a5dcae34f80eb
SHA1e3e4358cabfa74d6e36e26754b01ed78434a6877
SHA25669bba958a5dcd8650921b25d978c4847819eb83adc143ba2bd396811d7d73739
SHA512325c098b5a0a0ffee16a6074616126f9f4c7930b74507d38c63a294f659ab26fe1674af85a8ff495bd268aa821cc9d85f80f11ab1e7f828015920220e456ab81
-
Filesize
232KB
MD53ff825411b1fe07e712a5dcae34f80eb
SHA1e3e4358cabfa74d6e36e26754b01ed78434a6877
SHA25669bba958a5dcd8650921b25d978c4847819eb83adc143ba2bd396811d7d73739
SHA512325c098b5a0a0ffee16a6074616126f9f4c7930b74507d38c63a294f659ab26fe1674af85a8ff495bd268aa821cc9d85f80f11ab1e7f828015920220e456ab81
-
Filesize
232KB
MD53ff825411b1fe07e712a5dcae34f80eb
SHA1e3e4358cabfa74d6e36e26754b01ed78434a6877
SHA25669bba958a5dcd8650921b25d978c4847819eb83adc143ba2bd396811d7d73739
SHA512325c098b5a0a0ffee16a6074616126f9f4c7930b74507d38c63a294f659ab26fe1674af85a8ff495bd268aa821cc9d85f80f11ab1e7f828015920220e456ab81