Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    121s
  • max time network
    148s
  • platform
    windows7_x64
  • resource
    win7-20230831-en
  • resource tags

    arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
  • submitted
    13/10/2023, 04:36 UTC

General

  • Target

    db5268c43d753b67233bef775db184b7.exe

  • Size

    1.2MB

  • MD5

    db5268c43d753b67233bef775db184b7

  • SHA1

    c65d3a36915a9f54be30611334b6387e96329bce

  • SHA256

    629241c8629ef1de31f6a3c44238a1a80f6181d73dec9a21be18c8247ae2185f

  • SHA512

    c1bd01986df6b78f061ea7159fb51d90fea1333716b0aa63b0bd1e5e9d4f47c3f3f09ab6fa46b87efa32bcfeeb2ce78ef57bba27577b8dc2def6d1c47ed8df25

  • SSDEEP

    24576:Fyj5HO2btCiTFzOd273jji+ao1DcU9z2hHsEKSO+lQgUmHpk2gSf5LcEpGgvKvpQ:gjN/4i5zn3n9aoFh9zA2Sx9LpFgS5cEB

Malware Config

Signatures

  • Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs
  • Executes dropped EXE 4 IoCs
  • Loads dropped DLL 12 IoCs
  • Adds Run key to start application 2 TTPs 4 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Program crash 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 54 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\db5268c43d753b67233bef775db184b7.exe
    "C:\Users\Admin\AppData\Local\Temp\db5268c43d753b67233bef775db184b7.exe"
    1⤵
    • Loads dropped DLL
    • Adds Run key to start application
    • Suspicious use of WriteProcessMemory
    PID:2036
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\nc0ST66.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\nc0ST66.exe
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Adds Run key to start application
      • Suspicious use of WriteProcessMemory
      PID:2692
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\YZ3HP62.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\YZ3HP62.exe
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Adds Run key to start application
        • Suspicious use of WriteProcessMemory
        PID:2632
        • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\zA8Sk17.exe
          C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\zA8Sk17.exe
          4⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • Adds Run key to start application
          • Suspicious use of WriteProcessMemory
          PID:1448
          • C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\1kA40ES0.exe
            C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\1kA40ES0.exe
            5⤵
            • Executes dropped EXE
            • Loads dropped DLL
            • Suspicious use of SetThreadContext
            • Suspicious use of WriteProcessMemory
            PID:2688
            • C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
              "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
              6⤵
                PID:2656
              • C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
                "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
                6⤵
                • Modifies Windows Defender Real-time Protection settings
                • Suspicious behavior: EnumeratesProcesses
                • Suspicious use of AdjustPrivilegeToken
                PID:2600
              • C:\Windows\SysWOW64\WerFault.exe
                C:\Windows\SysWOW64\WerFault.exe -u -p 2688 -s 280
                6⤵
                • Loads dropped DLL
                • Program crash
                PID:2504

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\nc0ST66.exe

      Filesize

      1.1MB

      MD5

      7277c7f58ab32a173a94dc3841cb0eaf

      SHA1

      cbfde0aa8f66ddaa431e0b613c7cf4d2c88e9cfb

      SHA256

      19e32c071eb08ac418fc5f5074dc1c7179a88a1bd4b86ba42c30dd0265909ab7

      SHA512

      97ad226b85ee809ba24f6348ab83ad38d831412371296bf5e8ec55430b4ab1bb9f195e4d12bf05b47dfd573d368c7d4c00b2531ff9c165614030769ff2c2f62d

    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\nc0ST66.exe

      Filesize

      1.1MB

      MD5

      7277c7f58ab32a173a94dc3841cb0eaf

      SHA1

      cbfde0aa8f66ddaa431e0b613c7cf4d2c88e9cfb

      SHA256

      19e32c071eb08ac418fc5f5074dc1c7179a88a1bd4b86ba42c30dd0265909ab7

      SHA512

      97ad226b85ee809ba24f6348ab83ad38d831412371296bf5e8ec55430b4ab1bb9f195e4d12bf05b47dfd573d368c7d4c00b2531ff9c165614030769ff2c2f62d

    • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\YZ3HP62.exe

      Filesize

      690KB

      MD5

      bd8c5b198b9dc09709cde41b375c57c9

      SHA1

      6442d2aeef42eb4299a942e51a1bdf24d4e016a7

      SHA256

      acf74279398cea73abde823b950d0f4c8fbf5790f25c24248cab5b4ba2de2321

      SHA512

      fea07e5129dff4df77c587c432908b8b9c1c5ec735aff40e9c2cf2efcff7f4216bf5dbe6053b3c0794eda12879bea43a4bdf2662979871cb130ada3fdb48c77c

    • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\YZ3HP62.exe

      Filesize

      690KB

      MD5

      bd8c5b198b9dc09709cde41b375c57c9

      SHA1

      6442d2aeef42eb4299a942e51a1bdf24d4e016a7

      SHA256

      acf74279398cea73abde823b950d0f4c8fbf5790f25c24248cab5b4ba2de2321

      SHA512

      fea07e5129dff4df77c587c432908b8b9c1c5ec735aff40e9c2cf2efcff7f4216bf5dbe6053b3c0794eda12879bea43a4bdf2662979871cb130ada3fdb48c77c

    • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\zA8Sk17.exe

      Filesize

      330KB

      MD5

      c675af41b0d362b58e8796d97ef637f0

      SHA1

      d70dff9c2c678eb036f051bf8ec89d25169d8a18

      SHA256

      b8a131ce8a4b47d2dedd85359f76fc971d233ecc3c02911df0e4a2f9c58358ac

      SHA512

      9ee27776faebaf2e896b3d8141f4c2be0b3cc00e1fe82fc97f1532b3451900c7fd9eecb5b7afdad8405b0110b3af09c325f9ae08baf24580eeddf0080e41a9b3

    • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\zA8Sk17.exe

      Filesize

      330KB

      MD5

      c675af41b0d362b58e8796d97ef637f0

      SHA1

      d70dff9c2c678eb036f051bf8ec89d25169d8a18

      SHA256

      b8a131ce8a4b47d2dedd85359f76fc971d233ecc3c02911df0e4a2f9c58358ac

      SHA512

      9ee27776faebaf2e896b3d8141f4c2be0b3cc00e1fe82fc97f1532b3451900c7fd9eecb5b7afdad8405b0110b3af09c325f9ae08baf24580eeddf0080e41a9b3

    • C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\1kA40ES0.exe

      Filesize

      232KB

      MD5

      3ff825411b1fe07e712a5dcae34f80eb

      SHA1

      e3e4358cabfa74d6e36e26754b01ed78434a6877

      SHA256

      69bba958a5dcd8650921b25d978c4847819eb83adc143ba2bd396811d7d73739

      SHA512

      325c098b5a0a0ffee16a6074616126f9f4c7930b74507d38c63a294f659ab26fe1674af85a8ff495bd268aa821cc9d85f80f11ab1e7f828015920220e456ab81

    • C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\1kA40ES0.exe

      Filesize

      232KB

      MD5

      3ff825411b1fe07e712a5dcae34f80eb

      SHA1

      e3e4358cabfa74d6e36e26754b01ed78434a6877

      SHA256

      69bba958a5dcd8650921b25d978c4847819eb83adc143ba2bd396811d7d73739

      SHA512

      325c098b5a0a0ffee16a6074616126f9f4c7930b74507d38c63a294f659ab26fe1674af85a8ff495bd268aa821cc9d85f80f11ab1e7f828015920220e456ab81

    • \Users\Admin\AppData\Local\Temp\IXP000.TMP\nc0ST66.exe

      Filesize

      1.1MB

      MD5

      7277c7f58ab32a173a94dc3841cb0eaf

      SHA1

      cbfde0aa8f66ddaa431e0b613c7cf4d2c88e9cfb

      SHA256

      19e32c071eb08ac418fc5f5074dc1c7179a88a1bd4b86ba42c30dd0265909ab7

      SHA512

      97ad226b85ee809ba24f6348ab83ad38d831412371296bf5e8ec55430b4ab1bb9f195e4d12bf05b47dfd573d368c7d4c00b2531ff9c165614030769ff2c2f62d

    • \Users\Admin\AppData\Local\Temp\IXP000.TMP\nc0ST66.exe

      Filesize

      1.1MB

      MD5

      7277c7f58ab32a173a94dc3841cb0eaf

      SHA1

      cbfde0aa8f66ddaa431e0b613c7cf4d2c88e9cfb

      SHA256

      19e32c071eb08ac418fc5f5074dc1c7179a88a1bd4b86ba42c30dd0265909ab7

      SHA512

      97ad226b85ee809ba24f6348ab83ad38d831412371296bf5e8ec55430b4ab1bb9f195e4d12bf05b47dfd573d368c7d4c00b2531ff9c165614030769ff2c2f62d

    • \Users\Admin\AppData\Local\Temp\IXP001.TMP\YZ3HP62.exe

      Filesize

      690KB

      MD5

      bd8c5b198b9dc09709cde41b375c57c9

      SHA1

      6442d2aeef42eb4299a942e51a1bdf24d4e016a7

      SHA256

      acf74279398cea73abde823b950d0f4c8fbf5790f25c24248cab5b4ba2de2321

      SHA512

      fea07e5129dff4df77c587c432908b8b9c1c5ec735aff40e9c2cf2efcff7f4216bf5dbe6053b3c0794eda12879bea43a4bdf2662979871cb130ada3fdb48c77c

    • \Users\Admin\AppData\Local\Temp\IXP001.TMP\YZ3HP62.exe

      Filesize

      690KB

      MD5

      bd8c5b198b9dc09709cde41b375c57c9

      SHA1

      6442d2aeef42eb4299a942e51a1bdf24d4e016a7

      SHA256

      acf74279398cea73abde823b950d0f4c8fbf5790f25c24248cab5b4ba2de2321

      SHA512

      fea07e5129dff4df77c587c432908b8b9c1c5ec735aff40e9c2cf2efcff7f4216bf5dbe6053b3c0794eda12879bea43a4bdf2662979871cb130ada3fdb48c77c

    • \Users\Admin\AppData\Local\Temp\IXP002.TMP\zA8Sk17.exe

      Filesize

      330KB

      MD5

      c675af41b0d362b58e8796d97ef637f0

      SHA1

      d70dff9c2c678eb036f051bf8ec89d25169d8a18

      SHA256

      b8a131ce8a4b47d2dedd85359f76fc971d233ecc3c02911df0e4a2f9c58358ac

      SHA512

      9ee27776faebaf2e896b3d8141f4c2be0b3cc00e1fe82fc97f1532b3451900c7fd9eecb5b7afdad8405b0110b3af09c325f9ae08baf24580eeddf0080e41a9b3

    • \Users\Admin\AppData\Local\Temp\IXP002.TMP\zA8Sk17.exe

      Filesize

      330KB

      MD5

      c675af41b0d362b58e8796d97ef637f0

      SHA1

      d70dff9c2c678eb036f051bf8ec89d25169d8a18

      SHA256

      b8a131ce8a4b47d2dedd85359f76fc971d233ecc3c02911df0e4a2f9c58358ac

      SHA512

      9ee27776faebaf2e896b3d8141f4c2be0b3cc00e1fe82fc97f1532b3451900c7fd9eecb5b7afdad8405b0110b3af09c325f9ae08baf24580eeddf0080e41a9b3

    • \Users\Admin\AppData\Local\Temp\IXP003.TMP\1kA40ES0.exe

      Filesize

      232KB

      MD5

      3ff825411b1fe07e712a5dcae34f80eb

      SHA1

      e3e4358cabfa74d6e36e26754b01ed78434a6877

      SHA256

      69bba958a5dcd8650921b25d978c4847819eb83adc143ba2bd396811d7d73739

      SHA512

      325c098b5a0a0ffee16a6074616126f9f4c7930b74507d38c63a294f659ab26fe1674af85a8ff495bd268aa821cc9d85f80f11ab1e7f828015920220e456ab81

    • \Users\Admin\AppData\Local\Temp\IXP003.TMP\1kA40ES0.exe

      Filesize

      232KB

      MD5

      3ff825411b1fe07e712a5dcae34f80eb

      SHA1

      e3e4358cabfa74d6e36e26754b01ed78434a6877

      SHA256

      69bba958a5dcd8650921b25d978c4847819eb83adc143ba2bd396811d7d73739

      SHA512

      325c098b5a0a0ffee16a6074616126f9f4c7930b74507d38c63a294f659ab26fe1674af85a8ff495bd268aa821cc9d85f80f11ab1e7f828015920220e456ab81

    • \Users\Admin\AppData\Local\Temp\IXP003.TMP\1kA40ES0.exe

      Filesize

      232KB

      MD5

      3ff825411b1fe07e712a5dcae34f80eb

      SHA1

      e3e4358cabfa74d6e36e26754b01ed78434a6877

      SHA256

      69bba958a5dcd8650921b25d978c4847819eb83adc143ba2bd396811d7d73739

      SHA512

      325c098b5a0a0ffee16a6074616126f9f4c7930b74507d38c63a294f659ab26fe1674af85a8ff495bd268aa821cc9d85f80f11ab1e7f828015920220e456ab81

    • \Users\Admin\AppData\Local\Temp\IXP003.TMP\1kA40ES0.exe

      Filesize

      232KB

      MD5

      3ff825411b1fe07e712a5dcae34f80eb

      SHA1

      e3e4358cabfa74d6e36e26754b01ed78434a6877

      SHA256

      69bba958a5dcd8650921b25d978c4847819eb83adc143ba2bd396811d7d73739

      SHA512

      325c098b5a0a0ffee16a6074616126f9f4c7930b74507d38c63a294f659ab26fe1674af85a8ff495bd268aa821cc9d85f80f11ab1e7f828015920220e456ab81

    • \Users\Admin\AppData\Local\Temp\IXP003.TMP\1kA40ES0.exe

      Filesize

      232KB

      MD5

      3ff825411b1fe07e712a5dcae34f80eb

      SHA1

      e3e4358cabfa74d6e36e26754b01ed78434a6877

      SHA256

      69bba958a5dcd8650921b25d978c4847819eb83adc143ba2bd396811d7d73739

      SHA512

      325c098b5a0a0ffee16a6074616126f9f4c7930b74507d38c63a294f659ab26fe1674af85a8ff495bd268aa821cc9d85f80f11ab1e7f828015920220e456ab81

    • \Users\Admin\AppData\Local\Temp\IXP003.TMP\1kA40ES0.exe

      Filesize

      232KB

      MD5

      3ff825411b1fe07e712a5dcae34f80eb

      SHA1

      e3e4358cabfa74d6e36e26754b01ed78434a6877

      SHA256

      69bba958a5dcd8650921b25d978c4847819eb83adc143ba2bd396811d7d73739

      SHA512

      325c098b5a0a0ffee16a6074616126f9f4c7930b74507d38c63a294f659ab26fe1674af85a8ff495bd268aa821cc9d85f80f11ab1e7f828015920220e456ab81

    • memory/2600-42-0x0000000000400000-0x000000000040A000-memory.dmp

      Filesize

      40KB

    • memory/2600-45-0x0000000000400000-0x000000000040A000-memory.dmp

      Filesize

      40KB

    • memory/2600-47-0x0000000000400000-0x000000000040A000-memory.dmp

      Filesize

      40KB

    • memory/2600-49-0x0000000000400000-0x000000000040A000-memory.dmp

      Filesize

      40KB

    • memory/2600-40-0x0000000000400000-0x000000000040A000-memory.dmp

      Filesize

      40KB

    • memory/2600-41-0x0000000000400000-0x000000000040A000-memory.dmp

      Filesize

      40KB

    • memory/2600-44-0x00000000FFFDE000-0x00000000FFFDF000-memory.dmp

      Filesize

      4KB

    • memory/2600-43-0x0000000000400000-0x000000000040A000-memory.dmp

      Filesize

      40KB

    We care about your privacy.

    This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.