Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
120s -
max time network
127s -
platform
windows7_x64 -
resource
win7-20230831-en -
resource tags
arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system -
submitted
14/10/2023, 09:45
Static task
static1
Behavioral task
behavioral1
Sample
NEAS.583649b39e2ee7498b1861146378715d766af2b82c5fbdcc8ec0446ab32838b6exe_JC.exe
Resource
win7-20230831-en
Behavioral task
behavioral2
Sample
NEAS.583649b39e2ee7498b1861146378715d766af2b82c5fbdcc8ec0446ab32838b6exe_JC.exe
Resource
win10v2004-20230915-en
General
-
Target
NEAS.583649b39e2ee7498b1861146378715d766af2b82c5fbdcc8ec0446ab32838b6exe_JC.exe
-
Size
1.2MB
-
MD5
3b22489224edd6d7024720e6456ebd97
-
SHA1
391b470273d55f5d9a4712d4897bc3cffa1a981b
-
SHA256
583649b39e2ee7498b1861146378715d766af2b82c5fbdcc8ec0446ab32838b6
-
SHA512
bf1da24cca68260a3f67fc756dffe6e70584f0ba472a0716982ce5e0c0498fffd90a95602fb1c50fe0083108c0711c22c5ed3dfd4958e6ab9d4542c3786a7c89
-
SSDEEP
24576:4yjKDbjv5EjHzCRPK7Vm3i+r7cyrFKRncNvmnuhBv1gSzWVQpEAlaI5z:/jGQTCtUVI9r7cyBKRcNvouhBv1gTVQ5
Malware Config
Signatures
-
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" AppLaunch.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" AppLaunch.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" AppLaunch.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" AppLaunch.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" AppLaunch.exe Key created \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection AppLaunch.exe -
Executes dropped EXE 4 IoCs
pid Process 2088 Eq1hr92.exe 2164 Zi4fT07.exe 2744 pN2fB73.exe 2472 1Lm04yF8.exe -
Loads dropped DLL 12 IoCs
pid Process 1952 NEAS.583649b39e2ee7498b1861146378715d766af2b82c5fbdcc8ec0446ab32838b6exe_JC.exe 2088 Eq1hr92.exe 2088 Eq1hr92.exe 2164 Zi4fT07.exe 2164 Zi4fT07.exe 2744 pN2fB73.exe 2744 pN2fB73.exe 2472 1Lm04yF8.exe 2656 WerFault.exe 2656 WerFault.exe 2656 WerFault.exe 2656 WerFault.exe -
Adds Run key to start application 2 TTPs 4 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" NEAS.583649b39e2ee7498b1861146378715d766af2b82c5fbdcc8ec0446ab32838b6exe_JC.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" Eq1hr92.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\"" Zi4fT07.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup3 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP003.TMP\\\"" pN2fB73.exe -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 2472 set thread context of 2504 2472 1Lm04yF8.exe 32 -
Program crash 1 IoCs
pid pid_target Process procid_target 2656 2472 WerFault.exe 31 -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 2504 AppLaunch.exe 2504 AppLaunch.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 2504 AppLaunch.exe -
Suspicious use of WriteProcessMemory 47 IoCs
description pid Process procid_target PID 1952 wrote to memory of 2088 1952 NEAS.583649b39e2ee7498b1861146378715d766af2b82c5fbdcc8ec0446ab32838b6exe_JC.exe 28 PID 1952 wrote to memory of 2088 1952 NEAS.583649b39e2ee7498b1861146378715d766af2b82c5fbdcc8ec0446ab32838b6exe_JC.exe 28 PID 1952 wrote to memory of 2088 1952 NEAS.583649b39e2ee7498b1861146378715d766af2b82c5fbdcc8ec0446ab32838b6exe_JC.exe 28 PID 1952 wrote to memory of 2088 1952 NEAS.583649b39e2ee7498b1861146378715d766af2b82c5fbdcc8ec0446ab32838b6exe_JC.exe 28 PID 1952 wrote to memory of 2088 1952 NEAS.583649b39e2ee7498b1861146378715d766af2b82c5fbdcc8ec0446ab32838b6exe_JC.exe 28 PID 1952 wrote to memory of 2088 1952 NEAS.583649b39e2ee7498b1861146378715d766af2b82c5fbdcc8ec0446ab32838b6exe_JC.exe 28 PID 1952 wrote to memory of 2088 1952 NEAS.583649b39e2ee7498b1861146378715d766af2b82c5fbdcc8ec0446ab32838b6exe_JC.exe 28 PID 2088 wrote to memory of 2164 2088 Eq1hr92.exe 29 PID 2088 wrote to memory of 2164 2088 Eq1hr92.exe 29 PID 2088 wrote to memory of 2164 2088 Eq1hr92.exe 29 PID 2088 wrote to memory of 2164 2088 Eq1hr92.exe 29 PID 2088 wrote to memory of 2164 2088 Eq1hr92.exe 29 PID 2088 wrote to memory of 2164 2088 Eq1hr92.exe 29 PID 2088 wrote to memory of 2164 2088 Eq1hr92.exe 29 PID 2164 wrote to memory of 2744 2164 Zi4fT07.exe 30 PID 2164 wrote to memory of 2744 2164 Zi4fT07.exe 30 PID 2164 wrote to memory of 2744 2164 Zi4fT07.exe 30 PID 2164 wrote to memory of 2744 2164 Zi4fT07.exe 30 PID 2164 wrote to memory of 2744 2164 Zi4fT07.exe 30 PID 2164 wrote to memory of 2744 2164 Zi4fT07.exe 30 PID 2164 wrote to memory of 2744 2164 Zi4fT07.exe 30 PID 2744 wrote to memory of 2472 2744 pN2fB73.exe 31 PID 2744 wrote to memory of 2472 2744 pN2fB73.exe 31 PID 2744 wrote to memory of 2472 2744 pN2fB73.exe 31 PID 2744 wrote to memory of 2472 2744 pN2fB73.exe 31 PID 2744 wrote to memory of 2472 2744 pN2fB73.exe 31 PID 2744 wrote to memory of 2472 2744 pN2fB73.exe 31 PID 2744 wrote to memory of 2472 2744 pN2fB73.exe 31 PID 2472 wrote to memory of 2504 2472 1Lm04yF8.exe 32 PID 2472 wrote to memory of 2504 2472 1Lm04yF8.exe 32 PID 2472 wrote to memory of 2504 2472 1Lm04yF8.exe 32 PID 2472 wrote to memory of 2504 2472 1Lm04yF8.exe 32 PID 2472 wrote to memory of 2504 2472 1Lm04yF8.exe 32 PID 2472 wrote to memory of 2504 2472 1Lm04yF8.exe 32 PID 2472 wrote to memory of 2504 2472 1Lm04yF8.exe 32 PID 2472 wrote to memory of 2504 2472 1Lm04yF8.exe 32 PID 2472 wrote to memory of 2504 2472 1Lm04yF8.exe 32 PID 2472 wrote to memory of 2504 2472 1Lm04yF8.exe 32 PID 2472 wrote to memory of 2504 2472 1Lm04yF8.exe 32 PID 2472 wrote to memory of 2504 2472 1Lm04yF8.exe 32 PID 2472 wrote to memory of 2656 2472 1Lm04yF8.exe 33 PID 2472 wrote to memory of 2656 2472 1Lm04yF8.exe 33 PID 2472 wrote to memory of 2656 2472 1Lm04yF8.exe 33 PID 2472 wrote to memory of 2656 2472 1Lm04yF8.exe 33 PID 2472 wrote to memory of 2656 2472 1Lm04yF8.exe 33 PID 2472 wrote to memory of 2656 2472 1Lm04yF8.exe 33 PID 2472 wrote to memory of 2656 2472 1Lm04yF8.exe 33
Processes
-
C:\Users\Admin\AppData\Local\Temp\NEAS.583649b39e2ee7498b1861146378715d766af2b82c5fbdcc8ec0446ab32838b6exe_JC.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.583649b39e2ee7498b1861146378715d766af2b82c5fbdcc8ec0446ab32838b6exe_JC.exe"1⤵
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:1952 -
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Eq1hr92.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Eq1hr92.exe2⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:2088 -
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\Zi4fT07.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\Zi4fT07.exe3⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:2164 -
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\pN2fB73.exeC:\Users\Admin\AppData\Local\Temp\IXP002.TMP\pN2fB73.exe4⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:2744 -
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\1Lm04yF8.exeC:\Users\Admin\AppData\Local\Temp\IXP003.TMP\1Lm04yF8.exe5⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2472 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"6⤵
- Modifies Windows Defender Real-time Protection settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2504
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2472 -s 2726⤵
- Loads dropped DLL
- Program crash
PID:2656
-
-
-
-
-
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.1MB
MD5ef923a5293dace63ba8cee2c2de28634
SHA18a7e7a1264ef24808f6545c8f393ef9971539fe5
SHA2561381a20416bee23d5e78a3fea31addbe3feeb72208e2890df21fe2f385fcfc6c
SHA5129956fba6d56e75ea37a2de6c112fe539945c121337cf9dcf577da6ddb342a85476decba91a182843988761945eae877e31b9ad52b5708a42b3ac1ef8dc61d32a
-
Filesize
1.1MB
MD5ef923a5293dace63ba8cee2c2de28634
SHA18a7e7a1264ef24808f6545c8f393ef9971539fe5
SHA2561381a20416bee23d5e78a3fea31addbe3feeb72208e2890df21fe2f385fcfc6c
SHA5129956fba6d56e75ea37a2de6c112fe539945c121337cf9dcf577da6ddb342a85476decba91a182843988761945eae877e31b9ad52b5708a42b3ac1ef8dc61d32a
-
Filesize
691KB
MD512b8ee93cc600a1b0b1b94acfad2d103
SHA17d8394d08261bb6122b4d4259d3a130447ba0589
SHA25677e2504793c044f691d3de3b69e0a106661c9f6ae0fbd7fc6d50e7fd03f52fd1
SHA512ee583733c34989378f1e01eaa3803976a172b0d3e00419f21b79e1a1c361f688297eca7d26933f5d8c571c11a217c7bf7412f5b8905c73d4b479f84c87ac7c46
-
Filesize
691KB
MD512b8ee93cc600a1b0b1b94acfad2d103
SHA17d8394d08261bb6122b4d4259d3a130447ba0589
SHA25677e2504793c044f691d3de3b69e0a106661c9f6ae0fbd7fc6d50e7fd03f52fd1
SHA512ee583733c34989378f1e01eaa3803976a172b0d3e00419f21b79e1a1c361f688297eca7d26933f5d8c571c11a217c7bf7412f5b8905c73d4b479f84c87ac7c46
-
Filesize
330KB
MD52af1d6d96a76250e1e83a14a3b75b21f
SHA10806696496dc36a928caf2518fdc38355aaae748
SHA2560dcb0dcf127cd6c711064b8d01d1171a54e35a8c2a6bf50212040656ccca0e79
SHA512ae4282d55f5cde7c39984b347bfe49353f17081893264d78acb039c349133b3735ff31b1b2036d4aa5c246d5baa9bde7011e350fabe2f3c0955183177c26578e
-
Filesize
330KB
MD52af1d6d96a76250e1e83a14a3b75b21f
SHA10806696496dc36a928caf2518fdc38355aaae748
SHA2560dcb0dcf127cd6c711064b8d01d1171a54e35a8c2a6bf50212040656ccca0e79
SHA512ae4282d55f5cde7c39984b347bfe49353f17081893264d78acb039c349133b3735ff31b1b2036d4aa5c246d5baa9bde7011e350fabe2f3c0955183177c26578e
-
Filesize
232KB
MD53ff825411b1fe07e712a5dcae34f80eb
SHA1e3e4358cabfa74d6e36e26754b01ed78434a6877
SHA25669bba958a5dcd8650921b25d978c4847819eb83adc143ba2bd396811d7d73739
SHA512325c098b5a0a0ffee16a6074616126f9f4c7930b74507d38c63a294f659ab26fe1674af85a8ff495bd268aa821cc9d85f80f11ab1e7f828015920220e456ab81
-
Filesize
232KB
MD53ff825411b1fe07e712a5dcae34f80eb
SHA1e3e4358cabfa74d6e36e26754b01ed78434a6877
SHA25669bba958a5dcd8650921b25d978c4847819eb83adc143ba2bd396811d7d73739
SHA512325c098b5a0a0ffee16a6074616126f9f4c7930b74507d38c63a294f659ab26fe1674af85a8ff495bd268aa821cc9d85f80f11ab1e7f828015920220e456ab81
-
Filesize
1.1MB
MD5ef923a5293dace63ba8cee2c2de28634
SHA18a7e7a1264ef24808f6545c8f393ef9971539fe5
SHA2561381a20416bee23d5e78a3fea31addbe3feeb72208e2890df21fe2f385fcfc6c
SHA5129956fba6d56e75ea37a2de6c112fe539945c121337cf9dcf577da6ddb342a85476decba91a182843988761945eae877e31b9ad52b5708a42b3ac1ef8dc61d32a
-
Filesize
1.1MB
MD5ef923a5293dace63ba8cee2c2de28634
SHA18a7e7a1264ef24808f6545c8f393ef9971539fe5
SHA2561381a20416bee23d5e78a3fea31addbe3feeb72208e2890df21fe2f385fcfc6c
SHA5129956fba6d56e75ea37a2de6c112fe539945c121337cf9dcf577da6ddb342a85476decba91a182843988761945eae877e31b9ad52b5708a42b3ac1ef8dc61d32a
-
Filesize
691KB
MD512b8ee93cc600a1b0b1b94acfad2d103
SHA17d8394d08261bb6122b4d4259d3a130447ba0589
SHA25677e2504793c044f691d3de3b69e0a106661c9f6ae0fbd7fc6d50e7fd03f52fd1
SHA512ee583733c34989378f1e01eaa3803976a172b0d3e00419f21b79e1a1c361f688297eca7d26933f5d8c571c11a217c7bf7412f5b8905c73d4b479f84c87ac7c46
-
Filesize
691KB
MD512b8ee93cc600a1b0b1b94acfad2d103
SHA17d8394d08261bb6122b4d4259d3a130447ba0589
SHA25677e2504793c044f691d3de3b69e0a106661c9f6ae0fbd7fc6d50e7fd03f52fd1
SHA512ee583733c34989378f1e01eaa3803976a172b0d3e00419f21b79e1a1c361f688297eca7d26933f5d8c571c11a217c7bf7412f5b8905c73d4b479f84c87ac7c46
-
Filesize
330KB
MD52af1d6d96a76250e1e83a14a3b75b21f
SHA10806696496dc36a928caf2518fdc38355aaae748
SHA2560dcb0dcf127cd6c711064b8d01d1171a54e35a8c2a6bf50212040656ccca0e79
SHA512ae4282d55f5cde7c39984b347bfe49353f17081893264d78acb039c349133b3735ff31b1b2036d4aa5c246d5baa9bde7011e350fabe2f3c0955183177c26578e
-
Filesize
330KB
MD52af1d6d96a76250e1e83a14a3b75b21f
SHA10806696496dc36a928caf2518fdc38355aaae748
SHA2560dcb0dcf127cd6c711064b8d01d1171a54e35a8c2a6bf50212040656ccca0e79
SHA512ae4282d55f5cde7c39984b347bfe49353f17081893264d78acb039c349133b3735ff31b1b2036d4aa5c246d5baa9bde7011e350fabe2f3c0955183177c26578e
-
Filesize
232KB
MD53ff825411b1fe07e712a5dcae34f80eb
SHA1e3e4358cabfa74d6e36e26754b01ed78434a6877
SHA25669bba958a5dcd8650921b25d978c4847819eb83adc143ba2bd396811d7d73739
SHA512325c098b5a0a0ffee16a6074616126f9f4c7930b74507d38c63a294f659ab26fe1674af85a8ff495bd268aa821cc9d85f80f11ab1e7f828015920220e456ab81
-
Filesize
232KB
MD53ff825411b1fe07e712a5dcae34f80eb
SHA1e3e4358cabfa74d6e36e26754b01ed78434a6877
SHA25669bba958a5dcd8650921b25d978c4847819eb83adc143ba2bd396811d7d73739
SHA512325c098b5a0a0ffee16a6074616126f9f4c7930b74507d38c63a294f659ab26fe1674af85a8ff495bd268aa821cc9d85f80f11ab1e7f828015920220e456ab81
-
Filesize
232KB
MD53ff825411b1fe07e712a5dcae34f80eb
SHA1e3e4358cabfa74d6e36e26754b01ed78434a6877
SHA25669bba958a5dcd8650921b25d978c4847819eb83adc143ba2bd396811d7d73739
SHA512325c098b5a0a0ffee16a6074616126f9f4c7930b74507d38c63a294f659ab26fe1674af85a8ff495bd268aa821cc9d85f80f11ab1e7f828015920220e456ab81
-
Filesize
232KB
MD53ff825411b1fe07e712a5dcae34f80eb
SHA1e3e4358cabfa74d6e36e26754b01ed78434a6877
SHA25669bba958a5dcd8650921b25d978c4847819eb83adc143ba2bd396811d7d73739
SHA512325c098b5a0a0ffee16a6074616126f9f4c7930b74507d38c63a294f659ab26fe1674af85a8ff495bd268aa821cc9d85f80f11ab1e7f828015920220e456ab81
-
Filesize
232KB
MD53ff825411b1fe07e712a5dcae34f80eb
SHA1e3e4358cabfa74d6e36e26754b01ed78434a6877
SHA25669bba958a5dcd8650921b25d978c4847819eb83adc143ba2bd396811d7d73739
SHA512325c098b5a0a0ffee16a6074616126f9f4c7930b74507d38c63a294f659ab26fe1674af85a8ff495bd268aa821cc9d85f80f11ab1e7f828015920220e456ab81
-
Filesize
232KB
MD53ff825411b1fe07e712a5dcae34f80eb
SHA1e3e4358cabfa74d6e36e26754b01ed78434a6877
SHA25669bba958a5dcd8650921b25d978c4847819eb83adc143ba2bd396811d7d73739
SHA512325c098b5a0a0ffee16a6074616126f9f4c7930b74507d38c63a294f659ab26fe1674af85a8ff495bd268aa821cc9d85f80f11ab1e7f828015920220e456ab81