Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
120s -
max time network
134s -
platform
windows7_x64 -
resource
win7-20230831-en -
resource tags
arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system -
submitted
15/10/2023, 19:39
Static task
static1
Behavioral task
behavioral1
Sample
6945b1b6375202378fe90f17235f0d00_exe32.exe
Resource
win7-20230831-en
Behavioral task
behavioral2
Sample
6945b1b6375202378fe90f17235f0d00_exe32.exe
Resource
win10v2004-20230915-en
General
-
Target
6945b1b6375202378fe90f17235f0d00_exe32.exe
-
Size
1.1MB
-
MD5
6945b1b6375202378fe90f17235f0d00
-
SHA1
ac27b9609a00c94dce5129eaa8c65eacb899e984
-
SHA256
569a977023b8a9fb2fa761343ff88f7091a2ebef77293d0333a91a12e1225448
-
SHA512
13e5744c37c7dddfcd564b2b83c5c75b47e05f2a530d37b9291f80f8e2a235bcbf0b344a4497c039f5e04db4ffac8007f47d4cb9afedb825b17e176c7bde16d2
-
SSDEEP
24576:pyaf7VikDptRWix52Fw/gn0u2c2eXOtPbEMbkZy9VuK:caf7V7Rnx52Fw/HcjetPvkZy9
Malware Config
Signatures
-
Executes dropped EXE 3 IoCs
pid Process 2884 nw5BF3hd.exe 2620 ZS7rH5GF.exe 2744 1av56uC0.exe -
Loads dropped DLL 11 IoCs
pid Process 2080 6945b1b6375202378fe90f17235f0d00_exe32.exe 2884 nw5BF3hd.exe 2884 nw5BF3hd.exe 2620 ZS7rH5GF.exe 2620 ZS7rH5GF.exe 2620 ZS7rH5GF.exe 2744 1av56uC0.exe 2780 WerFault.exe 2780 WerFault.exe 2780 WerFault.exe 2780 WerFault.exe -
Adds Run key to start application 2 TTPs 3 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" 6945b1b6375202378fe90f17235f0d00_exe32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" nw5BF3hd.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\"" ZS7rH5GF.exe -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 2744 set thread context of 2612 2744 1av56uC0.exe 32 -
Program crash 2 IoCs
pid pid_target Process procid_target 2780 2744 WerFault.exe 30 2956 2612 WerFault.exe 32 -
Suspicious use of WriteProcessMemory 49 IoCs
description pid Process procid_target PID 2080 wrote to memory of 2884 2080 6945b1b6375202378fe90f17235f0d00_exe32.exe 28 PID 2080 wrote to memory of 2884 2080 6945b1b6375202378fe90f17235f0d00_exe32.exe 28 PID 2080 wrote to memory of 2884 2080 6945b1b6375202378fe90f17235f0d00_exe32.exe 28 PID 2080 wrote to memory of 2884 2080 6945b1b6375202378fe90f17235f0d00_exe32.exe 28 PID 2080 wrote to memory of 2884 2080 6945b1b6375202378fe90f17235f0d00_exe32.exe 28 PID 2080 wrote to memory of 2884 2080 6945b1b6375202378fe90f17235f0d00_exe32.exe 28 PID 2080 wrote to memory of 2884 2080 6945b1b6375202378fe90f17235f0d00_exe32.exe 28 PID 2884 wrote to memory of 2620 2884 nw5BF3hd.exe 29 PID 2884 wrote to memory of 2620 2884 nw5BF3hd.exe 29 PID 2884 wrote to memory of 2620 2884 nw5BF3hd.exe 29 PID 2884 wrote to memory of 2620 2884 nw5BF3hd.exe 29 PID 2884 wrote to memory of 2620 2884 nw5BF3hd.exe 29 PID 2884 wrote to memory of 2620 2884 nw5BF3hd.exe 29 PID 2884 wrote to memory of 2620 2884 nw5BF3hd.exe 29 PID 2620 wrote to memory of 2744 2620 ZS7rH5GF.exe 30 PID 2620 wrote to memory of 2744 2620 ZS7rH5GF.exe 30 PID 2620 wrote to memory of 2744 2620 ZS7rH5GF.exe 30 PID 2620 wrote to memory of 2744 2620 ZS7rH5GF.exe 30 PID 2620 wrote to memory of 2744 2620 ZS7rH5GF.exe 30 PID 2620 wrote to memory of 2744 2620 ZS7rH5GF.exe 30 PID 2620 wrote to memory of 2744 2620 ZS7rH5GF.exe 30 PID 2744 wrote to memory of 2612 2744 1av56uC0.exe 32 PID 2744 wrote to memory of 2612 2744 1av56uC0.exe 32 PID 2744 wrote to memory of 2612 2744 1av56uC0.exe 32 PID 2744 wrote to memory of 2612 2744 1av56uC0.exe 32 PID 2744 wrote to memory of 2612 2744 1av56uC0.exe 32 PID 2744 wrote to memory of 2612 2744 1av56uC0.exe 32 PID 2744 wrote to memory of 2612 2744 1av56uC0.exe 32 PID 2744 wrote to memory of 2612 2744 1av56uC0.exe 32 PID 2744 wrote to memory of 2612 2744 1av56uC0.exe 32 PID 2744 wrote to memory of 2612 2744 1av56uC0.exe 32 PID 2744 wrote to memory of 2612 2744 1av56uC0.exe 32 PID 2744 wrote to memory of 2612 2744 1av56uC0.exe 32 PID 2744 wrote to memory of 2612 2744 1av56uC0.exe 32 PID 2744 wrote to memory of 2612 2744 1av56uC0.exe 32 PID 2612 wrote to memory of 2956 2612 AppLaunch.exe 34 PID 2612 wrote to memory of 2956 2612 AppLaunch.exe 34 PID 2612 wrote to memory of 2956 2612 AppLaunch.exe 34 PID 2612 wrote to memory of 2956 2612 AppLaunch.exe 34 PID 2612 wrote to memory of 2956 2612 AppLaunch.exe 34 PID 2612 wrote to memory of 2956 2612 AppLaunch.exe 34 PID 2612 wrote to memory of 2956 2612 AppLaunch.exe 34 PID 2744 wrote to memory of 2780 2744 1av56uC0.exe 33 PID 2744 wrote to memory of 2780 2744 1av56uC0.exe 33 PID 2744 wrote to memory of 2780 2744 1av56uC0.exe 33 PID 2744 wrote to memory of 2780 2744 1av56uC0.exe 33 PID 2744 wrote to memory of 2780 2744 1av56uC0.exe 33 PID 2744 wrote to memory of 2780 2744 1av56uC0.exe 33 PID 2744 wrote to memory of 2780 2744 1av56uC0.exe 33
Processes
-
C:\Users\Admin\AppData\Local\Temp\6945b1b6375202378fe90f17235f0d00_exe32.exe"C:\Users\Admin\AppData\Local\Temp\6945b1b6375202378fe90f17235f0d00_exe32.exe"1⤵
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:2080 -
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\nw5BF3hd.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\nw5BF3hd.exe2⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:2884 -
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\ZS7rH5GF.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\ZS7rH5GF.exe3⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:2620 -
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\1av56uC0.exeC:\Users\Admin\AppData\Local\Temp\IXP002.TMP\1av56uC0.exe4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2744 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"5⤵
- Suspicious use of WriteProcessMemory
PID:2612 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2612 -s 2686⤵
- Program crash
PID:2956
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2744 -s 2685⤵
- Loads dropped DLL
- Program crash
PID:2780
-
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
756KB
MD5fa67733ffa94b522eec9f6e3cb74f9d6
SHA18a850c8cb7e30a3da2d8f7e6527c1319462c4719
SHA256749e93ebcfbf952d9015e97ed04937d914b4914391d444dbb907da2106e19d0e
SHA5120ad27936eaa008c26e3b2b40cf10db42b6cda5a64e55f9d7b839841298288a9f72a5d7817b97c101f55decb24512ca1974ab9b43ef2ccf307c8e3ca5a1de761b
-
Filesize
756KB
MD5fa67733ffa94b522eec9f6e3cb74f9d6
SHA18a850c8cb7e30a3da2d8f7e6527c1319462c4719
SHA256749e93ebcfbf952d9015e97ed04937d914b4914391d444dbb907da2106e19d0e
SHA5120ad27936eaa008c26e3b2b40cf10db42b6cda5a64e55f9d7b839841298288a9f72a5d7817b97c101f55decb24512ca1974ab9b43ef2ccf307c8e3ca5a1de761b
-
Filesize
560KB
MD578f1a4e7e93b6bcc05522c76960271cf
SHA116e4b88908c839c8d7dafc95aa97d134430c7372
SHA2569cfb07582c30f49e7d17307a4d8bd24e1b4b0c40b5c5f7d3d4bb50978899126e
SHA5125bf20696857e8d688ce1e70f0792414fbc3c689c3e4e1cdadb847fe7a47a808c2d1c81ab87b8e909c3f64c2ef0b6cbc6e4b79f535419aba7160f92fda96cb6e0
-
Filesize
560KB
MD578f1a4e7e93b6bcc05522c76960271cf
SHA116e4b88908c839c8d7dafc95aa97d134430c7372
SHA2569cfb07582c30f49e7d17307a4d8bd24e1b4b0c40b5c5f7d3d4bb50978899126e
SHA5125bf20696857e8d688ce1e70f0792414fbc3c689c3e4e1cdadb847fe7a47a808c2d1c81ab87b8e909c3f64c2ef0b6cbc6e4b79f535419aba7160f92fda96cb6e0
-
Filesize
1.1MB
MD5b971f0f56bd340686837930eaf95030c
SHA1e4ba997e3b16e78c97ff12a4f82dbff006f09416
SHA256ffe53ae729ffb95531892df64543d3d81dd775cc2159c2743b15b461955aaa5a
SHA512be08841316e7145e75a975e358c5880923571562de50f9f24e67c80553f9072b782baae15b8504de4fa7aff725bb1e4dfa8d982c10fbba95ec61657243c7ffdf
-
Filesize
1.1MB
MD5b971f0f56bd340686837930eaf95030c
SHA1e4ba997e3b16e78c97ff12a4f82dbff006f09416
SHA256ffe53ae729ffb95531892df64543d3d81dd775cc2159c2743b15b461955aaa5a
SHA512be08841316e7145e75a975e358c5880923571562de50f9f24e67c80553f9072b782baae15b8504de4fa7aff725bb1e4dfa8d982c10fbba95ec61657243c7ffdf
-
Filesize
1.1MB
MD5b971f0f56bd340686837930eaf95030c
SHA1e4ba997e3b16e78c97ff12a4f82dbff006f09416
SHA256ffe53ae729ffb95531892df64543d3d81dd775cc2159c2743b15b461955aaa5a
SHA512be08841316e7145e75a975e358c5880923571562de50f9f24e67c80553f9072b782baae15b8504de4fa7aff725bb1e4dfa8d982c10fbba95ec61657243c7ffdf
-
Filesize
756KB
MD5fa67733ffa94b522eec9f6e3cb74f9d6
SHA18a850c8cb7e30a3da2d8f7e6527c1319462c4719
SHA256749e93ebcfbf952d9015e97ed04937d914b4914391d444dbb907da2106e19d0e
SHA5120ad27936eaa008c26e3b2b40cf10db42b6cda5a64e55f9d7b839841298288a9f72a5d7817b97c101f55decb24512ca1974ab9b43ef2ccf307c8e3ca5a1de761b
-
Filesize
756KB
MD5fa67733ffa94b522eec9f6e3cb74f9d6
SHA18a850c8cb7e30a3da2d8f7e6527c1319462c4719
SHA256749e93ebcfbf952d9015e97ed04937d914b4914391d444dbb907da2106e19d0e
SHA5120ad27936eaa008c26e3b2b40cf10db42b6cda5a64e55f9d7b839841298288a9f72a5d7817b97c101f55decb24512ca1974ab9b43ef2ccf307c8e3ca5a1de761b
-
Filesize
560KB
MD578f1a4e7e93b6bcc05522c76960271cf
SHA116e4b88908c839c8d7dafc95aa97d134430c7372
SHA2569cfb07582c30f49e7d17307a4d8bd24e1b4b0c40b5c5f7d3d4bb50978899126e
SHA5125bf20696857e8d688ce1e70f0792414fbc3c689c3e4e1cdadb847fe7a47a808c2d1c81ab87b8e909c3f64c2ef0b6cbc6e4b79f535419aba7160f92fda96cb6e0
-
Filesize
560KB
MD578f1a4e7e93b6bcc05522c76960271cf
SHA116e4b88908c839c8d7dafc95aa97d134430c7372
SHA2569cfb07582c30f49e7d17307a4d8bd24e1b4b0c40b5c5f7d3d4bb50978899126e
SHA5125bf20696857e8d688ce1e70f0792414fbc3c689c3e4e1cdadb847fe7a47a808c2d1c81ab87b8e909c3f64c2ef0b6cbc6e4b79f535419aba7160f92fda96cb6e0
-
Filesize
1.1MB
MD5b971f0f56bd340686837930eaf95030c
SHA1e4ba997e3b16e78c97ff12a4f82dbff006f09416
SHA256ffe53ae729ffb95531892df64543d3d81dd775cc2159c2743b15b461955aaa5a
SHA512be08841316e7145e75a975e358c5880923571562de50f9f24e67c80553f9072b782baae15b8504de4fa7aff725bb1e4dfa8d982c10fbba95ec61657243c7ffdf
-
Filesize
1.1MB
MD5b971f0f56bd340686837930eaf95030c
SHA1e4ba997e3b16e78c97ff12a4f82dbff006f09416
SHA256ffe53ae729ffb95531892df64543d3d81dd775cc2159c2743b15b461955aaa5a
SHA512be08841316e7145e75a975e358c5880923571562de50f9f24e67c80553f9072b782baae15b8504de4fa7aff725bb1e4dfa8d982c10fbba95ec61657243c7ffdf
-
Filesize
1.1MB
MD5b971f0f56bd340686837930eaf95030c
SHA1e4ba997e3b16e78c97ff12a4f82dbff006f09416
SHA256ffe53ae729ffb95531892df64543d3d81dd775cc2159c2743b15b461955aaa5a
SHA512be08841316e7145e75a975e358c5880923571562de50f9f24e67c80553f9072b782baae15b8504de4fa7aff725bb1e4dfa8d982c10fbba95ec61657243c7ffdf
-
Filesize
1.1MB
MD5b971f0f56bd340686837930eaf95030c
SHA1e4ba997e3b16e78c97ff12a4f82dbff006f09416
SHA256ffe53ae729ffb95531892df64543d3d81dd775cc2159c2743b15b461955aaa5a
SHA512be08841316e7145e75a975e358c5880923571562de50f9f24e67c80553f9072b782baae15b8504de4fa7aff725bb1e4dfa8d982c10fbba95ec61657243c7ffdf
-
Filesize
1.1MB
MD5b971f0f56bd340686837930eaf95030c
SHA1e4ba997e3b16e78c97ff12a4f82dbff006f09416
SHA256ffe53ae729ffb95531892df64543d3d81dd775cc2159c2743b15b461955aaa5a
SHA512be08841316e7145e75a975e358c5880923571562de50f9f24e67c80553f9072b782baae15b8504de4fa7aff725bb1e4dfa8d982c10fbba95ec61657243c7ffdf
-
Filesize
1.1MB
MD5b971f0f56bd340686837930eaf95030c
SHA1e4ba997e3b16e78c97ff12a4f82dbff006f09416
SHA256ffe53ae729ffb95531892df64543d3d81dd775cc2159c2743b15b461955aaa5a
SHA512be08841316e7145e75a975e358c5880923571562de50f9f24e67c80553f9072b782baae15b8504de4fa7aff725bb1e4dfa8d982c10fbba95ec61657243c7ffdf
-
Filesize
1.1MB
MD5b971f0f56bd340686837930eaf95030c
SHA1e4ba997e3b16e78c97ff12a4f82dbff006f09416
SHA256ffe53ae729ffb95531892df64543d3d81dd775cc2159c2743b15b461955aaa5a
SHA512be08841316e7145e75a975e358c5880923571562de50f9f24e67c80553f9072b782baae15b8504de4fa7aff725bb1e4dfa8d982c10fbba95ec61657243c7ffdf