Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    122s
  • max time network
    126s
  • platform
    windows7_x64
  • resource
    win7-20230831-en
  • resource tags

    arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
  • submitted
    16/10/2023, 14:10

General

  • Target

    378709e6dfa1907262b83a223469bacd2ab5329c2e900e9862c9395d2aacdfee.exe

  • Size

    1.1MB

  • MD5

    d918302eff427b8528fd85a110d07b8d

  • SHA1

    6deb85ef73bf026ff2c1d66c894bcec64e77f9f1

  • SHA256

    378709e6dfa1907262b83a223469bacd2ab5329c2e900e9862c9395d2aacdfee

  • SHA512

    1e5c24b378548cf3d8c0e4287810894bd4f9f732bb03f9c7d2ff1ba412ef87a7d10f91c13a37d1470f6ed00acf8206b5c8494a4249c4285220af9714bc7f22bb

  • SSDEEP

    24576:lyGtE8WqWdT5Svlhkwvlipc4lrnR/1oejn18s:AGtEzbMlj9iJt1Vy

Score
7/10

Malware Config

Signatures

  • Executes dropped EXE 5 IoCs
  • Loads dropped DLL 15 IoCs
  • Adds Run key to start application 2 TTPs 5 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Program crash 2 IoCs
  • Suspicious use of WriteProcessMemory 63 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\378709e6dfa1907262b83a223469bacd2ab5329c2e900e9862c9395d2aacdfee.exe
    "C:\Users\Admin\AppData\Local\Temp\378709e6dfa1907262b83a223469bacd2ab5329c2e900e9862c9395d2aacdfee.exe"
    1⤵
    • Loads dropped DLL
    • Adds Run key to start application
    • Suspicious use of WriteProcessMemory
    PID:532
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ac8ud5ka.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ac8ud5ka.exe
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Adds Run key to start application
      • Suspicious use of WriteProcessMemory
      PID:2408
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\Tw4bJ6ed.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\Tw4bJ6ed.exe
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Adds Run key to start application
        • Suspicious use of WriteProcessMemory
        PID:1312
        • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\Bo9ym0Wo.exe
          C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\Bo9ym0Wo.exe
          4⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • Adds Run key to start application
          • Suspicious use of WriteProcessMemory
          PID:2668
          • C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\iT2kf7bs.exe
            C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\iT2kf7bs.exe
            5⤵
            • Executes dropped EXE
            • Loads dropped DLL
            • Adds Run key to start application
            • Suspicious use of WriteProcessMemory
            PID:2144
            • C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\1Au43wY7.exe
              C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\1Au43wY7.exe
              6⤵
              • Executes dropped EXE
              • Loads dropped DLL
              • Suspicious use of SetThreadContext
              • Suspicious use of WriteProcessMemory
              PID:2712
              • C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
                "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
                7⤵
                • Suspicious use of WriteProcessMemory
                PID:2496
                • C:\Windows\SysWOW64\WerFault.exe
                  C:\Windows\SysWOW64\WerFault.exe -u -p 2496 -s 268
                  8⤵
                  • Program crash
                  PID:2932
              • C:\Windows\SysWOW64\WerFault.exe
                C:\Windows\SysWOW64\WerFault.exe -u -p 2712 -s 268
                7⤵
                • Loads dropped DLL
                • Program crash
                PID:2516

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ac8ud5ka.exe

    Filesize

    1001KB

    MD5

    cf7b1cc8bb70b061be6514277dfac1bf

    SHA1

    77350dae7906367bc3552f468fed414366790ded

    SHA256

    a1d7732ab26d244816cbc06d3e1d737ad826da8f4a4ddd6893f0ee3a6926cb80

    SHA512

    c7fe00046fef30b42c4b28b5b9a3ee2dbc31a8e6a563d0098082c86fde1ff1e5f8b0c722247291fc2de1bb543e507837dfd7be7d4e59f35e936be0050f389e7b

  • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ac8ud5ka.exe

    Filesize

    1001KB

    MD5

    cf7b1cc8bb70b061be6514277dfac1bf

    SHA1

    77350dae7906367bc3552f468fed414366790ded

    SHA256

    a1d7732ab26d244816cbc06d3e1d737ad826da8f4a4ddd6893f0ee3a6926cb80

    SHA512

    c7fe00046fef30b42c4b28b5b9a3ee2dbc31a8e6a563d0098082c86fde1ff1e5f8b0c722247291fc2de1bb543e507837dfd7be7d4e59f35e936be0050f389e7b

  • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\Tw4bJ6ed.exe

    Filesize

    811KB

    MD5

    7044b4fc850fea4abc517afa7deec8c5

    SHA1

    171eaf04cae7fbc7ff16558b66f9911576f2dbd5

    SHA256

    5c0363a864a750df5a00cae1e261e580b08f8e3126a2d15d5c4bba882ed72a19

    SHA512

    23ca0c72944fdf0d72f0a75f5aedae5134ffc743247c9bfd4b79568eda2ebbdb6b392f9f29264d742e7db6c8acee2e2d6d9a6c75ee77bc128c953d5e642b4c41

  • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\Tw4bJ6ed.exe

    Filesize

    811KB

    MD5

    7044b4fc850fea4abc517afa7deec8c5

    SHA1

    171eaf04cae7fbc7ff16558b66f9911576f2dbd5

    SHA256

    5c0363a864a750df5a00cae1e261e580b08f8e3126a2d15d5c4bba882ed72a19

    SHA512

    23ca0c72944fdf0d72f0a75f5aedae5134ffc743247c9bfd4b79568eda2ebbdb6b392f9f29264d742e7db6c8acee2e2d6d9a6c75ee77bc128c953d5e642b4c41

  • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\Bo9ym0Wo.exe

    Filesize

    577KB

    MD5

    deecc6d583c6b762fe69b9e7b70ba0d4

    SHA1

    9dee62365e9c7251d30f769d340e41a2d61390fc

    SHA256

    7211e6b3b1c4682d642271623a09acd22f95c23550d1a2de8adcb7539d2b3a7b

    SHA512

    6e204fee2f7ba1fbe416ab7bff08fecf116c7bcaca71d5d0627ce263c4da9cd54c46b8cf60bf7f4b5c182f8f287c26b2fc172d8b9f5617d082ae5936abb42b16

  • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\Bo9ym0Wo.exe

    Filesize

    577KB

    MD5

    deecc6d583c6b762fe69b9e7b70ba0d4

    SHA1

    9dee62365e9c7251d30f769d340e41a2d61390fc

    SHA256

    7211e6b3b1c4682d642271623a09acd22f95c23550d1a2de8adcb7539d2b3a7b

    SHA512

    6e204fee2f7ba1fbe416ab7bff08fecf116c7bcaca71d5d0627ce263c4da9cd54c46b8cf60bf7f4b5c182f8f287c26b2fc172d8b9f5617d082ae5936abb42b16

  • C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\iT2kf7bs.exe

    Filesize

    382KB

    MD5

    2ee0e57bc9caedea3174d94e058874cf

    SHA1

    7e20c5c0b7be85fec4c616766d7f43d234c67620

    SHA256

    45d05dbd7db454815b8b8380b3dfdaed072a2c8a46396755cd98dcb547cf0f16

    SHA512

    73f4b6cd25c2b8105811d98ee06292d134830794033fd816c2729cc1961d2fcfcceaac6d7ba3c4e65e2e148f903dad039a2bc374671d88d9c7b4fca4eada3a2e

  • C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\iT2kf7bs.exe

    Filesize

    382KB

    MD5

    2ee0e57bc9caedea3174d94e058874cf

    SHA1

    7e20c5c0b7be85fec4c616766d7f43d234c67620

    SHA256

    45d05dbd7db454815b8b8380b3dfdaed072a2c8a46396755cd98dcb547cf0f16

    SHA512

    73f4b6cd25c2b8105811d98ee06292d134830794033fd816c2729cc1961d2fcfcceaac6d7ba3c4e65e2e148f903dad039a2bc374671d88d9c7b4fca4eada3a2e

  • C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\1Au43wY7.exe

    Filesize

    295KB

    MD5

    1a98df4e0e91c1ef9db3c683bf614bf6

    SHA1

    1ec6bc54930df4fa3923156e7c26857e702fd050

    SHA256

    a7e2b3a646568868b4716cdb5efa67162fac8e50604d05183e0284e0dd4b2528

    SHA512

    9769b8b8836734b8a67df58461f01628552340d2e483dd9425f117c3140c6ddde7a3b6feb1402d474eb05fa53382c9073d1d6b6b4e3cd745df0bece386c0bc66

  • C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\1Au43wY7.exe

    Filesize

    295KB

    MD5

    1a98df4e0e91c1ef9db3c683bf614bf6

    SHA1

    1ec6bc54930df4fa3923156e7c26857e702fd050

    SHA256

    a7e2b3a646568868b4716cdb5efa67162fac8e50604d05183e0284e0dd4b2528

    SHA512

    9769b8b8836734b8a67df58461f01628552340d2e483dd9425f117c3140c6ddde7a3b6feb1402d474eb05fa53382c9073d1d6b6b4e3cd745df0bece386c0bc66

  • C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\1Au43wY7.exe

    Filesize

    295KB

    MD5

    1a98df4e0e91c1ef9db3c683bf614bf6

    SHA1

    1ec6bc54930df4fa3923156e7c26857e702fd050

    SHA256

    a7e2b3a646568868b4716cdb5efa67162fac8e50604d05183e0284e0dd4b2528

    SHA512

    9769b8b8836734b8a67df58461f01628552340d2e483dd9425f117c3140c6ddde7a3b6feb1402d474eb05fa53382c9073d1d6b6b4e3cd745df0bece386c0bc66

  • \Users\Admin\AppData\Local\Temp\IXP000.TMP\ac8ud5ka.exe

    Filesize

    1001KB

    MD5

    cf7b1cc8bb70b061be6514277dfac1bf

    SHA1

    77350dae7906367bc3552f468fed414366790ded

    SHA256

    a1d7732ab26d244816cbc06d3e1d737ad826da8f4a4ddd6893f0ee3a6926cb80

    SHA512

    c7fe00046fef30b42c4b28b5b9a3ee2dbc31a8e6a563d0098082c86fde1ff1e5f8b0c722247291fc2de1bb543e507837dfd7be7d4e59f35e936be0050f389e7b

  • \Users\Admin\AppData\Local\Temp\IXP000.TMP\ac8ud5ka.exe

    Filesize

    1001KB

    MD5

    cf7b1cc8bb70b061be6514277dfac1bf

    SHA1

    77350dae7906367bc3552f468fed414366790ded

    SHA256

    a1d7732ab26d244816cbc06d3e1d737ad826da8f4a4ddd6893f0ee3a6926cb80

    SHA512

    c7fe00046fef30b42c4b28b5b9a3ee2dbc31a8e6a563d0098082c86fde1ff1e5f8b0c722247291fc2de1bb543e507837dfd7be7d4e59f35e936be0050f389e7b

  • \Users\Admin\AppData\Local\Temp\IXP001.TMP\Tw4bJ6ed.exe

    Filesize

    811KB

    MD5

    7044b4fc850fea4abc517afa7deec8c5

    SHA1

    171eaf04cae7fbc7ff16558b66f9911576f2dbd5

    SHA256

    5c0363a864a750df5a00cae1e261e580b08f8e3126a2d15d5c4bba882ed72a19

    SHA512

    23ca0c72944fdf0d72f0a75f5aedae5134ffc743247c9bfd4b79568eda2ebbdb6b392f9f29264d742e7db6c8acee2e2d6d9a6c75ee77bc128c953d5e642b4c41

  • \Users\Admin\AppData\Local\Temp\IXP001.TMP\Tw4bJ6ed.exe

    Filesize

    811KB

    MD5

    7044b4fc850fea4abc517afa7deec8c5

    SHA1

    171eaf04cae7fbc7ff16558b66f9911576f2dbd5

    SHA256

    5c0363a864a750df5a00cae1e261e580b08f8e3126a2d15d5c4bba882ed72a19

    SHA512

    23ca0c72944fdf0d72f0a75f5aedae5134ffc743247c9bfd4b79568eda2ebbdb6b392f9f29264d742e7db6c8acee2e2d6d9a6c75ee77bc128c953d5e642b4c41

  • \Users\Admin\AppData\Local\Temp\IXP002.TMP\Bo9ym0Wo.exe

    Filesize

    577KB

    MD5

    deecc6d583c6b762fe69b9e7b70ba0d4

    SHA1

    9dee62365e9c7251d30f769d340e41a2d61390fc

    SHA256

    7211e6b3b1c4682d642271623a09acd22f95c23550d1a2de8adcb7539d2b3a7b

    SHA512

    6e204fee2f7ba1fbe416ab7bff08fecf116c7bcaca71d5d0627ce263c4da9cd54c46b8cf60bf7f4b5c182f8f287c26b2fc172d8b9f5617d082ae5936abb42b16

  • \Users\Admin\AppData\Local\Temp\IXP002.TMP\Bo9ym0Wo.exe

    Filesize

    577KB

    MD5

    deecc6d583c6b762fe69b9e7b70ba0d4

    SHA1

    9dee62365e9c7251d30f769d340e41a2d61390fc

    SHA256

    7211e6b3b1c4682d642271623a09acd22f95c23550d1a2de8adcb7539d2b3a7b

    SHA512

    6e204fee2f7ba1fbe416ab7bff08fecf116c7bcaca71d5d0627ce263c4da9cd54c46b8cf60bf7f4b5c182f8f287c26b2fc172d8b9f5617d082ae5936abb42b16

  • \Users\Admin\AppData\Local\Temp\IXP003.TMP\iT2kf7bs.exe

    Filesize

    382KB

    MD5

    2ee0e57bc9caedea3174d94e058874cf

    SHA1

    7e20c5c0b7be85fec4c616766d7f43d234c67620

    SHA256

    45d05dbd7db454815b8b8380b3dfdaed072a2c8a46396755cd98dcb547cf0f16

    SHA512

    73f4b6cd25c2b8105811d98ee06292d134830794033fd816c2729cc1961d2fcfcceaac6d7ba3c4e65e2e148f903dad039a2bc374671d88d9c7b4fca4eada3a2e

  • \Users\Admin\AppData\Local\Temp\IXP003.TMP\iT2kf7bs.exe

    Filesize

    382KB

    MD5

    2ee0e57bc9caedea3174d94e058874cf

    SHA1

    7e20c5c0b7be85fec4c616766d7f43d234c67620

    SHA256

    45d05dbd7db454815b8b8380b3dfdaed072a2c8a46396755cd98dcb547cf0f16

    SHA512

    73f4b6cd25c2b8105811d98ee06292d134830794033fd816c2729cc1961d2fcfcceaac6d7ba3c4e65e2e148f903dad039a2bc374671d88d9c7b4fca4eada3a2e

  • \Users\Admin\AppData\Local\Temp\IXP004.TMP\1Au43wY7.exe

    Filesize

    295KB

    MD5

    1a98df4e0e91c1ef9db3c683bf614bf6

    SHA1

    1ec6bc54930df4fa3923156e7c26857e702fd050

    SHA256

    a7e2b3a646568868b4716cdb5efa67162fac8e50604d05183e0284e0dd4b2528

    SHA512

    9769b8b8836734b8a67df58461f01628552340d2e483dd9425f117c3140c6ddde7a3b6feb1402d474eb05fa53382c9073d1d6b6b4e3cd745df0bece386c0bc66

  • \Users\Admin\AppData\Local\Temp\IXP004.TMP\1Au43wY7.exe

    Filesize

    295KB

    MD5

    1a98df4e0e91c1ef9db3c683bf614bf6

    SHA1

    1ec6bc54930df4fa3923156e7c26857e702fd050

    SHA256

    a7e2b3a646568868b4716cdb5efa67162fac8e50604d05183e0284e0dd4b2528

    SHA512

    9769b8b8836734b8a67df58461f01628552340d2e483dd9425f117c3140c6ddde7a3b6feb1402d474eb05fa53382c9073d1d6b6b4e3cd745df0bece386c0bc66

  • \Users\Admin\AppData\Local\Temp\IXP004.TMP\1Au43wY7.exe

    Filesize

    295KB

    MD5

    1a98df4e0e91c1ef9db3c683bf614bf6

    SHA1

    1ec6bc54930df4fa3923156e7c26857e702fd050

    SHA256

    a7e2b3a646568868b4716cdb5efa67162fac8e50604d05183e0284e0dd4b2528

    SHA512

    9769b8b8836734b8a67df58461f01628552340d2e483dd9425f117c3140c6ddde7a3b6feb1402d474eb05fa53382c9073d1d6b6b4e3cd745df0bece386c0bc66

  • \Users\Admin\AppData\Local\Temp\IXP004.TMP\1Au43wY7.exe

    Filesize

    295KB

    MD5

    1a98df4e0e91c1ef9db3c683bf614bf6

    SHA1

    1ec6bc54930df4fa3923156e7c26857e702fd050

    SHA256

    a7e2b3a646568868b4716cdb5efa67162fac8e50604d05183e0284e0dd4b2528

    SHA512

    9769b8b8836734b8a67df58461f01628552340d2e483dd9425f117c3140c6ddde7a3b6feb1402d474eb05fa53382c9073d1d6b6b4e3cd745df0bece386c0bc66

  • \Users\Admin\AppData\Local\Temp\IXP004.TMP\1Au43wY7.exe

    Filesize

    295KB

    MD5

    1a98df4e0e91c1ef9db3c683bf614bf6

    SHA1

    1ec6bc54930df4fa3923156e7c26857e702fd050

    SHA256

    a7e2b3a646568868b4716cdb5efa67162fac8e50604d05183e0284e0dd4b2528

    SHA512

    9769b8b8836734b8a67df58461f01628552340d2e483dd9425f117c3140c6ddde7a3b6feb1402d474eb05fa53382c9073d1d6b6b4e3cd745df0bece386c0bc66

  • \Users\Admin\AppData\Local\Temp\IXP004.TMP\1Au43wY7.exe

    Filesize

    295KB

    MD5

    1a98df4e0e91c1ef9db3c683bf614bf6

    SHA1

    1ec6bc54930df4fa3923156e7c26857e702fd050

    SHA256

    a7e2b3a646568868b4716cdb5efa67162fac8e50604d05183e0284e0dd4b2528

    SHA512

    9769b8b8836734b8a67df58461f01628552340d2e483dd9425f117c3140c6ddde7a3b6feb1402d474eb05fa53382c9073d1d6b6b4e3cd745df0bece386c0bc66

  • \Users\Admin\AppData\Local\Temp\IXP004.TMP\1Au43wY7.exe

    Filesize

    295KB

    MD5

    1a98df4e0e91c1ef9db3c683bf614bf6

    SHA1

    1ec6bc54930df4fa3923156e7c26857e702fd050

    SHA256

    a7e2b3a646568868b4716cdb5efa67162fac8e50604d05183e0284e0dd4b2528

    SHA512

    9769b8b8836734b8a67df58461f01628552340d2e483dd9425f117c3140c6ddde7a3b6feb1402d474eb05fa53382c9073d1d6b6b4e3cd745df0bece386c0bc66

  • memory/2496-60-0x0000000000400000-0x0000000000432000-memory.dmp

    Filesize

    200KB

  • memory/2496-58-0x0000000000400000-0x0000000000432000-memory.dmp

    Filesize

    200KB

  • memory/2496-53-0x0000000000400000-0x0000000000432000-memory.dmp

    Filesize

    200KB

  • memory/2496-59-0x00000000FFFDE000-0x00000000FFFDF000-memory.dmp

    Filesize

    4KB

  • memory/2496-64-0x0000000000400000-0x0000000000432000-memory.dmp

    Filesize

    200KB

  • memory/2496-62-0x0000000000400000-0x0000000000432000-memory.dmp

    Filesize

    200KB

  • memory/2496-57-0x0000000000400000-0x0000000000432000-memory.dmp

    Filesize

    200KB

  • memory/2496-56-0x0000000000400000-0x0000000000432000-memory.dmp

    Filesize

    200KB

  • memory/2496-55-0x0000000000400000-0x0000000000432000-memory.dmp

    Filesize

    200KB

  • memory/2496-54-0x0000000000400000-0x0000000000432000-memory.dmp

    Filesize

    200KB