Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
118s -
max time network
126s -
platform
windows7_x64 -
resource
win7-20231020-en -
resource tags
arch:x64arch:x86image:win7-20231020-enlocale:en-usos:windows7-x64system -
submitted
17/11/2023, 01:03
Static task
static1
Behavioral task
behavioral1
Sample
0c648321522607509014810fa9850703.exe
Resource
win7-20231020-en
Behavioral task
behavioral2
Sample
0c648321522607509014810fa9850703.exe
Resource
win10v2004-20231020-en
General
-
Target
0c648321522607509014810fa9850703.exe
-
Size
2.5MB
-
MD5
0c648321522607509014810fa9850703
-
SHA1
637691d6383617223d3e560dca72cb47cd9df0e8
-
SHA256
76465863089ece91dfcafbcf35b4129659eee5bb53ac9a9add3b95c77c9022fc
-
SHA512
e9476fecdaafb141e77500878c2f5503a19ca810ffa5cf5bccf28599242f7a32021ea840aac7d174a3fff4d64131aca3ac9779b2b6f8cc96301befa55b15ed2f
-
SSDEEP
49152:Co5P6mI0jX9MTqoQQzLrk3PxbFszLJpRgmjXB2LtBasOrlSi0GTIzVIBDwN3CX/T:Co5RM5zc3PxezrjXM+skSqIqeNK
Malware Config
Signatures
-
Executes dropped EXE 7 IoCs
pid Process 1952 7z.exe 3016 7z.exe 2912 7z.exe 2612 7z.exe 2652 7z.exe 1916 7z.exe 2960 Installer.exe -
Loads dropped DLL 12 IoCs
pid Process 2868 cmd.exe 1952 7z.exe 2868 cmd.exe 3016 7z.exe 2868 cmd.exe 2912 7z.exe 2868 cmd.exe 2612 7z.exe 2868 cmd.exe 2652 7z.exe 2868 cmd.exe 1916 7z.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: CmdExeWriteProcessMemorySpam 1 IoCs
pid Process 2960 Installer.exe -
Suspicious behavior: EnumeratesProcesses 1 IoCs
pid Process 2960 Installer.exe -
Suspicious use of AdjustPrivilegeToken 25 IoCs
description pid Process Token: SeRestorePrivilege 1952 7z.exe Token: 35 1952 7z.exe Token: SeSecurityPrivilege 1952 7z.exe Token: SeSecurityPrivilege 1952 7z.exe Token: SeRestorePrivilege 3016 7z.exe Token: 35 3016 7z.exe Token: SeSecurityPrivilege 3016 7z.exe Token: SeSecurityPrivilege 3016 7z.exe Token: SeRestorePrivilege 2912 7z.exe Token: 35 2912 7z.exe Token: SeSecurityPrivilege 2912 7z.exe Token: SeSecurityPrivilege 2912 7z.exe Token: SeRestorePrivilege 2612 7z.exe Token: 35 2612 7z.exe Token: SeSecurityPrivilege 2612 7z.exe Token: SeSecurityPrivilege 2612 7z.exe Token: SeRestorePrivilege 2652 7z.exe Token: 35 2652 7z.exe Token: SeSecurityPrivilege 2652 7z.exe Token: SeSecurityPrivilege 2652 7z.exe Token: SeRestorePrivilege 1916 7z.exe Token: 35 1916 7z.exe Token: SeSecurityPrivilege 1916 7z.exe Token: SeSecurityPrivilege 1916 7z.exe Token: SeDebugPrivilege 2960 Installer.exe -
Suspicious use of WriteProcessMemory 35 IoCs
description pid Process procid_target PID 2204 wrote to memory of 2868 2204 0c648321522607509014810fa9850703.exe 28 PID 2204 wrote to memory of 2868 2204 0c648321522607509014810fa9850703.exe 28 PID 2204 wrote to memory of 2868 2204 0c648321522607509014810fa9850703.exe 28 PID 2204 wrote to memory of 2868 2204 0c648321522607509014810fa9850703.exe 28 PID 2868 wrote to memory of 2700 2868 cmd.exe 30 PID 2868 wrote to memory of 2700 2868 cmd.exe 30 PID 2868 wrote to memory of 2700 2868 cmd.exe 30 PID 2868 wrote to memory of 1952 2868 cmd.exe 31 PID 2868 wrote to memory of 1952 2868 cmd.exe 31 PID 2868 wrote to memory of 1952 2868 cmd.exe 31 PID 2868 wrote to memory of 3016 2868 cmd.exe 32 PID 2868 wrote to memory of 3016 2868 cmd.exe 32 PID 2868 wrote to memory of 3016 2868 cmd.exe 32 PID 2868 wrote to memory of 2912 2868 cmd.exe 33 PID 2868 wrote to memory of 2912 2868 cmd.exe 33 PID 2868 wrote to memory of 2912 2868 cmd.exe 33 PID 2868 wrote to memory of 2612 2868 cmd.exe 34 PID 2868 wrote to memory of 2612 2868 cmd.exe 34 PID 2868 wrote to memory of 2612 2868 cmd.exe 34 PID 2868 wrote to memory of 2652 2868 cmd.exe 35 PID 2868 wrote to memory of 2652 2868 cmd.exe 35 PID 2868 wrote to memory of 2652 2868 cmd.exe 35 PID 2868 wrote to memory of 1916 2868 cmd.exe 36 PID 2868 wrote to memory of 1916 2868 cmd.exe 36 PID 2868 wrote to memory of 1916 2868 cmd.exe 36 PID 2868 wrote to memory of 2964 2868 cmd.exe 37 PID 2868 wrote to memory of 2964 2868 cmd.exe 37 PID 2868 wrote to memory of 2964 2868 cmd.exe 37 PID 2868 wrote to memory of 2960 2868 cmd.exe 38 PID 2868 wrote to memory of 2960 2868 cmd.exe 38 PID 2868 wrote to memory of 2960 2868 cmd.exe 38 PID 2868 wrote to memory of 2960 2868 cmd.exe 38 PID 2868 wrote to memory of 2960 2868 cmd.exe 38 PID 2868 wrote to memory of 2960 2868 cmd.exe 38 PID 2868 wrote to memory of 2960 2868 cmd.exe 38 -
Views/modifies file attributes 1 TTPs 1 IoCs
pid Process 2964 attrib.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\0c648321522607509014810fa9850703.exe"C:\Users\Admin\AppData\Local\Temp\0c648321522607509014810fa9850703.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2204 -
C:\Windows\system32\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\main\main.bat" /S"2⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2868 -
C:\Windows\system32\mode.commode 65,103⤵PID:2700
-
-
C:\Users\Admin\AppData\Local\Temp\main\7z.exe7z.exe e file.zip -p199921163012031144012778512725 -oextracted3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
PID:1952
-
-
C:\Users\Admin\AppData\Local\Temp\main\7z.exe7z.exe e extracted/file_5.zip -oextracted3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
PID:3016
-
-
C:\Users\Admin\AppData\Local\Temp\main\7z.exe7z.exe e extracted/file_4.zip -oextracted3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
PID:2912
-
-
C:\Users\Admin\AppData\Local\Temp\main\7z.exe7z.exe e extracted/file_3.zip -oextracted3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
PID:2612
-
-
C:\Users\Admin\AppData\Local\Temp\main\7z.exe7z.exe e extracted/file_2.zip -oextracted3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
PID:2652
-
-
C:\Users\Admin\AppData\Local\Temp\main\7z.exe7z.exe e extracted/file_1.zip -oextracted3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
PID:1916
-
-
C:\Windows\system32\attrib.exeattrib +H "Installer.exe"3⤵
- Views/modifies file attributes
PID:2964
-
-
C:\Users\Admin\AppData\Local\Temp\main\Installer.exe"Installer.exe"3⤵
- Executes dropped EXE
- Suspicious behavior: CmdExeWriteProcessMemorySpam
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2960
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.6MB
MD572491c7b87a7c2dd350b727444f13bb4
SHA11e9338d56db7ded386878eab7bb44b8934ab1bc7
SHA25634ad9bb80fe8bf28171e671228eb5b64a55caa388c31cb8c0df77c0136735891
SHA512583d0859d29145dfc48287c5a1b459e5db4e939624bd549ff02c61eae8a0f31fc96a509f3e146200cdd4c93b154123e5adfbfe01f7d172db33968155189b5511
-
Filesize
458KB
MD5619f7135621b50fd1900ff24aade1524
SHA16c7ea8bbd435163ae3945cbef30ef6b9872a4591
SHA256344f076bb1211cb02eca9e5ed2c0ce59bcf74ccbc749ec611538fa14ecb9aad2
SHA5122c7293c084d09bc2e3ae2d066dd7b331c810d9e2eeca8b236a8e87fdeb18e877b948747d3491fcaff245816507685250bd35f984c67a43b29b0ae31ecb2bd628
-
Filesize
458KB
MD5619f7135621b50fd1900ff24aade1524
SHA16c7ea8bbd435163ae3945cbef30ef6b9872a4591
SHA256344f076bb1211cb02eca9e5ed2c0ce59bcf74ccbc749ec611538fa14ecb9aad2
SHA5122c7293c084d09bc2e3ae2d066dd7b331c810d9e2eeca8b236a8e87fdeb18e877b948747d3491fcaff245816507685250bd35f984c67a43b29b0ae31ecb2bd628
-
Filesize
458KB
MD5619f7135621b50fd1900ff24aade1524
SHA16c7ea8bbd435163ae3945cbef30ef6b9872a4591
SHA256344f076bb1211cb02eca9e5ed2c0ce59bcf74ccbc749ec611538fa14ecb9aad2
SHA5122c7293c084d09bc2e3ae2d066dd7b331c810d9e2eeca8b236a8e87fdeb18e877b948747d3491fcaff245816507685250bd35f984c67a43b29b0ae31ecb2bd628
-
Filesize
458KB
MD5619f7135621b50fd1900ff24aade1524
SHA16c7ea8bbd435163ae3945cbef30ef6b9872a4591
SHA256344f076bb1211cb02eca9e5ed2c0ce59bcf74ccbc749ec611538fa14ecb9aad2
SHA5122c7293c084d09bc2e3ae2d066dd7b331c810d9e2eeca8b236a8e87fdeb18e877b948747d3491fcaff245816507685250bd35f984c67a43b29b0ae31ecb2bd628
-
Filesize
458KB
MD5619f7135621b50fd1900ff24aade1524
SHA16c7ea8bbd435163ae3945cbef30ef6b9872a4591
SHA256344f076bb1211cb02eca9e5ed2c0ce59bcf74ccbc749ec611538fa14ecb9aad2
SHA5122c7293c084d09bc2e3ae2d066dd7b331c810d9e2eeca8b236a8e87fdeb18e877b948747d3491fcaff245816507685250bd35f984c67a43b29b0ae31ecb2bd628
-
Filesize
458KB
MD5619f7135621b50fd1900ff24aade1524
SHA16c7ea8bbd435163ae3945cbef30ef6b9872a4591
SHA256344f076bb1211cb02eca9e5ed2c0ce59bcf74ccbc749ec611538fa14ecb9aad2
SHA5122c7293c084d09bc2e3ae2d066dd7b331c810d9e2eeca8b236a8e87fdeb18e877b948747d3491fcaff245816507685250bd35f984c67a43b29b0ae31ecb2bd628
-
Filesize
458KB
MD5619f7135621b50fd1900ff24aade1524
SHA16c7ea8bbd435163ae3945cbef30ef6b9872a4591
SHA256344f076bb1211cb02eca9e5ed2c0ce59bcf74ccbc749ec611538fa14ecb9aad2
SHA5122c7293c084d09bc2e3ae2d066dd7b331c810d9e2eeca8b236a8e87fdeb18e877b948747d3491fcaff245816507685250bd35f984c67a43b29b0ae31ecb2bd628
-
Filesize
21KB
MD58094e61800a5461f723754cda0d85aa1
SHA11250dc65a0861507d8885d3a404b9c71a3fa306d
SHA25626d81f5d1ac64ffe6fd03f77030b99c890194a0affa5c34fb2e0c20f4add6353
SHA5126da9fc8490af86df2037f691ff87c989c6c79ba600aa7cf42a17a77cf6ddd61b40c6a8dad4476d301a6505480f788f6ae41df0370b7fa6ccf2a835cf7ae80be0
-
Filesize
2.1MB
MD5a217b3a8813052306f4f2b0a9ac1dfd7
SHA1f3f3bd5fb49a50a057abc23ff66ed9663fce7251
SHA25677d349afa0f3690f56a9c55f2ab3daf74f5cbecf8df33682e469ce1638cde633
SHA5129a9e507af0916e2eed7e9d070f06a47774ce983d2ddb64e40170d4ec8d26c8ef91aa788bd87d38276397352354cf40c67d31720e2eceee818c4192f827729815
-
Filesize
21KB
MD58094e61800a5461f723754cda0d85aa1
SHA11250dc65a0861507d8885d3a404b9c71a3fa306d
SHA25626d81f5d1ac64ffe6fd03f77030b99c890194a0affa5c34fb2e0c20f4add6353
SHA5126da9fc8490af86df2037f691ff87c989c6c79ba600aa7cf42a17a77cf6ddd61b40c6a8dad4476d301a6505480f788f6ae41df0370b7fa6ccf2a835cf7ae80be0
-
Filesize
9KB
MD5e12b7f891dde680e5950ce87df5455fb
SHA12b1a3d9e8c6f77f3604fdcbb036ba157cce9daee
SHA2564ed1c0b9af10c6a8c90c4e656de8f2aea25858f9f2e9df1f4640649450db95cd
SHA512aaee8c07fcfd1c5e7aab8cf20908cda86e470661b0e1c4529a5ae903834301845b70de99ccc491b3e4a1e0f1744681ab9e20f6ece82da8ed3a7e714b9971b9ef
-
Filesize
9KB
MD5e1cd221e697ce29ca70f2c689213153d
SHA13c875cd14fe3134a28eb1d83982422b696ef802b
SHA256f13f5eee8887618bf50ac16689866c4a6dc94e61ac5a27b941c07e2a6aff849b
SHA5125451c2c073dc186da0705317291d31a5061b4c4d9099885528f5d38b44ac7e201b0f6dd1b291aa7ed35ab8949014723da6368311ac4335c7c80c42523f4a7956
-
Filesize
9KB
MD58631891243067625145a9fba7f2a15b6
SHA1772c3baa15bdde6072af2b11c4561fe65bb0f8a4
SHA2562b52cea36c8238b91b4874dcdaef6cecdcae55697b10e88557e107ecc7ab3757
SHA5124aae821f78c4006e3dd645cc2bd32168a71d103058475d8f6daf849399e04fdcc0d7f808633528458eaa3a7cbd6bc1d12767d469d4d9cac9afec5637425a59be
-
Filesize
9KB
MD5e4e6029fb1592f4b0d980a1da68001b1
SHA1c67a1c93cb37f2ab3b99baeb3ff24def54a25519
SHA256496645b31890b89f1c580fb67de0e17fd941c856bdc90baeabd71c5b1ae297af
SHA5121912f9bcdab5cfe833dfd694cd7c72743c122ca3b62ab1d4c89442bf466f225c863262f470faf161a4bda2a590c37040d25708bb3228980caf469a69b31019f4
-
Filesize
1.6MB
MD5f23275793fbdcd6d6ad91221dd482799
SHA1daee133d2b751668ff7dbe2d1fabb0fc25ac8b39
SHA25620b2dd95c812adcedf04e5ca14b9e90ec047df4bff8bcffaae4f3eed1d789be1
SHA512f815ba5626f6ccc4f1bd408cec40418ed57a6a4d925c5946d82e839ed3797aeea05d0bc32aeedb1eb0b179ca8495858374a90fd7a1676543e0bd801c8ed9e879
-
Filesize
1.6MB
MD51ae10fd8ae5314f4034d0b08f1cb86eb
SHA1276a63551092638c5f7468648928a994a27b3447
SHA2563d7df2ab3035b67f9770785350cf8cb9bc6c6c396166f59055430fa003c49b43
SHA512678cc38b1bc0f974e32b976d9c6ed3d055df03cd96e8205f8ba75eea7a84743a9a9bd92eb68f8fdaf89862e50b8f77a19931596bb17c59ae721eac4b99ab221d
-
Filesize
476B
MD54fd8c0be3d5734a0efec73ad50927f94
SHA19c7e04c72e448804b0d2bc76d94e7646d16aefb9
SHA256172a4b8e026cdd3274d4f494528a7b8193dab2b5d8a5bbc2a19d7f997661cf98
SHA512c9a4ad6d7bacd1e2e6e8298ca041e715240ae2d1d36867cc3a9c174703011a803998f2e35e4b41ab6d5cd799730d435665e08f54a8478f770d839a9cf6f8ed94
-
Filesize
476B
MD54fd8c0be3d5734a0efec73ad50927f94
SHA19c7e04c72e448804b0d2bc76d94e7646d16aefb9
SHA256172a4b8e026cdd3274d4f494528a7b8193dab2b5d8a5bbc2a19d7f997661cf98
SHA512c9a4ad6d7bacd1e2e6e8298ca041e715240ae2d1d36867cc3a9c174703011a803998f2e35e4b41ab6d5cd799730d435665e08f54a8478f770d839a9cf6f8ed94
-
Filesize
1.6MB
MD572491c7b87a7c2dd350b727444f13bb4
SHA11e9338d56db7ded386878eab7bb44b8934ab1bc7
SHA25634ad9bb80fe8bf28171e671228eb5b64a55caa388c31cb8c0df77c0136735891
SHA512583d0859d29145dfc48287c5a1b459e5db4e939624bd549ff02c61eae8a0f31fc96a509f3e146200cdd4c93b154123e5adfbfe01f7d172db33968155189b5511
-
Filesize
1.6MB
MD572491c7b87a7c2dd350b727444f13bb4
SHA11e9338d56db7ded386878eab7bb44b8934ab1bc7
SHA25634ad9bb80fe8bf28171e671228eb5b64a55caa388c31cb8c0df77c0136735891
SHA512583d0859d29145dfc48287c5a1b459e5db4e939624bd549ff02c61eae8a0f31fc96a509f3e146200cdd4c93b154123e5adfbfe01f7d172db33968155189b5511
-
Filesize
1.6MB
MD572491c7b87a7c2dd350b727444f13bb4
SHA11e9338d56db7ded386878eab7bb44b8934ab1bc7
SHA25634ad9bb80fe8bf28171e671228eb5b64a55caa388c31cb8c0df77c0136735891
SHA512583d0859d29145dfc48287c5a1b459e5db4e939624bd549ff02c61eae8a0f31fc96a509f3e146200cdd4c93b154123e5adfbfe01f7d172db33968155189b5511
-
Filesize
1.6MB
MD572491c7b87a7c2dd350b727444f13bb4
SHA11e9338d56db7ded386878eab7bb44b8934ab1bc7
SHA25634ad9bb80fe8bf28171e671228eb5b64a55caa388c31cb8c0df77c0136735891
SHA512583d0859d29145dfc48287c5a1b459e5db4e939624bd549ff02c61eae8a0f31fc96a509f3e146200cdd4c93b154123e5adfbfe01f7d172db33968155189b5511
-
Filesize
1.6MB
MD572491c7b87a7c2dd350b727444f13bb4
SHA11e9338d56db7ded386878eab7bb44b8934ab1bc7
SHA25634ad9bb80fe8bf28171e671228eb5b64a55caa388c31cb8c0df77c0136735891
SHA512583d0859d29145dfc48287c5a1b459e5db4e939624bd549ff02c61eae8a0f31fc96a509f3e146200cdd4c93b154123e5adfbfe01f7d172db33968155189b5511
-
Filesize
1.6MB
MD572491c7b87a7c2dd350b727444f13bb4
SHA11e9338d56db7ded386878eab7bb44b8934ab1bc7
SHA25634ad9bb80fe8bf28171e671228eb5b64a55caa388c31cb8c0df77c0136735891
SHA512583d0859d29145dfc48287c5a1b459e5db4e939624bd549ff02c61eae8a0f31fc96a509f3e146200cdd4c93b154123e5adfbfe01f7d172db33968155189b5511
-
Filesize
458KB
MD5619f7135621b50fd1900ff24aade1524
SHA16c7ea8bbd435163ae3945cbef30ef6b9872a4591
SHA256344f076bb1211cb02eca9e5ed2c0ce59bcf74ccbc749ec611538fa14ecb9aad2
SHA5122c7293c084d09bc2e3ae2d066dd7b331c810d9e2eeca8b236a8e87fdeb18e877b948747d3491fcaff245816507685250bd35f984c67a43b29b0ae31ecb2bd628
-
Filesize
458KB
MD5619f7135621b50fd1900ff24aade1524
SHA16c7ea8bbd435163ae3945cbef30ef6b9872a4591
SHA256344f076bb1211cb02eca9e5ed2c0ce59bcf74ccbc749ec611538fa14ecb9aad2
SHA5122c7293c084d09bc2e3ae2d066dd7b331c810d9e2eeca8b236a8e87fdeb18e877b948747d3491fcaff245816507685250bd35f984c67a43b29b0ae31ecb2bd628
-
Filesize
458KB
MD5619f7135621b50fd1900ff24aade1524
SHA16c7ea8bbd435163ae3945cbef30ef6b9872a4591
SHA256344f076bb1211cb02eca9e5ed2c0ce59bcf74ccbc749ec611538fa14ecb9aad2
SHA5122c7293c084d09bc2e3ae2d066dd7b331c810d9e2eeca8b236a8e87fdeb18e877b948747d3491fcaff245816507685250bd35f984c67a43b29b0ae31ecb2bd628
-
Filesize
458KB
MD5619f7135621b50fd1900ff24aade1524
SHA16c7ea8bbd435163ae3945cbef30ef6b9872a4591
SHA256344f076bb1211cb02eca9e5ed2c0ce59bcf74ccbc749ec611538fa14ecb9aad2
SHA5122c7293c084d09bc2e3ae2d066dd7b331c810d9e2eeca8b236a8e87fdeb18e877b948747d3491fcaff245816507685250bd35f984c67a43b29b0ae31ecb2bd628
-
Filesize
458KB
MD5619f7135621b50fd1900ff24aade1524
SHA16c7ea8bbd435163ae3945cbef30ef6b9872a4591
SHA256344f076bb1211cb02eca9e5ed2c0ce59bcf74ccbc749ec611538fa14ecb9aad2
SHA5122c7293c084d09bc2e3ae2d066dd7b331c810d9e2eeca8b236a8e87fdeb18e877b948747d3491fcaff245816507685250bd35f984c67a43b29b0ae31ecb2bd628
-
Filesize
458KB
MD5619f7135621b50fd1900ff24aade1524
SHA16c7ea8bbd435163ae3945cbef30ef6b9872a4591
SHA256344f076bb1211cb02eca9e5ed2c0ce59bcf74ccbc749ec611538fa14ecb9aad2
SHA5122c7293c084d09bc2e3ae2d066dd7b331c810d9e2eeca8b236a8e87fdeb18e877b948747d3491fcaff245816507685250bd35f984c67a43b29b0ae31ecb2bd628