Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
140s -
max time network
135s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
07/01/2024, 00:14
Static task
static1
Behavioral task
behavioral1
Sample
4787553d83d6cb1d17d817b29c3f0d2e.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
4787553d83d6cb1d17d817b29c3f0d2e.exe
Resource
win10v2004-20231215-en
General
-
Target
4787553d83d6cb1d17d817b29c3f0d2e.exe
-
Size
365KB
-
MD5
4787553d83d6cb1d17d817b29c3f0d2e
-
SHA1
d8ab6d46a89385b31780ca78ffc2445c1c8de3d4
-
SHA256
6042378e770691c0c6c1c80ed5807be567f37a3c8608d3027996aa9fe369dc7d
-
SHA512
36ff0afabed4cb36a5c481df10449513dd21171b1d680e438961e4f153fc7dc9d74f6b7c858cf84a877d34905e1352deb803f8cfe2839edcb5892d400d1d2c2e
-
SSDEEP
6144:0bq+bIZrZL+TnqRTMdDVJJ8pnXunpWH3rF2dWVOfis9yMdnWFJ0htBuNhRI:T+IZQrqRAdD+pXunQ7F2djdIJ0ht6k
Malware Config
Signatures
-
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" 4787553d83d6cb1d17d817b29c3f0d2e.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" 4787553d83d6cb1d17d817b29c3f0d2e.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" 043A6AEB00014973000C1B69B4EB2331.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" 043A6AEB00014973000C1B69B4EB2331.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" 043A6AEB00014973000C1B69B4EB2331.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" 043A6AEB00014973000C1B69B4EB2331.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" 4787553d83d6cb1d17d817b29c3f0d2e.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" 4787553d83d6cb1d17d817b29c3f0d2e.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" 4787553d83d6cb1d17d817b29c3f0d2e.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" 043A6AEB00014973000C1B69B4EB2331.exe -
Disables taskbar notifications via registry modification
-
Deletes itself 1 IoCs
pid Process 2060 043A6AEB00014973000C1B69B4EB2331.exe -
Executes dropped EXE 1 IoCs
pid Process 2060 043A6AEB00014973000C1B69B4EB2331.exe -
Loads dropped DLL 2 IoCs
pid Process 2532 4787553d83d6cb1d17d817b29c3f0d2e.exe 2532 4787553d83d6cb1d17d817b29c3f0d2e.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" 043A6AEB00014973000C1B69B4EB2331.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" 043A6AEB00014973000C1B69B4EB2331.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\svc 043A6AEB00014973000C1B69B4EB2331.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" 4787553d83d6cb1d17d817b29c3f0d2e.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Security Center\svc 4787553d83d6cb1d17d817b29c3f0d2e.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" 043A6AEB00014973000C1B69B4EB2331.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" 4787553d83d6cb1d17d817b29c3f0d2e.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" 4787553d83d6cb1d17d817b29c3f0d2e.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" 4787553d83d6cb1d17d817b29c3f0d2e.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\svc 4787553d83d6cb1d17d817b29c3f0d2e.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" 043A6AEB00014973000C1B69B4EB2331.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" 043A6AEB00014973000C1B69B4EB2331.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Security Center\svc 043A6AEB00014973000C1B69B4EB2331.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" 4787553d83d6cb1d17d817b29c3f0d2e.exe -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\043A6AEB00014973000C1B69B4EB2331 = "C:\\ProgramData\\043A6AEB00014973000C1B69B4EB2331\\043A6AEB00014973000C1B69B4EB2331.exe" 043A6AEB00014973000C1B69B4EB2331.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2532 4787553d83d6cb1d17d817b29c3f0d2e.exe 2532 4787553d83d6cb1d17d817b29c3f0d2e.exe 2532 4787553d83d6cb1d17d817b29c3f0d2e.exe 2532 4787553d83d6cb1d17d817b29c3f0d2e.exe 2532 4787553d83d6cb1d17d817b29c3f0d2e.exe 2532 4787553d83d6cb1d17d817b29c3f0d2e.exe 2532 4787553d83d6cb1d17d817b29c3f0d2e.exe 2060 043A6AEB00014973000C1B69B4EB2331.exe 2060 043A6AEB00014973000C1B69B4EB2331.exe 2060 043A6AEB00014973000C1B69B4EB2331.exe 2060 043A6AEB00014973000C1B69B4EB2331.exe 2060 043A6AEB00014973000C1B69B4EB2331.exe 2060 043A6AEB00014973000C1B69B4EB2331.exe 2060 043A6AEB00014973000C1B69B4EB2331.exe 2060 043A6AEB00014973000C1B69B4EB2331.exe 2060 043A6AEB00014973000C1B69B4EB2331.exe 2060 043A6AEB00014973000C1B69B4EB2331.exe 2060 043A6AEB00014973000C1B69B4EB2331.exe 2060 043A6AEB00014973000C1B69B4EB2331.exe 2060 043A6AEB00014973000C1B69B4EB2331.exe 2060 043A6AEB00014973000C1B69B4EB2331.exe 2060 043A6AEB00014973000C1B69B4EB2331.exe 2060 043A6AEB00014973000C1B69B4EB2331.exe 2060 043A6AEB00014973000C1B69B4EB2331.exe 2060 043A6AEB00014973000C1B69B4EB2331.exe 2060 043A6AEB00014973000C1B69B4EB2331.exe 2060 043A6AEB00014973000C1B69B4EB2331.exe 2060 043A6AEB00014973000C1B69B4EB2331.exe 2060 043A6AEB00014973000C1B69B4EB2331.exe 2060 043A6AEB00014973000C1B69B4EB2331.exe 2060 043A6AEB00014973000C1B69B4EB2331.exe 2060 043A6AEB00014973000C1B69B4EB2331.exe 2060 043A6AEB00014973000C1B69B4EB2331.exe 2060 043A6AEB00014973000C1B69B4EB2331.exe 2060 043A6AEB00014973000C1B69B4EB2331.exe 2060 043A6AEB00014973000C1B69B4EB2331.exe 2060 043A6AEB00014973000C1B69B4EB2331.exe 2060 043A6AEB00014973000C1B69B4EB2331.exe 2060 043A6AEB00014973000C1B69B4EB2331.exe 2060 043A6AEB00014973000C1B69B4EB2331.exe 2060 043A6AEB00014973000C1B69B4EB2331.exe 2060 043A6AEB00014973000C1B69B4EB2331.exe 2060 043A6AEB00014973000C1B69B4EB2331.exe 2060 043A6AEB00014973000C1B69B4EB2331.exe 2060 043A6AEB00014973000C1B69B4EB2331.exe 2060 043A6AEB00014973000C1B69B4EB2331.exe 2060 043A6AEB00014973000C1B69B4EB2331.exe 2060 043A6AEB00014973000C1B69B4EB2331.exe 2060 043A6AEB00014973000C1B69B4EB2331.exe 2060 043A6AEB00014973000C1B69B4EB2331.exe 2060 043A6AEB00014973000C1B69B4EB2331.exe 2060 043A6AEB00014973000C1B69B4EB2331.exe 2060 043A6AEB00014973000C1B69B4EB2331.exe 2060 043A6AEB00014973000C1B69B4EB2331.exe 2060 043A6AEB00014973000C1B69B4EB2331.exe 2060 043A6AEB00014973000C1B69B4EB2331.exe 2060 043A6AEB00014973000C1B69B4EB2331.exe 2060 043A6AEB00014973000C1B69B4EB2331.exe 2060 043A6AEB00014973000C1B69B4EB2331.exe 2060 043A6AEB00014973000C1B69B4EB2331.exe 2060 043A6AEB00014973000C1B69B4EB2331.exe 2060 043A6AEB00014973000C1B69B4EB2331.exe 2060 043A6AEB00014973000C1B69B4EB2331.exe 2060 043A6AEB00014973000C1B69B4EB2331.exe -
Suspicious use of FindShellTrayWindow 3 IoCs
pid Process 2060 043A6AEB00014973000C1B69B4EB2331.exe 2060 043A6AEB00014973000C1B69B4EB2331.exe 2060 043A6AEB00014973000C1B69B4EB2331.exe -
Suspicious use of SendNotifyMessage 3 IoCs
pid Process 2060 043A6AEB00014973000C1B69B4EB2331.exe 2060 043A6AEB00014973000C1B69B4EB2331.exe 2060 043A6AEB00014973000C1B69B4EB2331.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 2060 043A6AEB00014973000C1B69B4EB2331.exe 2060 043A6AEB00014973000C1B69B4EB2331.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2532 wrote to memory of 2060 2532 4787553d83d6cb1d17d817b29c3f0d2e.exe 28 PID 2532 wrote to memory of 2060 2532 4787553d83d6cb1d17d817b29c3f0d2e.exe 28 PID 2532 wrote to memory of 2060 2532 4787553d83d6cb1d17d817b29c3f0d2e.exe 28 PID 2532 wrote to memory of 2060 2532 4787553d83d6cb1d17d817b29c3f0d2e.exe 28
Processes
-
C:\Users\Admin\AppData\Local\Temp\4787553d83d6cb1d17d817b29c3f0d2e.exe"C:\Users\Admin\AppData\Local\Temp\4787553d83d6cb1d17d817b29c3f0d2e.exe"1⤵
- Windows security bypass
- Loads dropped DLL
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2532 -
C:\ProgramData\043A6AEB00014973000C1B69B4EB2331\043A6AEB00014973000C1B69B4EB2331.exe"C:\ProgramData\043A6AEB00014973000C1B69B4EB2331\043A6AEB00014973000C1B69B4EB2331.exe" "C:\Users\Admin\AppData\Local\Temp\4787553d83d6cb1d17d817b29c3f0d2e.exe"2⤵
- Windows security bypass
- Deletes itself
- Executes dropped EXE
- Windows security modification
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:2060
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
37KB
MD544d4f7f20686ba39077f7a5ab977f3ca
SHA186d58b04b300c2c3a37b024314a96825d4e63e6a
SHA2568bbfc423aa2780f1b9054d4ea171c71f213989248fdd923882043f0c8977a156
SHA512a1ba5aaebc2caaac6f9c121efcc1f99661706f226c344fcba0de8b3ba9ad7118e56798f64a8815cee05a22e786cdd9633acf3f4c9491537ab5fe11b87db4d6cf
-
Filesize
90KB
MD575031416d9e0e7fb02a5a26fcfd35438
SHA1e5e2fbcd9fca5d12f885aa06c23a9e5b8a45622d
SHA2567c9c491cf98f08f77301f9d2616fda3564a6658f43ac12d1e0e678035d1c2e20
SHA5124c029ae761cded412ce247f0f338818bcfd91086df860339911c8995db5d428ace53c31099a6e72274452b4818c8cd53511f15fbd2aae40c548ad39770251cde
-
Filesize
1KB
MD5841b69102e698d5eed7911c374d2d37f
SHA1e3e1ae1337892c4e5779d0db4343c7c007fca8f3
SHA256a580b0d9e621e05a2871f2278ee4098b35b68b98f013a2a8f6c57d66155bddca
SHA5122d1e0725201d45337300d7183640e6819e48539a96972d765e6642377c1a871c5c0ea8db05e7bc6b689d9b7cd35fff5c5475b991be26bde5f01b72572ff7e54c
-
Filesize
71KB
MD520e6691800b5b8514c7f22275b8986e9
SHA1a63dda7eea8eb106f5dacfed0d0d40ef422dc45f
SHA256f870d481ea8a247c453fa160937f99f66ea2ca8094c112848e9d3e8bb0cd4876
SHA5128b24e357c1007bbf32afb975e5f79ab7a6cc31979785f6a84b61c08eb3dc30bdb28eec354b051ca12c25316db767b548380fe42ff1c218e4a76d35217e5f992c
-
Filesize
52KB
MD5a6582e724c91f74842e46cbfee234d1f
SHA1e2a5bfbe0fc8968c196901defdf162972f871dbd
SHA256db4c0f8a48dbaf2690aceab44108f7cf7a80daab9edbb376578175ccc6d1a5ff
SHA512847ddd4d02253a924f202b495c29e8b9ce2f66c0f2f53356385357cfd63bbc094a4fe84ac1dffe133fb5af2d9b57fcb0bfa5973973e6e09e9ad56a6c9bc59dc6