Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
91s -
max time network
181s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
03/10/2022, 04:29
Static task
static1
Behavioral task
behavioral1
Sample
5fca2b8e57c0295530d0df729c6c0df2a6286af0d0dd6dbf35e27034e67db0bc.exe
Resource
win7-20220812-en
windows7-x64
0 signatures
150 seconds
Behavioral task
behavioral2
Sample
5fca2b8e57c0295530d0df729c6c0df2a6286af0d0dd6dbf35e27034e67db0bc.exe
Resource
win10v2004-20220812-en
windows10-2004-x64
3 signatures
150 seconds
General
-
Target
5fca2b8e57c0295530d0df729c6c0df2a6286af0d0dd6dbf35e27034e67db0bc.exe
-
Size
808KB
-
MD5
60b96ca31602004232ec62cd3f2bcfd0
-
SHA1
50753b8fc1d99e0004317d4fdaaf8b1c197409af
-
SHA256
5fca2b8e57c0295530d0df729c6c0df2a6286af0d0dd6dbf35e27034e67db0bc
-
SHA512
b3cc68bf9c38fca8bbca64d56aaa19024dc7e80f9d446774b37f3bcff9184e1f5dd45bba7f19e55a92f750edb652697f5fea898f6bc0a15b8e6089b92adf9e70
-
SSDEEP
24576:lW8i87x4UeaR2kFey/r7TvF7kB73uroQX:llik/7TS
Score
6/10
Malware Config
Signatures
-
Enumerates connected drives 3 TTPs 2 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\A: 5fca2b8e57c0295530d0df729c6c0df2a6286af0d0dd6dbf35e27034e67db0bc.exe File opened (read-only) \??\B: 5fca2b8e57c0295530d0df729c6c0df2a6286af0d0dd6dbf35e27034e67db0bc.exe -
Drops file in Program Files directory 58 IoCs
description ioc Process File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe 5fca2b8e57c0295530d0df729c6c0df2a6286af0d0dd6dbf35e27034e67db0bc.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe 5fca2b8e57c0295530d0df729c6c0df2a6286af0d0dd6dbf35e27034e67db0bc.exe File opened for modification C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe 5fca2b8e57c0295530d0df729c6c0df2a6286af0d0dd6dbf35e27034e67db0bc.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\idlj.exe 5fca2b8e57c0295530d0df729c6c0df2a6286af0d0dd6dbf35e27034e67db0bc.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\java.exe 5fca2b8e57c0295530d0df729c6c0df2a6286af0d0dd6dbf35e27034e67db0bc.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\jdeps.exe 5fca2b8e57c0295530d0df729c6c0df2a6286af0d0dd6dbf35e27034e67db0bc.exe File opened for modification C:\Program Files\7-Zip\7zFM.exe 5fca2b8e57c0295530d0df729c6c0df2a6286af0d0dd6dbf35e27034e67db0bc.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe 5fca2b8e57c0295530d0df729c6c0df2a6286af0d0dd6dbf35e27034e67db0bc.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\mip.exe 5fca2b8e57c0295530d0df729c6c0df2a6286af0d0dd6dbf35e27034e67db0bc.exe File opened for modification C:\Program Files\Internet Explorer\ielowutil.exe 5fca2b8e57c0295530d0df729c6c0df2a6286af0d0dd6dbf35e27034e67db0bc.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\jarsigner.exe 5fca2b8e57c0295530d0df729c6c0df2a6286af0d0dd6dbf35e27034e67db0bc.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\jjs.exe 5fca2b8e57c0295530d0df729c6c0df2a6286af0d0dd6dbf35e27034e67db0bc.exe File opened for modification C:\Program Files\Google\Chrome\Application\chrome_proxy.exe 5fca2b8e57c0295530d0df729c6c0df2a6286af0d0dd6dbf35e27034e67db0bc.exe File opened for modification C:\Program Files\Google\Chrome\Application\89.0.4389.114\chrome_pwa_launcher.exe 5fca2b8e57c0295530d0df729c6c0df2a6286af0d0dd6dbf35e27034e67db0bc.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\jabswitch.exe 5fca2b8e57c0295530d0df729c6c0df2a6286af0d0dd6dbf35e27034e67db0bc.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\javafxpackager.exe 5fca2b8e57c0295530d0df729c6c0df2a6286af0d0dd6dbf35e27034e67db0bc.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\jmc.exe 5fca2b8e57c0295530d0df729c6c0df2a6286af0d0dd6dbf35e27034e67db0bc.exe File opened for modification C:\Program Files\7-Zip\7zG.exe 5fca2b8e57c0295530d0df729c6c0df2a6286af0d0dd6dbf35e27034e67db0bc.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe 5fca2b8e57c0295530d0df729c6c0df2a6286af0d0dd6dbf35e27034e67db0bc.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\jinfo.exe 5fca2b8e57c0295530d0df729c6c0df2a6286af0d0dd6dbf35e27034e67db0bc.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\jps.exe 5fca2b8e57c0295530d0df729c6c0df2a6286af0d0dd6dbf35e27034e67db0bc.exe File opened for modification C:\Program Files\Internet Explorer\iexplore.exe 5fca2b8e57c0295530d0df729c6c0df2a6286af0d0dd6dbf35e27034e67db0bc.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\jdb.exe 5fca2b8e57c0295530d0df729c6c0df2a6286af0d0dd6dbf35e27034e67db0bc.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\jcmd.exe 5fca2b8e57c0295530d0df729c6c0df2a6286af0d0dd6dbf35e27034e67db0bc.exe File opened for modification C:\Program Files\Internet Explorer\ExtExport.exe 5fca2b8e57c0295530d0df729c6c0df2a6286af0d0dd6dbf35e27034e67db0bc.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\javadoc.exe 5fca2b8e57c0295530d0df729c6c0df2a6286af0d0dd6dbf35e27034e67db0bc.exe File opened for modification C:\Program Files\Google\Chrome\Application\89.0.4389.114\Installer\chrmstp.exe 5fca2b8e57c0295530d0df729c6c0df2a6286af0d0dd6dbf35e27034e67db0bc.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\jmap.exe 5fca2b8e57c0295530d0df729c6c0df2a6286af0d0dd6dbf35e27034e67db0bc.exe File opened for modification C:\Program Files\Internet Explorer\iediagcmd.exe 5fca2b8e57c0295530d0df729c6c0df2a6286af0d0dd6dbf35e27034e67db0bc.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\javac.exe 5fca2b8e57c0295530d0df729c6c0df2a6286af0d0dd6dbf35e27034e67db0bc.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\javapackager.exe 5fca2b8e57c0295530d0df729c6c0df2a6286af0d0dd6dbf35e27034e67db0bc.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\jhat.exe 5fca2b8e57c0295530d0df729c6c0df2a6286af0d0dd6dbf35e27034e67db0bc.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\jrunscript.exe 5fca2b8e57c0295530d0df729c6c0df2a6286af0d0dd6dbf35e27034e67db0bc.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe 5fca2b8e57c0295530d0df729c6c0df2a6286af0d0dd6dbf35e27034e67db0bc.exe File opened for modification C:\Program Files\Google\Chrome\Application\89.0.4389.114\elevation_service.exe 5fca2b8e57c0295530d0df729c6c0df2a6286af0d0dd6dbf35e27034e67db0bc.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\java-rmi.exe 5fca2b8e57c0295530d0df729c6c0df2a6286af0d0dd6dbf35e27034e67db0bc.exe File opened for modification C:\Program Files\Google\Chrome\Application\89.0.4389.114\Installer\setup.exe 5fca2b8e57c0295530d0df729c6c0df2a6286af0d0dd6dbf35e27034e67db0bc.exe File opened for modification C:\Program Files\Internet Explorer\ieinstal.exe 5fca2b8e57c0295530d0df729c6c0df2a6286af0d0dd6dbf35e27034e67db0bc.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\ShapeCollector.exe 5fca2b8e57c0295530d0df729c6c0df2a6286af0d0dd6dbf35e27034e67db0bc.exe File opened for modification C:\Program Files\Google\Chrome\Application\chrome.exe 5fca2b8e57c0295530d0df729c6c0df2a6286af0d0dd6dbf35e27034e67db0bc.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\javaw.exe 5fca2b8e57c0295530d0df729c6c0df2a6286af0d0dd6dbf35e27034e67db0bc.exe File opened for modification C:\Program Files\Google\Chrome\Application\89.0.4389.114\notification_helper.exe 5fca2b8e57c0295530d0df729c6c0df2a6286af0d0dd6dbf35e27034e67db0bc.exe File opened for modification C:\Program Files\7-Zip\Uninstall.exe 5fca2b8e57c0295530d0df729c6c0df2a6286af0d0dd6dbf35e27034e67db0bc.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe 5fca2b8e57c0295530d0df729c6c0df2a6286af0d0dd6dbf35e27034e67db0bc.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\javap.exe 5fca2b8e57c0295530d0df729c6c0df2a6286af0d0dd6dbf35e27034e67db0bc.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe 5fca2b8e57c0295530d0df729c6c0df2a6286af0d0dd6dbf35e27034e67db0bc.exe File opened for modification C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE 5fca2b8e57c0295530d0df729c6c0df2a6286af0d0dd6dbf35e27034e67db0bc.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\javah.exe 5fca2b8e57c0295530d0df729c6c0df2a6286af0d0dd6dbf35e27034e67db0bc.exe File opened for modification C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe 5fca2b8e57c0295530d0df729c6c0df2a6286af0d0dd6dbf35e27034e67db0bc.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\appletviewer.exe 5fca2b8e57c0295530d0df729c6c0df2a6286af0d0dd6dbf35e27034e67db0bc.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\extcheck.exe 5fca2b8e57c0295530d0df729c6c0df2a6286af0d0dd6dbf35e27034e67db0bc.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\jar.exe 5fca2b8e57c0295530d0df729c6c0df2a6286af0d0dd6dbf35e27034e67db0bc.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\javaws.exe 5fca2b8e57c0295530d0df729c6c0df2a6286af0d0dd6dbf35e27034e67db0bc.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\jconsole.exe 5fca2b8e57c0295530d0df729c6c0df2a6286af0d0dd6dbf35e27034e67db0bc.exe File opened for modification C:\Program Files\7-Zip\7z.exe 5fca2b8e57c0295530d0df729c6c0df2a6286af0d0dd6dbf35e27034e67db0bc.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\InputPersonalization.exe 5fca2b8e57c0295530d0df729c6c0df2a6286af0d0dd6dbf35e27034e67db0bc.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe 5fca2b8e57c0295530d0df729c6c0df2a6286af0d0dd6dbf35e27034e67db0bc.exe File opened for modification C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE 5fca2b8e57c0295530d0df729c6c0df2a6286af0d0dd6dbf35e27034e67db0bc.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.