Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
152s -
max time network
46s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
11/10/2022, 00:21
Static task
static1
Behavioral task
behavioral1
Sample
8dfcc006bd4fdef37ad31ee0db9cac2576c68bf89945d9c860599fa47a738f6e.exe
Resource
win7-20220812-en
windows7-x64
2 signatures
150 seconds
Behavioral task
behavioral2
Sample
8dfcc006bd4fdef37ad31ee0db9cac2576c68bf89945d9c860599fa47a738f6e.exe
Resource
win10v2004-20220812-en
windows10-2004-x64
2 signatures
150 seconds
General
-
Target
8dfcc006bd4fdef37ad31ee0db9cac2576c68bf89945d9c860599fa47a738f6e.exe
-
Size
148KB
-
MD5
68b5afb66e7e0a146ee6cd53dc37fe50
-
SHA1
9044ec53c1f4c0a53f8d0377da00b569a5355361
-
SHA256
8dfcc006bd4fdef37ad31ee0db9cac2576c68bf89945d9c860599fa47a738f6e
-
SHA512
f8847cf553b5b4a53fce60ac15edb13f97eedd0e0237027f9990a67ed87be310fc37702316ba804cbd27201c0a6fbd6213199ac726271a7732fd7801d18af119
-
SSDEEP
1536:2iBD5tslno6PIztL+qvVLVJPWmgqhpjsnbpV4mlHs2vhzSb:HDilo6QztL+qvFumrpGbpV4kHs2vhzS
Score
4/10
Malware Config
Signatures
-
Drops file in Program Files directory 39 IoCs
description ioc Process File opened for modification C:\Program Files\Google\Chrome\Application\chrome_proxy.exe 8dfcc006bd4fdef37ad31ee0db9cac2576c68bf89945d9c860599fa47a738f6e.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\jabswitch.exe 8dfcc006bd4fdef37ad31ee0db9cac2576c68bf89945d9c860599fa47a738f6e.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\jarsigner.exe 8dfcc006bd4fdef37ad31ee0db9cac2576c68bf89945d9c860599fa47a738f6e.exe File opened for modification C:\Program Files\7-Zip\7zFM.exe 8dfcc006bd4fdef37ad31ee0db9cac2576c68bf89945d9c860599fa47a738f6e.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE 8dfcc006bd4fdef37ad31ee0db9cac2576c68bf89945d9c860599fa47a738f6e.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\ShapeCollector.exe 8dfcc006bd4fdef37ad31ee0db9cac2576c68bf89945d9c860599fa47a738f6e.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\VSTO\10.0\VSTOInstaller.exe 8dfcc006bd4fdef37ad31ee0db9cac2576c68bf89945d9c860599fa47a738f6e.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\apt.exe 8dfcc006bd4fdef37ad31ee0db9cac2576c68bf89945d9c860599fa47a738f6e.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\extcheck.exe 8dfcc006bd4fdef37ad31ee0db9cac2576c68bf89945d9c860599fa47a738f6e.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\javadoc.exe 8dfcc006bd4fdef37ad31ee0db9cac2576c68bf89945d9c860599fa47a738f6e.exe File opened for modification C:\Program Files\7-Zip\7zG.exe 8dfcc006bd4fdef37ad31ee0db9cac2576c68bf89945d9c860599fa47a738f6e.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\FlickLearningWizard.exe 8dfcc006bd4fdef37ad31ee0db9cac2576c68bf89945d9c860599fa47a738f6e.exe File opened for modification C:\Program Files\DVD Maker\DVDMaker.exe 8dfcc006bd4fdef37ad31ee0db9cac2576c68bf89945d9c860599fa47a738f6e.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\javac.exe 8dfcc006bd4fdef37ad31ee0db9cac2576c68bf89945d9c860599fa47a738f6e.exe File opened for modification C:\Program Files\Internet Explorer\iediagcmd.exe 8dfcc006bd4fdef37ad31ee0db9cac2576c68bf89945d9c860599fa47a738f6e.exe File opened for modification C:\Program Files\Internet Explorer\ieinstal.exe 8dfcc006bd4fdef37ad31ee0db9cac2576c68bf89945d9c860599fa47a738f6e.exe File opened for modification C:\Program Files\Internet Explorer\ielowutil.exe 8dfcc006bd4fdef37ad31ee0db9cac2576c68bf89945d9c860599fa47a738f6e.exe File opened for modification C:\Program Files\Internet Explorer\iexplore.exe 8dfcc006bd4fdef37ad31ee0db9cac2576c68bf89945d9c860599fa47a738f6e.exe File opened for modification C:\Program Files\Google\Chrome\Application\89.0.4389.114\nacl_irt_x86_64.nexe 8dfcc006bd4fdef37ad31ee0db9cac2576c68bf89945d9c860599fa47a738f6e.exe File opened for modification C:\Program Files\Google\Chrome\Application\chrome.exe 8dfcc006bd4fdef37ad31ee0db9cac2576c68bf89945d9c860599fa47a738f6e.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\OFFICE14\MSOXMLED.EXE 8dfcc006bd4fdef37ad31ee0db9cac2576c68bf89945d9c860599fa47a738f6e.exe File opened for modification C:\Program Files\Google\Chrome\Application\89.0.4389.114\elevation_service.exe 8dfcc006bd4fdef37ad31ee0db9cac2576c68bf89945d9c860599fa47a738f6e.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\java-rmi.exe 8dfcc006bd4fdef37ad31ee0db9cac2576c68bf89945d9c860599fa47a738f6e.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\java.exe 8dfcc006bd4fdef37ad31ee0db9cac2576c68bf89945d9c860599fa47a738f6e.exe File opened for modification C:\Program Files\7-Zip\Uninstall.exe 8dfcc006bd4fdef37ad31ee0db9cac2576c68bf89945d9c860599fa47a738f6e.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\InputPersonalization.exe 8dfcc006bd4fdef37ad31ee0db9cac2576c68bf89945d9c860599fa47a738f6e.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\TabTip.exe 8dfcc006bd4fdef37ad31ee0db9cac2576c68bf89945d9c860599fa47a738f6e.exe File opened for modification C:\Program Files\Google\Chrome\Application\89.0.4389.114\chrome_pwa_launcher.exe 8dfcc006bd4fdef37ad31ee0db9cac2576c68bf89945d9c860599fa47a738f6e.exe File opened for modification C:\Program Files\Google\Chrome\Application\89.0.4389.114\Installer\chrmstp.exe 8dfcc006bd4fdef37ad31ee0db9cac2576c68bf89945d9c860599fa47a738f6e.exe File opened for modification C:\Program Files\Google\Chrome\Application\89.0.4389.114\Installer\setup.exe 8dfcc006bd4fdef37ad31ee0db9cac2576c68bf89945d9c860599fa47a738f6e.exe File opened for modification C:\Program Files\Google\Chrome\Application\89.0.4389.114\notification_helper.exe 8dfcc006bd4fdef37ad31ee0db9cac2576c68bf89945d9c860599fa47a738f6e.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\appletviewer.exe 8dfcc006bd4fdef37ad31ee0db9cac2576c68bf89945d9c860599fa47a738f6e.exe File opened for modification C:\Program Files\7-Zip\7z.exe 8dfcc006bd4fdef37ad31ee0db9cac2576c68bf89945d9c860599fa47a738f6e.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\InkWatson.exe 8dfcc006bd4fdef37ad31ee0db9cac2576c68bf89945d9c860599fa47a738f6e.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\ConvertInkStore.exe 8dfcc006bd4fdef37ad31ee0db9cac2576c68bf89945d9c860599fa47a738f6e.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\MSInfo\msinfo32.exe 8dfcc006bd4fdef37ad31ee0db9cac2576c68bf89945d9c860599fa47a738f6e.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\jar.exe 8dfcc006bd4fdef37ad31ee0db9cac2576c68bf89945d9c860599fa47a738f6e.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\mip.exe 8dfcc006bd4fdef37ad31ee0db9cac2576c68bf89945d9c860599fa47a738f6e.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\idlj.exe 8dfcc006bd4fdef37ad31ee0db9cac2576c68bf89945d9c860599fa47a738f6e.exe -
Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 1920 wrote to memory of 1688 1920 8dfcc006bd4fdef37ad31ee0db9cac2576c68bf89945d9c860599fa47a738f6e.exe 28 PID 1920 wrote to memory of 1688 1920 8dfcc006bd4fdef37ad31ee0db9cac2576c68bf89945d9c860599fa47a738f6e.exe 28 PID 1920 wrote to memory of 1688 1920 8dfcc006bd4fdef37ad31ee0db9cac2576c68bf89945d9c860599fa47a738f6e.exe 28 PID 1920 wrote to memory of 1688 1920 8dfcc006bd4fdef37ad31ee0db9cac2576c68bf89945d9c860599fa47a738f6e.exe 28 PID 1920 wrote to memory of 1688 1920 8dfcc006bd4fdef37ad31ee0db9cac2576c68bf89945d9c860599fa47a738f6e.exe 28 PID 1920 wrote to memory of 1688 1920 8dfcc006bd4fdef37ad31ee0db9cac2576c68bf89945d9c860599fa47a738f6e.exe 28 PID 1920 wrote to memory of 1688 1920 8dfcc006bd4fdef37ad31ee0db9cac2576c68bf89945d9c860599fa47a738f6e.exe 28
Processes
-
C:\Users\Admin\AppData\Local\Temp\8dfcc006bd4fdef37ad31ee0db9cac2576c68bf89945d9c860599fa47a738f6e.exe"C:\Users\Admin\AppData\Local\Temp\8dfcc006bd4fdef37ad31ee0db9cac2576c68bf89945d9c860599fa47a738f6e.exe"1⤵
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:1920 -
C:\Users\Admin\AppData\Local\Temp\8dfcc006bd4fdef37ad31ee0db9cac2576c68bf89945d9c860599fa47a738f6e.exe"C:\Users\Admin\AppData\Local\Temp\8dfcc006bd4fdef37ad31ee0db9cac2576c68bf89945d9c860599fa47a738f6e.exe"2⤵PID:1688
-