Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
151s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
11/10/2022, 06:32
Static task
static1
Behavioral task
behavioral1
Sample
9d9afba0fc3a930a117b8905b4ee4821bb5e922794306aac084a1b1e51b0391a.exe
Resource
win7-20220812-en
windows7-x64
7 signatures
150 seconds
General
-
Target
9d9afba0fc3a930a117b8905b4ee4821bb5e922794306aac084a1b1e51b0391a.exe
-
Size
614KB
-
MD5
4ff1701c87bbe196868574a141261708
-
SHA1
c17fb32dac1680e324f4fde436281927aedb10d5
-
SHA256
9d9afba0fc3a930a117b8905b4ee4821bb5e922794306aac084a1b1e51b0391a
-
SHA512
84b3a01deac6822cc2656d78f44764652e7a08a74aa2aaad06dd8a6d4478d6a3324128e327698edb027ad1d05476e41f8d57db6c10a611927e44300f8e40e95b
-
SSDEEP
6144:+rZSYomWS//JmcZiWE58TR45SYomWS//JmcZiWE58TR4u:dYomWS//JmcE2YomWS//JmcE
Malware Config
Signatures
-
Drops startup file 1 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ÄÅØÈÔÐÀÒÎÐ.txt 9d9afba0fc3a930a117b8905b4ee4821bb5e922794306aac084a1b1e51b0391a.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files (x86)\Common Files\System\fr-FR\ÄÅØÈÔÐÀÒÎÐ.txt 9d9afba0fc3a930a117b8905b4ee4821bb5e922794306aac084a1b1e51b0391a.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.BingWeather_4.25.20211.0_x64__8wekyb3d8bbwe\Assets\AppTiles\WeatherImages\210x173\39.jpg 9d9afba0fc3a930a117b8905b4ee4821bb5e922794306aac084a1b1e51b0391a.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\FirstRunMailBlurred.layoutdir-RTL.jpg 9d9afba0fc3a930a117b8905b4ee4821bb5e922794306aac084a1b1e51b0391a.exe File created C:\Program Files\WindowsApps\Microsoft.XboxGamingOverlay_2.34.28001.0_x64__8wekyb3d8bbwe\microsoft.system.package.metadata\ÄÅØÈÔÐÀÒÎÐ.txt 9d9afba0fc3a930a117b8905b4ee4821bb5e922794306aac084a1b1e51b0391a.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\desktop-connector-files\js\nls\en-ae\ÄÅØÈÔÐÀÒÎÐ.txt 9d9afba0fc3a930a117b8905b4ee4821bb5e922794306aac084a1b1e51b0391a.exe File created C:\Program Files\WindowsApps\Microsoft.Windows.Photos_2019.19071.12548.0_x64__8wekyb3d8bbwe\Lumia.MagicEdit\UserControls\ÄÅØÈÔÐÀÒÎÐ.txt 9d9afba0fc3a930a117b8905b4ee4821bb5e922794306aac084a1b1e51b0391a.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\home\js\nls\en-gb\ÄÅØÈÔÐÀÒÎÐ.txt 9d9afba0fc3a930a117b8905b4ee4821bb5e922794306aac084a1b1e51b0391a.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\reviews\js\nls\ko-kr\ÄÅØÈÔÐÀÒÎÐ.txt 9d9afba0fc3a930a117b8905b4ee4821bb5e922794306aac084a1b1e51b0391a.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\insert\insertbase.xml 9d9afba0fc3a930a117b8905b4ee4821bb5e922794306aac084a1b1e51b0391a.exe File created C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\profiler\lib\ÄÅØÈÔÐÀÒÎÐ.txt 9d9afba0fc3a930a117b8905b4ee4821bb5e922794306aac084a1b1e51b0391a.exe File created C:\Program Files\WindowsApps\Microsoft.BingWeather_4.25.20211.0_x64__8wekyb3d8bbwe\ÄÅØÈÔÐÀÒÎÐ.txt 9d9afba0fc3a930a117b8905b4ee4821bb5e922794306aac084a1b1e51b0391a.exe File created C:\Program Files\WindowsApps\Microsoft.Windows.Photos_2019.19071.12548.0_neutral_~_8wekyb3d8bbwe\ÄÅØÈÔÐÀÒÎÐ.txt 9d9afba0fc3a930a117b8905b4ee4821bb5e922794306aac084a1b1e51b0391a.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.BingWeather_4.25.20211.0_x64__8wekyb3d8bbwe\Assets\AppTiles\WeatherImages\423x173\4.jpg 9d9afba0fc3a930a117b8905b4ee4821bb5e922794306aac084a1b1e51b0391a.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\de-de\ÄÅØÈÔÐÀÒÎÐ.txt 9d9afba0fc3a930a117b8905b4ee4821bb5e922794306aac084a1b1e51b0391a.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\aicuc\js\nls\fr-fr\ÄÅØÈÔÐÀÒÎÐ.txt 9d9afba0fc3a930a117b8905b4ee4821bb5e922794306aac084a1b1e51b0391a.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGLBL108.XML 9d9afba0fc3a930a117b8905b4ee4821bb5e922794306aac084a1b1e51b0391a.exe File created C:\Program Files\VideoLAN\VLC\plugins\demux\ÄÅØÈÔÐÀÒÎÐ.txt 9d9afba0fc3a930a117b8905b4ee4821bb5e922794306aac084a1b1e51b0391a.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_2019.125.2243.0_neutral_~_8wekyb3d8bbwe\AppxMetadata\AppxBundleManifest.xml 9d9afba0fc3a930a117b8905b4ee4821bb5e922794306aac084a1b1e51b0391a.exe File created C:\Program Files\WindowsApps\Microsoft.StorePurchaseApp_11811.1001.18.0_x64__8wekyb3d8bbwe\Store.Purchase\Controls\ÄÅØÈÔÐÀÒÎÐ.txt 9d9afba0fc3a930a117b8905b4ee4821bb5e922794306aac084a1b1e51b0391a.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\images\themes\dark\ÄÅØÈÔÐÀÒÎÐ.txt 9d9afba0fc3a930a117b8905b4ee4821bb5e922794306aac084a1b1e51b0391a.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\editpdf\js\nls\pt-br\ÄÅØÈÔÐÀÒÎÐ.txt 9d9afba0fc3a930a117b8905b4ee4821bb5e922794306aac084a1b1e51b0391a.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\reviews\js\nls\de-de\ÄÅØÈÔÐÀÒÎÐ.txt 9d9afba0fc3a930a117b8905b4ee4821bb5e922794306aac084a1b1e51b0391a.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\task-handler\js\nls\fr-fr\ÄÅØÈÔÐÀÒÎÐ.txt 9d9afba0fc3a930a117b8905b4ee4821bb5e922794306aac084a1b1e51b0391a.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\visualvm\update_tracking\com-sun-tools-visualvm-jvmstat.xml 9d9afba0fc3a930a117b8905b4ee4821bb5e922794306aac084a1b1e51b0391a.exe File created C:\Program Files\WindowsApps\Microsoft.ZuneMusic_10.19071.19011.0_x64__8wekyb3d8bbwe\Images\ÄÅØÈÔÐÀÒÎÐ.txt 9d9afba0fc3a930a117b8905b4ee4821bb5e922794306aac084a1b1e51b0391a.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\js\nls\en-ae\ÄÅØÈÔÐÀÒÎÐ.txt 9d9afba0fc3a930a117b8905b4ee4821bb5e922794306aac084a1b1e51b0391a.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\swiftshader\ÄÅØÈÔÐÀÒÎÐ.txt 9d9afba0fc3a930a117b8905b4ee4821bb5e922794306aac084a1b1e51b0391a.exe File created C:\Program Files\VideoLAN\VLC\lua\http\css\ui-lightness\images\ÄÅØÈÔÐÀÒÎÐ.txt 9d9afba0fc3a930a117b8905b4ee4821bb5e922794306aac084a1b1e51b0391a.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.StorePurchaseApp_11811.1001.18.0_neutral_split.scale-100_8wekyb3d8bbwe\AppxBlockMap.xml 9d9afba0fc3a930a117b8905b4ee4821bb5e922794306aac084a1b1e51b0391a.exe File created C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_x64__8wekyb3d8bbwe\Assets\SecondaryTiles\Car\LTR\contrast-black\ÄÅØÈÔÐÀÒÎÐ.txt 9d9afba0fc3a930a117b8905b4ee4821bb5e922794306aac084a1b1e51b0391a.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\editpdf\js\nls\root\ÄÅØÈÔÐÀÒÎÐ.txt 9d9afba0fc3a930a117b8905b4ee4821bb5e922794306aac084a1b1e51b0391a.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\visualvm\config\Modules\com-sun-tools-visualvm-threaddump.xml 9d9afba0fc3a930a117b8905b4ee4821bb5e922794306aac084a1b1e51b0391a.exe File created C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\jsaddins\en-us\ÄÅØÈÔÐÀÒÎÐ.txt 9d9afba0fc3a930a117b8905b4ee4821bb5e922794306aac084a1b1e51b0391a.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\desktop-connector-files\js\nls\fi-fi\ÄÅØÈÔÐÀÒÎÐ.txt 9d9afba0fc3a930a117b8905b4ee4821bb5e922794306aac084a1b1e51b0391a.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\js\nls\cs-cz\ÄÅØÈÔÐÀÒÎÐ.txt 9d9afba0fc3a930a117b8905b4ee4821bb5e922794306aac084a1b1e51b0391a.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\search-summary\js\nls\hu-hu\ÄÅØÈÔÐÀÒÎÐ.txt 9d9afba0fc3a930a117b8905b4ee4821bb5e922794306aac084a1b1e51b0391a.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\config\Modules\org-openide-nodes.xml 9d9afba0fc3a930a117b8905b4ee4821bb5e922794306aac084a1b1e51b0391a.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\visualvm\update_tracking\com-sun-tools-visualvm-attach.xml 9d9afba0fc3a930a117b8905b4ee4821bb5e922794306aac084a1b1e51b0391a.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.MixedReality.Portal_2000.19081.1301.0_x64__8wekyb3d8bbwe\Assets\Background_RoomTracing_02.jpg 9d9afba0fc3a930a117b8905b4ee4821bb5e922794306aac084a1b1e51b0391a.exe File created C:\Program Files\WindowsApps\Microsoft.StorePurchaseApp_11811.1001.1813.0_neutral_~_8wekyb3d8bbwe\ÄÅØÈÔÐÀÒÎÐ.txt 9d9afba0fc3a930a117b8905b4ee4821bb5e922794306aac084a1b1e51b0391a.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\walk-through\js\nls\en-gb\ÄÅØÈÔÐÀÒÎÐ.txt 9d9afba0fc3a930a117b8905b4ee4821bb5e922794306aac084a1b1e51b0391a.exe File created C:\Program Files (x86)\Common Files\System\ja-JP\ÄÅØÈÔÐÀÒÎÐ.txt 9d9afba0fc3a930a117b8905b4ee4821bb5e922794306aac084a1b1e51b0391a.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\config\Modules\org-openide-compat.xml 9d9afba0fc3a930a117b8905b4ee4821bb5e922794306aac084a1b1e51b0391a.exe File opened for modification C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-0018-0409-1000-0000000FF1CE.xml 9d9afba0fc3a930a117b8905b4ee4821bb5e922794306aac084a1b1e51b0391a.exe File opened for modification C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Fonts\Cambria.xml 9d9afba0fc3a930a117b8905b4ee4821bb5e922794306aac084a1b1e51b0391a.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer-select\js\nls\it-it\ÄÅØÈÔÐÀÒÎÐ.txt 9d9afba0fc3a930a117b8905b4ee4821bb5e922794306aac084a1b1e51b0391a.exe File created C:\Program Files\Java\jre1.8.0_66\lib\jfr\ÄÅØÈÔÐÀÒÎÐ.txt 9d9afba0fc3a930a117b8905b4ee4821bb5e922794306aac084a1b1e51b0391a.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\officeinventoryagentlogon.xml 9d9afba0fc3a930a117b8905b4ee4821bb5e922794306aac084a1b1e51b0391a.exe File created C:\Program Files\Microsoft Office\root\Office16\MSIPC\fr\ÄÅØÈÔÐÀÒÎÐ.txt 9d9afba0fc3a930a117b8905b4ee4821bb5e922794306aac084a1b1e51b0391a.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\ro-ro\ÄÅØÈÔÐÀÒÎÐ.txt 9d9afba0fc3a930a117b8905b4ee4821bb5e922794306aac084a1b1e51b0391a.exe File created C:\Program Files (x86)\Windows NT\Accessories\ÄÅØÈÔÐÀÒÎÐ.txt 9d9afba0fc3a930a117b8905b4ee4821bb5e922794306aac084a1b1e51b0391a.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\update_tracking\org-netbeans-core-multitabs.xml 9d9afba0fc3a930a117b8905b4ee4821bb5e922794306aac084a1b1e51b0391a.exe File created C:\Program Files\WindowsApps\Microsoft.MSPaint_6.1907.29027.0_x64__8wekyb3d8bbwe\Assets\Images\Stickers\ÄÅØÈÔÐÀÒÎÐ.txt 9d9afba0fc3a930a117b8905b4ee4821bb5e922794306aac084a1b1e51b0391a.exe File created C:\Program Files\WindowsApps\Microsoft.WindowsCamera_2018.826.98.0_neutral_~_8wekyb3d8bbwe\AppxMetadata\ÄÅØÈÔÐÀÒÎÐ.txt 9d9afba0fc3a930a117b8905b4ee4821bb5e922794306aac084a1b1e51b0391a.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\zh-tw\ÄÅØÈÔÐÀÒÎÐ.txt 9d9afba0fc3a930a117b8905b4ee4821bb5e922794306aac084a1b1e51b0391a.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\config\Modules\org-netbeans-core-ui.xml 9d9afba0fc3a930a117b8905b4ee4821bb5e922794306aac084a1b1e51b0391a.exe File created C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_2019.125.2243.0_neutral_~_8wekyb3d8bbwe\AppxMetadata\ÄÅØÈÔÐÀÒÎÐ.txt 9d9afba0fc3a930a117b8905b4ee4821bb5e922794306aac084a1b1e51b0391a.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sign-services-auth\js\nls\ca-es\ÄÅØÈÔÐÀÒÎÐ.txt 9d9afba0fc3a930a117b8905b4ee4821bb5e922794306aac084a1b1e51b0391a.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\manifests\BuiltinOnboardingCommands.xml 9d9afba0fc3a930a117b8905b4ee4821bb5e922794306aac084a1b1e51b0391a.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\search-summary\js\nls\eu-es\ÄÅØÈÔÐÀÒÎÐ.txt 9d9afba0fc3a930a117b8905b4ee4821bb5e922794306aac084a1b1e51b0391a.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sign-services-auth\js\nls\es-es\ÄÅØÈÔÐÀÒÎÐ.txt 9d9afba0fc3a930a117b8905b4ee4821bb5e922794306aac084a1b1e51b0391a.exe File created C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\update_tracking\ÄÅØÈÔÐÀÒÎÐ.txt 9d9afba0fc3a930a117b8905b4ee4821bb5e922794306aac084a1b1e51b0391a.exe File created C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsCamera_2018.826.98.0_neutral_split.scale-200_8wekyb3d8bbwe\Assets\WindowsIcons\ÄÅØÈÔÐÀÒÎÐ.txt 9d9afba0fc3a930a117b8905b4ee4821bb5e922794306aac084a1b1e51b0391a.exe File created C:\Program Files\WindowsApps\Microsoft.BingWeather_4.25.20211.0_x64__8wekyb3d8bbwe\Microsoft.Msn.Shell\Themes\Glyphs\Font\ÄÅØÈÔÐÀÒÎÐ.txt 9d9afba0fc3a930a117b8905b4ee4821bb5e922794306aac084a1b1e51b0391a.exe -
Modifies registry class 10 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\EORCUJXLNELSWAO\shell 9d9afba0fc3a930a117b8905b4ee4821bb5e922794306aac084a1b1e51b0391a.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\EORCUJXLNELSWAO\shell\open 9d9afba0fc3a930a117b8905b4ee4821bb5e922794306aac084a1b1e51b0391a.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\EORCUJXLNELSWAO\shell\open\command\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\63596J48vG1Qq2M.exe" 9d9afba0fc3a930a117b8905b4ee4821bb5e922794306aac084a1b1e51b0391a.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\EORCUJXLNELSWAO\ = "CRYPTED!" 9d9afba0fc3a930a117b8905b4ee4821bb5e922794306aac084a1b1e51b0391a.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\EORCUJXLNELSWAO\DefaultIcon\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\63596J48vG1Qq2M.exe,0" 9d9afba0fc3a930a117b8905b4ee4821bb5e922794306aac084a1b1e51b0391a.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\EORCUJXLNELSWAO 9d9afba0fc3a930a117b8905b4ee4821bb5e922794306aac084a1b1e51b0391a.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\EORCUJXLNELSWAO\DefaultIcon 9d9afba0fc3a930a117b8905b4ee4821bb5e922794306aac084a1b1e51b0391a.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\EORCUJXLNELSWAO\shell\open\command 9d9afba0fc3a930a117b8905b4ee4821bb5e922794306aac084a1b1e51b0391a.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.50027 9d9afba0fc3a930a117b8905b4ee4821bb5e922794306aac084a1b1e51b0391a.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.50027\ = "EORCUJXLNELSWAO" 9d9afba0fc3a930a117b8905b4ee4821bb5e922794306aac084a1b1e51b0391a.exe