Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
151s -
max time network
43s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
16/10/2022, 07:22
Static task
static1
Behavioral task
behavioral1
Sample
8190b1e77f9e7b16db8e97ec8311affb789ac369d0d92c158b5b3b77e79e83d4.exe
Resource
win7-20220812-en
windows7-x64
9 signatures
150 seconds
General
-
Target
8190b1e77f9e7b16db8e97ec8311affb789ac369d0d92c158b5b3b77e79e83d4.exe
-
Size
1.2MB
-
MD5
a36815cebb90bdd7fa089e352653c453
-
SHA1
550ac30c3b1d84bd0860ce1fab40121b6efa5ae6
-
SHA256
8190b1e77f9e7b16db8e97ec8311affb789ac369d0d92c158b5b3b77e79e83d4
-
SHA512
71655a3f1d5a4ee6f3e258d2f4f2356e1d91bfd96aff9e060cffdfb3e6359e4e521881534a381d3e37a8b5d37ea31f4aa21d31fb274cbf89f7016475f824479d
-
SSDEEP
24576:lKKKKKKKKKKKKut89TMFZ2qrQHTdocJVZUrK2MtENe:Ut89TMn24QHTdRJVZUrK2MtENe
Score
9/10
Malware Config
Signatures
-
Deletes shadow copies 2 TTPs
Ransomware often targets backup files to inhibit system recovery.
-
Drops startup file 2 IoCs
description ioc Process File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Kaspersky.exe 8190b1e77f9e7b16db8e97ec8311affb789ac369d0d92c158b5b3b77e79e83d4.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Kaspersky.exe 8190b1e77f9e7b16db8e97ec8311affb789ac369d0d92c158b5b3b77e79e83d4.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Drops autorun.inf file 1 TTPs 3 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
description ioc Process File created C:\Users\Admin\AppData\Local\Temp\autorun.inf cmd.exe File opened for modification C:\Users\Admin\AppData\Local\Temp\autorun.inf cmd.exe File opened for modification C:\Users\Admin\AppData\Local\Temp\autorun.inf cmd.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\IACOM2.DLL 8190b1e77f9e7b16db8e97ec8311affb789ac369d0d92c158b5b3b77e79e83d4.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\Smart Tag\FPERSON.DLL 8190b1e77f9e7b16db8e97ec8311affb789ac369d0d92c158b5b3b77e79e83d4.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\ink\Microsoft.Ink.dll 8190b1e77f9e7b16db8e97ec8311affb789ac369d0d92c158b5b3b77e79e83d4.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\ink\tiptsf.dll 8190b1e77f9e7b16db8e97ec8311affb789ac369d0d92c158b5b3b77e79e83d4.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\ink\1.7\Microsoft.Ink.dll 8190b1e77f9e7b16db8e97ec8311affb789ac369d0d92c158b5b3b77e79e83d4.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\MUOPTIN.DLL 8190b1e77f9e7b16db8e97ec8311affb789ac369d0d92c158b5b3b77e79e83d4.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\MSOXMLMF.DLL 8190b1e77f9e7b16db8e97ec8311affb789ac369d0d92c158b5b3b77e79e83d4.exe File opened for modification C:\Program Files (x86)\Common Files\System\ado\msador15.dll 8190b1e77f9e7b16db8e97ec8311affb789ac369d0d92c158b5b3b77e79e83d4.exe File opened for modification C:\Program Files (x86)\Common Files\System\msadc\msdarem.dll 8190b1e77f9e7b16db8e97ec8311affb789ac369d0d92c158b5b3b77e79e83d4.exe File opened for modification C:\Program Files (x86)\Common Files\Adobe AIR\Versions\1.0\template.exe 8190b1e77f9e7b16db8e97ec8311affb789ac369d0d92c158b5b3b77e79e83d4.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\ink\rtscom.dll 8190b1e77f9e7b16db8e97ec8311affb789ac369d0d92c158b5b3b77e79e83d4.exe File opened for modification C:\Program Files (x86)\Common Files\System\Ole DB\msdaorar.dll 8190b1e77f9e7b16db8e97ec8311affb789ac369d0d92c158b5b3b77e79e83d4.exe File opened for modification C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroPDF.dll 8190b1e77f9e7b16db8e97ec8311affb789ac369d0d92c158b5b3b77e79e83d4.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\Help\1042\hxdsui.dll 8190b1e77f9e7b16db8e97ec8311affb789ac369d0d92c158b5b3b77e79e83d4.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\CsiSoap.dll 8190b1e77f9e7b16db8e97ec8311affb789ac369d0d92c158b5b3b77e79e83d4.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\1033\OARPMANR.DLL 8190b1e77f9e7b16db8e97ec8311affb789ac369d0d92c158b5b3b77e79e83d4.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\MSOXMLED.EXE 8190b1e77f9e7b16db8e97ec8311affb789ac369d0d92c158b5b3b77e79e83d4.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\ink\InkDiv.dll 8190b1e77f9e7b16db8e97ec8311affb789ac369d0d92c158b5b3b77e79e83d4.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\ink\skchobj.dll 8190b1e77f9e7b16db8e97ec8311affb789ac369d0d92c158b5b3b77e79e83d4.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\ink\skchui.dll 8190b1e77f9e7b16db8e97ec8311affb789ac369d0d92c158b5b3b77e79e83d4.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\EXP_XPS.DLL 8190b1e77f9e7b16db8e97ec8311affb789ac369d0d92c158b5b3b77e79e83d4.exe File opened for modification C:\Program Files (x86)\Common Files\Adobe\Updater6\AdobeUpdaterInstallMgr.exe 8190b1e77f9e7b16db8e97ec8311affb789ac369d0d92c158b5b3b77e79e83d4.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\ink\InkObj.dll 8190b1e77f9e7b16db8e97ec8311affb789ac369d0d92c158b5b3b77e79e83d4.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\ink\penusa.dll 8190b1e77f9e7b16db8e97ec8311affb789ac369d0d92c158b5b3b77e79e83d4.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\ink\pipanel.dll 8190b1e77f9e7b16db8e97ec8311affb789ac369d0d92c158b5b3b77e79e83d4.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Csi.dll 8190b1e77f9e7b16db8e97ec8311affb789ac369d0d92c158b5b3b77e79e83d4.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\Portal\PortalConnectCore.dll 8190b1e77f9e7b16db8e97ec8311affb789ac369d0d92c158b5b3b77e79e83d4.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\Portal\1033\PortalConnect.dll 8190b1e77f9e7b16db8e97ec8311affb789ac369d0d92c158b5b3b77e79e83d4.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\TextConv\WksConv\Wkconv.exe 8190b1e77f9e7b16db8e97ec8311affb789ac369d0d92c158b5b3b77e79e83d4.exe File opened for modification C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll 8190b1e77f9e7b16db8e97ec8311affb789ac369d0d92c158b5b3b77e79e83d4.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\ink\mshwgst.dll 8190b1e77f9e7b16db8e97ec8311affb789ac369d0d92c158b5b3b77e79e83d4.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\Web Folders\MSOSV.DLL 8190b1e77f9e7b16db8e97ec8311affb789ac369d0d92c158b5b3b77e79e83d4.exe File opened for modification C:\Program Files (x86)\Common Files\System\msadc\msdaprsr.dll 8190b1e77f9e7b16db8e97ec8311affb789ac369d0d92c158b5b3b77e79e83d4.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\Filters\odffilt.dll 8190b1e77f9e7b16db8e97ec8311affb789ac369d0d92c158b5b3b77e79e83d4.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\Help\1028\hxdsui.dll 8190b1e77f9e7b16db8e97ec8311affb789ac369d0d92c158b5b3b77e79e83d4.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\MSORES.DLL 8190b1e77f9e7b16db8e97ec8311affb789ac369d0d92c158b5b3b77e79e83d4.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\OSetupPS.dll 8190b1e77f9e7b16db8e97ec8311affb789ac369d0d92c158b5b3b77e79e83d4.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\Smart Tag\MOFL.DLL 8190b1e77f9e7b16db8e97ec8311affb789ac369d0d92c158b5b3b77e79e83d4.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\OPTINPS.DLL 8190b1e77f9e7b16db8e97ec8311affb789ac369d0d92c158b5b3b77e79e83d4.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\PROOF\MSLID.DLL 8190b1e77f9e7b16db8e97ec8311affb789ac369d0d92c158b5b3b77e79e83d4.exe File opened for modification C:\Program Files (x86)\Common Files\System\ado\msjro.dll 8190b1e77f9e7b16db8e97ec8311affb789ac369d0d92c158b5b3b77e79e83d4.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\Source Engine\OSE.EXE 8190b1e77f9e7b16db8e97ec8311affb789ac369d0d92c158b5b3b77e79e83d4.exe File opened for modification C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll 8190b1e77f9e7b16db8e97ec8311affb789ac369d0d92c158b5b3b77e79e83d4.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\EXPSRV.DLL 8190b1e77f9e7b16db8e97ec8311affb789ac369d0d92c158b5b3b77e79e83d4.exe File opened for modification C:\Program Files (x86)\Common Files\System\Ole DB\msdaurl.dll 8190b1e77f9e7b16db8e97ec8311affb789ac369d0d92c158b5b3b77e79e83d4.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\OfficeSoftwareProtectionPlatform\OSPPCEXT.DLL 8190b1e77f9e7b16db8e97ec8311affb789ac369d0d92c158b5b3b77e79e83d4.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\VSTO\10.0\1033\VSTOInstallerUI.dll 8190b1e77f9e7b16db8e97ec8311affb789ac369d0d92c158b5b3b77e79e83d4.exe File opened for modification C:\Program Files (x86)\Common Files\System\msadc\msadcfr.dll 8190b1e77f9e7b16db8e97ec8311affb789ac369d0d92c158b5b3b77e79e83d4.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\DW\DW20.EXE 8190b1e77f9e7b16db8e97ec8311affb789ac369d0d92c158b5b3b77e79e83d4.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\ink\mip.exe 8190b1e77f9e7b16db8e97ec8311affb789ac369d0d92c158b5b3b77e79e83d4.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\Help\1031\hxdsui.dll 8190b1e77f9e7b16db8e97ec8311affb789ac369d0d92c158b5b3b77e79e83d4.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\Smart Tag\METCONV.DLL 8190b1e77f9e7b16db8e97ec8311affb789ac369d0d92c158b5b3b77e79e83d4.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\VSTA\Pipeline.v10.0\AddInViews\Microsoft.Office.Tools.v9.0.dll 8190b1e77f9e7b16db8e97ec8311affb789ac369d0d92c158b5b3b77e79e83d4.exe File opened for modification C:\Program Files (x86)\Common Files\System\msadc\msadce.dll 8190b1e77f9e7b16db8e97ec8311affb789ac369d0d92c158b5b3b77e79e83d4.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\1033\ACEODBCI.DLL 8190b1e77f9e7b16db8e97ec8311affb789ac369d0d92c158b5b3b77e79e83d4.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\TRANSLAT\MSB1XTOR.DLL 8190b1e77f9e7b16db8e97ec8311affb789ac369d0d92c158b5b3b77e79e83d4.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\TRANSLAT\ESEN\MSB1ESEN.DLL 8190b1e77f9e7b16db8e97ec8311affb789ac369d0d92c158b5b3b77e79e83d4.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\VSTA\Pipeline.v10.0\HostSideAdapters\Microsoft.VisualStudio.Tools.Applications.HostAdapter.v10.0.dll 8190b1e77f9e7b16db8e97ec8311affb789ac369d0d92c158b5b3b77e79e83d4.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\VSTA\Pipeline.v10.0\HostSideAdapters\Microsoft.VisualStudio.Tools.Office.Outlook.HostAdapter.v10.0.dll 8190b1e77f9e7b16db8e97ec8311affb789ac369d0d92c158b5b3b77e79e83d4.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\ink\penjpn.dll 8190b1e77f9e7b16db8e97ec8311affb789ac369d0d92c158b5b3b77e79e83d4.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\VSTA\Pipeline.v10.0\HostSideAdapters\Microsoft.VisualStudio.Tools.Office.HostAdapter.v10.0.dll 8190b1e77f9e7b16db8e97ec8311affb789ac369d0d92c158b5b3b77e79e83d4.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\MSEnv\PublicAssemblies\extensibility.dll 8190b1e77f9e7b16db8e97ec8311affb789ac369d0d92c158b5b3b77e79e83d4.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\ACETXT.DLL 8190b1e77f9e7b16db8e97ec8311affb789ac369d0d92c158b5b3b77e79e83d4.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\EURO\MSOEURO.DLL 8190b1e77f9e7b16db8e97ec8311affb789ac369d0d92c158b5b3b77e79e83d4.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Interacts with shadow copies 2 TTPs 1 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
pid Process 1724 vssadmin.exe -
Suspicious use of AdjustPrivilegeToken 5 IoCs
description pid Process Token: SeDebugPrivilege 784 8190b1e77f9e7b16db8e97ec8311affb789ac369d0d92c158b5b3b77e79e83d4.exe Token: SeDebugPrivilege 784 8190b1e77f9e7b16db8e97ec8311affb789ac369d0d92c158b5b3b77e79e83d4.exe Token: SeBackupPrivilege 1116 vssvc.exe Token: SeRestorePrivilege 1116 vssvc.exe Token: SeAuditPrivilege 1116 vssvc.exe -
Suspicious use of WriteProcessMemory 20 IoCs
description pid Process procid_target PID 784 wrote to memory of 980 784 8190b1e77f9e7b16db8e97ec8311affb789ac369d0d92c158b5b3b77e79e83d4.exe 26 PID 784 wrote to memory of 980 784 8190b1e77f9e7b16db8e97ec8311affb789ac369d0d92c158b5b3b77e79e83d4.exe 26 PID 784 wrote to memory of 980 784 8190b1e77f9e7b16db8e97ec8311affb789ac369d0d92c158b5b3b77e79e83d4.exe 26 PID 784 wrote to memory of 980 784 8190b1e77f9e7b16db8e97ec8311affb789ac369d0d92c158b5b3b77e79e83d4.exe 26 PID 980 wrote to memory of 1724 980 cmd.exe 28 PID 980 wrote to memory of 1724 980 cmd.exe 28 PID 980 wrote to memory of 1724 980 cmd.exe 28 PID 980 wrote to memory of 1724 980 cmd.exe 28 PID 784 wrote to memory of 660 784 8190b1e77f9e7b16db8e97ec8311affb789ac369d0d92c158b5b3b77e79e83d4.exe 30 PID 784 wrote to memory of 660 784 8190b1e77f9e7b16db8e97ec8311affb789ac369d0d92c158b5b3b77e79e83d4.exe 30 PID 784 wrote to memory of 660 784 8190b1e77f9e7b16db8e97ec8311affb789ac369d0d92c158b5b3b77e79e83d4.exe 30 PID 784 wrote to memory of 660 784 8190b1e77f9e7b16db8e97ec8311affb789ac369d0d92c158b5b3b77e79e83d4.exe 30 PID 784 wrote to memory of 1180 784 8190b1e77f9e7b16db8e97ec8311affb789ac369d0d92c158b5b3b77e79e83d4.exe 32 PID 784 wrote to memory of 1180 784 8190b1e77f9e7b16db8e97ec8311affb789ac369d0d92c158b5b3b77e79e83d4.exe 32 PID 784 wrote to memory of 1180 784 8190b1e77f9e7b16db8e97ec8311affb789ac369d0d92c158b5b3b77e79e83d4.exe 32 PID 784 wrote to memory of 1180 784 8190b1e77f9e7b16db8e97ec8311affb789ac369d0d92c158b5b3b77e79e83d4.exe 32 PID 784 wrote to memory of 1292 784 8190b1e77f9e7b16db8e97ec8311affb789ac369d0d92c158b5b3b77e79e83d4.exe 34 PID 784 wrote to memory of 1292 784 8190b1e77f9e7b16db8e97ec8311affb789ac369d0d92c158b5b3b77e79e83d4.exe 34 PID 784 wrote to memory of 1292 784 8190b1e77f9e7b16db8e97ec8311affb789ac369d0d92c158b5b3b77e79e83d4.exe 34 PID 784 wrote to memory of 1292 784 8190b1e77f9e7b16db8e97ec8311affb789ac369d0d92c158b5b3b77e79e83d4.exe 34
Processes
-
C:\Users\Admin\AppData\Local\Temp\8190b1e77f9e7b16db8e97ec8311affb789ac369d0d92c158b5b3b77e79e83d4.exe"C:\Users\Admin\AppData\Local\Temp\8190b1e77f9e7b16db8e97ec8311affb789ac369d0d92c158b5b3b77e79e83d4.exe"1⤵
- Drops startup file
- Drops file in Program Files directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:784 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C vssadmin delete shadows /all /quiet && wmic shadowcopy delete2⤵
- Suspicious use of WriteProcessMemory
PID:980 -
C:\Windows\SysWOW64\vssadmin.exevssadmin delete shadows /all /quiet3⤵
- Interacts with shadow copies
PID:1724
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C echo ^[autorun^] >autorun.inf2⤵
- Drops autorun.inf file
PID:660
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C echo ^open^=KasperskyScan^.exe >>autorun.inf2⤵
- Drops autorun.inf file
PID:1180
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C echo ^execute=^KasperskyScan^.exe >>autorun.inf2⤵
- Drops autorun.inf file
PID:1292
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1116
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
12B
MD57b74b59eb512d0797b7f12bf5176b8c4
SHA11ff3e7eea7883a65abf79353a6039dfcd518f4da
SHA25650c692a2d0e822df720c66654c601a49d1d23bbe0c329624c02a97564a738a27
SHA5123f46b9cddad177a21ba6b52928c739821aa108ab92da4c907a8808689782ce3fa2036381912b267b02c0daabd992f11cde0ea867082d8d336e53d8ec79435a29
-
Filesize
65B
MD5fbefa88e6b51c05dd63d97dfdbeb3589
SHA167e09918d878c6615befab5dc9194439027f268d
SHA2563861acedffd29452d2fdb96728f7347652bde9353915d3873a7414843f49b8b1
SHA51258f8c1a64f2eb21be7b96db335d1ade0ce0878566a8386b3689b650132ca28e14761b20fdfe50f2af9915dff2bdd3a5b07f6f3ed082e4e6998ec5f0cd052f12f
-
Filesize
65B
MD5fbefa88e6b51c05dd63d97dfdbeb3589
SHA167e09918d878c6615befab5dc9194439027f268d
SHA2563861acedffd29452d2fdb96728f7347652bde9353915d3873a7414843f49b8b1
SHA51258f8c1a64f2eb21be7b96db335d1ade0ce0878566a8386b3689b650132ca28e14761b20fdfe50f2af9915dff2bdd3a5b07f6f3ed082e4e6998ec5f0cd052f12f