Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
43s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
17/10/2022, 07:27
Static task
static1
Behavioral task
behavioral1
Sample
4de628bdc666391026c46d5716fa3978d654ae9d0465d12a5c58ead1e98e2b51.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
4de628bdc666391026c46d5716fa3978d654ae9d0465d12a5c58ead1e98e2b51.exe
Resource
win10v2004-20220812-en
General
-
Target
4de628bdc666391026c46d5716fa3978d654ae9d0465d12a5c58ead1e98e2b51.exe
-
Size
253KB
-
MD5
fa04c93f3ef714871c20d6ed7b766a32
-
SHA1
6c1d5dc71479a5caf54b6488141784d65b5cf3b8
-
SHA256
4de628bdc666391026c46d5716fa3978d654ae9d0465d12a5c58ead1e98e2b51
-
SHA512
b6a1170fa188e9c7a951798b865d65833b1e8d8753e4be13a44c24bfae5a0d29e423ffd6c48647b6d26d5752cbb0ea4738d7be9c345e5f934a1a583ab9d1ff6f
-
SSDEEP
1536:W7ZhA7pApaX0aX09rDVMFDwU5LenTpnDr5LenTpnDRSfuR5LenTpnDr5LenTpnDS:6e7WpGlCKo
Malware Config
Signatures
-
Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\7-Zip\Lang\ps.txt.tmp 4de628bdc666391026c46d5716fa3978d654ae9d0465d12a5c58ead1e98e2b51.exe File created C:\Program Files\7-Zip\Lang\va.txt.tmp 4de628bdc666391026c46d5716fa3978d654ae9d0465d12a5c58ead1e98e2b51.exe File created C:\Program Files\Common Files\Microsoft Shared\Filters\offfiltx.dll.tmp 4de628bdc666391026c46d5716fa3978d654ae9d0465d12a5c58ead1e98e2b51.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\en-US\FlickLearningWizard.exe.mui.tmp 4de628bdc666391026c46d5716fa3978d654ae9d0465d12a5c58ead1e98e2b51.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\es-ES\FlickLearningWizard.exe.mui.tmp 4de628bdc666391026c46d5716fa3978d654ae9d0465d12a5c58ead1e98e2b51.exe File created C:\Program Files\7-Zip\Lang\ka.txt.tmp 4de628bdc666391026c46d5716fa3978d654ae9d0465d12a5c58ead1e98e2b51.exe File created C:\Program Files\7-Zip\Lang\ne.txt.tmp 4de628bdc666391026c46d5716fa3978d654ae9d0465d12a5c58ead1e98e2b51.exe File created C:\Program Files\Common Files\Microsoft Shared\Filters\VISFILT.DLL.tmp 4de628bdc666391026c46d5716fa3978d654ae9d0465d12a5c58ead1e98e2b51.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\hwrdeslm.dat.tmp 4de628bdc666391026c46d5716fa3978d654ae9d0465d12a5c58ead1e98e2b51.exe File created C:\Program Files\7-Zip\Lang\ro.txt.tmp 4de628bdc666391026c46d5716fa3978d654ae9d0465d12a5c58ead1e98e2b51.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\da-DK\tipresx.dll.mui.tmp 4de628bdc666391026c46d5716fa3978d654ae9d0465d12a5c58ead1e98e2b51.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\web.xml.tmp 4de628bdc666391026c46d5716fa3978d654ae9d0465d12a5c58ead1e98e2b51.exe File created C:\Program Files\7-Zip\Lang\bg.txt.tmp 4de628bdc666391026c46d5716fa3978d654ae9d0465d12a5c58ead1e98e2b51.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\base_rtl.xml.tmp 4de628bdc666391026c46d5716fa3978d654ae9d0465d12a5c58ead1e98e2b51.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\hwresmlm.dat.tmp 4de628bdc666391026c46d5716fa3978d654ae9d0465d12a5c58ead1e98e2b51.exe File created C:\Program Files\7-Zip\Lang\cs.txt.tmp 4de628bdc666391026c46d5716fa3978d654ae9d0465d12a5c58ead1e98e2b51.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\Alphabet.xml.tmp 4de628bdc666391026c46d5716fa3978d654ae9d0465d12a5c58ead1e98e2b51.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\he-IL\tipresx.dll.mui.tmp 4de628bdc666391026c46d5716fa3978d654ae9d0465d12a5c58ead1e98e2b51.exe File created C:\Program Files\7-Zip\Lang\en.ttt.tmp 4de628bdc666391026c46d5716fa3978d654ae9d0465d12a5c58ead1e98e2b51.exe File created C:\Program Files\7-Zip\Lang\eu.txt.tmp 4de628bdc666391026c46d5716fa3978d654ae9d0465d12a5c58ead1e98e2b51.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\en-US\IPSEventLogMsg.dll.mui.tmp 4de628bdc666391026c46d5716fa3978d654ae9d0465d12a5c58ead1e98e2b51.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\en-US\split.avi.tmp 4de628bdc666391026c46d5716fa3978d654ae9d0465d12a5c58ead1e98e2b51.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\FlickAnimation.avi.tmp 4de628bdc666391026c46d5716fa3978d654ae9d0465d12a5c58ead1e98e2b51.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\hwrenalm.dat.tmp 4de628bdc666391026c46d5716fa3978d654ae9d0465d12a5c58ead1e98e2b51.exe File created C:\Program Files\7-Zip\Lang\kk.txt.tmp 4de628bdc666391026c46d5716fa3978d654ae9d0465d12a5c58ead1e98e2b51.exe File created C:\Program Files\7-Zip\Lang\tr.txt.tmp 4de628bdc666391026c46d5716fa3978d654ae9d0465d12a5c58ead1e98e2b51.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\cs-CZ\tipresx.dll.mui.tmp 4de628bdc666391026c46d5716fa3978d654ae9d0465d12a5c58ead1e98e2b51.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\de-DE\IPSEventLogMsg.dll.mui.tmp 4de628bdc666391026c46d5716fa3978d654ae9d0465d12a5c58ead1e98e2b51.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\de-DE\rtscom.dll.mui.tmp 4de628bdc666391026c46d5716fa3978d654ae9d0465d12a5c58ead1e98e2b51.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\web\webbase.xml.tmp 4de628bdc666391026c46d5716fa3978d654ae9d0465d12a5c58ead1e98e2b51.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\es-ES\mip.exe.mui.tmp 4de628bdc666391026c46d5716fa3978d654ae9d0465d12a5c58ead1e98e2b51.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\base_kor.xml.tmp 4de628bdc666391026c46d5716fa3978d654ae9d0465d12a5c58ead1e98e2b51.exe File created C:\Program Files\7-Zip\7zCon.sfx.tmp 4de628bdc666391026c46d5716fa3978d654ae9d0465d12a5c58ead1e98e2b51.exe File created C:\Program Files\7-Zip\Lang\mng2.txt.tmp 4de628bdc666391026c46d5716fa3978d654ae9d0465d12a5c58ead1e98e2b51.exe File created C:\Program Files\7-Zip\Lang\el.txt.tmp 4de628bdc666391026c46d5716fa3978d654ae9d0465d12a5c58ead1e98e2b51.exe File created C:\Program Files\7-Zip\History.txt.tmp 4de628bdc666391026c46d5716fa3978d654ae9d0465d12a5c58ead1e98e2b51.exe File created C:\Program Files\7-Zip\Lang\cy.txt.tmp 4de628bdc666391026c46d5716fa3978d654ae9d0465d12a5c58ead1e98e2b51.exe File created C:\Program Files\7-Zip\Lang\sr-spc.txt.tmp 4de628bdc666391026c46d5716fa3978d654ae9d0465d12a5c58ead1e98e2b51.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\zh-phonetic.xml.tmp 4de628bdc666391026c46d5716fa3978d654ae9d0465d12a5c58ead1e98e2b51.exe File created C:\Program Files\7-Zip\Lang\mr.txt.tmp 4de628bdc666391026c46d5716fa3978d654ae9d0465d12a5c58ead1e98e2b51.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\es-ES\InkWatson.exe.mui.tmp 4de628bdc666391026c46d5716fa3978d654ae9d0465d12a5c58ead1e98e2b51.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\es-ES\InputPersonalization.exe.mui.tmp 4de628bdc666391026c46d5716fa3978d654ae9d0465d12a5c58ead1e98e2b51.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\es-ES\TipRes.dll.mui.tmp 4de628bdc666391026c46d5716fa3978d654ae9d0465d12a5c58ead1e98e2b51.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\fr-FR\InkWatson.exe.mui.tmp 4de628bdc666391026c46d5716fa3978d654ae9d0465d12a5c58ead1e98e2b51.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\symbols\symbase.xml.tmp 4de628bdc666391026c46d5716fa3978d654ae9d0465d12a5c58ead1e98e2b51.exe File created C:\Program Files\7-Zip\Lang\gl.txt.tmp 4de628bdc666391026c46d5716fa3978d654ae9d0465d12a5c58ead1e98e2b51.exe File created C:\Program Files\7-Zip\Lang\hi.txt.tmp 4de628bdc666391026c46d5716fa3978d654ae9d0465d12a5c58ead1e98e2b51.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\fr-FR\mshwLatin.dll.mui.tmp 4de628bdc666391026c46d5716fa3978d654ae9d0465d12a5c58ead1e98e2b51.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\numbers\numbase.xml.tmp 4de628bdc666391026c46d5716fa3978d654ae9d0465d12a5c58ead1e98e2b51.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\es-ES\IPSEventLogMsg.dll.mui.tmp 4de628bdc666391026c46d5716fa3978d654ae9d0465d12a5c58ead1e98e2b51.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\fr-FR\InputPersonalization.exe.mui.tmp 4de628bdc666391026c46d5716fa3978d654ae9d0465d12a5c58ead1e98e2b51.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\osknumpad.xml.tmp 4de628bdc666391026c46d5716fa3978d654ae9d0465d12a5c58ead1e98e2b51.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\oskpred\oskpredbase.xml.tmp 4de628bdc666391026c46d5716fa3978d654ae9d0465d12a5c58ead1e98e2b51.exe File created C:\Program Files\7-Zip\Lang\ca.txt.tmp 4de628bdc666391026c46d5716fa3978d654ae9d0465d12a5c58ead1e98e2b51.exe File created C:\Program Files\7-Zip\License.txt.tmp 4de628bdc666391026c46d5716fa3978d654ae9d0465d12a5c58ead1e98e2b51.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\hwrdeulm.dat.tmp 4de628bdc666391026c46d5716fa3978d654ae9d0465d12a5c58ead1e98e2b51.exe File created C:\Program Files\7-Zip\Lang\eo.txt.tmp 4de628bdc666391026c46d5716fa3978d654ae9d0465d12a5c58ead1e98e2b51.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\fr-FR\TipBand.dll.mui.tmp 4de628bdc666391026c46d5716fa3978d654ae9d0465d12a5c58ead1e98e2b51.exe File created C:\Program Files\7-Zip\Lang\ba.txt.tmp 4de628bdc666391026c46d5716fa3978d654ae9d0465d12a5c58ead1e98e2b51.exe File created C:\Program Files\7-Zip\Lang\kaa.txt.tmp 4de628bdc666391026c46d5716fa3978d654ae9d0465d12a5c58ead1e98e2b51.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\auxpad.xml.tmp 4de628bdc666391026c46d5716fa3978d654ae9d0465d12a5c58ead1e98e2b51.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\keypad\keypadbase.xml.tmp 4de628bdc666391026c46d5716fa3978d654ae9d0465d12a5c58ead1e98e2b51.exe File created C:\Program Files\7-Zip\Lang\fy.txt.tmp 4de628bdc666391026c46d5716fa3978d654ae9d0465d12a5c58ead1e98e2b51.exe File created C:\Program Files\7-Zip\Uninstall.exe.tmp 4de628bdc666391026c46d5716fa3978d654ae9d0465d12a5c58ead1e98e2b51.exe
Processes
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
253KB
MD579b5182175fb29822c5f73c765e49376
SHA1a056cdb17c698d93be59781a41205fc5a31627ef
SHA25627a26ac1047233f80b3f6c9206ecb59ad4105c82fb2a8007946bcc660c95b2f0
SHA512dfad4f3078b56e3e5843e5679ff3e66095d9535b9142bc66d4ad3870f59ca8e9d5d0151baafdac1a58e00af5846c2728fc8d35b1059fb654b7e28e4e0d703b21