Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
205s -
max time network
47s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
29/10/2022, 17:38
Static task
static1
Behavioral task
behavioral1
Sample
cfd3d25a2a7627709fe86fabe2d84d5b7f064fc55c5bcf94af50fd86bf3dc363.exe
Resource
win7-20220812-en
windows7-x64
1 signatures
150 seconds
Behavioral task
behavioral2
Sample
cfd3d25a2a7627709fe86fabe2d84d5b7f064fc55c5bcf94af50fd86bf3dc363.exe
Resource
win10v2004-20220812-en
windows10-2004-x64
2 signatures
150 seconds
General
-
Target
cfd3d25a2a7627709fe86fabe2d84d5b7f064fc55c5bcf94af50fd86bf3dc363.exe
-
Size
246KB
-
MD5
a34cafc34fdb780115c4c4caf187aa90
-
SHA1
c9757c8d8c8349c563f75fced79b025cd52f2538
-
SHA256
cfd3d25a2a7627709fe86fabe2d84d5b7f064fc55c5bcf94af50fd86bf3dc363
-
SHA512
31684eab4a85e87b30992e8449ea62f55df34c058a01c6203233df4d0865e0ea5d19e1039b447d70bc3cecdf2696ac5ec6e13a9e4d4b87d8b0edc6a8931cc242
-
SSDEEP
3072:h3BTstA+R1dqPlxK5QN/pJXpjK92i4lihCXroL8HafOafafhcZMjuHlE3Hh3B:haA+YfESS7RzSpc+
Score
4/10
Malware Config
Signatures
-
Drops file in Windows directory 64 IoCs
description ioc Process File created C:\Windows\ehome\MediaCenterWebLauncher.exe cfd3d25a2a7627709fe86fabe2d84d5b7f064fc55c5bcf94af50fd86bf3dc363.exe File created C:\Windows\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\ServiceModelReg.exe cfd3d25a2a7627709fe86fabe2d84d5b7f064fc55c5bcf94af50fd86bf3dc363.exe File created C:\Windows\Microsoft.NET\Framework64\v3.0\Windows Communication Foundation\ComSvcConfig.exe cfd3d25a2a7627709fe86fabe2d84d5b7f064fc55c5bcf94af50fd86bf3dc363.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exe cfd3d25a2a7627709fe86fabe2d84d5b7f064fc55c5bcf94af50fd86bf3dc363.exe File created C:\Windows\ehome\ehtray.exe cfd3d25a2a7627709fe86fabe2d84d5b7f064fc55c5bcf94af50fd86bf3dc363.exe File created C:\Windows\ehome\wow\ehexthost32.exe cfd3d25a2a7627709fe86fabe2d84d5b7f064fc55c5bcf94af50fd86bf3dc363.exe File created C:\Windows\Microsoft.NET\Framework\v2.0.50727\aspnet_regiis.exe cfd3d25a2a7627709fe86fabe2d84d5b7f064fc55c5bcf94af50fd86bf3dc363.exe File created C:\Windows\Microsoft.NET\Framework\v2.0.50727\IEExec.exe cfd3d25a2a7627709fe86fabe2d84d5b7f064fc55c5bcf94af50fd86bf3dc363.exe File created C:\Windows\Microsoft.NET\Framework\v2.0.50727\ilasm.exe cfd3d25a2a7627709fe86fabe2d84d5b7f064fc55c5bcf94af50fd86bf3dc363.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess32.exe cfd3d25a2a7627709fe86fabe2d84d5b7f064fc55c5bcf94af50fd86bf3dc363.exe File created C:\Windows\ehome\ehsched.exe cfd3d25a2a7627709fe86fabe2d84d5b7f064fc55c5bcf94af50fd86bf3dc363.exe File created C:\Windows\Microsoft.NET\Framework64\v2.0.50727\AppLaunch.exe cfd3d25a2a7627709fe86fabe2d84d5b7f064fc55c5bcf94af50fd86bf3dc363.exe File created C:\Windows\Microsoft.NET\Framework64\v2.0.50727\aspnet_regbrowsers.exe cfd3d25a2a7627709fe86fabe2d84d5b7f064fc55c5bcf94af50fd86bf3dc363.exe File created C:\Windows\Microsoft.NET\Framework64\v2.0.50727\IEExec.exe cfd3d25a2a7627709fe86fabe2d84d5b7f064fc55c5bcf94af50fd86bf3dc363.exe File created C:\Windows\Microsoft.NET\Framework64\v3.5\AddInProcess32.exe cfd3d25a2a7627709fe86fabe2d84d5b7f064fc55c5bcf94af50fd86bf3dc363.exe File opened for modification C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_wp.exe cfd3d25a2a7627709fe86fabe2d84d5b7f064fc55c5bcf94af50fd86bf3dc363.exe File created C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe cfd3d25a2a7627709fe86fabe2d84d5b7f064fc55c5bcf94af50fd86bf3dc363.exe File opened for modification C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe cfd3d25a2a7627709fe86fabe2d84d5b7f064fc55c5bcf94af50fd86bf3dc363.exe File opened for modification C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe cfd3d25a2a7627709fe86fabe2d84d5b7f064fc55c5bcf94af50fd86bf3dc363.exe File created C:\Windows\ehome\McrMgr.exe cfd3d25a2a7627709fe86fabe2d84d5b7f064fc55c5bcf94af50fd86bf3dc363.exe File opened for modification C:\Windows\Microsoft.NET\Framework\v4.0.30319\ComSvcConfig.exe cfd3d25a2a7627709fe86fabe2d84d5b7f064fc55c5bcf94af50fd86bf3dc363.exe File opened for modification C:\Windows\Microsoft.NET\Framework\v4.0.30319\ServiceModelReg.exe cfd3d25a2a7627709fe86fabe2d84d5b7f064fc55c5bcf94af50fd86bf3dc363.exe File created C:\Windows\Microsoft.NET\Framework64\v3.5\csc.exe cfd3d25a2a7627709fe86fabe2d84d5b7f064fc55c5bcf94af50fd86bf3dc363.exe File created C:\Windows\Microsoft.NET\Framework\v2.0.50727\aspnet_wp.exe cfd3d25a2a7627709fe86fabe2d84d5b7f064fc55c5bcf94af50fd86bf3dc363.exe File opened for modification C:\Windows\Microsoft.NET\Framework\v4.0.30319\DataSvcUtil.exe cfd3d25a2a7627709fe86fabe2d84d5b7f064fc55c5bcf94af50fd86bf3dc363.exe File opened for modification C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe cfd3d25a2a7627709fe86fabe2d84d5b7f064fc55c5bcf94af50fd86bf3dc363.exe File created C:\Windows\Microsoft.NET\Framework64\v2.0.50727\RegAsm.exe cfd3d25a2a7627709fe86fabe2d84d5b7f064fc55c5bcf94af50fd86bf3dc363.exe File created C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe cfd3d25a2a7627709fe86fabe2d84d5b7f064fc55c5bcf94af50fd86bf3dc363.exe File created C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe cfd3d25a2a7627709fe86fabe2d84d5b7f064fc55c5bcf94af50fd86bf3dc363.exe File created C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe cfd3d25a2a7627709fe86fabe2d84d5b7f064fc55c5bcf94af50fd86bf3dc363.exe File created C:\Windows\Microsoft.NET\Framework\NETFXSBS10.exe cfd3d25a2a7627709fe86fabe2d84d5b7f064fc55c5bcf94af50fd86bf3dc363.exe File opened for modification C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe cfd3d25a2a7627709fe86fabe2d84d5b7f064fc55c5bcf94af50fd86bf3dc363.exe File created C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ngen.exe cfd3d25a2a7627709fe86fabe2d84d5b7f064fc55c5bcf94af50fd86bf3dc363.exe File created C:\Windows\Microsoft.NET\Framework64\v3.0\Windows Communication Foundation\ServiceModelReg.exe cfd3d25a2a7627709fe86fabe2d84d5b7f064fc55c5bcf94af50fd86bf3dc363.exe File created C:\Windows\ehome\ehmsas.exe cfd3d25a2a7627709fe86fabe2d84d5b7f064fc55c5bcf94af50fd86bf3dc363.exe File created C:\Windows\Microsoft.NET\Framework\v2.0.50727\ngen.exe cfd3d25a2a7627709fe86fabe2d84d5b7f064fc55c5bcf94af50fd86bf3dc363.exe File opened for modification C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_state.exe cfd3d25a2a7627709fe86fabe2d84d5b7f064fc55c5bcf94af50fd86bf3dc363.exe File opened for modification C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe cfd3d25a2a7627709fe86fabe2d84d5b7f064fc55c5bcf94af50fd86bf3dc363.exe File created C:\Windows\Microsoft.NET\Framework64\v3.0\WPF\PresentationFontCache.exe cfd3d25a2a7627709fe86fabe2d84d5b7f064fc55c5bcf94af50fd86bf3dc363.exe File created C:\Windows\Microsoft.NET\Framework64\v3.5\AddInUtil.exe cfd3d25a2a7627709fe86fabe2d84d5b7f064fc55c5bcf94af50fd86bf3dc363.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AppLaunch.exe cfd3d25a2a7627709fe86fabe2d84d5b7f064fc55c5bcf94af50fd86bf3dc363.exe File created C:\Windows\ehome\mcspad.exe cfd3d25a2a7627709fe86fabe2d84d5b7f064fc55c5bcf94af50fd86bf3dc363.exe File created C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe cfd3d25a2a7627709fe86fabe2d84d5b7f064fc55c5bcf94af50fd86bf3dc363.exe File created C:\Windows\Microsoft.NET\Framework\v2.0.50727\aspnet_regbrowsers.exe cfd3d25a2a7627709fe86fabe2d84d5b7f064fc55c5bcf94af50fd86bf3dc363.exe File created C:\Windows\ehome\RegisterMCEApp.exe cfd3d25a2a7627709fe86fabe2d84d5b7f064fc55c5bcf94af50fd86bf3dc363.exe File opened for modification C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess.exe cfd3d25a2a7627709fe86fabe2d84d5b7f064fc55c5bcf94af50fd86bf3dc363.exe File opened for modification C:\Windows\Microsoft.NET\Framework\v4.0.30319\SMSvcHost.exe cfd3d25a2a7627709fe86fabe2d84d5b7f064fc55c5bcf94af50fd86bf3dc363.exe File opened for modification C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe cfd3d25a2a7627709fe86fabe2d84d5b7f064fc55c5bcf94af50fd86bf3dc363.exe File created C:\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorsvw.exe cfd3d25a2a7627709fe86fabe2d84d5b7f064fc55c5bcf94af50fd86bf3dc363.exe File created C:\Windows\Boot\PCAT\memtest.exe cfd3d25a2a7627709fe86fabe2d84d5b7f064fc55c5bcf94af50fd86bf3dc363.exe File created C:\Windows\Microsoft.NET\Framework64\v2.0.50727\aspnet_regsql.exe cfd3d25a2a7627709fe86fabe2d84d5b7f064fc55c5bcf94af50fd86bf3dc363.exe File created C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe cfd3d25a2a7627709fe86fabe2d84d5b7f064fc55c5bcf94af50fd86bf3dc363.exe File opened for modification C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regsql.exe cfd3d25a2a7627709fe86fabe2d84d5b7f064fc55c5bcf94af50fd86bf3dc363.exe File opened for modification C:\Windows\Microsoft.NET\Framework\v4.0.30319\regtlibv12.exe cfd3d25a2a7627709fe86fabe2d84d5b7f064fc55c5bcf94af50fd86bf3dc363.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_regiis.exe cfd3d25a2a7627709fe86fabe2d84d5b7f064fc55c5bcf94af50fd86bf3dc363.exe File opened for modification C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe cfd3d25a2a7627709fe86fabe2d84d5b7f064fc55c5bcf94af50fd86bf3dc363.exe File created C:\Windows\Microsoft.NET\Framework64\v2.0.50727\dw20.exe cfd3d25a2a7627709fe86fabe2d84d5b7f064fc55c5bcf94af50fd86bf3dc363.exe File created C:\Windows\hh.exe cfd3d25a2a7627709fe86fabe2d84d5b7f064fc55c5bcf94af50fd86bf3dc363.exe File created C:\Windows\ehome\ehrecvr.exe cfd3d25a2a7627709fe86fabe2d84d5b7f064fc55c5bcf94af50fd86bf3dc363.exe File created C:\Windows\Microsoft.NET\Framework\v3.5\csc.exe cfd3d25a2a7627709fe86fabe2d84d5b7f064fc55c5bcf94af50fd86bf3dc363.exe File created C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ilasm.exe cfd3d25a2a7627709fe86fabe2d84d5b7f064fc55c5bcf94af50fd86bf3dc363.exe File created C:\Windows\Microsoft.NET\Framework64\v2.0.50727\InstallUtil.exe cfd3d25a2a7627709fe86fabe2d84d5b7f064fc55c5bcf94af50fd86bf3dc363.exe File created C:\Windows\bfsvc.exe cfd3d25a2a7627709fe86fabe2d84d5b7f064fc55c5bcf94af50fd86bf3dc363.exe File created C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe cfd3d25a2a7627709fe86fabe2d84d5b7f064fc55c5bcf94af50fd86bf3dc363.exe