Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
177s -
max time network
194s -
platform
windows10-2004_x64 -
resource
win10v2004-20221111-en -
resource tags
arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system -
submitted
29/11/2022, 08:41
Static task
static1
Behavioral task
behavioral1
Sample
2118417b1b796fd386e01651b5a8b7c6cd380c5e4626b9ff255215eb1b1543da.exe
Resource
win7-20220901-en
windows7-x64
2 signatures
150 seconds
Behavioral task
behavioral2
Sample
2118417b1b796fd386e01651b5a8b7c6cd380c5e4626b9ff255215eb1b1543da.exe
Resource
win10v2004-20221111-en
windows10-2004-x64
2 signatures
150 seconds
General
-
Target
2118417b1b796fd386e01651b5a8b7c6cd380c5e4626b9ff255215eb1b1543da.exe
-
Size
30KB
-
MD5
0c7e5a8a06d25a02e3d2f575efc69330
-
SHA1
166106326c853686be258c962ae160db438a4b31
-
SHA256
2118417b1b796fd386e01651b5a8b7c6cd380c5e4626b9ff255215eb1b1543da
-
SHA512
def0fb9fb7b85390183db48670e233a30bcc8e4d4d82639b918255b582945e772f5d6cfcafaf6454165758792a01121f152565ae1c26f830df090ae34423e0f7
-
SSDEEP
192:0TD0cOQ2IwkW8jAbKpWwD42FC/8eFWY4Wgh9IBcdtM2w0ik:pcZR9jyKpWwDjFlyWY4WXc/C0v
Score
5/10
Malware Config
Signatures
-
Drops file in System32 directory 64 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\SystemUWPLauncher.exe 2118417b1b796fd386e01651b5a8b7c6cd380c5e4626b9ff255215eb1b1543da.exe File opened for modification C:\Windows\SysWOW64\wermgr.exe 2118417b1b796fd386e01651b5a8b7c6cd380c5e4626b9ff255215eb1b1543da.exe File opened for modification C:\Windows\SysWOW64\ddodiag.exe 2118417b1b796fd386e01651b5a8b7c6cd380c5e4626b9ff255215eb1b1543da.exe File opened for modification C:\Windows\SysWOW64\diskpart.exe 2118417b1b796fd386e01651b5a8b7c6cd380c5e4626b9ff255215eb1b1543da.exe File opened for modification C:\Windows\SysWOW64\gpresult.exe 2118417b1b796fd386e01651b5a8b7c6cd380c5e4626b9ff255215eb1b1543da.exe File opened for modification C:\Windows\SysWOW64\runas.exe 2118417b1b796fd386e01651b5a8b7c6cd380c5e4626b9ff255215eb1b1543da.exe File opened for modification C:\Windows\SysWOW64\SettingSyncHost.exe 2118417b1b796fd386e01651b5a8b7c6cd380c5e4626b9ff255215eb1b1543da.exe File opened for modification C:\Windows\SysWOW64\SndVol.exe 2118417b1b796fd386e01651b5a8b7c6cd380c5e4626b9ff255215eb1b1543da.exe File opened for modification C:\Windows\SysWOW64\wiaacmgr.exe 2118417b1b796fd386e01651b5a8b7c6cd380c5e4626b9ff255215eb1b1543da.exe File opened for modification C:\Windows\SysWOW64\wsmprovhost.exe 2118417b1b796fd386e01651b5a8b7c6cd380c5e4626b9ff255215eb1b1543da.exe File opened for modification C:\Windows\SysWOW64\xcopy.exe 2118417b1b796fd386e01651b5a8b7c6cd380c5e4626b9ff255215eb1b1543da.exe File opened for modification C:\Windows\SysWOW64\bitsadmin.exe 2118417b1b796fd386e01651b5a8b7c6cd380c5e4626b9ff255215eb1b1543da.exe File opened for modification C:\Windows\SysWOW64\clip.exe 2118417b1b796fd386e01651b5a8b7c6cd380c5e4626b9ff255215eb1b1543da.exe File opened for modification C:\Windows\SysWOW64\cmd.exe 2118417b1b796fd386e01651b5a8b7c6cd380c5e4626b9ff255215eb1b1543da.exe File opened for modification C:\Windows\SysWOW64\MRINFO.EXE 2118417b1b796fd386e01651b5a8b7c6cd380c5e4626b9ff255215eb1b1543da.exe File opened for modification C:\Windows\SysWOW64\verifiergui.exe 2118417b1b796fd386e01651b5a8b7c6cd380c5e4626b9ff255215eb1b1543da.exe File opened for modification C:\Windows\SysWOW64\GamePanel.exe 2118417b1b796fd386e01651b5a8b7c6cd380c5e4626b9ff255215eb1b1543da.exe File opened for modification C:\Windows\SysWOW64\poqexec.exe 2118417b1b796fd386e01651b5a8b7c6cd380c5e4626b9ff255215eb1b1543da.exe File opened for modification C:\Windows\SysWOW64\srdelayed.exe 2118417b1b796fd386e01651b5a8b7c6cd380c5e4626b9ff255215eb1b1543da.exe File opened for modification C:\Windows\SysWOW64\bthudtask.exe 2118417b1b796fd386e01651b5a8b7c6cd380c5e4626b9ff255215eb1b1543da.exe File opened for modification C:\Windows\SysWOW64\colorcpl.exe 2118417b1b796fd386e01651b5a8b7c6cd380c5e4626b9ff255215eb1b1543da.exe File opened for modification C:\Windows\SysWOW64\ieUnatt.exe 2118417b1b796fd386e01651b5a8b7c6cd380c5e4626b9ff255215eb1b1543da.exe File opened for modification C:\Windows\SysWOW64\RdpSa.exe 2118417b1b796fd386e01651b5a8b7c6cd380c5e4626b9ff255215eb1b1543da.exe File opened for modification C:\Windows\SysWOW64\CameraSettingsUIHost.exe 2118417b1b796fd386e01651b5a8b7c6cd380c5e4626b9ff255215eb1b1543da.exe File opened for modification C:\Windows\SysWOW64\dpapimig.exe 2118417b1b796fd386e01651b5a8b7c6cd380c5e4626b9ff255215eb1b1543da.exe File opened for modification C:\Windows\SysWOW64\fsquirt.exe 2118417b1b796fd386e01651b5a8b7c6cd380c5e4626b9ff255215eb1b1543da.exe File opened for modification C:\Windows\SysWOW64\isoburn.exe 2118417b1b796fd386e01651b5a8b7c6cd380c5e4626b9ff255215eb1b1543da.exe File opened for modification C:\Windows\SysWOW64\RmClient.exe 2118417b1b796fd386e01651b5a8b7c6cd380c5e4626b9ff255215eb1b1543da.exe File opened for modification C:\Windows\SysWOW64\RunLegacyCPLElevated.exe 2118417b1b796fd386e01651b5a8b7c6cd380c5e4626b9ff255215eb1b1543da.exe File opened for modification C:\Windows\SysWOW64\UserAccountControlSettings.exe 2118417b1b796fd386e01651b5a8b7c6cd380c5e4626b9ff255215eb1b1543da.exe File opened for modification C:\Windows\SysWOW64\cmdkey.exe 2118417b1b796fd386e01651b5a8b7c6cd380c5e4626b9ff255215eb1b1543da.exe File opened for modification C:\Windows\SysWOW64\gpscript.exe 2118417b1b796fd386e01651b5a8b7c6cd380c5e4626b9ff255215eb1b1543da.exe File opened for modification C:\Windows\SysWOW64\notepad.exe 2118417b1b796fd386e01651b5a8b7c6cd380c5e4626b9ff255215eb1b1543da.exe File opened for modification C:\Windows\SysWOW64\setupugc.exe 2118417b1b796fd386e01651b5a8b7c6cd380c5e4626b9ff255215eb1b1543da.exe File opened for modification C:\Windows\SysWOW64\shutdown.exe 2118417b1b796fd386e01651b5a8b7c6cd380c5e4626b9ff255215eb1b1543da.exe File opened for modification C:\Windows\SysWOW64\TpmTool.exe 2118417b1b796fd386e01651b5a8b7c6cd380c5e4626b9ff255215eb1b1543da.exe File opened for modification C:\Windows\SysWOW64\whoami.exe 2118417b1b796fd386e01651b5a8b7c6cd380c5e4626b9ff255215eb1b1543da.exe File opened for modification C:\Windows\SysWOW64\comp.exe 2118417b1b796fd386e01651b5a8b7c6cd380c5e4626b9ff255215eb1b1543da.exe File opened for modification C:\Windows\SysWOW64\Dism.exe 2118417b1b796fd386e01651b5a8b7c6cd380c5e4626b9ff255215eb1b1543da.exe File opened for modification C:\Windows\SysWOW64\dpnsvr.exe 2118417b1b796fd386e01651b5a8b7c6cd380c5e4626b9ff255215eb1b1543da.exe File opened for modification C:\Windows\SysWOW64\fixmapi.exe 2118417b1b796fd386e01651b5a8b7c6cd380c5e4626b9ff255215eb1b1543da.exe File opened for modification C:\Windows\SysWOW64\SystemPropertiesDataExecutionPrevention.exe 2118417b1b796fd386e01651b5a8b7c6cd380c5e4626b9ff255215eb1b1543da.exe File opened for modification C:\Windows\SysWOW64\TSTheme.exe 2118417b1b796fd386e01651b5a8b7c6cd380c5e4626b9ff255215eb1b1543da.exe File opened for modification C:\Windows\SysWOW64\attrib.exe 2118417b1b796fd386e01651b5a8b7c6cd380c5e4626b9ff255215eb1b1543da.exe File opened for modification C:\Windows\SysWOW64\choice.exe 2118417b1b796fd386e01651b5a8b7c6cd380c5e4626b9ff255215eb1b1543da.exe File opened for modification C:\Windows\SysWOW64\regedit.exe 2118417b1b796fd386e01651b5a8b7c6cd380c5e4626b9ff255215eb1b1543da.exe File opened for modification C:\Windows\SysWOW64\backgroundTaskHost.exe 2118417b1b796fd386e01651b5a8b7c6cd380c5e4626b9ff255215eb1b1543da.exe File opened for modification C:\Windows\SysWOW64\EaseOfAccessDialog.exe 2118417b1b796fd386e01651b5a8b7c6cd380c5e4626b9ff255215eb1b1543da.exe File opened for modification C:\Windows\SysWOW64\finger.exe 2118417b1b796fd386e01651b5a8b7c6cd380c5e4626b9ff255215eb1b1543da.exe File opened for modification C:\Windows\SysWOW64\InfDefaultInstall.exe 2118417b1b796fd386e01651b5a8b7c6cd380c5e4626b9ff255215eb1b1543da.exe File opened for modification C:\Windows\SysWOW64\mtstocom.exe 2118417b1b796fd386e01651b5a8b7c6cd380c5e4626b9ff255215eb1b1543da.exe File opened for modification C:\Windows\SysWOW64\upnpcont.exe 2118417b1b796fd386e01651b5a8b7c6cd380c5e4626b9ff255215eb1b1543da.exe File opened for modification C:\Windows\SysWOW64\Windows.Media.BackgroundPlayback.exe 2118417b1b796fd386e01651b5a8b7c6cd380c5e4626b9ff255215eb1b1543da.exe File opened for modification C:\Windows\SysWOW64\cmmon32.exe 2118417b1b796fd386e01651b5a8b7c6cd380c5e4626b9ff255215eb1b1543da.exe File opened for modification C:\Windows\SysWOW64\ComputerDefaults.exe 2118417b1b796fd386e01651b5a8b7c6cd380c5e4626b9ff255215eb1b1543da.exe File opened for modification C:\Windows\SysWOW64\msfeedssync.exe 2118417b1b796fd386e01651b5a8b7c6cd380c5e4626b9ff255215eb1b1543da.exe File opened for modification C:\Windows\SysWOW64\relog.exe 2118417b1b796fd386e01651b5a8b7c6cd380c5e4626b9ff255215eb1b1543da.exe File opened for modification C:\Windows\SysWOW64\RMActivate_ssp.exe 2118417b1b796fd386e01651b5a8b7c6cd380c5e4626b9ff255215eb1b1543da.exe File opened for modification C:\Windows\SysWOW64\where.exe 2118417b1b796fd386e01651b5a8b7c6cd380c5e4626b9ff255215eb1b1543da.exe File opened for modification C:\Windows\SysWOW64\userinit.exe 2118417b1b796fd386e01651b5a8b7c6cd380c5e4626b9ff255215eb1b1543da.exe File opened for modification C:\Windows\SysWOW64\WerFaultSecure.exe 2118417b1b796fd386e01651b5a8b7c6cd380c5e4626b9ff255215eb1b1543da.exe File opened for modification C:\Windows\SysWOW64\eventvwr.exe 2118417b1b796fd386e01651b5a8b7c6cd380c5e4626b9ff255215eb1b1543da.exe File opened for modification C:\Windows\SysWOW64\msdt.exe 2118417b1b796fd386e01651b5a8b7c6cd380c5e4626b9ff255215eb1b1543da.exe File opened for modification C:\Windows\SysWOW64\nslookup.exe 2118417b1b796fd386e01651b5a8b7c6cd380c5e4626b9ff255215eb1b1543da.exe -
Drops file in Windows directory 8 IoCs
description ioc Process File opened for modification C:\Windows\HelpPane.exe 2118417b1b796fd386e01651b5a8b7c6cd380c5e4626b9ff255215eb1b1543da.exe File opened for modification C:\Windows\hh.exe 2118417b1b796fd386e01651b5a8b7c6cd380c5e4626b9ff255215eb1b1543da.exe File opened for modification C:\Windows\notepad.exe 2118417b1b796fd386e01651b5a8b7c6cd380c5e4626b9ff255215eb1b1543da.exe File opened for modification C:\Windows\splwow64.exe 2118417b1b796fd386e01651b5a8b7c6cd380c5e4626b9ff255215eb1b1543da.exe File opened for modification C:\Windows\winhlp32.exe 2118417b1b796fd386e01651b5a8b7c6cd380c5e4626b9ff255215eb1b1543da.exe File opened for modification C:\Windows\write.exe 2118417b1b796fd386e01651b5a8b7c6cd380c5e4626b9ff255215eb1b1543da.exe File opened for modification C:\Windows\bfsvc.exe 2118417b1b796fd386e01651b5a8b7c6cd380c5e4626b9ff255215eb1b1543da.exe File opened for modification C:\Windows\explorer.exe 2118417b1b796fd386e01651b5a8b7c6cd380c5e4626b9ff255215eb1b1543da.exe