Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
250s -
max time network
336s -
platform
windows7_x64 -
resource
win7-20221111-en -
resource tags
arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system -
submitted
01/12/2022, 20:51
Behavioral task
behavioral1
Sample
832863ece8c7eced9395b8929b1557297feab33f8912210e8ff870ed849baab2.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
832863ece8c7eced9395b8929b1557297feab33f8912210e8ff870ed849baab2.exe
Resource
win10v2004-20220812-en
General
-
Target
832863ece8c7eced9395b8929b1557297feab33f8912210e8ff870ed849baab2.exe
-
Size
30KB
-
MD5
72070d73697bf0654b0fd0945145dba4
-
SHA1
00b5ffca350d130925ebca21c680f600eeaf6b3d
-
SHA256
832863ece8c7eced9395b8929b1557297feab33f8912210e8ff870ed849baab2
-
SHA512
7cee6e0f9607bbc029ada3befb08e7816fb467f25b7059bb26dc6d4aff8b3a83b00f1b5d4166729fa98ccf56119b36f11283909b24a2de2c514ea6da82ec8402
-
SSDEEP
384:qnIzTqDPuZ/guOipqmQUzoOaE4WXmeqCkAn1gfothwd6uAZvSdx691kxQ8623lel:q2qDPncqmVtHW0nBtrZvSdA9CxQo1A
Malware Config
Signatures
-
resource yara_rule behavioral1/memory/940-55-0x0000000000400000-0x0000000000425000-memory.dmp upx behavioral1/memory/940-57-0x0000000000400000-0x0000000000425000-memory.dmp upx behavioral1/memory/940-58-0x0000000000400000-0x0000000000425000-memory.dmp upx -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Sets desktop wallpaper using registry 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Local\\Temp\\fcjaejochlaejoch.bmp" 832863ece8c7eced9395b8929b1557297feab33f8912210e8ff870ed849baab2.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\PH02746U.BMP 832863ece8c7eced9395b8929b1557297feab33f8912210e8ff870ed849baab2.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveProjectToolset\TABOFF.JPG 832863ece8c7eced9395b8929b1557297feab33f8912210e8ff870ed849baab2.exe File opened for modification C:\Program Files (x86)\Microsoft Visual Studio 8\Common7\IDE\VSTA\ItemTemplates\VisualBasic\1033\SettingsInternal.zip 832863ece8c7eced9395b8929b1557297feab33f8912210e8ff870ed849baab2.exe File opened for modification C:\Program Files\7-Zip\Lang\eo.txt 832863ece8c7eced9395b8929b1557297feab33f8912210e8ff870ed849baab2.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0382959.JPG 832863ece8c7eced9395b8929b1557297feab33f8912210e8ff870ed849baab2.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\PH02074U.BMP 832863ece8c7eced9395b8929b1557297feab33f8912210e8ff870ed849baab2.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\PH02291U.BMP 832863ece8c7eced9395b8929b1557297feab33f8912210e8ff870ed849baab2.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolBMPs\NotifierWindowMask.bmp 832863ece8c7eced9395b8929b1557297feab33f8912210e8ff870ed849baab2.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\Calendar\CalendarToolIconImages.jpg 832863ece8c7eced9395b8929b1557297feab33f8912210e8ff870ed849baab2.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms\FormsViewAttachmentIconsMask.bmp 832863ece8c7eced9395b8929b1557297feab33f8912210e8ff870ed849baab2.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0148757.JPG 832863ece8c7eced9395b8929b1557297feab33f8912210e8ff870ed849baab2.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\PH03224I.JPG 832863ece8c7eced9395b8929b1557297feab33f8912210e8ff870ed849baab2.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\PH02757U.BMP 832863ece8c7eced9395b8929b1557297feab33f8912210e8ff870ed849baab2.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLN.XLS 832863ece8c7eced9395b8929b1557297feab33f8912210e8ff870ed849baab2.exe File opened for modification C:\Program Files (x86)\Microsoft Visual Studio 8\Common7\IDE\VSTA\ItemTemplates\CSharp\1033\AssemblyInfoInternal.zip 832863ece8c7eced9395b8929b1557297feab33f8912210e8ff870ed849baab2.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\Stationery\Stars.jpg 832863ece8c7eced9395b8929b1557297feab33f8912210e8ff870ed849baab2.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0179963.JPG 832863ece8c7eced9395b8929b1557297feab33f8912210e8ff870ed849baab2.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsViewAttachmentIcons.jpg 832863ece8c7eced9395b8929b1557297feab33f8912210e8ff870ed849baab2.exe File opened for modification C:\Program Files (x86)\Microsoft Visual Studio 8\Common7\IDE\VSTA\ItemTemplates\CSharp\1033\EmptyDatabase.zip 832863ece8c7eced9395b8929b1557297feab33f8912210e8ff870ed849baab2.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.babel.nls_eclipse_ja_4.4.0.v20140623020002\eclipse_update_120.jpg 832863ece8c7eced9395b8929b1557297feab33f8912210e8ff870ed849baab2.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolBMPs\PicturesToolIconImages.jpg 832863ece8c7eced9395b8929b1557297feab33f8912210e8ff870ed849baab2.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolBMPs\WebToolIconImagesMask.bmp 832863ece8c7eced9395b8929b1557297feab33f8912210e8ff870ed849baab2.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\CommonData\AlertImage_FileOff.jpg 832863ece8c7eced9395b8929b1557297feab33f8912210e8ff870ed849baab2.exe File opened for modification C:\Program Files (x86)\Windows NT\TableTextService\TableTextServiceSimplifiedQuanPin.txt 832863ece8c7eced9395b8929b1557297feab33f8912210e8ff870ed849baab2.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\Stationery\OrangeCircles.jpg 832863ece8c7eced9395b8929b1557297feab33f8912210e8ff870ed849baab2.exe File opened for modification C:\Program Files\VideoLAN\VLC\THANKS.txt 832863ece8c7eced9395b8929b1557297feab33f8912210e8ff870ed849baab2.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0384888.JPG 832863ece8c7eced9395b8929b1557297feab33f8912210e8ff870ed849baab2.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\PH01236U.BMP 832863ece8c7eced9395b8929b1557297feab33f8912210e8ff870ed849baab2.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveDocumentReview\MarkupIconImages.jpg 832863ece8c7eced9395b8929b1557297feab33f8912210e8ff870ed849baab2.exe File opened for modification C:\Program Files (x86)\Microsoft Visual Studio 8\Common7\IDE\VSTA\ItemTemplates\CSharp\1033\AssemblyInfo.zip 832863ece8c7eced9395b8929b1557297feab33f8912210e8ff870ed849baab2.exe File opened for modification C:\Program Files (x86)\Microsoft Visual Studio 8\Common7\IDE\VSTA\ItemTemplates\VisualBasic\1033\SplashScreen.zip 832863ece8c7eced9395b8929b1557297feab33f8912210e8ff870ed849baab2.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\rectangle_specialocc_Thumbnail.bmp 832863ece8c7eced9395b8929b1557297feab33f8912210e8ff870ed849baab2.exe File opened for modification C:\Program Files\Java\jre7\THIRDPARTYLICENSEREADME.txt 832863ece8c7eced9395b8929b1557297feab33f8912210e8ff870ed849baab2.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0382968.JPG 832863ece8c7eced9395b8929b1557297feab33f8912210e8ff870ed849baab2.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0386120.JPG 832863ece8c7eced9395b8929b1557297feab33f8912210e8ff870ed849baab2.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.babel.nls_eclipse_zh_4.4.0.v20140623020002\eclipse_update_120.jpg 832863ece8c7eced9395b8929b1557297feab33f8912210e8ff870ed849baab2.exe File opened for modification C:\Program Files\Windows Media Player\Network Sharing\wmpnss_bw32.jpg 832863ece8c7eced9395b8929b1557297feab33f8912210e8ff870ed849baab2.exe File opened for modification C:\Program Files\Windows NT\TableTextService\TableTextServiceSimplifiedShuangPin.txt 832863ece8c7eced9395b8929b1557297feab33f8912210e8ff870ed849baab2.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\Unicode\Mappings\Mac\ICELAND.TXT 832863ece8c7eced9395b8929b1557297feab33f8912210e8ff870ed849baab2.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolBMPs\NotifierWindowMaskRTL.bmp 832863ece8c7eced9395b8929b1557297feab33f8912210e8ff870ed849baab2.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolBMPs\TipsImage.jpg 832863ece8c7eced9395b8929b1557297feab33f8912210e8ff870ed849baab2.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\Stationery\SoftBlue.jpg 832863ece8c7eced9395b8929b1557297feab33f8912210e8ff870ed849baab2.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\Stationery\White_Chocolate.jpg 832863ece8c7eced9395b8929b1557297feab33f8912210e8ff870ed849baab2.exe File opened for modification C:\Program Files\Windows NT\TableTextService\TableTextServiceSimplifiedZhengMa.txt 832863ece8c7eced9395b8929b1557297feab33f8912210e8ff870ed849baab2.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0178639.JPG 832863ece8c7eced9395b8929b1557297feab33f8912210e8ff870ed849baab2.exe File opened for modification C:\Program Files (x86)\Microsoft Visual Studio 8\Common7\IDE\VSTA\ItemTemplates\CSharp\1033\AppConfigInternal.zip 832863ece8c7eced9395b8929b1557297feab33f8912210e8ff870ed849baab2.exe File opened for modification C:\Program Files\7-Zip\Lang\uz.txt 832863ece8c7eced9395b8929b1557297feab33f8912210e8ff870ed849baab2.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0145707.JPG 832863ece8c7eced9395b8929b1557297feab33f8912210e8ff870ed849baab2.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0382960.JPG 832863ece8c7eced9395b8929b1557297feab33f8912210e8ff870ed849baab2.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolBMPs\MessageAttachmentIconImages.jpg 832863ece8c7eced9395b8929b1557297feab33f8912210e8ff870ed849baab2.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\CommonData\AlertImage_High.jpg 832863ece8c7eced9395b8929b1557297feab33f8912210e8ff870ed849baab2.exe File opened for modification C:\Program Files (x86)\Microsoft Visual Studio 8\Common7\IDE\VSTA\ItemTemplates\VisualBasic\1033\Class.zip 832863ece8c7eced9395b8929b1557297feab33f8912210e8ff870ed849baab2.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\PH02752U.BMP 832863ece8c7eced9395b8929b1557297feab33f8912210e8ff870ed849baab2.exe File opened for modification C:\Program Files\7-Zip\Lang\be.txt 832863ece8c7eced9395b8929b1557297feab33f8912210e8ff870ed849baab2.exe File opened for modification C:\Program Files\7-Zip\Lang\tr.txt 832863ece8c7eced9395b8929b1557297feab33f8912210e8ff870ed849baab2.exe File opened for modification C:\Program Files\Microsoft Office\Office14\1033\Mso Example Intl Setup File B.txt 832863ece8c7eced9395b8929b1557297feab33f8912210e8ff870ed849baab2.exe File opened for modification C:\Program Files\VideoLAN\VLC\README.txt 832863ece8c7eced9395b8929b1557297feab33f8912210e8ff870ed849baab2.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0309480.JPG 832863ece8c7eced9395b8929b1557297feab33f8912210e8ff870ed849baab2.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0382969.JPG 832863ece8c7eced9395b8929b1557297feab33f8912210e8ff870ed849baab2.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0387882.JPG 832863ece8c7eced9395b8929b1557297feab33f8912210e8ff870ed849baab2.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\SAMPLES\SOLVSAMP.XLS 832863ece8c7eced9395b8929b1557297feab33f8912210e8ff870ed849baab2.exe File opened for modification C:\Program Files (x86)\Windows NT\TableTextService\TableTextServiceAmharic.txt 832863ece8c7eced9395b8929b1557297feab33f8912210e8ff870ed849baab2.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolBMPs\QuestionIconMask.bmp 832863ece8c7eced9395b8929b1557297feab33f8912210e8ff870ed849baab2.exe File opened for modification C:\Program Files\7-Zip\Lang\ar.txt 832863ece8c7eced9395b8929b1557297feab33f8912210e8ff870ed849baab2.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 940 wrote to memory of 1364 940 832863ece8c7eced9395b8929b1557297feab33f8912210e8ff870ed849baab2.exe 29 PID 940 wrote to memory of 1364 940 832863ece8c7eced9395b8929b1557297feab33f8912210e8ff870ed849baab2.exe 29 PID 940 wrote to memory of 1364 940 832863ece8c7eced9395b8929b1557297feab33f8912210e8ff870ed849baab2.exe 29 PID 940 wrote to memory of 1364 940 832863ece8c7eced9395b8929b1557297feab33f8912210e8ff870ed849baab2.exe 29
Processes
-
C:\Users\Admin\AppData\Local\Temp\832863ece8c7eced9395b8929b1557297feab33f8912210e8ff870ed849baab2.exe"C:\Users\Admin\AppData\Local\Temp\832863ece8c7eced9395b8929b1557297feab33f8912210e8ff870ed849baab2.exe"1⤵
- Sets desktop wallpaper using registry
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:940 -
C:\Windows\SysWOW64\NOTEPAD.EXE"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\HOW TO DECRYPT FILES.txt2⤵PID:1364
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD5e7c9d74ed45132eb6bbe2457d6d8b5e9
SHA1dce71d933878c0ac0140d968ba695c3d9db1b1b0
SHA256861fa41190282a7510a70eb90cf558817e6731e68ef55246fa67dc0c1c8df1fc
SHA5129435dbe2bf75eca50bf38cbd40d82e2764d3a9b843cc480adfc539250d232b62920eeb5ef68a1316152f3ef1c5d17b80e2f44bd112f59acc50ab10723fa82f5a