Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
152s -
max time network
160s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
03/12/2022, 22:36
Static task
static1
Behavioral task
behavioral1
Sample
ac742fab57cb2c5cea730ffdfa0a9d488cc8f3856ec48064d2eb3509f5fca576.exe
Resource
win7-20220812-en
windows7-x64
6 signatures
150 seconds
Behavioral task
behavioral2
Sample
ac742fab57cb2c5cea730ffdfa0a9d488cc8f3856ec48064d2eb3509f5fca576.exe
Resource
win10v2004-20220812-en
windows10-2004-x64
6 signatures
150 seconds
General
-
Target
ac742fab57cb2c5cea730ffdfa0a9d488cc8f3856ec48064d2eb3509f5fca576.exe
-
Size
3.9MB
-
MD5
53c4576f955148926c67946897dc57c2
-
SHA1
5d051a1a2b58a3952613b18b3153ef8763f74347
-
SHA256
ac742fab57cb2c5cea730ffdfa0a9d488cc8f3856ec48064d2eb3509f5fca576
-
SHA512
d3d74fb1e73f5ab4f89315640bdc994af64a649ba3968de7b853d44e963b4bce5c956a8aa711fd03489f9b975634ec641bb5ad1278633c6b56cdd754d23dbd39
-
SSDEEP
49152:GWzOILziX1he1Hxy1bp2KzMMp70nILDcO/fsBmLjRw6qpZmBZWyLaXMXW:GICFheu/2KzMMJiUQO/fsiR6vmBNLfm
Score
6/10
Malware Config
Signatures
-
Adds Run key to start application 2 TTPs 4 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run ac742fab57cb2c5cea730ffdfa0a9d488cc8f3856ec48064d2eb3509f5fca576.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunServices ac742fab57cb2c5cea730ffdfa0a9d488cc8f3856ec48064d2eb3509f5fca576.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\mircOffice = "C:\\Users\\Admin\\AppData\\Local\\Temp\\ac742fab57cb2c5cea730ffdfa0a9d488cc8f3856ec48064d2eb3509f5fca576.exe" ac742fab57cb2c5cea730ffdfa0a9d488cc8f3856ec48064d2eb3509f5fca576.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunServices\Officemirc = "C:\\Users\\Admin\\AppData\\Local\\Temp\\ac742fab57cb2c5cea730ffdfa0a9d488cc8f3856ec48064d2eb3509f5fca576.exe" ac742fab57cb2c5cea730ffdfa0a9d488cc8f3856ec48064d2eb3509f5fca576.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Drops file in System32 directory 1 IoCs
description ioc Process File created C:\Windows\SysWOW64\ntdll.dll.dll ac742fab57cb2c5cea730ffdfa0a9d488cc8f3856ec48064d2eb3509f5fca576.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files (x86)\Common Files\microsoft shared\Portal\PortalConnectCoreOffice14.0.4730.1010.exe ac742fab57cb2c5cea730ffdfa0a9d488cc8f3856ec48064d2eb3509f5fca576.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Document Parts\1033\14\BuildingBlocksd.exe ac742fab57cb2c5cea730ffdfa0a9d488cc8f3856ec48064d2eb3509f5fca576.exe File created C:\Program Files (x86)\Common Files\microsoft shared\VSTA\Pipeline.v10.0\AddInViews\VisualTools.exe ac742fab57cb2c5cea730ffdfa0a9d488cc8f3856ec48064d2eb3509f5fca576.exe File created C:\Program Files (x86)\Common Files\microsoft shared\GRPHFLT\wpgimp32Office.exe ac742fab57cb2c5cea730ffdfa0a9d488cc8f3856ec48064d2eb3509f5fca576.exe File opened for modification C:\Program Files (x86)\Windows NT\TableTextService\RCX30F3.tmp ac742fab57cb2c5cea730ffdfa0a9d488cc8f3856ec48064d2eb3509f5fca576.exe File opened for modification C:\Program Files (x86)\Windows Photo Viewer\de-DE\PhotoAcqMicrosoft.exe ac742fab57cb2c5cea730ffdfa0a9d488cc8f3856ec48064d2eb3509f5fca576.exe File created C:\Program Files (x86)\Windows Defender\mpasdescMsMpLics.exe ac742fab57cb2c5cea730ffdfa0a9d488cc8f3856ec48064d2eb3509f5fca576.exe File created C:\Program Files (x86)\Common Files\microsoft shared\VSTO\10.0\StudioVSTOInstaller10.0.21022.2.exe ac742fab57cb2c5cea730ffdfa0a9d488cc8f3856ec48064d2eb3509f5fca576.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\Portal\1033\OfficeMicrosoft.exe ac742fab57cb2c5cea730ffdfa0a9d488cc8f3856ec48064d2eb3509f5fca576.exe File created C:\Program Files (x86)\Windows NT\Accessories\fr-FR\wordpadSystme.exe ac742fab57cb2c5cea730ffdfa0a9d488cc8f3856ec48064d2eb3509f5fca576.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\OneNote\SendToOneNotePrintDriverFilterSendToOneNoteUI.exe ac742fab57cb2c5cea730ffdfa0a9d488cc8f3856ec48064d2eb3509f5fca576.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\Web Folders\MSOSVMicrosoft.exe ac742fab57cb2c5cea730ffdfa0a9d488cc8f3856ec48064d2eb3509f5fca576.exe File opened for modification C:\Program Files (x86)\Windows Media Player\es-ES\setupwmwmlaunch12.0.7600.163857.0907131255.exe ac742fab57cb2c5cea730ffdfa0a9d488cc8f3856ec48064d2eb3509f5fca576.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\Filters\FilterMicrosoft2010.1400.4746.1000.exe ac742fab57cb2c5cea730ffdfa0a9d488cc8f3856ec48064d2eb3509f5fca576.exe File created C:\Program Files (x86)\Windows Mail\OEIMPORTSystem6.1.7601.17514.exe ac742fab57cb2c5cea730ffdfa0a9d488cc8f3856ec48064d2eb3509f5fca576.exe File created C:\Program Files (x86)\Common Files\microsoft shared\MSClientDataMgr\DataClient14.0.4731.1000.exe ac742fab57cb2c5cea730ffdfa0a9d488cc8f3856ec48064d2eb3509f5fca576.exe File created C:\Program Files (x86)\Windows NT\TableTextService\it-IT\SystemWindows.exe ac742fab57cb2c5cea730ffdfa0a9d488cc8f3856ec48064d2eb3509f5fca576.exe File opened for modification C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\AUTOSHAP\GlobalOffice14.0.4730.1010.exe ac742fab57cb2c5cea730ffdfa0a9d488cc8f3856ec48064d2eb3509f5fca576.exe File created C:\Program Files (x86)\Common Files\System\es-ES\operativoMicrosoft.exe ac742fab57cb2c5cea730ffdfa0a9d488cc8f3856ec48064d2eb3509f5fca576.exe File created C:\Program Files (x86)\Microsoft Office\Office14\PROOF\3082\msgr3esmsgr3es.exe ac742fab57cb2c5cea730ffdfa0a9d488cc8f3856ec48064d2eb3509f5fca576.exe File created C:\Program Files (x86)\Windows Defender\en-US\WindowsSystem.exe ac742fab57cb2c5cea730ffdfa0a9d488cc8f3856ec48064d2eb3509f5fca576.exe File opened for modification C:\Program Files (x86)\Microsoft Analysis Services\AS OLEDB\10\Servermsmdsrv10.0.2733.0.exe ac742fab57cb2c5cea730ffdfa0a9d488cc8f3856ec48064d2eb3509f5fca576.exe File created C:\Program Files (x86)\Windows Media Player\fr-FR\Windowswmplayer.exe ac742fab57cb2c5cea730ffdfa0a9d488cc8f3856ec48064d2eb3509f5fca576.exe File created C:\Program Files (x86)\Common Files\microsoft shared\Help\1041\HXDSUIMicrosoftR.exe ac742fab57cb2c5cea730ffdfa0a9d488cc8f3856ec48064d2eb3509f5fca576.exe File opened for modification C:\Program Files (x86)\Common Files\System\ado\en-US\OperatingSystem.exe ac742fab57cb2c5cea730ffdfa0a9d488cc8f3856ec48064d2eb3509f5fca576.exe File created C:\Program Files (x86)\Common Files\System\Ole DB\SystemWindows.exe ac742fab57cb2c5cea730ffdfa0a9d488cc8f3856ec48064d2eb3509f5fca576.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\VBA\VBA7\1033\VisualBasic.exe ac742fab57cb2c5cea730ffdfa0a9d488cc8f3856ec48064d2eb3509f5fca576.exe File opened for modification C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.0\es\systemsystem.exe ac742fab57cb2c5cea730ffdfa0a9d488cc8f3856ec48064d2eb3509f5fca576.exe File created C:\Program Files (x86)\Common Files\microsoft shared\Help\1028\MicrosoftMicrosoft2.05.50727.4039.0507274000.exe ac742fab57cb2c5cea730ffdfa0a9d488cc8f3856ec48064d2eb3509f5fca576.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\TRANSLAT\msb1coreTranslation.exe ac742fab57cb2c5cea730ffdfa0a9d488cc8f3856ec48064d2eb3509f5fca576.exe File created C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AMT\AdobeUpdater9.0.0.0.exe ac742fab57cb2c5cea730ffdfa0a9d488cc8f3856ec48064d2eb3509f5fca576.exe File created C:\Program Files (x86)\Common Files\System\ado\en-US\OperatingSystem.exe ac742fab57cb2c5cea730ffdfa0a9d488cc8f3856ec48064d2eb3509f5fca576.exe File created C:\Program Files (x86)\Common Files\System\ado\es-ES\OperatingSystem6.1.7600.163857.0907131255.exe ac742fab57cb2c5cea730ffdfa0a9d488cc8f3856ec48064d2eb3509f5fca576.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\Help\1033\HelpMicrosoft.exe ac742fab57cb2c5cea730ffdfa0a9d488cc8f3856ec48064d2eb3509f5fca576.exe File created C:\Program Files (x86)\Common Files\microsoft shared\MSInfo\ja-JP\Microsoftmsinfo.exe ac742fab57cb2c5cea730ffdfa0a9d488cc8f3856ec48064d2eb3509f5fca576.exe File created C:\Program Files (x86)\Common Files\microsoft shared\Help\1046\HelpMicrosoft2.05.50727.4039.0507274000.exe ac742fab57cb2c5cea730ffdfa0a9d488cc8f3856ec48064d2eb3509f5fca576.exe File created C:\Program Files (x86)\Common Files\System\fr-FR\Microsoftdexploitation.exe ac742fab57cb2c5cea730ffdfa0a9d488cc8f3856ec48064d2eb3509f5fca576.exe File opened for modification C:\Program Files (x86)\Microsoft.NET\Primary Interop Assemblies\Visualtype.exe ac742fab57cb2c5cea730ffdfa0a9d488cc8f3856ec48064d2eb3509f5fca576.exe File opened for modification C:\Program Files (x86)\Common Files\System\msadc\ja-JP\SystemOperating.exe ac742fab57cb2c5cea730ffdfa0a9d488cc8f3856ec48064d2eb3509f5fca576.exe File created C:\Program Files (x86)\Adobe\Reader 9.0\Reader\VisualCoolType.exe ac742fab57cb2c5cea730ffdfa0a9d488cc8f3856ec48064d2eb3509f5fca576.exe File opened for modification C:\Program Files (x86)\Windows Defender\en-US\WindowsSystem.exe ac742fab57cb2c5cea730ffdfa0a9d488cc8f3856ec48064d2eb3509f5fca576.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\VSTA\AppInfoDocument\Microsoft.VisualStudio.Tools.Office.AppInfoDocument\VisualVisualStudio.exe ac742fab57cb2c5cea730ffdfa0a9d488cc8f3856ec48064d2eb3509f5fca576.exe File opened for modification C:\Program Files (x86)\Windows Sidebar\WindowsSystem.exe ac742fab57cb2c5cea730ffdfa0a9d488cc8f3856ec48064d2eb3509f5fca576.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\MSInfo\ja-JP\Microsoftmsinfo.exe ac742fab57cb2c5cea730ffdfa0a9d488cc8f3856ec48064d2eb3509f5fca576.exe File created C:\Program Files (x86)\Windows NT\TableTextService\es-ES\WindowsTableTextService.exe ac742fab57cb2c5cea730ffdfa0a9d488cc8f3856ec48064d2eb3509f5fca576.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\Help\3082\HXDSUIMicrosoft.exe ac742fab57cb2c5cea730ffdfa0a9d488cc8f3856ec48064d2eb3509f5fca576.exe File opened for modification C:\Program Files (x86)\Windows NT\Accessories\WindowsWindows.exe ac742fab57cb2c5cea730ffdfa0a9d488cc8f3856ec48064d2eb3509f5fca576.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\DW\MicrosoftError14.0.4750.1000.exe ac742fab57cb2c5cea730ffdfa0a9d488cc8f3856ec48064d2eb3509f5fca576.exe File created C:\Program Files (x86)\Common Files\microsoft shared\MSInfo\fr-FR\msinfomsinfo.exe ac742fab57cb2c5cea730ffdfa0a9d488cc8f3856ec48064d2eb3509f5fca576.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\1033\OfficeOffice.exe ac742fab57cb2c5cea730ffdfa0a9d488cc8f3856ec48064d2eb3509f5fca576.exe File opened for modification C:\Program Files (x86)\Windows NT\TableTextService\WindowsOperating.exe ac742fab57cb2c5cea730ffdfa0a9d488cc8f3856ec48064d2eb3509f5fca576.exe File opened for modification C:\Program Files (x86)\Windows NT\Accessories\en-US\WindowsOperating6.1.7600.163857.0907131255.exe ac742fab57cb2c5cea730ffdfa0a9d488cc8f3856ec48064d2eb3509f5fca576.exe File created C:\Program Files (x86)\Windows NT\Accessories\it-IT\WORDPADWindows6.1.7600.163857.0907131255.exe ac742fab57cb2c5cea730ffdfa0a9d488cc8f3856ec48064d2eb3509f5fca576.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\SPPlugins\ManagerAdobe.exe ac742fab57cb2c5cea730ffdfa0a9d488cc8f3856ec48064d2eb3509f5fca576.exe File opened for modification C:\Program Files (x86)\Windows Media Player\ja-JP\OperatingWindows.exe ac742fab57cb2c5cea730ffdfa0a9d488cc8f3856ec48064d2eb3509f5fca576.exe File created C:\Program Files (x86)\Common Files\microsoft shared\ink\it-IT\RTSComWindows6.1.7600.16385.exe ac742fab57cb2c5cea730ffdfa0a9d488cc8f3856ec48064d2eb3509f5fca576.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\MSInfo\es-ES\Sistemaoperativo.exe ac742fab57cb2c5cea730ffdfa0a9d488cc8f3856ec48064d2eb3509f5fca576.exe File created C:\Program Files (x86)\Common Files\microsoft shared\Help\2052\HXDSUIMicrosoft.exe ac742fab57cb2c5cea730ffdfa0a9d488cc8f3856ec48064d2eb3509f5fca576.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\Help\1046\HelpMicrosoft2.05.50727.4039.0507274000.exe ac742fab57cb2c5cea730ffdfa0a9d488cc8f3856ec48064d2eb3509f5fca576.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\TRANSLAT\FREN\TranslationOffice.exe ac742fab57cb2c5cea730ffdfa0a9d488cc8f3856ec48064d2eb3509f5fca576.exe File opened for modification C:\Program Files (x86)\Microsoft SQL Server Compact Edition\v3.5\SQLCEOLEDBSQLCECOMPACT.exe ac742fab57cb2c5cea730ffdfa0a9d488cc8f3856ec48064d2eb3509f5fca576.exe File created C:\Program Files (x86)\Windows NT\TableTextService\ja-JP\TableTextServiceSystem.exe ac742fab57cb2c5cea730ffdfa0a9d488cc8f3856ec48064d2eb3509f5fca576.exe File created C:\Program Files (x86)\Windows Media Player\ja-JP\OperatingWindows.exe ac742fab57cb2c5cea730ffdfa0a9d488cc8f3856ec48064d2eb3509f5fca576.exe File created C:\Program Files (x86)\Microsoft Office\Office14\CONVERT\Outlooktransmgr.exe ac742fab57cb2c5cea730ffdfa0a9d488cc8f3856ec48064d2eb3509f5fca576.exe -
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 ac742fab57cb2c5cea730ffdfa0a9d488cc8f3856ec48064d2eb3509f5fca576.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString ac742fab57cb2c5cea730ffdfa0a9d488cc8f3856ec48064d2eb3509f5fca576.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier ac742fab57cb2c5cea730ffdfa0a9d488cc8f3856ec48064d2eb3509f5fca576.exe -
Suspicious behavior: EnumeratesProcesses 3 IoCs
pid Process 288 ac742fab57cb2c5cea730ffdfa0a9d488cc8f3856ec48064d2eb3509f5fca576.exe 288 ac742fab57cb2c5cea730ffdfa0a9d488cc8f3856ec48064d2eb3509f5fca576.exe 288 ac742fab57cb2c5cea730ffdfa0a9d488cc8f3856ec48064d2eb3509f5fca576.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\ac742fab57cb2c5cea730ffdfa0a9d488cc8f3856ec48064d2eb3509f5fca576.exe"C:\Users\Admin\AppData\Local\Temp\ac742fab57cb2c5cea730ffdfa0a9d488cc8f3856ec48064d2eb3509f5fca576.exe"1⤵
- Adds Run key to start application
- Drops file in System32 directory
- Drops file in Program Files directory
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
PID:288