Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
161s -
max time network
171s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
03/12/2022, 22:36
Static task
static1
Behavioral task
behavioral1
Sample
ac742fab57cb2c5cea730ffdfa0a9d488cc8f3856ec48064d2eb3509f5fca576.exe
Resource
win7-20220812-en
windows7-x64
6 signatures
150 seconds
Behavioral task
behavioral2
Sample
ac742fab57cb2c5cea730ffdfa0a9d488cc8f3856ec48064d2eb3509f5fca576.exe
Resource
win10v2004-20220812-en
windows10-2004-x64
6 signatures
150 seconds
General
-
Target
ac742fab57cb2c5cea730ffdfa0a9d488cc8f3856ec48064d2eb3509f5fca576.exe
-
Size
3.9MB
-
MD5
53c4576f955148926c67946897dc57c2
-
SHA1
5d051a1a2b58a3952613b18b3153ef8763f74347
-
SHA256
ac742fab57cb2c5cea730ffdfa0a9d488cc8f3856ec48064d2eb3509f5fca576
-
SHA512
d3d74fb1e73f5ab4f89315640bdc994af64a649ba3968de7b853d44e963b4bce5c956a8aa711fd03489f9b975634ec641bb5ad1278633c6b56cdd754d23dbd39
-
SSDEEP
49152:GWzOILziX1he1Hxy1bp2KzMMp70nILDcO/fsBmLjRw6qpZmBZWyLaXMXW:GICFheu/2KzMMJiUQO/fsiR6vmBNLfm
Score
6/10
Malware Config
Signatures
-
Adds Run key to start application 2 TTPs 4 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunServices\mIRCmirc = "C:\\Users\\Admin\\AppData\\Local\\Temp\\ac742fab57cb2c5cea730ffdfa0a9d488cc8f3856ec48064d2eb3509f5fca576.exe" ac742fab57cb2c5cea730ffdfa0a9d488cc8f3856ec48064d2eb3509f5fca576.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run ac742fab57cb2c5cea730ffdfa0a9d488cc8f3856ec48064d2eb3509f5fca576.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunServices ac742fab57cb2c5cea730ffdfa0a9d488cc8f3856ec48064d2eb3509f5fca576.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\mIRCmirc = "C:\\Users\\Admin\\AppData\\Local\\Temp\\ac742fab57cb2c5cea730ffdfa0a9d488cc8f3856ec48064d2eb3509f5fca576.exe" ac742fab57cb2c5cea730ffdfa0a9d488cc8f3856ec48064d2eb3509f5fca576.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Drops file in System32 directory 1 IoCs
description ioc Process File created C:\Windows\SysWOW64\ntdll.dll.dll ac742fab57cb2c5cea730ffdfa0a9d488cc8f3856ec48064d2eb3509f5fca576.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\mircAdobe.exe ac742fab57cb2c5cea730ffdfa0a9d488cc8f3856ec48064d2eb3509f5fca576.exe File opened for modification C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.5\it\MicrosoftEntity.exe ac742fab57cb2c5cea730ffdfa0a9d488cc8f3856ec48064d2eb3509f5fca576.exe File created C:\Program Files (x86)\Microsoft.NET\Primary Interop Assemblies\mshtmlMSHTML7.0.3300.0.exe ac742fab57cb2c5cea730ffdfa0a9d488cc8f3856ec48064d2eb3509f5fca576.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\EBWebView\x86\mircBrowser92.0.902.67.exe ac742fab57cb2c5cea730ffdfa0a9d488cc8f3856ec48064d2eb3509f5fca576.exe File created C:\Program Files (x86)\Windows Portable Devices\SystemOperating10.0.19041.1.160101.0800.exe ac742fab57cb2c5cea730ffdfa0a9d488cc8f3856ec48064d2eb3509f5fca576.exe File created C:\Program Files (x86)\Common Files\System\ado\en-US\MicrosoftOperating.exe ac742fab57cb2c5cea730ffdfa0a9d488cc8f3856ec48064d2eb3509f5fca576.exe File opened for modification C:\Program Files (x86)\Common Files\Microsoft Shared\ink\es-ES\operativoWindows.exe ac742fab57cb2c5cea730ffdfa0a9d488cc8f3856ec48064d2eb3509f5fca576.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\libEGLnotificationhelperexe.exe ac742fab57cb2c5cea730ffdfa0a9d488cc8f3856ec48064d2eb3509f5fca576.exe File opened for modification C:\Program Files (x86)\Common Files\Microsoft Shared\VSTO\10.0\1033\mIRCmirc.exe ac742fab57cb2c5cea730ffdfa0a9d488cc8f3856ec48064d2eb3509f5fca576.exe File opened for modification C:\Program Files (x86)\Common Files\System\Ole DB\fr-FR\SystemSystem.exe ac742fab57cb2c5cea730ffdfa0a9d488cc8f3856ec48064d2eb3509f5fca576.exe File opened for modification C:\Program Files (x86)\Common Files\Java\Java Update\CheckerJava.exe ac742fab57cb2c5cea730ffdfa0a9d488cc8f3856ec48064d2eb3509f5fca576.exe File opened for modification C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMmIRC.exe ac742fab57cb2c5cea730ffdfa0a9d488cc8f3856ec48064d2eb3509f5fca576.exe File opened for modification C:\Program Files (x86)\Google\Update\Download\{8A69D345-D564-463C-AFF1-A69D9E530F96}\89.0.4389.114\ChromeInstaller.exe ac742fab57cb2c5cea730ffdfa0a9d488cc8f3856ec48064d2eb3509f5fca576.exe File opened for modification C:\Program Files (x86)\Common Files\System\ja-JP\mircmirc.exe ac742fab57cb2c5cea730ffdfa0a9d488cc8f3856ec48064d2eb3509f5fca576.exe File created C:\Program Files (x86)\Common Files\System\Ole DB\ja-JP\Systemmsdasqlr.exe ac742fab57cb2c5cea730ffdfa0a9d488cc8f3856ec48064d2eb3509f5fca576.exe File opened for modification C:\Program Files (x86)\Windows Media Player\de-DE\Windowsmpvis.exe ac742fab57cb2c5cea730ffdfa0a9d488cc8f3856ec48064d2eb3509f5fca576.exe File opened for modification C:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\AddInSideAdapters\VisualApplications.exe ac742fab57cb2c5cea730ffdfa0a9d488cc8f3856ec48064d2eb3509f5fca576.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.165.21\Microsoftmsedgeupdate.exe ac742fab57cb2c5cea730ffdfa0a9d488cc8f3856ec48064d2eb3509f5fca576.exe File created C:\Program Files (x86)\Common Files\Microsoft Shared\VSTO\10.0\VSTOLoaderMicrosoft10.0.60828.0.exe ac742fab57cb2c5cea730ffdfa0a9d488cc8f3856ec48064d2eb3509f5fca576.exe File opened for modification C:\Program Files (x86)\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\fr\mircPowerShell.exe ac742fab57cb2c5cea730ffdfa0a9d488cc8f3856ec48064d2eb3509f5fca576.exe File created C:\Program Files (x86)\Microsoft.NET\Primary Interop Assemblies\MSHTMLmshtml.exe ac742fab57cb2c5cea730ffdfa0a9d488cc8f3856ec48064d2eb3509f5fca576.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sample-files\assets\Sample Files\mircmirc.exe ac742fab57cb2c5cea730ffdfa0a9d488cc8f3856ec48064d2eb3509f5fca576.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ApplicationA3DUtils.exe ac742fab57cb2c5cea730ffdfa0a9d488cc8f3856ec48064d2eb3509f5fca576.exe File opened for modification C:\Program Files (x86)\Common Files\Microsoft Shared\ink\it-IT\Windowsoperativo.exe ac742fab57cb2c5cea730ffdfa0a9d488cc8f3856ec48064d2eb3509f5fca576.exe File created C:\Program Files (x86)\Windows Media Player\ja-JP\wmplayerOperating.exe ac742fab57cb2c5cea730ffdfa0a9d488cc8f3856ec48064d2eb3509f5fca576.exe File created C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.0\ReachFrameworkPresentationFramework.exe ac742fab57cb2c5cea730ffdfa0a9d488cc8f3856ec48064d2eb3509f5fca576.exe File opened for modification C:\Program Files (x86)\Common Files\System\msadc\es-ES\mIRCmIRC.exe ac742fab57cb2c5cea730ffdfa0a9d488cc8f3856ec48064d2eb3509f5fca576.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\Download\{F3C4FE00-EFD5-403B-9569-398A20F1BA4A}\1.3.165.21\SetupUpdate.exe ac742fab57cb2c5cea730ffdfa0a9d488cc8f3856ec48064d2eb3509f5fca576.exe File created C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.0\it\WindowsPrinting3.0.6920.91356.exe ac742fab57cb2c5cea730ffdfa0a9d488cc8f3856ec48064d2eb3509f5fca576.exe File opened for modification C:\Program Files (x86)\Common Files\System\msadc\msdaprsrMicrosoft.exe ac742fab57cb2c5cea730ffdfa0a9d488cc8f3856ec48064d2eb3509f5fca576.exe File created C:\Program Files (x86)\Common Files\System\WAB32resWindows.exe ac742fab57cb2c5cea730ffdfa0a9d488cc8f3856ec48064d2eb3509f5fca576.exe File opened for modification C:\Program Files (x86)\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\ja\SystemPackageManagement.exe ac742fab57cb2c5cea730ffdfa0a9d488cc8f3856ec48064d2eb3509f5fca576.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\Proxymsedgeexe.exe ac742fab57cb2c5cea730ffdfa0a9d488cc8f3856ec48064d2eb3509f5fca576.exe File opened for modification C:\Program Files (x86)\Windows NT\TableTextService\en-US\mircmIRC.exe ac742fab57cb2c5cea730ffdfa0a9d488cc8f3856ec48064d2eb3509f5fca576.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\msedgeelfmicrosoftshellintegration.exe ac742fab57cb2c5cea730ffdfa0a9d488cc8f3856ec48064d2eb3509f5fca576.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ViewerDynamic.exe ac742fab57cb2c5cea730ffdfa0a9d488cc8f3856ec48064d2eb3509f5fca576.exe File created C:\Program Files (x86)\Windows Photo Viewer\it-IT\mIRCmirc.exe ac742fab57cb2c5cea730ffdfa0a9d488cc8f3856ec48064d2eb3509f5fca576.exe File created C:\Program Files (x86)\Common Files\System\Ole DB\fr-FR\mircmirc6.35.exe ac742fab57cb2c5cea730ffdfa0a9d488cc8f3856ec48064d2eb3509f5fca576.exe File opened for modification C:\Program Files (x86)\Windows Mail\mIRCWABMIG.exe ac742fab57cb2c5cea730ffdfa0a9d488cc8f3856ec48064d2eb3509f5fca576.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins3d\Libraryprcr.exe ac742fab57cb2c5cea730ffdfa0a9d488cc8f3856ec48064d2eb3509f5fca576.exe File created C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.5\de\EntitySystem.exe ac742fab57cb2c5cea730ffdfa0a9d488cc8f3856ec48064d2eb3509f5fca576.exe File opened for modification C:\Program Files (x86)\Windows NT\TableTextService\en-US\SystemWindows.exe ac742fab57cb2c5cea730ffdfa0a9d488cc8f3856ec48064d2eb3509f5fca576.exe File opened for modification C:\Program Files (x86)\Common Files\System\msadc\ja-JP\mircmIRC6.35.exe ac742fab57cb2c5cea730ffdfa0a9d488cc8f3856ec48064d2eb3509f5fca576.exe File opened for modification C:\Program Files (x86)\Common Files\System\Ole DB\es-ES\mIRCmIRC.exe ac742fab57cb2c5cea730ffdfa0a9d488cc8f3856ec48064d2eb3509f5fca576.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AIR\mIRCAcrobat.exe ac742fab57cb2c5cea730ffdfa0a9d488cc8f3856ec48064d2eb3509f5fca576.exe File created C:\Program Files (x86)\Common Files\System\WAB32Microsoft10.0.19041.1110.exe ac742fab57cb2c5cea730ffdfa0a9d488cc8f3856ec48064d2eb3509f5fca576.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\EBWebView\x86\WebViewEdge.exe ac742fab57cb2c5cea730ffdfa0a9d488cc8f3856ec48064d2eb3509f5fca576.exe File opened for modification C:\Program Files (x86)\Common Files\System\Ole DB\ja-JP\mIRCmirc.exe ac742fab57cb2c5cea730ffdfa0a9d488cc8f3856ec48064d2eb3509f5fca576.exe File created C:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\AddInViews\VisualOffice.exe ac742fab57cb2c5cea730ffdfa0a9d488cc8f3856ec48064d2eb3509f5fca576.exe File created C:\Program Files (x86)\Common Files\System\es-ES\mIRCmirc.exe ac742fab57cb2c5cea730ffdfa0a9d488cc8f3856ec48064d2eb3509f5fca576.exe File created C:\Program Files (x86)\Windows Media Player\fr-FR\mircmIRC.exe ac742fab57cb2c5cea730ffdfa0a9d488cc8f3856ec48064d2eb3509f5fca576.exe File created C:\Program Files (x86)\Common Files\Microsoft Shared\ink\ja-JP\mIRCmirc.exe ac742fab57cb2c5cea730ffdfa0a9d488cc8f3856ec48064d2eb3509f5fca576.exe File opened for modification C:\Program Files (x86)\Common Files\Microsoft Shared\VSTO\Visualvstoee.exe ac742fab57cb2c5cea730ffdfa0a9d488cc8f3856ec48064d2eb3509f5fca576.exe File opened for modification C:\Program Files (x86)\Common Files\System\msadc\ja-JP\msaddsrmsadcer10.0.19041.1.160101.0800.exe ac742fab57cb2c5cea730ffdfa0a9d488cc8f3856ec48064d2eb3509f5fca576.exe File opened for modification C:\Program Files (x86)\Windows Defender\it-IT\operativompasdesc.exe ac742fab57cb2c5cea730ffdfa0a9d488cc8f3856ec48064d2eb3509f5fca576.exe File created C:\Program Files (x86)\Mozilla Maintenance Service\Firefoxmaintenanceserviceinstaller.exe ac742fab57cb2c5cea730ffdfa0a9d488cc8f3856ec48064d2eb3509f5fca576.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\mircmsedgeexe.exe ac742fab57cb2c5cea730ffdfa0a9d488cc8f3856ec48064d2eb3509f5fca576.exe File created C:\Program Files (x86)\Google\Update\Download\{8A69D345-D564-463C-AFF1-A69D9E530F96}\89.0.4389.114\GoogleInstaller.exe ac742fab57cb2c5cea730ffdfa0a9d488cc8f3856ec48064d2eb3509f5fca576.exe File created C:\Program Files (x86)\Windows Defender\es-ES\mIRCmirc6.35.exe ac742fab57cb2c5cea730ffdfa0a9d488cc8f3856ec48064d2eb3509f5fca576.exe File opened for modification C:\Program Files (x86)\Common Files\Microsoft Shared\ink\it-IT\mircmIRC.exe ac742fab57cb2c5cea730ffdfa0a9d488cc8f3856ec48064d2eb3509f5fca576.exe File created C:\Program Files (x86)\Windows Photo Viewer\en-US\PhotoAcqWindows.exe ac742fab57cb2c5cea730ffdfa0a9d488cc8f3856ec48064d2eb3509f5fca576.exe File opened for modification C:\Program Files (x86)\Common Files\Microsoft Shared\VSTO\vstoeeStudio.exe ac742fab57cb2c5cea730ffdfa0a9d488cc8f3856ec48064d2eb3509f5fca576.exe File created C:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\AppInfoDocument\Microsoft.VisualStudio.Tools.Office.AppInfoDocument\mIRCTools6.35.exe ac742fab57cb2c5cea730ffdfa0a9d488cc8f3856ec48064d2eb3509f5fca576.exe File opened for modification C:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\HostSideAdapters\HostAdapterOffice.exe ac742fab57cb2c5cea730ffdfa0a9d488cc8f3856ec48064d2eb3509f5fca576.exe -
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 ac742fab57cb2c5cea730ffdfa0a9d488cc8f3856ec48064d2eb3509f5fca576.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString ac742fab57cb2c5cea730ffdfa0a9d488cc8f3856ec48064d2eb3509f5fca576.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier ac742fab57cb2c5cea730ffdfa0a9d488cc8f3856ec48064d2eb3509f5fca576.exe -
Suspicious behavior: EnumeratesProcesses 18 IoCs
pid Process 3064 ac742fab57cb2c5cea730ffdfa0a9d488cc8f3856ec48064d2eb3509f5fca576.exe 3064 ac742fab57cb2c5cea730ffdfa0a9d488cc8f3856ec48064d2eb3509f5fca576.exe 3064 ac742fab57cb2c5cea730ffdfa0a9d488cc8f3856ec48064d2eb3509f5fca576.exe 3064 ac742fab57cb2c5cea730ffdfa0a9d488cc8f3856ec48064d2eb3509f5fca576.exe 3064 ac742fab57cb2c5cea730ffdfa0a9d488cc8f3856ec48064d2eb3509f5fca576.exe 3064 ac742fab57cb2c5cea730ffdfa0a9d488cc8f3856ec48064d2eb3509f5fca576.exe 3064 ac742fab57cb2c5cea730ffdfa0a9d488cc8f3856ec48064d2eb3509f5fca576.exe 3064 ac742fab57cb2c5cea730ffdfa0a9d488cc8f3856ec48064d2eb3509f5fca576.exe 3064 ac742fab57cb2c5cea730ffdfa0a9d488cc8f3856ec48064d2eb3509f5fca576.exe 3064 ac742fab57cb2c5cea730ffdfa0a9d488cc8f3856ec48064d2eb3509f5fca576.exe 3064 ac742fab57cb2c5cea730ffdfa0a9d488cc8f3856ec48064d2eb3509f5fca576.exe 3064 ac742fab57cb2c5cea730ffdfa0a9d488cc8f3856ec48064d2eb3509f5fca576.exe 3064 ac742fab57cb2c5cea730ffdfa0a9d488cc8f3856ec48064d2eb3509f5fca576.exe 3064 ac742fab57cb2c5cea730ffdfa0a9d488cc8f3856ec48064d2eb3509f5fca576.exe 3064 ac742fab57cb2c5cea730ffdfa0a9d488cc8f3856ec48064d2eb3509f5fca576.exe 3064 ac742fab57cb2c5cea730ffdfa0a9d488cc8f3856ec48064d2eb3509f5fca576.exe 3064 ac742fab57cb2c5cea730ffdfa0a9d488cc8f3856ec48064d2eb3509f5fca576.exe 3064 ac742fab57cb2c5cea730ffdfa0a9d488cc8f3856ec48064d2eb3509f5fca576.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\ac742fab57cb2c5cea730ffdfa0a9d488cc8f3856ec48064d2eb3509f5fca576.exe"C:\Users\Admin\AppData\Local\Temp\ac742fab57cb2c5cea730ffdfa0a9d488cc8f3856ec48064d2eb3509f5fca576.exe"1⤵
- Adds Run key to start application
- Drops file in System32 directory
- Drops file in Program Files directory
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
PID:3064