Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
20s -
max time network
103s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
22/12/2023, 13:52
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
b038610ebae6ac3c8251436eb897e3f9.exe
Resource
win7-20231215-en
windows7-x64
5 signatures
150 seconds
Behavioral task
behavioral2
Sample
b038610ebae6ac3c8251436eb897e3f9.exe
Resource
win10v2004-20231215-en
windows10-2004-x64
4 signatures
150 seconds
General
-
Target
b038610ebae6ac3c8251436eb897e3f9.exe
-
Size
181KB
-
MD5
b038610ebae6ac3c8251436eb897e3f9
-
SHA1
73f025d75063aa8b6df5329536f37b876a81949f
-
SHA256
cca678692520109e90709bc9bd6b92db4aa96f21a63314dd03d363d99026d2d6
-
SHA512
16c00142df6ef0ea07b06970a4df78c814b39d5a101f48ad9ef884576acfd297870a13ba9d3a623799d06bb415169a73dff8cb4bfc536e14a9abd852082d6d37
-
SSDEEP
3072:NR2FoCu4wHbSgEcD0I1gQ/N4nK1CWeeudkIjVhHhTMjtbsoUvJmh:NSdwHWgjD0hc1zudfVh9M9soUvJmh
Score
7/10
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
pid Process 2460 b038610ebae6ac3c8251436eb897e3f9.usa -
Drops file in System32 directory 2 IoCs
description ioc Process File created C:\Windows\SysWOW64\UsaShohdi.asu b038610ebae6ac3c8251436eb897e3f9.exe File opened for modification C:\Windows\SysWOW64\UsaShohdi.asu b038610ebae6ac3c8251436eb897e3f9.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File created \??\c:\Program Files\Microsoft Office\root\Office16\NAMECONTROLSERVER.EXE b038610ebae6ac3c8251436eb897e3f9.exe File created \??\c:\Program Files\Microsoft Office\root\Office16\ONENOTE.EXE b038610ebae6ac3c8251436eb897e3f9.exe File created \??\c:\Program Files\Java\jre-1.8\bin\javaws.exe b038610ebae6ac3c8251436eb897e3f9.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\Client\AppVLP.usa b038610ebae6ac3c8251436eb897e3f9.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\Office16\MSOSYNC.usa b038610ebae6ac3c8251436eb897e3f9.exe File opened for modification \??\c:\Program Files\7-Zip\Uninstall.usa b038610ebae6ac3c8251436eb897e3f9.exe File created \??\c:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe b038610ebae6ac3c8251436eb897e3f9.exe File created \??\c:\Program Files\Java\jre-1.8\bin\jp2launcher.exe b038610ebae6ac3c8251436eb897e3f9.exe File opened for modification \??\c:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\chrmstp.usa b038610ebae6ac3c8251436eb897e3f9.exe File created \??\c:\Program Files\7-Zip\7zFM.exe b038610ebae6ac3c8251436eb897e3f9.exe File opened for modification \??\c:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.usa b038610ebae6ac3c8251436eb897e3f9.exe File opened for modification \??\c:\Program Files\Common Files\microsoft shared\Source Engine\OSE.usa b038610ebae6ac3c8251436eb897e3f9.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\Office16\msotd.usa b038610ebae6ac3c8251436eb897e3f9.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\Office16\SDXHelperBgt.usa b038610ebae6ac3c8251436eb897e3f9.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\Office16\VPREVIEW.usa b038610ebae6ac3c8251436eb897e3f9.exe File opened for modification \??\c:\Program Files\Java\jdk-1.8\jre\bin\javaws.usa b038610ebae6ac3c8251436eb897e3f9.exe File created \??\c:\Program Files\Java\jre-1.8\bin\javaw.exe b038610ebae6ac3c8251436eb897e3f9.exe File created \??\c:\Program Files\Microsoft Office\root\Office16\MSOHTMED.EXE b038610ebae6ac3c8251436eb897e3f9.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\Office16\ONENOTEM.usa b038610ebae6ac3c8251436eb897e3f9.exe File opened for modification \??\c:\Program Files\Java\jdk-1.8\bin\javaw.usa b038610ebae6ac3c8251436eb897e3f9.exe File created \??\c:\Program Files\Java\jre-1.8\bin\javacpl.exe b038610ebae6ac3c8251436eb897e3f9.exe File created \??\c:\Program Files\Microsoft Office\root\Client\AppVLP.exe b038610ebae6ac3c8251436eb897e3f9.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\Office16\SETLANG.usa b038610ebae6ac3c8251436eb897e3f9.exe File opened for modification \??\c:\Program Files\Java\jre-1.8\bin\javaws.usa b038610ebae6ac3c8251436eb897e3f9.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\Office16\NAMECONTROLSERVER.usa b038610ebae6ac3c8251436eb897e3f9.exe File created \??\c:\Program Files\Microsoft Office\root\Office16\protocolhandler.exe b038610ebae6ac3c8251436eb897e3f9.exe File created \??\c:\Program Files\Microsoft Office\root\Office16\IEContentService.exe b038610ebae6ac3c8251436eb897e3f9.exe File created \??\c:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE b038610ebae6ac3c8251436eb897e3f9.exe File created \??\c:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe b038610ebae6ac3c8251436eb897e3f9.exe File created \??\c:\Program Files\Java\jre-1.8\bin\ssvagent.exe b038610ebae6ac3c8251436eb897e3f9.exe File created \??\c:\Program Files\Microsoft Office\root\Office16\misc.exe b038610ebae6ac3c8251436eb897e3f9.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\Office16\ONENOTE.usa b038610ebae6ac3c8251436eb897e3f9.exe File created \??\c:\Program Files\Microsoft Office\root\Office16\ORGCHART.EXE b038610ebae6ac3c8251436eb897e3f9.exe File created \??\c:\Program Files\Microsoft Office\root\Office16\SkypeSrv\SKYPESERVER.EXE b038610ebae6ac3c8251436eb897e3f9.exe File created \??\c:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\chrmstp.exe b038610ebae6ac3c8251436eb897e3f9.exe File created \??\c:\Program Files\Java\jdk-1.8\bin\javaws.exe b038610ebae6ac3c8251436eb897e3f9.exe File opened for modification \??\c:\Program Files\Java\jre-1.8\bin\jp2launcher.usa b038610ebae6ac3c8251436eb897e3f9.exe File created \??\c:\Program Files\Microsoft Office\root\Office16\SDXHelper.exe b038610ebae6ac3c8251436eb897e3f9.exe File created \??\c:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE b038610ebae6ac3c8251436eb897e3f9.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\Office16\WINWORD.usa b038610ebae6ac3c8251436eb897e3f9.exe File created \??\c:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe b038610ebae6ac3c8251436eb897e3f9.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\Office16\MSOHTMED.usa b038610ebae6ac3c8251436eb897e3f9.exe File created \??\c:\Program Files\Microsoft Office\root\Office16\PerfBoost.exe b038610ebae6ac3c8251436eb897e3f9.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\Office16\msoadfsb.usa b038610ebae6ac3c8251436eb897e3f9.exe File created \??\c:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe b038610ebae6ac3c8251436eb897e3f9.exe File opened for modification \??\c:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.usa b038610ebae6ac3c8251436eb897e3f9.exe File created \??\c:\Program Files\Microsoft Office\root\Office16\GRAPH.EXE b038610ebae6ac3c8251436eb897e3f9.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\Office16\CLVIEW.usa b038610ebae6ac3c8251436eb897e3f9.exe File created \??\c:\Program Files\Microsoft Office\root\Office16\SDXHelperBgt.exe b038610ebae6ac3c8251436eb897e3f9.exe File created \??\c:\Program Files\7-Zip\Uninstall.exe b038610ebae6ac3c8251436eb897e3f9.exe File created \??\c:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe b038610ebae6ac3c8251436eb897e3f9.exe File opened for modification \??\c:\Program Files\Java\jdk-1.8\bin\jconsole.usa b038610ebae6ac3c8251436eb897e3f9.exe File created \??\c:\Program Files\Google\Chrome\Application\106.0.5249.119\notification_helper.exe b038610ebae6ac3c8251436eb897e3f9.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\Office16\MSOSREC.usa b038610ebae6ac3c8251436eb897e3f9.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\Office16\POWERPNT.usa b038610ebae6ac3c8251436eb897e3f9.exe File created \??\c:\Program Files\Microsoft Office\root\Office16\Wordconv.exe b038610ebae6ac3c8251436eb897e3f9.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\Office16\Wordconv.usa b038610ebae6ac3c8251436eb897e3f9.exe File created \??\c:\Program Files\Microsoft Office\root\Office16\XLICONS.EXE b038610ebae6ac3c8251436eb897e3f9.exe File opened for modification \??\c:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.usa b038610ebae6ac3c8251436eb897e3f9.exe File opened for modification \??\c:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.usa b038610ebae6ac3c8251436eb897e3f9.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\Office16\msoev.usa b038610ebae6ac3c8251436eb897e3f9.exe File created \??\c:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.exe b038610ebae6ac3c8251436eb897e3f9.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.usa b038610ebae6ac3c8251436eb897e3f9.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.NetFX40.usa b038610ebae6ac3c8251436eb897e3f9.exe -
Suspicious use of WriteProcessMemory 2 IoCs
description pid Process procid_target PID 3720 wrote to memory of 2460 3720 b038610ebae6ac3c8251436eb897e3f9.exe 17 PID 3720 wrote to memory of 2460 3720 b038610ebae6ac3c8251436eb897e3f9.exe 17
Processes
-
C:\Users\Admin\AppData\Local\Temp\b038610ebae6ac3c8251436eb897e3f9.exe"C:\Users\Admin\AppData\Local\Temp\b038610ebae6ac3c8251436eb897e3f9.exe"1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:3720 -
C:\Users\Admin\AppData\Local\Temp\b038610ebae6ac3c8251436eb897e3f9.usaC:\Users\Admin\AppData\Local\Temp\b038610ebae6ac3c8251436eb897e3f9.usa2⤵
- Executes dropped EXE
PID:2460
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
72KB
MD53949c28983bc219f5b79e643f2a5740b
SHA16abdcf67af98af011fae3d9392f37946cbd1e193
SHA256edbd7d087ee6bed76c65d3bd2b8d0903fa2d9c3abff2507b3e19584aba7c2a92
SHA512d413f1492131acebf5f1ec66197add27db266f7d00e757b1d40adf7de395ff70862ccdb64660c5529bc8c35c06333e7cd8e71cb450e40006dd6de18bf62d3ecf
-
Filesize
26KB
MD5c774be86e4e8427db75eb0ee2fa917e0
SHA136097de24013bd12e3955a09d05028bdb07dcd67
SHA25670585fa969b61ee3409f86372aa6c367c4c3424e44318cdf45c3dfa1626bb686
SHA512107060b63ccad0a0cab57c28e474e7d04d66aa2b28e5eb35645f5ba43de2ce4b1eb0377fe26cb4148b787168f6fe23e65e0e823928d4d8fa01d62f5b11450328
-
Filesize
16KB
MD538b043760254434476a1fd91e7701a4a
SHA1d50fd195453759ff049ac3456d74bf42f4fe67ac
SHA2565e8cf5240b973b8ca03c96a14621c23980d0d421b8c65e51ad1d0733ab80de4f
SHA512bfa5210d0db5381c081c1516c4138758e35952651a83a03780350d0a655cbc03f3994a0a2868fd466a0892a30374a19918b643a672fb4d2339c517fe3a72ebae