Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
155s -
max time network
161s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
22/12/2023, 13:36
Static task
static1
Behavioral task
behavioral1
Sample
a75c63df5a85cbe3ed17100502e1404f.exe
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
a75c63df5a85cbe3ed17100502e1404f.exe
Resource
win10v2004-20231215-en
General
-
Target
a75c63df5a85cbe3ed17100502e1404f.exe
-
Size
282KB
-
MD5
a75c63df5a85cbe3ed17100502e1404f
-
SHA1
a7ebcc4ac85a9836150b51942ecf1660a91f222b
-
SHA256
acd36607aaf800a81f8c7473852d0c414b793d1f3babef3624f9819fe56c1735
-
SHA512
208df4b0fe90c45e092a8b1cc80735dd8200cb04e7db1814353216d21d658d54e04796d82292e7a038d747260fb155b29ca54c55b2a79709530164e618c8dbca
-
SSDEEP
3072:ygV7qR3tGXRvjxCb5NgXDY7uSlkJcUa7kYQTcqW2NdQQGH/UDhSCUc4aqTBF91gP:L1XlKgzelZNQSBQGH/CSpWqTImQ
Malware Config
Signatures
-
Enumerates connected drives 3 TTPs 10 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\E: a75c63df5a85cbe3ed17100502e1404f.exe File opened (read-only) \??\G: a75c63df5a85cbe3ed17100502e1404f.exe File opened (read-only) \??\J: a75c63df5a85cbe3ed17100502e1404f.exe File opened (read-only) \??\L: a75c63df5a85cbe3ed17100502e1404f.exe File opened (read-only) \??\M: a75c63df5a85cbe3ed17100502e1404f.exe File opened (read-only) \??\N: a75c63df5a85cbe3ed17100502e1404f.exe File opened (read-only) \??\O: a75c63df5a85cbe3ed17100502e1404f.exe File opened (read-only) \??\H: a75c63df5a85cbe3ed17100502e1404f.exe File opened (read-only) \??\I: a75c63df5a85cbe3ed17100502e1404f.exe File opened (read-only) \??\K: a75c63df5a85cbe3ed17100502e1404f.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\createdump.exe a75c63df5a85cbe3ed17100502e1404f.exe File created C:\Program Files\Google\Chrome\Application\106.0.5249.119\chrome_pwa_launcher.exe a75c63df5a85cbe3ed17100502e1404f.exe File created C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\setup.exe a75c63df5a85cbe3ed17100502e1404f.exe File created C:\Program Files\Java\jdk-1.8\bin\extcheck.cab a75c63df5a85cbe3ed17100502e1404f.exe File opened for modification C:\Program Files\Microsoft Office\Office16\OSPPREARM.cab a75c63df5a85cbe3ed17100502e1404f.exe File opened for modification C:\Program Files\Mozilla Firefox\RCXA733.tmp a75c63df5a85cbe3ed17100502e1404f.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.cab a75c63df5a85cbe3ed17100502e1404f.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\createdump.exe a75c63df5a85cbe3ed17100502e1404f.exe File opened for modification C:\Program Files\Internet Explorer\iediagcmd.cab a75c63df5a85cbe3ed17100502e1404f.exe File created C:\Program Files\Internet Explorer\iediagcmd.exe a75c63df5a85cbe3ed17100502e1404f.exe File created C:\Program Files\Internet Explorer\ielowutil.cab a75c63df5a85cbe3ed17100502e1404f.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\jabswitch.cab a75c63df5a85cbe3ed17100502e1404f.exe File opened for modification C:\Program Files\Mozilla Firefox\uninstall\RCXA773.tmp a75c63df5a85cbe3ed17100502e1404f.exe File opened for modification C:\Program Files\Mozilla Firefox\uninstall\RCXA774.tmp a75c63df5a85cbe3ed17100502e1404f.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\RCXA3FE.tmp a75c63df5a85cbe3ed17100502e1404f.exe File opened for modification C:\Program Files\Google\Chrome\Application\106.0.5249.119\RCXA536.tmp a75c63df5a85cbe3ed17100502e1404f.exe File created C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.cab a75c63df5a85cbe3ed17100502e1404f.exe File opened for modification C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\RCXA60C.tmp a75c63df5a85cbe3ed17100502e1404f.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe a75c63df5a85cbe3ed17100502e1404f.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\jabswitch.exe a75c63df5a85cbe3ed17100502e1404f.exe File opened for modification C:\Program Files\7-Zip\7z.cab a75c63df5a85cbe3ed17100502e1404f.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\createdump.cab a75c63df5a85cbe3ed17100502e1404f.exe File opened for modification C:\Program Files\Google\Chrome\Application\RCXA4E3.tmp a75c63df5a85cbe3ed17100502e1404f.exe File created C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe a75c63df5a85cbe3ed17100502e1404f.exe File opened for modification C:\Program Files\7-Zip\7z.exe a75c63df5a85cbe3ed17100502e1404f.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe a75c63df5a85cbe3ed17100502e1404f.exe File opened for modification C:\Program Files\Google\Chrome\Application\RCXA4F4.tmp a75c63df5a85cbe3ed17100502e1404f.exe File created C:\Program Files\Google\Chrome\Application\chrome_proxy.cab a75c63df5a85cbe3ed17100502e1404f.exe File created C:\Program Files\Internet Explorer\ExtExport.exe a75c63df5a85cbe3ed17100502e1404f.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\RCXA186.tmp a75c63df5a85cbe3ed17100502e1404f.exe File opened for modification C:\Program Files\Google\Chrome\Application\chrome.cab a75c63df5a85cbe3ed17100502e1404f.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\appletviewer.cab a75c63df5a85cbe3ed17100502e1404f.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\RCXA65B.tmp a75c63df5a85cbe3ed17100502e1404f.exe File created C:\Program Files\Microsoft Office\Office16\OSPPREARM.cab a75c63df5a85cbe3ed17100502e1404f.exe File opened for modification C:\Program Files\7-Zip\RCXA067.tmp a75c63df5a85cbe3ed17100502e1404f.exe File opened for modification C:\Program Files\dotnet\dotnet.exe a75c63df5a85cbe3ed17100502e1404f.exe File opened for modification C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\setup.cab a75c63df5a85cbe3ed17100502e1404f.exe File created C:\Program Files\Internet Explorer\ExtExport.cab a75c63df5a85cbe3ed17100502e1404f.exe File opened for modification C:\Program Files\Microsoft Office\Office16\OSPPREARM.EXE a75c63df5a85cbe3ed17100502e1404f.exe File created C:\Program Files\Mozilla Firefox\default-browser-agent.exe a75c63df5a85cbe3ed17100502e1404f.exe File opened for modification C:\Program Files\Google\Chrome\Application\RCXA4A0.tmp a75c63df5a85cbe3ed17100502e1404f.exe File opened for modification C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\RCXA5EA.tmp a75c63df5a85cbe3ed17100502e1404f.exe File created C:\Program Files\Java\jdk-1.8\bin\extcheck.exe a75c63df5a85cbe3ed17100502e1404f.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\RCXA6BD.tmp a75c63df5a85cbe3ed17100502e1404f.exe File opened for modification C:\Program Files\Google\Chrome\Application\RCXA4A1.tmp a75c63df5a85cbe3ed17100502e1404f.exe File opened for modification C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\setup.exe a75c63df5a85cbe3ed17100502e1404f.exe File created C:\Program Files\Java\jre-1.8\bin\jabswitch.cab a75c63df5a85cbe3ed17100502e1404f.exe File created C:\Program Files\Java\jre-1.8\bin\java-rmi.exe a75c63df5a85cbe3ed17100502e1404f.exe File opened for modification C:\Program Files\dotnet\RCXA3ED.tmp a75c63df5a85cbe3ed17100502e1404f.exe File created C:\Program Files\7-Zip\7zFM.cab a75c63df5a85cbe3ed17100502e1404f.exe File created C:\Program Files\dotnet\dotnet.exe a75c63df5a85cbe3ed17100502e1404f.exe File opened for modification C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\chrmstp.cab a75c63df5a85cbe3ed17100502e1404f.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\extcheck.exe a75c63df5a85cbe3ed17100502e1404f.exe File created C:\Program Files\Mozilla Firefox\uninstall\helper.exe a75c63df5a85cbe3ed17100502e1404f.exe File opened for modification C:\Program Files\7-Zip\RCXA057.tmp a75c63df5a85cbe3ed17100502e1404f.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.cab a75c63df5a85cbe3ed17100502e1404f.exe File created C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\chrmstp.exe a75c63df5a85cbe3ed17100502e1404f.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\RCXA66B.tmp a75c63df5a85cbe3ed17100502e1404f.exe File created C:\Program Files\readme.1xt a75c63df5a85cbe3ed17100502e1404f.exe File created C:\Program Files\7-Zip\7z.exe a75c63df5a85cbe3ed17100502e1404f.exe File opened for modification C:\Program Files\Google\Chrome\Application\RCXA4D3.tmp a75c63df5a85cbe3ed17100502e1404f.exe File created C:\Program Files\Internet Explorer\ieinstal.cab a75c63df5a85cbe3ed17100502e1404f.exe File opened for modification C:\Program Files\7-Zip\7zFM.cab a75c63df5a85cbe3ed17100502e1404f.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.cab a75c63df5a85cbe3ed17100502e1404f.exe
Processes
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
297KB
MD5b85f89c1d7b9dcacc34245c1b49006eb
SHA1997e5eeb3feee333f31045f1338cd698e730d086
SHA256ef6cde42795b1545558f6906d8b2b31d5d56b81d6d491ec8270e998a9b1fe8c4
SHA512d4b2bec6d3b4efaa6f682a67be11d9b26948d082280091ba17d1b9e2f0144100dfcaeed29a262d0a98f0b7e686a7bab00e56659cd8dc3490931743bf647b703e
-
Filesize
109KB
MD5b32eca916fe620757b65c0f7645d8441
SHA1e9ce9c4c4130496d91590da2ce18c3566a302457
SHA2564486eda92d7af0d0f4181448c35fb0d781d3c9713d2a60871542aabca9b5292a
SHA5128889dc332fcc49feee72bb85d342cf2437fd7e5cf7194494c0c30c616796610d13ccfcddb1535e94d0b8ee3f7952f4901eb1463a4d780258879e7025edc22d87
-
Filesize
135KB
MD5cedfb0d05f8643f389822347ae42d083
SHA1ce26fc9afa3bd952e6721d8113a13aadd0527586
SHA256ea40e003a9655feb1972b01ad0335cd0f0570eb1c6e4f5310fd24199df29284e
SHA512c72303080c415ff559a56069ba9bb7c0dda47cfc5d9580dfd657d50e0a843fd8b49b39a569540dee0042c6d1ed14f2a6b1e9eb98392233254b1651821b79eaf0
-
Filesize
281KB
MD53dc3594fb3b25c55081fe4b3226abbc2
SHA17eaddfd597fc76244f71f98877f7149c9e85dc9e
SHA2566d54694077faf07473196da7b7f1c6981c8ad6a462fcea4777a80cfc6bc5769e
SHA5128f268673c86e2c38d1713696ed25b75a565d8beb5b05ea755c9cbb12f625b8d4abfc1bb3f9f54c297ba4bd7dd9e465737c30f492aaef0034b0e1568ce13d2445
-
Filesize
273KB
MD5dafaaa61e7cec0c0ffd918f9c21ede6b
SHA1e50324afc7e08e732ea39f73e874f0efe5783066
SHA25657ace32d62e449f8d43edac40efdaf7b02288a6f529d0ae8a7989184b554f275
SHA51296751b446911cfde76c56e7e70d1c50602fdd1ef1f5657a97f9bc519039ed464109c5ff49a5356dc122139ba65516695c3f5a33c36c37156550b2519f34fa24e
-
Filesize
859KB
MD5fce722463a72c3e328e0dd8eb776dc36
SHA1a7c330a93bb87d8684ec16afff6b8fabfcc703a5
SHA256e2f0193c53186d1f5e8462453ba763d344e0aee3c56dd5a3c776a20add4615d3
SHA512c5ba1814e523e4b23cc65fb50dc9eda2796b65ac80e582e53142b831ec8148c648155e7584f7e7b1a257ebfab0ca3f8a5a9448147175b48d4a971e4c494192a9
-
Filesize
944KB
MD53418ff15b01b138422786d083843ec6f
SHA146205a77118b07ca62608bfa46220f6426b49fa9
SHA25665699818aeb97954a916f884ca6cc74608db54af1e247890373bd8bd7503a97e
SHA5129bc6c4a6d01a22f614516a40ccd80c4a7580444868db54db6685c5f4a75a2424c11c982205b2f35a8a30cc1947f7b71bcc4dd0b8679f220beabf0fdefa94b65e
-
Filesize
1.1MB
MD54319086aefdc3032ed47ccc51a07cf55
SHA1be84e5d6ae787bdce4dfb4238ea9b8d06aec603a
SHA256bd6be70f845cc8aa76b210145c4a3a28c1f580319472344ad611aade60c31895
SHA512b5e7088e61760e917d19339ee8ca55c950c67ed66aa289bc5d78e33d25eae457ce6802f2be16c7659f7a0460b6a8b0bf6d70385e83ac685221e581fa2b0984f0
-
Filesize
1.0MB
MD593f63b0400d36ba8bef30761056be19a
SHA18f9e78e99294e616e3451473e28bdc85f59009a1
SHA256cfd2567cb995e82625f04340a6b3ac40de5196ae11230096928e4a7b65d76bbf
SHA512a17079d37dd000ffaf7704fba9e7738813eade423f718039b53473dd5ac93b533f72e667967345eb474621040e11608c2e9252d3b0b0c47692136d90ac0df1b0
-
Filesize
1.3MB
MD531b4face34787f8f64cb3879d96e5695
SHA134b9c0f97ae915578e262ce8144a1fc233da8040
SHA256befeadc902f270989c14afc3b15db5da1e46ce247763b4f91d87780aeb7f34ec
SHA512453732ac9e7d6238dd33c5d5843a0295bb1237f352cf40d5fa811021783342d426d8b06b63f181b3595300d69991eb2a1cdaa184498db373fd6068726644b4ac
-
Filesize
236KB
MD57da11a6b4a94e75b2923ec0e4a396fc9
SHA1441ae20ba71bc046f3820c8f7053c07fef1089a9
SHA2565ddf2ec66b31cfba2292360f60be9e27f11773911dc88df5fe4530446daaf57c
SHA512c0b5effcc766009558bcfcd9de9aa738b696b58ffdde96469c62d9097aead83345cda95fedac5c77d4a37a826be0ca4d625ffed213d5433a23fc0716edd59b03
-
Filesize
445KB
MD59716c854daf49a841dc8ce48c015169b
SHA12ded0743a14d6855e28bcc1fff6e1711e8467ec0
SHA256da5bf3ae7bb1f42e486a7921ee9a953439004fce47dc4dacc6449a82da57de5a
SHA512a832705a728bb3fb8f7c6c6cde5dec40584bec439c68d577d2681f2dedbd356bc3f26a78ba0e673b55681dd5636332fb9a678ddda6fa4df4873e097f235da200
-
Filesize
568KB
MD5cc68949d31e6f281e8e2b1a7159bf083
SHA19a61d33413d384a6be0dd8ad034e04947058d1a5
SHA25634a9457df192d345e134f75df47f423f08f6daf13b5fd2e253f85523ba770ee5
SHA5122625ab9518243a02b454c02da00d61cdfe95a2f6d3b063d2f21c4c9ecb67ebd8e0fb940d90b40603887ac996da2c1714d9a78c463f757bf75e52f6016a74659f
-
Filesize
1012KB
MD5ff51a894440deb6d900df2491170aecc
SHA16c0a52d6444bea9f42b440e4bdf9a8f92955d31a
SHA256c60d1a8007e0188b269887bc2f081e74e43069bb6cb1c19d5c43e76e64cabb8d
SHA51254f36b0c28651a79ddc422ad494b7513b3c04c1a94e1e3daff290b51bce40a0a823c824218f3da0b11d38904a60ecc27a5f36a271721bd23631f15286c5565f2
-
Filesize
236KB
MD5c08fc7e0176921375f6db3f2e6113591
SHA1c06bda517e4e13ef936aae4996864f59c878165d
SHA256e7c9ed2b94b02229be47e2bb5615fba5d729d7a8eb94c6c52f281bce773bfa7e
SHA51213eec5d8ff86a3b631d57bb29fa6bd362db4995cb70c04d03bbe47f256b0c8bf20de2c3cbb048875ffbaf8280efccc4a73e0dd06f30a8d35682e8c86730597e2
-
Filesize
23KB
MD5f63d14c000dfcadf2394c737edaeaec9
SHA11c9d16d93f58d2c0a4708ffeaddf9d2c26ef33e8
SHA256ea8543b0eab31dece2b50ef45a2585f4de09af35c68d9a63152944f8a831ac29
SHA5124cffa0d1c4c1a1ddb91ade23e17a76dac807174d022115592caec2d0927af8188455e0c7b8273972de4e27e4bb816e83deed70551075b6effd4f32aecf994053
-
Filesize
23KB
MD5952fc862806f000e37d22897243c2bc4
SHA12da507ba99d86deee0fed3238e5e9fb170a562d2
SHA256955f386e3af5d87a46dcb2064967e34eb25a44ca3d2436e54bd5b84f4a2ab2ee
SHA512c74263c02d2066c0ff8a236c9fc620e2e088b3c1d3b54852de45f7b7dfbea799ffef41787919a196ff4e7ff03d1c7dc1bb2b876f1c7f829e04aa577ff728ef05
-
Filesize
44KB
MD5f0f1575cb0a27c0815cd6a6ee694c7a1
SHA1347aabf545b26e24293e7983a34a88fb1f132ed3
SHA2567f1b10f0679401e5360f7e0baf903035728a631c03056b7d40dbb6ae734fecae
SHA5126713667c5a1cc7d8aef24b3214f045411d41f1d0c14a4d994ec4f53302d9293bb56360e30c51f31542ad67d540b0f0c9f0530783481bc810d1634b127e48989a
-
Filesize
23KB
MD55aab08e129caf5c4595f21142e3c32bd
SHA11ee57e2d3e4939945939d4df180c1f9128fb2582
SHA256ee8ecfd717dfde63ff423f21fca560d80ec333ebfe2d55aba23fb7a1c4bffaaf
SHA5125b5481ff4d75762419322ed491eb932b7a2dc89497f15a5cb020406de717e9463e3494974945b0ff459b2acff2c314c42ebecf5580d4a40e9e3d555bbc0cfe2d
-
Filesize
238KB
MD53f1c773a2e54f4d27b29c3fc1edd7d43
SHA1ef9a5cefd1f3c76b0fa5c8ea4a261dc46e59d185
SHA256ac66bafa0e7196b9f7b4a83b9625b32e83db7731418ecd0f4a8de474f7355254
SHA512d6636ba0c800757d361212169f770d3799cc46583c79e0b9cc7cc49c565b86849e8965fe0783100bfb8039f12b717db88f95062e7b6b6f67a7f8bd38144a4297
-
Filesize
262KB
MD573603c36b4d1522c3402d67ecf657312
SHA16a964ae5d681455c320ea0f8611b79a99a35b283
SHA2567fb934da4bebc1cb81c3e9f5be4dbb3e43aa8098b6e63f5e0b97b3cc105830b4
SHA5125fdc5f8ab72bd05ebea6068c896a7805211a9bdccf0167f48ac456a1e4283b59001e588d7349e34f8511fa297f98af8d5140c883e6d4a192af8d350a433c0238
-
Filesize
697KB
MD53fa2910cbd44b17be47ff26ef27c5157
SHA1d8a2bbcd3c88671b48478db293c61268fc24accf
SHA256d448206c75c51f8a44a1c7fd5dabb8b0505f670ecb2e5d2adf55791b9cef1b0c
SHA51216b70c679db2ba74a98f99956984fa044e96c821ccd5521b4882134c705b823674891d0521dc49c2391d5c184bbbd0c6d68890df65aad1972113aeda4f3b944a
-
Filesize
1.1MB
MD57569f642fb8dc4772f1e06d3360a1b73
SHA100ce8658ba9713c46f4aaaf0ece9b882609cd10b
SHA25635c9bc0d25b66a2a4da3341bd7b1634c9c1296c919add04e11c6bd3ac25e3386
SHA5126d8a3522a11ae8983457478c8095c61faff7c4fce2fba03af6abd4cd4130cdd203960273793f2278128348f9c2b4c5ccd2d34796357029d8daf4a4809d87d96d
-
Filesize
138KB
MD5b51fb63223915f23c60adc580c9a0531
SHA1a22bf33ac2769c31c922c45f314b4d6e42ed77db
SHA256b9eace03c8471717e3f98873527005dbd9a92367b954f8c48484d2b7b78efbac
SHA512cd72aac2128c48c34568db1ac7b33e6934f31f473278426ef2acf9cd4df545dea8424bedf79340eb74a966ce39a3a7d9910fcbe456047d83330c62761644194d
-
Filesize
56KB
MD548218aa6a473255fe6d47dcf3f0b7d6b
SHA165f9f03c3131da53389e3250a255eda418f18fc8
SHA25676e459a20b870b91c42f525155ba94e8e2aa0ce82c4da46bdf2386321f6378b3
SHA512bbf5edaf94bd8356dae4bfe63967c75044cf03c1844a67628f5b30e70a0d82dc74340466147614b48ffb48de25326bc28a2f366f776f9fb6bed98512aa275161