Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
12s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
24/12/2023, 14:50
Behavioral task
behavioral1
Sample
023832845d2507e2bd62832d44fc091c.exe
Resource
win7-20231215-en
windows7-x64
Behavioral task
behavioral2
Sample
023832845d2507e2bd62832d44fc091c.exe
Resource
win10v2004-20231215-en
windows10-2004-x64
General
-
Target
023832845d2507e2bd62832d44fc091c.exe
-
Size
1.8MB
-
MD5
023832845d2507e2bd62832d44fc091c
-
SHA1
fd1707fb8c54d46343427b0e4661de57ceb6a0eb
-
SHA256
895cc7b9833f33e7814f9e5aeb60505ef41b0d300f853660be0d39e17db2d67e
-
SHA512
92af5fb04d964301f96fec6b7f9b47197025caf95edb0680a3a7d987c6ffe5c1c49491a04d9e5ec67fee23d5508a9d96470cdba4798a8b34702a860972b779ab
-
SSDEEP
24576:S6pQPxQ2JyP2r5mJV91xM7RpbwgIvs7Nxqw:SCqm2Jpr0nNM7Dus7Nxp
Malware Config
Signatures
-
resource yara_rule behavioral2/memory/3516-0-0x0000000000400000-0x00000000005BA000-memory.dmp upx behavioral2/files/0x0002000000022897-5.dat upx behavioral2/memory/3516-5293-0x0000000000400000-0x00000000005BA000-memory.dmp upx behavioral2/files/0x000100000002182d-11160.dat upx behavioral2/files/0x000100000002182d-11164.dat upx behavioral2/files/0x000100000002182d-11163.dat upx behavioral2/files/0x000100000002182d-11162.dat upx behavioral2/files/0x000100000002182d-11161.dat upx behavioral2/files/0x000100000002182d-11159.dat upx behavioral2/memory/3516-13405-0x0000000000400000-0x00000000005BA000-memory.dmp upx -
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Java\jdk-1.8\jre\lib\plugin.jar 023832845d2507e2bd62832d44fc091c.exe File opened for modification C:\Program Files\Java\jdk-1.8\legal\javafx\gstreamer.md 023832845d2507e2bd62832d44fc091c.exe File opened for modification C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\lt.pak 023832845d2507e2bd62832d44fc091c.exe File created C:\Program Files\Internet Explorer\iexplore.exe 023832845d2507e2bd62832d44fc091c.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\api-ms-win-crt-conio-l1-1-0.dll 023832845d2507e2bd62832d44fc091c.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\t2k.dll.exe 023832845d2507e2bd62832d44fc091c.exe File created C:\Program Files\Common Files\System\msadc\msadce.dll 023832845d2507e2bd62832d44fc091c.exe File created C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\base_altgr.xml.exe 023832845d2507e2bd62832d44fc091c.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\lib\cmm\GRAY.pf 023832845d2507e2bd62832d44fc091c.exe File created C:\Program Files\Java\jre-1.8\bin\api-ms-win-core-handle-l1-1-0.dll.exe 023832845d2507e2bd62832d44fc091c.exe File created C:\Program Files\Java\jre-1.8\bin\api-ms-win-crt-runtime-l1-1-0.dll.exe 023832845d2507e2bd62832d44fc091c.exe File created C:\Program Files\Common Files\System\ado\msado21.tlb 023832845d2507e2bd62832d44fc091c.exe File created C:\Program Files\Common Files\microsoft shared\ink\de-DE\InkObj.dll.mui 023832845d2507e2bd62832d44fc091c.exe File created C:\Program Files\Google\Chrome\Application\chrome.VisualElementsManifest.xml.exe 023832845d2507e2bd62832d44fc091c.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\jfxmedia.dll 023832845d2507e2bd62832d44fc091c.exe File created C:\Program Files\Java\jdk-1.8\bin\jstat.exe.exe 023832845d2507e2bd62832d44fc091c.exe File created C:\Program Files\7-Zip\Lang\br.txt.exe 023832845d2507e2bd62832d44fc091c.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.fr-fr.dll.exe 023832845d2507e2bd62832d44fc091c.exe File created C:\Program Files\Common Files\microsoft shared\ink\rtscom.dll.exe 023832845d2507e2bd62832d44fc091c.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\api-ms-win-core-handle-l1-1-0.dll 023832845d2507e2bd62832d44fc091c.exe File created C:\Program Files\Common Files\microsoft shared\ink\TipRes.dll 023832845d2507e2bd62832d44fc091c.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\java_crw_demo.dll.exe 023832845d2507e2bd62832d44fc091c.exe File created C:\Program Files\Java\jdk-1.8\lib\ct.sym.exe 023832845d2507e2bd62832d44fc091c.exe File opened for modification C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\gu.pak 023832845d2507e2bd62832d44fc091c.exe File created C:\Program Files\Google\Chrome\Application\106.0.5249.119\VisualElements\LogoCanary.png.exe 023832845d2507e2bd62832d44fc091c.exe File opened for modification C:\Program Files\Google\Chrome\Application\106.0.5249.119\chrome_wer.dll 023832845d2507e2bd62832d44fc091c.exe File created C:\Program Files\Internet Explorer\hmmapi.dll 023832845d2507e2bd62832d44fc091c.exe File created C:\Program Files\Common Files\System\Ole DB\ja-JP\sqlxmlx.rll.mui.exe 023832845d2507e2bd62832d44fc091c.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\ServiceWatcherSchedule.xml 023832845d2507e2bd62832d44fc091c.exe File created C:\Program Files\Common Files\microsoft shared\OFFICE16\Office Setup Controller\pkeyconfig-office.xrm-ms.exe 023832845d2507e2bd62832d44fc091c.exe File created C:\Program Files\Common Files\microsoft shared\ink\it-IT\tabskb.dll.mui.exe 023832845d2507e2bd62832d44fc091c.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\javacpl.cpl 023832845d2507e2bd62832d44fc091c.exe File opened for modification C:\Program Files\Java\jdk-1.8\THIRDPARTYLICENSEREADME.txt 023832845d2507e2bd62832d44fc091c.exe File created C:\Program Files\Java\jdk-1.8\include\jdwpTransport.h.exe 023832845d2507e2bd62832d44fc091c.exe File created C:\Program Files\Java\jdk-1.8\include\win32\jawt_md.h.exe 023832845d2507e2bd62832d44fc091c.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\api-ms-win-crt-multibyte-l1-1-0.dll 023832845d2507e2bd62832d44fc091c.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe.exe 023832845d2507e2bd62832d44fc091c.exe File created C:\Program Files\Java\jdk-1.8\jre\legal\jdk\cryptix.md.exe 023832845d2507e2bd62832d44fc091c.exe File opened for modification C:\Program Files\7-Zip\History.txt 023832845d2507e2bd62832d44fc091c.exe File created C:\Program Files\Common Files\System\ado\de-DE\msader15.dll.mui.exe 023832845d2507e2bd62832d44fc091c.exe File opened for modification C:\Program Files\Google\Chrome\Application\106.0.5249.119\VisualElements\SmallLogoCanary.png 023832845d2507e2bd62832d44fc091c.exe File opened for modification C:\Program Files\Google\Chrome\Application\106.0.5249.119\WidevineCdm\_platform_specific\win_x64\widevinecdm.dll 023832845d2507e2bd62832d44fc091c.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\lib\jsse.jar 023832845d2507e2bd62832d44fc091c.exe File created C:\Program Files\Java\jdk-1.8\lib\tools.jar.exe 023832845d2507e2bd62832d44fc091c.exe File created C:\Program Files\7-Zip\Lang\is.txt.exe 023832845d2507e2bd62832d44fc091c.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\fontmanager.dll.exe 023832845d2507e2bd62832d44fc091c.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\plugin2\msvcp140.dll.exe 023832845d2507e2bd62832d44fc091c.exe File created C:\Program Files\Java\jdk-1.8\jre\lib\ext\sunmscapi.jar.exe 023832845d2507e2bd62832d44fc091c.exe File created C:\Program Files\7-Zip\Lang\nb.txt.exe 023832845d2507e2bd62832d44fc091c.exe File created C:\Program Files\Google\Chrome\Application\106.0.5249.119\chrome_elf.dll.exe 023832845d2507e2bd62832d44fc091c.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\lib\classlist 023832845d2507e2bd62832d44fc091c.exe File created C:\Program Files\7-Zip\Lang\fy.txt.exe 023832845d2507e2bd62832d44fc091c.exe File created C:\Program Files\Common Files\System\msadc\fr-FR\msaddsr.dll.mui.exe 023832845d2507e2bd62832d44fc091c.exe File created C:\Program Files\Common Files\microsoft shared\ink\it-IT\mshwLatin.dll.mui.exe 023832845d2507e2bd62832d44fc091c.exe File opened for modification C:\Program Files\Google\Chrome\Application\106.0.5249.119\default_apps\external_extensions.json 023832845d2507e2bd62832d44fc091c.exe File created C:\Program Files\Java\jre-1.8\bin\jsound.dll.exe 023832845d2507e2bd62832d44fc091c.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-core-file-l1-2-0.dll.exe 023832845d2507e2bd62832d44fc091c.exe File created C:\Program Files\Common Files\microsoft shared\ink\ar-SA\tipresx.dll.mui 023832845d2507e2bd62832d44fc091c.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\dcpr.dll.exe 023832845d2507e2bd62832d44fc091c.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\jaas_nt.dll 023832845d2507e2bd62832d44fc091c.exe File opened for modification C:\Program Files\Java\jre-1.8\THIRDPARTYLICENSEREADME-JAVAFX.txt 023832845d2507e2bd62832d44fc091c.exe File created C:\Program Files\Java\jre-1.8\bin\api-ms-win-crt-conio-l1-1-0.dll.exe 023832845d2507e2bd62832d44fc091c.exe File created C:\Program Files\7-Zip\Lang\az.txt.exe 023832845d2507e2bd62832d44fc091c.exe File created C:\Program Files\Internet Explorer\es-ES\ieinstal.exe.mui 023832845d2507e2bd62832d44fc091c.exe
Processes
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
129KB
MD5b0b238ca70413271cc298655340a0b32
SHA199a6977218583c718b74e74c1c27df9df8b2f7ee
SHA256f57249dfdac0de77c3ea99e966642fcdd95b2a0b43f4f9267eaaa86ebd20bc4c
SHA5129b30fbf7067ea334bc7690e54f3a2f95b3ec2dcb736540d74b4f24c7dff343ac37183eb1b0995d99f6706983a20d1cc6651181e18d6a1f12bcd5b3fd1a9d5a88
-
C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\msoshext.dll
Filesize350KB
MD55cbcdd8c3667588c9f6de23000aec26b
SHA17e2bc7481f37a18ff84ac8d424f03e7c073f70b7
SHA256d4b4adc96e2dd1b32357f1d785399727a2637dc758804a264039c7cb76a51582
SHA512e73bcfc71549a94fc4c9aaa7aac64183c1fb98bc75e3fa2b260583c26f8cbb50189831954f63f4a4678ea6cd5498d2a66967acf332d0d66f98950ff07b72cac9
-
C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\msoshext.dll
Filesize1KB
MD5b2137d95f05ce3a88174d28d7502383f
SHA14d8bf0ba77a6828d0a951949cc7aa2540d616900
SHA25669125a5ff0fd84f7cf40ff20f1be93b08032de5df50a7334e39a60c481cb6948
SHA5124d1562f7f65d4fd6e28bb2747fc1bac7f0d7b1055f495ee4010ec23ab422d6acdac3fc2f3220d4e0742a90950959a12c0e3f026c2b937ddf089f372b6152cd81
-
C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\msoshext.dll
Filesize324KB
MD51c0fad922e1892cecddfb88933a669ff
SHA13d9b8087f5ca6f2ea7adf1c39ca9531dabe59429
SHA2566c823a843e34451fd5047201250e5936902909c40fe05907387d1b3a3f3c7549
SHA512972ea7df9ed31cdc91a030f4b41a3a8ccd0aea86610eecb795456f5e4469e9b508760c65853577617134b95dcd049e1371cdb6f62e05d67069da4c58f250ad3e
-
C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\msoshext.dll
Filesize432KB
MD58aec731642e02dc033f2f43dfb6dbc47
SHA11bd00aeff9a7291249a5052b811261ccc9a687a2
SHA25663c3672e72783837c22a7b3846881d440a43d5ba6f7c7aa527fea3386ab26708
SHA5123c19c4c04ab32e160aa7a529473353654d0a05d58b016fc260c04a916a30ae6898c6cf533f4f4a3c1e01a94aa7054c5eb69a063b4337d24894eacce74c5b3e39
-
C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\msoshext.dll
Filesize308KB
MD5698e5326bf725f90c87103baf08d2086
SHA1551a0fc5be9ff5e0c2250a6856ec7a7e98917e70
SHA256aeb73f701feec7777e2631c22fc0d8eb618994c2a027c89a3fa9bf31272d440d
SHA512cc3ef536e6eb1e3f408f101c98ce01e1555755ffed5ca8e208ce528864dca4c9f286e0993e9dd9212e56894340bb83be8bdfd5d6ddd340257b374020a6d28f61