Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
120s -
max time network
125s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
25/12/2023, 03:57
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
0439cdc48533b30ecf55a22ab4c98d41.exe
Resource
win7-20231215-en
windows7-x64
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
0439cdc48533b30ecf55a22ab4c98d41.exe
Resource
win10v2004-20231215-en
windows10-2004-x64
1 signatures
150 seconds
General
-
Target
0439cdc48533b30ecf55a22ab4c98d41.exe
-
Size
26KB
-
MD5
0439cdc48533b30ecf55a22ab4c98d41
-
SHA1
4dbafb06307a872178657a30de2adda7cec3045d
-
SHA256
30ded1bf967b8caa619cbe8e9f55942583d644f663a5825da42070eff9e4f77c
-
SHA512
84f8e32c872716fd232a7bc53e8a3ac57dcddf5377fd141e980bcf92867fbd4d2f6ea2675a7be335b16bb83169be717afadc918d649ee6f14347f2dbb8c6e01b
-
SSDEEP
384:MQEAygHFk+M0j0WVqs84S0iMbxQWC4Tn4xUWpWzWv4rBvbVL1KZ695:hyglgWI4DtKWfT4xCxDLEZ45
Score
5/10
Malware Config
Signatures
-
Drops file in System32 directory 64 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\Netplwiz.exe 0439cdc48533b30ecf55a22ab4c98d41.exe File opened for modification C:\Windows\SysWOW64\taskeng.exe 0439cdc48533b30ecf55a22ab4c98d41.exe File opened for modification C:\Windows\SysWOW64\tasklist.exe 0439cdc48533b30ecf55a22ab4c98d41.exe File opened for modification C:\Windows\SysWOW64\wextract.exe 0439cdc48533b30ecf55a22ab4c98d41.exe File opened for modification C:\Windows\SysWOW64\where.exe 0439cdc48533b30ecf55a22ab4c98d41.exe File opened for modification C:\Windows\SysWOW64\wowreg32.exe 0439cdc48533b30ecf55a22ab4c98d41.exe File opened for modification C:\Windows\SysWOW64\cmdkey.exe 0439cdc48533b30ecf55a22ab4c98d41.exe File opened for modification C:\Windows\SysWOW64\chkdsk.exe 0439cdc48533b30ecf55a22ab4c98d41.exe File opened for modification C:\Windows\SysWOW64\chkntfs.exe 0439cdc48533b30ecf55a22ab4c98d41.exe File opened for modification C:\Windows\SysWOW64\NETSTAT.EXE 0439cdc48533b30ecf55a22ab4c98d41.exe File opened for modification C:\Windows\SysWOW64\print.exe 0439cdc48533b30ecf55a22ab4c98d41.exe File opened for modification C:\Windows\SysWOW64\RunLegacyCPLElevated.exe 0439cdc48533b30ecf55a22ab4c98d41.exe File opened for modification C:\Windows\SysWOW64\SystemPropertiesComputerName.exe 0439cdc48533b30ecf55a22ab4c98d41.exe File opened for modification C:\Windows\SysWOW64\tzutil.exe 0439cdc48533b30ecf55a22ab4c98d41.exe File opened for modification C:\Windows\SysWOW64\attrib.exe 0439cdc48533b30ecf55a22ab4c98d41.exe File opened for modification C:\Windows\SysWOW64\xwizard.exe 0439cdc48533b30ecf55a22ab4c98d41.exe File opened for modification C:\Windows\SysWOW64\wimserv.exe 0439cdc48533b30ecf55a22ab4c98d41.exe File opened for modification C:\Windows\SysWOW64\SystemPropertiesPerformance.exe 0439cdc48533b30ecf55a22ab4c98d41.exe File opened for modification C:\Windows\SysWOW64\timeout.exe 0439cdc48533b30ecf55a22ab4c98d41.exe File opened for modification C:\Windows\SysWOW64\credwiz.exe 0439cdc48533b30ecf55a22ab4c98d41.exe File opened for modification C:\Windows\SysWOW64\icardagt.exe 0439cdc48533b30ecf55a22ab4c98d41.exe File opened for modification C:\Windows\SysWOW64\mspaint.exe 0439cdc48533b30ecf55a22ab4c98d41.exe File opened for modification C:\Windows\SysWOW64\SystemPropertiesAdvanced.exe 0439cdc48533b30ecf55a22ab4c98d41.exe File opened for modification C:\Windows\SysWOW64\dcomcnfg.exe 0439cdc48533b30ecf55a22ab4c98d41.exe File opened for modification C:\Windows\SysWOW64\DWWIN.EXE 0439cdc48533b30ecf55a22ab4c98d41.exe File opened for modification C:\Windows\SysWOW64\grpconv.exe 0439cdc48533b30ecf55a22ab4c98d41.exe File opened for modification C:\Windows\SysWOW64\RMActivate.exe 0439cdc48533b30ecf55a22ab4c98d41.exe File opened for modification C:\Windows\SysWOW64\tracerpt.exe 0439cdc48533b30ecf55a22ab4c98d41.exe File opened for modification C:\Windows\SysWOW64\clip.exe 0439cdc48533b30ecf55a22ab4c98d41.exe File opened for modification C:\Windows\SysWOW64\sfc.exe 0439cdc48533b30ecf55a22ab4c98d41.exe File opened for modification C:\Windows\SysWOW64\systeminfo.exe 0439cdc48533b30ecf55a22ab4c98d41.exe File opened for modification C:\Windows\SysWOW64\vssadmin.exe 0439cdc48533b30ecf55a22ab4c98d41.exe File opened for modification C:\Windows\SysWOW64\proquota.exe 0439cdc48533b30ecf55a22ab4c98d41.exe File opened for modification C:\Windows\SysWOW64\label.exe 0439cdc48533b30ecf55a22ab4c98d41.exe File opened for modification C:\Windows\SysWOW64\RegisterIEPKEYs.exe 0439cdc48533b30ecf55a22ab4c98d41.exe File opened for modification C:\Windows\SysWOW64\RmClient.exe 0439cdc48533b30ecf55a22ab4c98d41.exe File opened for modification C:\Windows\SysWOW64\Utilman.exe 0439cdc48533b30ecf55a22ab4c98d41.exe File opened for modification C:\Windows\SysWOW64\winrshost.exe 0439cdc48533b30ecf55a22ab4c98d41.exe File opened for modification C:\Windows\SysWOW64\hh.exe 0439cdc48533b30ecf55a22ab4c98d41.exe File opened for modification C:\Windows\SysWOW64\makecab.exe 0439cdc48533b30ecf55a22ab4c98d41.exe File opened for modification C:\Windows\SysWOW64\systray.exe 0439cdc48533b30ecf55a22ab4c98d41.exe File opened for modification C:\Windows\SysWOW64\TpmInit.exe 0439cdc48533b30ecf55a22ab4c98d41.exe File opened for modification C:\Windows\SysWOW64\UserAccountControlSettings.exe 0439cdc48533b30ecf55a22ab4c98d41.exe File opened for modification C:\Windows\SysWOW64\cacls.exe 0439cdc48533b30ecf55a22ab4c98d41.exe File opened for modification C:\Windows\SysWOW64\gpupdate.exe 0439cdc48533b30ecf55a22ab4c98d41.exe File opened for modification C:\Windows\SysWOW64\mmc.exe 0439cdc48533b30ecf55a22ab4c98d41.exe File opened for modification C:\Windows\SysWOW64\rasphone.exe 0439cdc48533b30ecf55a22ab4c98d41.exe File opened for modification C:\Windows\SysWOW64\SystemPropertiesProtection.exe 0439cdc48533b30ecf55a22ab4c98d41.exe File opened for modification C:\Windows\SysWOW64\cmdl32.exe 0439cdc48533b30ecf55a22ab4c98d41.exe File opened for modification C:\Windows\SysWOW64\winver.exe 0439cdc48533b30ecf55a22ab4c98d41.exe File opened for modification C:\Windows\SysWOW64\RMActivate_ssp_isv.exe 0439cdc48533b30ecf55a22ab4c98d41.exe File opened for modification C:\Windows\SysWOW64\recover.exe 0439cdc48533b30ecf55a22ab4c98d41.exe File opened for modification C:\Windows\SysWOW64\perfmon.exe 0439cdc48533b30ecf55a22ab4c98d41.exe File opened for modification C:\Windows\SysWOW64\com\MigRegDB.exe 0439cdc48533b30ecf55a22ab4c98d41.exe File opened for modification C:\Windows\SysWOW64\setupSNK.exe 0439cdc48533b30ecf55a22ab4c98d41.exe File opened for modification C:\Windows\SysWOW64\sort.exe 0439cdc48533b30ecf55a22ab4c98d41.exe File opened for modification C:\Windows\SysWOW64\bootcfg.exe 0439cdc48533b30ecf55a22ab4c98d41.exe File opened for modification C:\Windows\SysWOW64\ocsetup.exe 0439cdc48533b30ecf55a22ab4c98d41.exe File opened for modification C:\Windows\SysWOW64\com\comrepl.exe 0439cdc48533b30ecf55a22ab4c98d41.exe File opened for modification C:\Windows\SysWOW64\forfiles.exe 0439cdc48533b30ecf55a22ab4c98d41.exe File opened for modification C:\Windows\SysWOW64\iscsicpl.exe 0439cdc48533b30ecf55a22ab4c98d41.exe File opened for modification C:\Windows\SysWOW64\msdt.exe 0439cdc48533b30ecf55a22ab4c98d41.exe File opened for modification C:\Windows\SysWOW64\SndVol.exe 0439cdc48533b30ecf55a22ab4c98d41.exe File opened for modification C:\Windows\SysWOW64\svchost.exe 0439cdc48533b30ecf55a22ab4c98d41.exe -
Drops file in Program Files directory 5 IoCs
description ioc Process File opened for modification C:\Program Files\Windows Photo Viewer\ImagingDevices.exe 0439cdc48533b30ecf55a22ab4c98d41.exe File opened for modification C:\Program Files\Mozilla Firefox\maintenanceservice.exe 0439cdc48533b30ecf55a22ab4c98d41.exe File opened for modification C:\Program Files\Mozilla Firefox\minidump-analyzer.exe 0439cdc48533b30ecf55a22ab4c98d41.exe File opened for modification C:\Program Files\Mozilla Firefox\pingsender.exe 0439cdc48533b30ecf55a22ab4c98d41.exe File opened for modification C:\Program Files\Windows NT\Accessories\wordpad.exe 0439cdc48533b30ecf55a22ab4c98d41.exe -
Drops file in Windows directory 3 IoCs
description ioc Process File opened for modification C:\Windows\hh.exe 0439cdc48533b30ecf55a22ab4c98d41.exe File opened for modification C:\Windows\twunk_32.exe 0439cdc48533b30ecf55a22ab4c98d41.exe File opened for modification C:\Windows\fveupdate.exe 0439cdc48533b30ecf55a22ab4c98d41.exe