Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
91s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20231222-en -
resource tags
arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system -
submitted
25/12/2023, 11:37
Behavioral task
behavioral1
Sample
1b5a2b0ed958c8d5babdd33ba46355b0.exe
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
1b5a2b0ed958c8d5babdd33ba46355b0.exe
Resource
win10v2004-20231222-en
General
-
Target
1b5a2b0ed958c8d5babdd33ba46355b0.exe
-
Size
1.8MB
-
MD5
1b5a2b0ed958c8d5babdd33ba46355b0
-
SHA1
b638d8823b9a2ae6cda12ca8aac3ac0f0d2a240e
-
SHA256
04295bf9e3fce76d33cd3dc00a875c350743927545663100aca63066ef171c2b
-
SHA512
9af49cd2fd8b4d9a507d65c3076c1cacb9a659234efcc3a2085ab9f07ee9aac0779d6df8cdee20c1f91b1af16ab593812da7ac3a0407348925a08b8060a5c9f9
-
SSDEEP
24576:S6pQPxQ2JyP2r5mJV91xM7RpbwgIvs7NxqtI:SCqm2Jpr0nNM7Dus7Nx/
Malware Config
Signatures
-
resource yara_rule behavioral2/memory/4912-0-0x0000000000400000-0x00000000005BA000-memory.dmp upx behavioral2/files/0x00020000000228cc-5.dat upx behavioral2/memory/4912-5391-0x0000000000400000-0x00000000005BA000-memory.dmp upx behavioral2/memory/4912-13419-0x0000000000400000-0x00000000005BA000-memory.dmp upx -
Drops desktop.ini file(s) 2 IoCs
description ioc Process File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\DataServices\DESKTOP.INI 1b5a2b0ed958c8d5babdd33ba46355b0.exe File created C:\Program Files\desktop.ini 1b5a2b0ed958c8d5babdd33ba46355b0.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Java\jdk-1.8\bin\api-ms-win-core-console-l1-1-0.dll 1b5a2b0ed958c8d5babdd33ba46355b0.exe File created C:\Program Files\Microsoft Office\root\Client\vccorlib140.dll.exe 1b5a2b0ed958c8d5babdd33ba46355b0.exe File created C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.XboxGamingOverlay_2.34.28001.0_neutral_split.scale-125_8wekyb3d8bbwe\AppxSignature.p7x 1b5a2b0ed958c8d5babdd33ba46355b0.exe File created C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\images\contrast-black\OneNoteAppList.targetsize-32_altform-unplated.png.exe 1b5a2b0ed958c8d5babdd33ba46355b0.exe File created C:\Program Files\WindowsApps\Microsoft.ScreenSketch_10.1907.2471.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\ScreenSketchSquare44x44Logo.scale-100_contrast-black.png.exe 1b5a2b0ed958c8d5babdd33ba46355b0.exe File opened for modification C:\Program Files\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\DSCResources\MSFT_PackageManagementSource\it-IT\MSFT_PackageManagementSource.strings.psd1 1b5a2b0ed958c8d5babdd33ba46355b0.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019R_OEM_Perp3-pl.xrm-ms 1b5a2b0ed958c8d5babdd33ba46355b0.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProPlusR_OEM_Perp3-ul-oob.xrm-ms.exe 1b5a2b0ed958c8d5babdd33ba46355b0.exe File created C:\Program Files\WindowsApps\Microsoft.VP9VideoExtensions_1.0.22681.0_x64__8wekyb3d8bbwe\Assets\contrast-black\AppList.targetsize-20_altform-unplated_contrast-black.png.exe 1b5a2b0ed958c8d5babdd33ba46355b0.exe File created C:\Program Files\WindowsApps\Microsoft.WebpImageExtension_1.0.22753.0_x64__8wekyb3d8bbwe\Assets\AppList.targetsize-256_altform-unplated.png 1b5a2b0ed958c8d5babdd33ba46355b0.exe File created C:\Program Files\WindowsApps\Microsoft.WindowsCalculator_10.1906.55.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\CalculatorSmallTile.contrast-white_scale-100.png.exe 1b5a2b0ed958c8d5babdd33ba46355b0.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\api-ms-win-core-processthreads-l1-1-0.dll 1b5a2b0ed958c8d5babdd33ba46355b0.exe File created C:\Program Files\WindowsApps\Microsoft.Windows.Photos_2019.19071.12548.0_x64__8wekyb3d8bbwe\Assets\PhotosAppList.targetsize-80_altform-colorize.png 1b5a2b0ed958c8d5babdd33ba46355b0.exe File created C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\ExchangeBadge.scale-150.png 1b5a2b0ed958c8d5babdd33ba46355b0.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\ExcelR_OEM_Perp-pl.xrm-ms 1b5a2b0ed958c8d5babdd33ba46355b0.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\Standard2019R_Trial-ul-oob.xrm-ms 1b5a2b0ed958c8d5babdd33ba46355b0.exe File created C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.DesktopAppInstaller_1.0.30251.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\AppPackageSmallTile.scale-125.png 1b5a2b0ed958c8d5babdd33ba46355b0.exe File created C:\Program Files\WindowsApps\Microsoft.Microsoft3DViewer_6.1908.2042.0_x64__8wekyb3d8bbwe\Assets\StoreLogo.scale-400.png 1b5a2b0ed958c8d5babdd33ba46355b0.exe File created C:\Program Files\WindowsApps\Microsoft.ZuneVideo_10.19071.19011.0_x64__8wekyb3d8bbwe\Assets\contrast-black\AppList.targetsize-40_contrast-black.png 1b5a2b0ed958c8d5babdd33ba46355b0.exe File created C:\Program Files\Common Files\microsoft shared\ink\lt-LT\tipresx.dll.mui 1b5a2b0ed958c8d5babdd33ba46355b0.exe File created C:\Program Files\VideoLAN\VLC\locale\my\LC_MESSAGES\vlc.mo.exe 1b5a2b0ed958c8d5babdd33ba46355b0.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\pt_PT\LC_MESSAGES\vlc.mo 1b5a2b0ed958c8d5babdd33ba46355b0.exe File created C:\Program Files\WindowsApps\Microsoft.MicrosoftStickyNotes_3.6.73.0_x64__8wekyb3d8bbwe\Assets\ImagePlaceholderBlack.png.exe 1b5a2b0ed958c8d5babdd33ba46355b0.exe File created C:\Program Files\WindowsApps\Microsoft.ZuneMusic_10.19071.19011.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\contrast-black\iheart-radio.scale-100_contrast-black.png.exe 1b5a2b0ed958c8d5babdd33ba46355b0.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe.exe 1b5a2b0ed958c8d5babdd33ba46355b0.exe File created C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000027\assets\Icons\[email protected] 1b5a2b0ed958c8d5babdd33ba46355b0.exe File created C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\AppTiles\contrast-white\MapsWideTile.scale-100.png.exe 1b5a2b0ed958c8d5babdd33ba46355b0.exe File created C:\Program Files\Microsoft Office\root\Licenses16\OutlookR_Retail-ul-phn.xrm-ms.exe 1b5a2b0ed958c8d5babdd33ba46355b0.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\ProPlusR_OEM_Perp4-ppd.xrm-ms 1b5a2b0ed958c8d5babdd33ba46355b0.exe File created C:\Program Files\WindowsApps\Microsoft.YourPhone_0.19051.7.0_x64__8wekyb3d8bbwe\Assets\AppTiles\MediumTile.scale-200.png.exe 1b5a2b0ed958c8d5babdd33ba46355b0.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\Microsoft.Win32.Registry.AccessControl.dll.exe 1b5a2b0ed958c8d5babdd33ba46355b0.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\pt-BR\PresentationCore.resources.dll 1b5a2b0ed958c8d5babdd33ba46355b0.exe File created C:\Program Files\Common Files\Services\verisign.bmp 1b5a2b0ed958c8d5babdd33ba46355b0.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\de\System.Windows.Input.Manipulations.resources.dll.exe 1b5a2b0ed958c8d5babdd33ba46355b0.exe File created C:\Program Files\Common Files\microsoft shared\MSInfo\fr-FR\msinfo32.exe.mui 1b5a2b0ed958c8d5babdd33ba46355b0.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Smart Tag\MSTAG.TLB 1b5a2b0ed958c8d5babdd33ba46355b0.exe File created C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\System.Printing.dll 1b5a2b0ed958c8d5babdd33ba46355b0.exe File created C:\Program Files\WindowsApps\Microsoft.ScreenSketch_10.1907.2471.0_x64__8wekyb3d8bbwe\Assets\ScreenSketchSquare44x44Logo.targetsize-24_contrast-white.png 1b5a2b0ed958c8d5babdd33ba46355b0.exe File created C:\Program Files\WindowsApps\Microsoft.WindowsCalculator_10.1906.55.0_x64__8wekyb3d8bbwe\Assets\CalculatorAppList.contrast-white_targetsize-60.png 1b5a2b0ed958c8d5babdd33ba46355b0.exe File created C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\HxA-Yahoo-Dark.scale-150.png 1b5a2b0ed958c8d5babdd33ba46355b0.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\Microsoft.VisualBasic.dll.exe 1b5a2b0ed958c8d5babdd33ba46355b0.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProPlusR_OEM_Perp6-pl.xrm-ms.exe 1b5a2b0ed958c8d5babdd33ba46355b0.exe File created C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\Doughboy.scale-250.png.exe 1b5a2b0ed958c8d5babdd33ba46355b0.exe File created C:\Program Files\Microsoft Office\root\Office16\MSIPC\ipcsecproc.dll.exe 1b5a2b0ed958c8d5babdd33ba46355b0.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\codec\libdvbsub_plugin.dll 1b5a2b0ed958c8d5babdd33ba46355b0.exe File created C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsStore_11910.1002.5.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\AppTiles\LibrarySquare150x150Logo.scale-125.png.exe 1b5a2b0ed958c8d5babdd33ba46355b0.exe File created C:\Program Files\WindowsApps\Microsoft.WindowsAlarms_10.1906.2182.0_x64__8wekyb3d8bbwe\Assets\AlarmsAppList.contrast-black_targetsize-16_altform-unplated.png.exe 1b5a2b0ed958c8d5babdd33ba46355b0.exe File created C:\Program Files\WindowsApps\Microsoft.XboxApp_48.49.31001.0_x64__8wekyb3d8bbwe\Assets\GamesXboxHubAppList.targetsize-32_altform-unplated_contrast-white.png.exe 1b5a2b0ed958c8d5babdd33ba46355b0.exe File created C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-black\OutlookMailWideTile.scale-150.png 1b5a2b0ed958c8d5babdd33ba46355b0.exe File created C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-white\HxA-Generic-Light.scale-300.png 1b5a2b0ed958c8d5babdd33ba46355b0.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\System.Runtime.CompilerServices.VisualC.dll.exe 1b5a2b0ed958c8d5babdd33ba46355b0.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\VisioPro2019R_Grace-ppd.xrm-ms 1b5a2b0ed958c8d5babdd33ba46355b0.exe File created C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\manifests\BuiltinOnboardingCommands.xml 1b5a2b0ed958c8d5babdd33ba46355b0.exe File created C:\Program Files\WindowsApps\Microsoft.ZuneVideo_10.19071.19011.0_x64__8wekyb3d8bbwe\Assets\AppList.targetsize-48_altform-lightunplated.png.exe 1b5a2b0ed958c8d5babdd33ba46355b0.exe File created C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\models\it-IT.PhoneNumber.model.exe 1b5a2b0ed958c8d5babdd33ba46355b0.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Cartridges\msjet.xsl 1b5a2b0ed958c8d5babdd33ba46355b0.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Fonts\private\BOOKOS.TTF 1b5a2b0ed958c8d5babdd33ba46355b0.exe File created C:\Program Files\VideoLAN\VLC\lua\modules\sandbox.luac.exe 1b5a2b0ed958c8d5babdd33ba46355b0.exe File created C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.YourPhone_0.19051.7.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\AppTiles\contrast-white\LargeTile.scale-125_contrast-white.png 1b5a2b0ed958c8d5babdd33ba46355b0.exe File created C:\Program Files\WindowsApps\Microsoft.VP9VideoExtensions_1.0.22681.0_x64__8wekyb3d8bbwe\Assets\contrast-black\AppList.targetsize-96_contrast-black.png.exe 1b5a2b0ed958c8d5babdd33ba46355b0.exe File created C:\Program Files\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\Microsoft.PowerShell.PackageManagement.dll.exe 1b5a2b0ed958c8d5babdd33ba46355b0.exe File created C:\Program Files\Microsoft Office\root\Licenses16\SkypeforBusiness2019VL_KMS_Client_AE-ul-oob.xrm-ms.exe 1b5a2b0ed958c8d5babdd33ba46355b0.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\VisioStd2019VL_KMS_Client_AE-ul.xrm-ms 1b5a2b0ed958c8d5babdd33ba46355b0.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\tr\UIAutomationProvider.resources.dll 1b5a2b0ed958c8d5babdd33ba46355b0.exe
Processes
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.4MB
MD5b8de49eaf9ee100450e2ed37e5fdd2cb
SHA19d48119e7d5978b1504815f70a956d497fcfe883
SHA256bca8227cd12aec187dbd8c6fb294cb74a65df51de0f0b86a53cc0b1006d83cf7
SHA51263156decf7c2575551bd35ff5404d65a2920446d905232ecc06d1fad62fcddb05376a4c708e96c753aa5ea0908c436473857af9a09d3a115f2d5fc9fb0fa96d2