Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
22s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
26/12/2023, 11:08
Behavioral task
behavioral1
Sample
69b0db900c3342e04345e2f3ba2d5c33.exe
Resource
win7-20231215-en
windows7-x64
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
69b0db900c3342e04345e2f3ba2d5c33.exe
Resource
win10v2004-20231215-en
windows10-2004-x64
3 signatures
150 seconds
General
-
Target
69b0db900c3342e04345e2f3ba2d5c33.exe
-
Size
1.8MB
-
MD5
69b0db900c3342e04345e2f3ba2d5c33
-
SHA1
38fe867819a61d962cd16e74d566880ec5fb2266
-
SHA256
6ee591fa2cdb0df27177a8904e1a16687314d90a62f4c9ad04380307f1332736
-
SHA512
36b71ed7cb824914a55ddb25bcb201ee58a130837f325286b003ba135da832ae61473f8b1f3bff7f935b8e7acb071ab5ff7d58ba8b4918bcd519426504b9305b
-
SSDEEP
24576:S6pQPxQ2JyP2r5mJV91xM7RpbwgIvs7NxqUkHA:SCqm2Jpr0nNM7Dus7Nx2g
Score
7/10
Malware Config
Signatures
-
resource yara_rule behavioral2/memory/4976-0-0x0000000000400000-0x00000000005BA000-memory.dmp upx behavioral2/memory/4976-6025-0x0000000000400000-0x00000000005BA000-memory.dmp upx behavioral2/memory/4976-13403-0x0000000000400000-0x00000000005BA000-memory.dmp upx -
Drops desktop.ini file(s) 1 IoCs
description ioc Process File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\DataServices\DESKTOP.INI 69b0db900c3342e04345e2f3ba2d5c33.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Java\jdk-1.8\include\win32\bridge\AccessBridgeCalls.h 69b0db900c3342e04345e2f3ba2d5c33.exe File opened for modification C:\Program Files\Java\jre-1.8\lib\logging.properties 69b0db900c3342e04345e2f3ba2d5c33.exe File created C:\Program Files\Microsoft Office\root\Integration\C2RManifest.DCF.DCF.x-none.msi.16.x-none.xml.exe 69b0db900c3342e04345e2f3ba2d5c33.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\ProjectPro2019VL_KMS_Client_AE-ppd.xrm-ms 69b0db900c3342e04345e2f3ba2d5c33.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.hr-hr.dll.exe 69b0db900c3342e04345e2f3ba2d5c33.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\api-ms-win-crt-utility-l1-1-0.dll 69b0db900c3342e04345e2f3ba2d5c33.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javapackager.exe 69b0db900c3342e04345e2f3ba2d5c33.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\legal\jdk\lcms.md 69b0db900c3342e04345e2f3ba2d5c33.exe File opened for modification C:\Program Files\Java\jre-1.8\lib\classlist 69b0db900c3342e04345e2f3ba2d5c33.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\ProjectProXC2RVL_MAKC2R-ppd.xrm-ms 69b0db900c3342e04345e2f3ba2d5c33.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectStdR_Retail-ul-phn.xrm-ms.exe 69b0db900c3342e04345e2f3ba2d5c33.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\Standard2019MSDNR_Retail-ul-oob.xrm-ms 69b0db900c3342e04345e2f3ba2d5c33.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\Word2019R_Grace-ppd.xrm-ms 69b0db900c3342e04345e2f3ba2d5c33.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\EventSource.dll 69b0db900c3342e04345e2f3ba2d5c33.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\lib\accessibility.properties 69b0db900c3342e04345e2f3ba2d5c33.exe File created C:\Program Files\Java\jdk-1.8\jre\lib\meta-index.exe 69b0db900c3342e04345e2f3ba2d5c33.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\Access2019VL_MAK_AE-pl.xrm-ms 69b0db900c3342e04345e2f3ba2d5c33.exe File created C:\Program Files\Microsoft Office\root\Licenses16\HomeStudentVNextR_Retail-ppd.xrm-ms.exe 69b0db900c3342e04345e2f3ba2d5c33.exe File created C:\Program Files\Java\jdk-1.8\jre\lib\deploy\messages_it.properties.exe 69b0db900c3342e04345e2f3ba2d5c33.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\lib\security\policy\limited\local_policy.jar 69b0db900c3342e04345e2f3ba2d5c33.exe File created C:\Program Files\Java\jre-1.8\bin\api-ms-win-crt-private-l1-1-0.dll.exe 69b0db900c3342e04345e2f3ba2d5c33.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectStd2019R_Retail-pl.xrm-ms.exe 69b0db900c3342e04345e2f3ba2d5c33.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\AccessRuntime2019_eula.txt 69b0db900c3342e04345e2f3ba2d5c33.exe File created C:\Program Files\7-Zip\Lang\io.txt.exe 69b0db900c3342e04345e2f3ba2d5c33.exe File created C:\Program Files\Common Files\System\msadc\fr-FR\msdaremr.dll.mui 69b0db900c3342e04345e2f3ba2d5c33.exe File created C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\nl.pak.exe 69b0db900c3342e04345e2f3ba2d5c33.exe File opened for modification C:\Program Files\Google\Chrome\Application\106.0.5249.119\WidevineCdm\manifest.json 69b0db900c3342e04345e2f3ba2d5c33.exe File created C:\Program Files\Java\jre-1.8\bin\keytool.exe.exe 69b0db900c3342e04345e2f3ba2d5c33.exe File created C:\Program Files\Microsoft Office\root\Licenses16\AccessR_Retail-ul-oob.xrm-ms.exe 69b0db900c3342e04345e2f3ba2d5c33.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\PowerPointVL_KMS_Client-ppd.xrm-ms 69b0db900c3342e04345e2f3ba2d5c33.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019R_OEM_Perp-ul-oob.xrm-ms 69b0db900c3342e04345e2f3ba2d5c33.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectPro2019XC2RVL_KMS_ClientC2R-ppd.xrm-ms.exe 69b0db900c3342e04345e2f3ba2d5c33.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\VisioStdXC2RVL_MAKC2R-ppd.xrm-ms 69b0db900c3342e04345e2f3ba2d5c33.exe File created C:\Program Files\7-Zip\Lang\pl.txt.exe 69b0db900c3342e04345e2f3ba2d5c33.exe File created C:\Program Files\7-Zip\Lang\vi.txt.exe 69b0db900c3342e04345e2f3ba2d5c33.exe File created C:\Program Files\Common Files\microsoft shared\ink\ipsel.xml 69b0db900c3342e04345e2f3ba2d5c33.exe File created C:\Program Files\Java\jdk-1.8\legal\javafx\libffi.md.exe 69b0db900c3342e04345e2f3ba2d5c33.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\PublisherR_OEM_Perp-pl.xrm-ms 69b0db900c3342e04345e2f3ba2d5c33.exe File created C:\Program Files\Microsoft Office\root\Licenses16\SkypeforBusiness2019R_Retail-ul-phn.xrm-ms.exe 69b0db900c3342e04345e2f3ba2d5c33.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\POWERPNT_F_COL.HXK 69b0db900c3342e04345e2f3ba2d5c33.exe File created C:\Program Files\Common Files\System\Ole DB\oledbjvs.inc 69b0db900c3342e04345e2f3ba2d5c33.exe File created C:\Program Files\Common Files\microsoft shared\ink\ipsfin.xml 69b0db900c3342e04345e2f3ba2d5c33.exe File created C:\Program Files\Microsoft Office\root\Licenses16\HomeStudentDemoR_BypassTrial180-ppd.xrm-ms.exe 69b0db900c3342e04345e2f3ba2d5c33.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusR_Subscription3-ppd.xrm-ms 69b0db900c3342e04345e2f3ba2d5c33.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectPro2019R_Trial-ppd.xrm-ms.exe 69b0db900c3342e04345e2f3ba2d5c33.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\VisioPro2019R_Retail-ppd.xrm-ms 69b0db900c3342e04345e2f3ba2d5c33.exe File created C:\Program Files\Common Files\microsoft shared\ink\ipsen.xml 69b0db900c3342e04345e2f3ba2d5c33.exe File created C:\Program Files\Java\jdk-1.8\bin\api-ms-win-core-localization-l1-2-0.dll.exe 69b0db900c3342e04345e2f3ba2d5c33.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\zip.dll 69b0db900c3342e04345e2f3ba2d5c33.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019VL_MAK_AE-pl.xrm-ms.exe 69b0db900c3342e04345e2f3ba2d5c33.exe File created C:\Program Files\Microsoft Office\root\Licenses16\PublisherR_Trial-ul-oob.xrm-ms.exe 69b0db900c3342e04345e2f3ba2d5c33.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\StandardR_Grace-ul-oob.xrm-ms 69b0db900c3342e04345e2f3ba2d5c33.exe File created C:\Program Files\Microsoft Office\root\Licenses16\VisioProCO365R_SubTest-pl.xrm-ms.exe 69b0db900c3342e04345e2f3ba2d5c33.exe File created C:\Program Files\Microsoft Office\root\Office16\1033\Bibliography\BIBFORM.XML.exe 69b0db900c3342e04345e2f3ba2d5c33.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ADDINS\EduWorks Data Streamer Add-In\Microsoft.Office.Tools.Excel.dll 69b0db900c3342e04345e2f3ba2d5c33.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\api-ms-win-core-libraryloader-l1-1-0.dll 69b0db900c3342e04345e2f3ba2d5c33.exe File created C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Effects\Grunge Texture.eftx.exe 69b0db900c3342e04345e2f3ba2d5c33.exe File opened for modification C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Fonts\Times New Roman-Arial.xml 69b0db900c3342e04345e2f3ba2d5c33.exe File created C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessR_OEM_Perp2-ul-oob.xrm-ms.exe 69b0db900c3342e04345e2f3ba2d5c33.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\PersonalR_OEM_Perp-pl.xrm-ms 69b0db900c3342e04345e2f3ba2d5c33.exe File opened for modification C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Colors\Blue II.xml 69b0db900c3342e04345e2f3ba2d5c33.exe File created C:\Program Files\Microsoft Office\root\Licenses16\MondoR_O16ConsumerPerp_Bypass30-ppd.xrm-ms.exe 69b0db900c3342e04345e2f3ba2d5c33.exe File created C:\Program Files\Microsoft Office\root\Licenses16\VisioProDemoR_BypassTrial180-ppd.xrm-ms.exe 69b0db900c3342e04345e2f3ba2d5c33.exe File created C:\Program Files\Common Files\microsoft shared\ink\nl-NL\tipresx.dll.mui.exe 69b0db900c3342e04345e2f3ba2d5c33.exe