Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
3s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20231129-en -
resource tags
arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system -
submitted
26/12/2023, 12:35
Behavioral task
behavioral1
Sample
6ef66ee1985a43283a7d1d2c8e0c8275.exe
Resource
win7-20231129-en
windows7-x64
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
6ef66ee1985a43283a7d1d2c8e0c8275.exe
Resource
win10v2004-20231222-en
windows10-2004-x64
2 signatures
150 seconds
General
-
Target
6ef66ee1985a43283a7d1d2c8e0c8275.exe
-
Size
1.8MB
-
MD5
6ef66ee1985a43283a7d1d2c8e0c8275
-
SHA1
e9a30fcc00dfd715fb3b4d1b43ca3291a36b7f4f
-
SHA256
e9b8d1920a116a120b8a78a35af40e0392f1d5cdd9ea0f67292bcb84cf11f730
-
SHA512
af72ab719a55dfae2206fb3b9346e4b21b5e470213e03d17bb613c62606647350bc871985eaeedb595e8144c790cd4f8584c6dbead87b5edceeb3a5a66268a30
-
SSDEEP
24576:S6pQPxQ2JyP2r5mJV91xM7RpbwgIvs7Nxqc:SCqm2Jpr0nNM7Dus7Nxh
Score
7/10
Malware Config
Signatures
-
resource yara_rule behavioral1/memory/2360-0-0x0000000000400000-0x00000000005BA000-memory.dmp upx behavioral1/memory/2360-2057-0x0000000000400000-0x00000000005BA000-memory.dmp upx behavioral1/memory/2360-9210-0x0000000000400000-0x00000000005BA000-memory.dmp upx -
Drops desktop.ini file(s) 1 IoCs
description ioc Process File created C:\Program Files\Common Files\Microsoft Shared\Stationery\Desktop.ini 6ef66ee1985a43283a7d1d2c8e0c8275.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\7-Zip\Lang\ne.txt 6ef66ee1985a43283a7d1d2c8e0c8275.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\VSTO\10.0\VSTOInstaller.exe 6ef66ee1985a43283a7d1d2c8e0c8275.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\es-ES\rtscom.dll.mui.exe 6ef66ee1985a43283a7d1d2c8e0c8275.exe File created C:\Program Files\7-Zip\Lang\et.txt.exe 6ef66ee1985a43283a7d1d2c8e0c8275.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\hwrdeslm.dat.exe 6ef66ee1985a43283a7d1d2c8e0c8275.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\ipscat.xml.exe 6ef66ee1985a43283a7d1d2c8e0c8275.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\tiptsf.dll 6ef66ee1985a43283a7d1d2c8e0c8275.exe File created C:\Program Files\7-Zip\Lang\pl.txt.exe 6ef66ee1985a43283a7d1d2c8e0c8275.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPWMI.DLL 6ef66ee1985a43283a7d1d2c8e0c8275.exe File created C:\Program Files\Common Files\Microsoft Shared\Stationery\Tanspecks.jpg.exe 6ef66ee1985a43283a7d1d2c8e0c8275.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\numbers\numbase.xml 6ef66ee1985a43283a7d1d2c8e0c8275.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\ja-JP\TipRes.dll.mui.exe 6ef66ee1985a43283a7d1d2c8e0c8275.exe File created C:\Program Files\7-Zip\Lang\en.ttt.exe 6ef66ee1985a43283a7d1d2c8e0c8275.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\base_altgr.xml.exe 6ef66ee1985a43283a7d1d2c8e0c8275.exe File created C:\Program Files\Common Files\SpeechEngines\Microsoft\TTS20\es-ES\MSTTSLoc.dll.mui 6ef66ee1985a43283a7d1d2c8e0c8275.exe File created C:\Program Files\7-Zip\Lang\af.txt.exe 6ef66ee1985a43283a7d1d2c8e0c8275.exe File opened for modification C:\Program Files\7-Zip\Lang\pl.txt 6ef66ee1985a43283a7d1d2c8e0c8275.exe File created C:\Program Files\Common Files\Microsoft Shared\Stationery\Bears.jpg.exe 6ef66ee1985a43283a7d1d2c8e0c8275.exe File created C:\Program Files\Common Files\SpeechEngines\Microsoft\TTS20\it-IT\MSTTSLoc.dll.mui 6ef66ee1985a43283a7d1d2c8e0c8275.exe File opened for modification C:\Program Files\7-Zip\Lang\fy.txt 6ef66ee1985a43283a7d1d2c8e0c8275.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\hwrdeulm.dat.exe 6ef66ee1985a43283a7d1d2c8e0c8275.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\en-US\correct.avi 6ef66ee1985a43283a7d1d2c8e0c8275.exe File created C:\Program Files\Common Files\Microsoft Shared\Stationery\ShadesOfBlue.jpg.exe 6ef66ee1985a43283a7d1d2c8e0c8275.exe File created C:\Program Files\Common Files\System\Ole DB\de-DE\msdasqlr.dll.mui.exe 6ef66ee1985a43283a7d1d2c8e0c8275.exe File created C:\Program Files\Common Files\Microsoft Shared\Stationery\Music.emf 6ef66ee1985a43283a7d1d2c8e0c8275.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\ja-JP\mip.exe.mui 6ef66ee1985a43283a7d1d2c8e0c8275.exe File created C:\Program Files\7-Zip\Uninstall.exe.exe 6ef66ee1985a43283a7d1d2c8e0c8275.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\OFFICE14\MSOXEV.DLL 6ef66ee1985a43283a7d1d2c8e0c8275.exe File created C:\Program Files\Common Files\Microsoft Shared\VSTO\10.0\VSTOInstaller.exe.exe 6ef66ee1985a43283a7d1d2c8e0c8275.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\Alphabet.xml 6ef66ee1985a43283a7d1d2c8e0c8275.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\mraut.dll.exe 6ef66ee1985a43283a7d1d2c8e0c8275.exe File opened for modification C:\Program Files\7-Zip\Lang\zh-cn.txt 6ef66ee1985a43283a7d1d2c8e0c8275.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\InkDiv.dll 6ef66ee1985a43283a7d1d2c8e0c8275.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\keypad\ea.xml 6ef66ee1985a43283a7d1d2c8e0c8275.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\it-IT\mip.exe.mui.exe 6ef66ee1985a43283a7d1d2c8e0c8275.exe File created C:\Program Files\Common Files\Microsoft Shared\Stationery\Month_Calendar.emf.exe 6ef66ee1985a43283a7d1d2c8e0c8275.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\ShapeCollector.exe.exe 6ef66ee1985a43283a7d1d2c8e0c8275.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\TabTip.exe 6ef66ee1985a43283a7d1d2c8e0c8275.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\de-DE\TipBand.dll.mui 6ef66ee1985a43283a7d1d2c8e0c8275.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\ja-JP\ShapeCollector.exe.mui 6ef66ee1985a43283a7d1d2c8e0c8275.exe File opened for modification C:\Program Files\7-Zip\Lang\bg.txt 6ef66ee1985a43283a7d1d2c8e0c8275.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\pt-BR\tipresx.dll.mui 6ef66ee1985a43283a7d1d2c8e0c8275.exe File created C:\Program Files\7-Zip\Lang\ro.txt.exe 6ef66ee1985a43283a7d1d2c8e0c8275.exe File opened for modification C:\Program Files\7-Zip\Lang\ca.txt 6ef66ee1985a43283a7d1d2c8e0c8275.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\IPSEventLogMsg.dll.exe 6ef66ee1985a43283a7d1d2c8e0c8275.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\es-ES\TipTsf.dll.mui 6ef66ee1985a43283a7d1d2c8e0c8275.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\fr-FR\mshwLatin.dll.mui 6ef66ee1985a43283a7d1d2c8e0c8275.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\nl-NL\tipresx.dll.mui.exe 6ef66ee1985a43283a7d1d2c8e0c8275.exe File created C:\Program Files\7-Zip\7-zip.dll.exe 6ef66ee1985a43283a7d1d2c8e0c8275.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\ja-jp.xml 6ef66ee1985a43283a7d1d2c8e0c8275.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\oskmenu.xml 6ef66ee1985a43283a7d1d2c8e0c8275.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\es-ES\tabskb.dll.mui.exe 6ef66ee1985a43283a7d1d2c8e0c8275.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\fi-FI\tipresx.dll.mui 6ef66ee1985a43283a7d1d2c8e0c8275.exe File created C:\Program Files\7-Zip\Lang\tr.txt.exe 6ef66ee1985a43283a7d1d2c8e0c8275.exe File created C:\Program Files\7-Zip\Lang\fy.txt.exe 6ef66ee1985a43283a7d1d2c8e0c8275.exe File created C:\Program Files\Common Files\Microsoft Shared\Stationery\Memo.emf.exe 6ef66ee1985a43283a7d1d2c8e0c8275.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\osknumpad\osknumpadbase.xml.exe 6ef66ee1985a43283a7d1d2c8e0c8275.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\it-IT\FlickLearningWizard.exe.mui 6ef66ee1985a43283a7d1d2c8e0c8275.exe File created C:\Program Files\Common Files\System\Ole DB\de-DE\oledb32r.dll.mui.exe 6ef66ee1985a43283a7d1d2c8e0c8275.exe File opened for modification C:\Program Files\7-Zip\Lang\el.txt 6ef66ee1985a43283a7d1d2c8e0c8275.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\zh-dayi.xml.exe 6ef66ee1985a43283a7d1d2c8e0c8275.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\ipsnor.xml.exe 6ef66ee1985a43283a7d1d2c8e0c8275.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\ipsplk.xml 6ef66ee1985a43283a7d1d2c8e0c8275.exe File created C:\Program Files\Common Files\Microsoft Shared\Stationery\Sand_Paper.jpg 6ef66ee1985a43283a7d1d2c8e0c8275.exe