Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
122s -
max time network
149s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
26/12/2023, 12:41
Behavioral task
behavioral1
Sample
6f432908e4fba546594423dae70c3be0.exe
Resource
win7-20231215-en
windows7-x64
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
6f432908e4fba546594423dae70c3be0.exe
Resource
win10v2004-20231222-en
windows10-2004-x64
3 signatures
150 seconds
General
-
Target
6f432908e4fba546594423dae70c3be0.exe
-
Size
1.8MB
-
MD5
6f432908e4fba546594423dae70c3be0
-
SHA1
7968e085bdc19cb8e1762a170a7d1e5a39dd6c01
-
SHA256
e2a15b2036d73b720f54e4b77b2a0b8a7909423b9e7c39b70fe7388a2075958e
-
SHA512
8fc92c3697b8116682d719e00328db593cf192c8f35bf914f015dc5550aa645f8208dbcba676cac42e9328afc2cf03ffa5c86119693f6bcd93844fa699e60602
-
SSDEEP
24576:S6pQPxQ2JyP2r5mJV91xM7RpbwgIvs7NxqOj:SCqm2Jpr0nNM7Dus7Nxvj
Score
7/10
Malware Config
Signatures
-
resource yara_rule behavioral1/memory/2724-0-0x0000000000400000-0x00000000005BA000-memory.dmp upx behavioral1/files/0x0034000000012337-5.dat upx behavioral1/memory/2724-63-0x0000000000400000-0x00000000005BA000-memory.dmp upx -
Drops desktop.ini file(s) 1 IoCs
description ioc Process File created C:\Program Files\Common Files\Microsoft Shared\Stationery\Desktop.ini 6f432908e4fba546594423dae70c3be0.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\7-Zip\Lang\fr.txt 6f432908e4fba546594423dae70c3be0.exe File created C:\Program Files\Common Files\Microsoft Shared\Stationery\Music.emf.exe 6f432908e4fba546594423dae70c3be0.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\en-US\InkWatson.exe.mui.exe 6f432908e4fba546594423dae70c3be0.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\es-ES\tipresx.dll.mui 6f432908e4fba546594423dae70c3be0.exe File created C:\Program Files\7-Zip\7zFM.exe.exe 6f432908e4fba546594423dae70c3be0.exe File created C:\Program Files\7-Zip\Lang\hy.txt.exe 6f432908e4fba546594423dae70c3be0.exe File created C:\Program Files\Common Files\Microsoft Shared\MSInfo\msinfo32.exe.exe 6f432908e4fba546594423dae70c3be0.exe File created C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPCEXT.DLL.exe 6f432908e4fba546594423dae70c3be0.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\TabTip.exe.exe 6f432908e4fba546594423dae70c3be0.exe File opened for modification C:\Program Files\7-Zip\Lang\ca.txt 6f432908e4fba546594423dae70c3be0.exe File created C:\Program Files\7-Zip\Lang\fa.txt.exe 6f432908e4fba546594423dae70c3be0.exe File opened for modification C:\Program Files\7-Zip\Lang\sv.txt 6f432908e4fba546594423dae70c3be0.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Csi.dll 6f432908e4fba546594423dae70c3be0.exe File opened for modification C:\Program Files\7-Zip\Lang\sr-spc.txt 6f432908e4fba546594423dae70c3be0.exe File created C:\Program Files\Common Files\Microsoft Shared\Stationery\Garden.jpg 6f432908e4fba546594423dae70c3be0.exe File created C:\Program Files\Common Files\Microsoft Shared\Stationery\Stars.jpg.exe 6f432908e4fba546594423dae70c3be0.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\es-ES\TipTsf.dll.mui 6f432908e4fba546594423dae70c3be0.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\el-GR\tipresx.dll.mui.exe 6f432908e4fba546594423dae70c3be0.exe File opened for modification C:\Program Files\7-Zip\Lang\br.txt 6f432908e4fba546594423dae70c3be0.exe File created C:\Program Files\7-Zip\Lang\fy.txt.exe 6f432908e4fba546594423dae70c3be0.exe File created C:\Program Files\Common Files\Microsoft Shared\Stationery\Hand Prints.htm 6f432908e4fba546594423dae70c3be0.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\Microsoft.Ink.dll 6f432908e4fba546594423dae70c3be0.exe File opened for modification C:\Program Files\7-Zip\7z.dll 6f432908e4fba546594423dae70c3be0.exe File created C:\Program Files\Common Files\Microsoft Shared\Stationery\Roses.htm 6f432908e4fba546594423dae70c3be0.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\FlickAnimation.avi 6f432908e4fba546594423dae70c3be0.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\InkObj.dll.exe 6f432908e4fba546594423dae70c3be0.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\es-ES\TipRes.dll.mui.exe 6f432908e4fba546594423dae70c3be0.exe File created C:\Program Files\7-Zip\Lang\cy.txt.exe 6f432908e4fba546594423dae70c3be0.exe File created C:\Program Files\Common Files\Microsoft Shared\Stationery\Peacock.htm.exe 6f432908e4fba546594423dae70c3be0.exe File created C:\Program Files\Common Files\Microsoft Shared\Stationery\Sand_Paper.jpg.exe 6f432908e4fba546594423dae70c3be0.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\en-US\join.avi 6f432908e4fba546594423dae70c3be0.exe File created C:\Program Files\Common Files\Microsoft Shared\Stationery\Bears.htm 6f432908e4fba546594423dae70c3be0.exe File created C:\Program Files\Common Files\Microsoft Shared\Stationery\Hand Prints.htm.exe 6f432908e4fba546594423dae70c3be0.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\VSTO\10.0\VSTOInstaller.config 6f432908e4fba546594423dae70c3be0.exe File opened for modification C:\Program Files\7-Zip\Lang\pl.txt 6f432908e4fba546594423dae70c3be0.exe File created C:\Program Files\7-Zip\Lang\sa.txt.exe 6f432908e4fba546594423dae70c3be0.exe File created C:\Program Files\Common Files\Microsoft Shared\Stationery\Desktop.ini 6f432908e4fba546594423dae70c3be0.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\Filters\offfiltx.dll 6f432908e4fba546594423dae70c3be0.exe File created C:\Program Files\Common Files\Microsoft Shared\Stationery\Graph.emf.exe 6f432908e4fba546594423dae70c3be0.exe File created C:\Program Files\Common Files\Microsoft Shared\Stationery\Shorthand.emf.exe 6f432908e4fba546594423dae70c3be0.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\de-DE\IpsMigrationPlugin.dll.mui.exe 6f432908e4fba546594423dae70c3be0.exe File created C:\Program Files\7-Zip\Lang\hr.txt.exe 6f432908e4fba546594423dae70c3be0.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPWMI.MOF 6f432908e4fba546594423dae70c3be0.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\VSTO\10.0\VSTOLoader.dll 6f432908e4fba546594423dae70c3be0.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\en-US\join.avi.exe 6f432908e4fba546594423dae70c3be0.exe File opened for modification C:\Program Files\7-Zip\Lang\ug.txt 6f432908e4fba546594423dae70c3be0.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\TipRes.dll 6f432908e4fba546594423dae70c3be0.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\es-ES\FlickLearningWizard.exe.mui 6f432908e4fba546594423dae70c3be0.exe File opened for modification C:\Program Files\7-Zip\7zCon.sfx 6f432908e4fba546594423dae70c3be0.exe File created C:\Program Files\7-Zip\Lang\pl.txt.exe 6f432908e4fba546594423dae70c3be0.exe File created C:\Program Files\Common Files\Microsoft Shared\Stationery\White_Chocolate.jpg.exe 6f432908e4fba546594423dae70c3be0.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\en-US\delete.avi 6f432908e4fba546594423dae70c3be0.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\de-DE\InputPersonalization.exe.mui 6f432908e4fba546594423dae70c3be0.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\es-ES\tipresx.dll.mui.exe 6f432908e4fba546594423dae70c3be0.exe File created C:\Program Files\7-Zip\7zCon.sfx.exe 6f432908e4fba546594423dae70c3be0.exe File created C:\Program Files\7-Zip\Lang\it.txt.exe 6f432908e4fba546594423dae70c3be0.exe File created C:\Program Files\7-Zip\Lang\vi.txt.exe 6f432908e4fba546594423dae70c3be0.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\de-DE\InkObj.dll.mui 6f432908e4fba546594423dae70c3be0.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE 6f432908e4fba546594423dae70c3be0.exe File created C:\Program Files\Common Files\Microsoft Shared\Stationery\Connectivity.gif.exe 6f432908e4fba546594423dae70c3be0.exe File created C:\Program Files\Common Files\Microsoft Shared\Stationery\Music.emf 6f432908e4fba546594423dae70c3be0.exe File created C:\Program Files\7-Zip\Lang\ja.txt.exe 6f432908e4fba546594423dae70c3be0.exe File opened for modification C:\Program Files\7-Zip\Lang\ms.txt 6f432908e4fba546594423dae70c3be0.exe File opened for modification C:\Program Files\7-Zip\Lang\zh-tw.txt 6f432908e4fba546594423dae70c3be0.exe
Processes
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
672KB
MD5ea17c2670e5afc5e2a2b5344888d5ca2
SHA1e263909f7395f7d7acc79f0b4e142df67776f116
SHA256a86c196923073e0c8dac7d60e35a775f6c5c353ca1ccdb1973baea199c2c9cb8
SHA512dfe23782c28a55eddfd0dd0d1d77aeaf43596d9afd88b0616f17874ffc9106cc298acfe6e818c0cf86ad1dea9831643a97cceabcefd7ff6a4e5ff5c16018170e