Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
76s -
max time network
19s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
29/12/2023, 21:40
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
04ae1c325ec51afcc468a4733236f0c6.exe
Resource
win7-20231215-en
windows7-x64
4 signatures
150 seconds
General
-
Target
04ae1c325ec51afcc468a4733236f0c6.exe
-
Size
312KB
-
MD5
04ae1c325ec51afcc468a4733236f0c6
-
SHA1
f04706e45f003ffecd35783caf9862613ec438e3
-
SHA256
5f529d1d9977e5beea8d25fe3244ef7d51e31089f7539a91188d50ef52964523
-
SHA512
94f000d87b7fc1bd283e2b6aa41059ab16204517c9d02aecad34c8a8aea41a084826a457c1c5312f392ab3ba50c6981889e06c083e051e016ca4b692dc97f9db
-
SSDEEP
6144:Uo35D99Pd1E6dqi4paDrd1E6dqi4py5Y9rN4ShcHUaB:HPEynbEy1RvUaB
Score
7/10
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
pid Process 2160 04ae1c325ec51afcc468a4733236f0c6.viv -
Loads dropped DLL 1 IoCs
pid Process 1112 04ae1c325ec51afcc468a4733236f0c6.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File created \??\c:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE 04ae1c325ec51afcc468a4733236f0c6.exe File opened for modification \??\c:\Program Files\Java\jdk1.7.0_80\bin\kinit.viv 04ae1c325ec51afcc468a4733236f0c6.exe File opened for modification \??\c:\Program Files\Java\jdk1.7.0_80\jre\bin\policytool.viv 04ae1c325ec51afcc468a4733236f0c6.exe File created \??\c:\Program Files (x86)\Microsoft Office\Office14\ONENOTE.EXE 04ae1c325ec51afcc468a4733236f0c6.exe File created \??\c:\Program Files (x86)\Microsoft Office\Office14\ONENOTEM.EXE 04ae1c325ec51afcc468a4733236f0c6.exe File created \??\c:\Program Files\Mozilla Firefox\minidump-analyzer.exe 04ae1c325ec51afcc468a4733236f0c6.exe File created \??\c:\Program Files (x86)\Common Files\microsoft shared\TextConv\WksConv\Wkconv.exe 04ae1c325ec51afcc468a4733236f0c6.exe File opened for modification \??\c:\Program Files\Java\jdk1.7.0_80\bin\wsgen.viv 04ae1c325ec51afcc468a4733236f0c6.exe File created \??\c:\Program Files\Java\jdk1.7.0_80\jre\bin\pack200.exe 04ae1c325ec51afcc468a4733236f0c6.exe File created \??\c:\Program Files\7-Zip\7z.exe 04ae1c325ec51afcc468a4733236f0c6.exe File opened for modification \??\c:\Program Files\Java\jdk1.7.0_80\bin\javadoc.viv 04ae1c325ec51afcc468a4733236f0c6.exe File opened for modification \??\c:\Program Files\Java\jre7\bin\jp2launcher.viv 04ae1c325ec51afcc468a4733236f0c6.exe File created \??\c:\Program Files\Java\jdk1.7.0_80\bin\jmc.exe 04ae1c325ec51afcc468a4733236f0c6.exe File opened for modification \??\c:\Program Files (x86)\Adobe\Reader 9.0\Reader\Eula.viv 04ae1c325ec51afcc468a4733236f0c6.exe File created \??\c:\Program Files (x86)\Microsoft Office\Office14\misc.exe 04ae1c325ec51afcc468a4733236f0c6.exe File opened for modification \??\c:\Program Files\Java\jdk1.7.0_80\bin\jsadebugd.viv 04ae1c325ec51afcc468a4733236f0c6.exe File created \??\c:\Program Files\Mozilla Firefox\plugin-container.exe 04ae1c325ec51afcc468a4733236f0c6.exe File created \??\c:\Program Files\Java\jdk1.7.0_80\bin\policytool.exe 04ae1c325ec51afcc468a4733236f0c6.exe File opened for modification \??\c:\Program Files\Microsoft Games\Solitaire\Solitaire.viv 04ae1c325ec51afcc468a4733236f0c6.exe File created \??\c:\Program Files\Java\jdk1.7.0_80\jre\bin\policytool.exe 04ae1c325ec51afcc468a4733236f0c6.exe File created \??\c:\Program Files (x86)\Google\Update\1.3.36.151\GoogleCrashHandler.exe 04ae1c325ec51afcc468a4733236f0c6.exe File opened for modification \??\c:\Program Files\Java\jre7\bin\ssvagent.viv 04ae1c325ec51afcc468a4733236f0c6.exe File opened for modification \??\c:\Program Files (x86)\Microsoft Office\Office14\MSTORE.viv 04ae1c325ec51afcc468a4733236f0c6.exe File opened for modification \??\c:\Program Files\Java\jdk1.7.0_80\bin\jar.viv 04ae1c325ec51afcc468a4733236f0c6.exe File opened for modification \??\c:\Program Files\Java\jdk1.7.0_80\bin\jvisualvm.viv 04ae1c325ec51afcc468a4733236f0c6.exe File created \??\c:\Program Files\Java\jdk1.7.0_80\bin\native2ascii.exe 04ae1c325ec51afcc468a4733236f0c6.exe File created \??\c:\Program Files\Mozilla Firefox\maintenanceservice.exe 04ae1c325ec51afcc468a4733236f0c6.exe File opened for modification \??\c:\Program Files\Java\jdk1.7.0_80\bin\wsimport.viv 04ae1c325ec51afcc468a4733236f0c6.exe File opened for modification \??\c:\Program Files\Java\jdk1.7.0_80\bin\idlj.viv 04ae1c325ec51afcc468a4733236f0c6.exe File opened for modification \??\c:\Program Files\Mozilla Firefox\private_browsing.viv 04ae1c325ec51afcc468a4733236f0c6.exe File created \??\c:\Program Files\Google\Chrome\Application\chrome.exe 04ae1c325ec51afcc468a4733236f0c6.exe File opened for modification \??\c:\Program Files\Java\jdk1.7.0_80\bin\jdb.viv 04ae1c325ec51afcc468a4733236f0c6.exe File opened for modification \??\c:\Program Files\Java\jdk1.7.0_80\jre\lib\launcher.viv 04ae1c325ec51afcc468a4733236f0c6.exe File opened for modification \??\c:\Program Files\Microsoft Games\Multiplayer\Checkers\chkrzm.viv 04ae1c325ec51afcc468a4733236f0c6.exe File opened for modification \??\c:\Program Files\Mozilla Firefox\firefox.viv 04ae1c325ec51afcc468a4733236f0c6.exe File opened for modification \??\c:\Program Files\VideoLAN\VLC\vlc-cache-gen.viv 04ae1c325ec51afcc468a4733236f0c6.exe File opened for modification \??\c:\Program Files (x86)\Microsoft Office\Office14\INFOPATH.viv 04ae1c325ec51afcc468a4733236f0c6.exe File created \??\c:\Program Files\Java\jdk1.7.0_80\jre\bin\javaws.exe 04ae1c325ec51afcc468a4733236f0c6.exe File created \??\c:\Program Files\Microsoft Games\Minesweeper\MineSweeper.exe 04ae1c325ec51afcc468a4733236f0c6.exe File created \??\c:\Program Files\Java\jdk1.7.0_80\bin\jconsole.exe 04ae1c325ec51afcc468a4733236f0c6.exe File opened for modification \??\c:\Program Files\Java\jdk1.7.0_80\bin\jrunscript.viv 04ae1c325ec51afcc468a4733236f0c6.exe File created \??\c:\Program Files\Google\Chrome\Application\106.0.5249.119\chrome_pwa_launcher.exe 04ae1c325ec51afcc468a4733236f0c6.exe File opened for modification \??\c:\Program Files (x86)\Common Files\Adobe AIR\Versions\1.0\template.viv 04ae1c325ec51afcc468a4733236f0c6.exe File created \??\c:\Program Files (x86)\Common Files\microsoft shared\DW\DW20.EXE 04ae1c325ec51afcc468a4733236f0c6.exe File created \??\c:\Program Files\Java\jdk1.7.0_80\bin\jstack.exe 04ae1c325ec51afcc468a4733236f0c6.exe File opened for modification \??\c:\Program Files\Java\jdk1.7.0_80\bin\unpack200.viv 04ae1c325ec51afcc468a4733236f0c6.exe File created \??\c:\Program Files\Mozilla Firefox\pingsender.exe 04ae1c325ec51afcc468a4733236f0c6.exe File created \??\c:\Program Files (x86)\Microsoft Office\Office14\MSTORE.EXE 04ae1c325ec51afcc468a4733236f0c6.exe File opened for modification \??\c:\Program Files\Java\jdk1.7.0_80\jre\bin\javacpl.viv 04ae1c325ec51afcc468a4733236f0c6.exe File opened for modification \??\c:\Program Files\Java\jdk1.7.0_80\jre\bin\javaws.viv 04ae1c325ec51afcc468a4733236f0c6.exe File opened for modification \??\c:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\FLTLDR.viv 04ae1c325ec51afcc468a4733236f0c6.exe File opened for modification \??\c:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\MSOXMLED.viv 04ae1c325ec51afcc468a4733236f0c6.exe File opened for modification \??\c:\Program Files (x86)\Common Files\microsoft shared\TextConv\WksConv\Wkconv.viv 04ae1c325ec51afcc468a4733236f0c6.exe File opened for modification \??\c:\Program Files\Java\jdk1.7.0_80\bin\jps.viv 04ae1c325ec51afcc468a4733236f0c6.exe File created \??\c:\Program Files\Java\jre7\bin\tnameserv.exe 04ae1c325ec51afcc468a4733236f0c6.exe File opened for modification \??\c:\Program Files\Microsoft Games\Purble Place\PurblePlace.viv 04ae1c325ec51afcc468a4733236f0c6.exe File created \??\c:\Program Files (x86)\Common Files\microsoft shared\DW\DWTRIG20.EXE 04ae1c325ec51afcc468a4733236f0c6.exe File created \??\c:\Program Files\Common Files\Microsoft Shared\VSTO\10.0\VSTOInstaller.exe 04ae1c325ec51afcc468a4733236f0c6.exe File opened for modification \??\c:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroBroker.viv 04ae1c325ec51afcc468a4733236f0c6.exe File created \??\c:\Program Files\Java\jre7\bin\rmiregistry.exe 04ae1c325ec51afcc468a4733236f0c6.exe File opened for modification \??\c:\Program Files (x86)\Microsoft Office\Office14\CLVIEW.viv 04ae1c325ec51afcc468a4733236f0c6.exe File opened for modification \??\c:\Program Files\7-Zip\Uninstall.viv 04ae1c325ec51afcc468a4733236f0c6.exe File opened for modification \??\c:\Program Files\Java\jdk1.7.0_80\bin\pack200.viv 04ae1c325ec51afcc468a4733236f0c6.exe File created \??\c:\Program Files\Java\jdk1.7.0_80\jre\bin\jp2launcher.exe 04ae1c325ec51afcc468a4733236f0c6.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1112 wrote to memory of 2160 1112 04ae1c325ec51afcc468a4733236f0c6.exe 28 PID 1112 wrote to memory of 2160 1112 04ae1c325ec51afcc468a4733236f0c6.exe 28 PID 1112 wrote to memory of 2160 1112 04ae1c325ec51afcc468a4733236f0c6.exe 28 PID 1112 wrote to memory of 2160 1112 04ae1c325ec51afcc468a4733236f0c6.exe 28
Processes
-
C:\Users\Admin\AppData\Local\Temp\04ae1c325ec51afcc468a4733236f0c6.exe"C:\Users\Admin\AppData\Local\Temp\04ae1c325ec51afcc468a4733236f0c6.exe"1⤵
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:1112 -
C:\Users\Admin\AppData\Local\Temp\04ae1c325ec51afcc468a4733236f0c6.vivC:\Users\Admin\AppData\Local\Temp\04ae1c325ec51afcc468a4733236f0c6.viv2⤵
- Executes dropped EXE
PID:2160
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
856KB
MD5fa0318a52baadc08a2e3a7b8e343e288
SHA13affe7766afe80dd922542e16c38cc5f79a86639
SHA2562359768934e5265779435ee0b7ebc7208d8de77984ac0825828a8125ffbed45b
SHA5121dc116afc1057a2bce70545e110dece69064c781a1e5043e137aafda69b73a275d25122bf955fed191359aca79c95d9510dd5263560a4b146336474f9d7135b1
-
Filesize
140KB
MD51793928d1c8daf03a8b67a60a0ffbd93
SHA1c777c5be2321bf493877efef590eec8c822e2072
SHA25684a2bb3191f370ba456dd8637e08cd47ef1c80a54d081881cd1e16a8c67f0238
SHA51264ef94fb34b637c5d40878f4d3b0db7f2d74e89be35fca959ee9354cdf8f5bd61d90e8aa1ff795ddafe60ba5d1a0d4b57c41b1bf8750d24d685aa98f4142c11a