Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
10s -
max time network
129s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
30/12/2023, 20:29
Behavioral task
behavioral1
Sample
1bd9f382652168dd7310f8bb63037169.exe
Resource
win7-20231215-en
windows7-x64
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
1bd9f382652168dd7310f8bb63037169.exe
Resource
win10v2004-20231215-en
windows10-2004-x64
2 signatures
150 seconds
General
-
Target
1bd9f382652168dd7310f8bb63037169.exe
-
Size
1.8MB
-
MD5
1bd9f382652168dd7310f8bb63037169
-
SHA1
acc154702e4305f245e0ba170e83cd02f0fa27c2
-
SHA256
b00820a96165ef6006dd32a0b6d15dfb9bbc40aef1f103c0e03e86b4aa034d27
-
SHA512
e2adebeaef06442af1384390ea693eb3ab710c71ee82d767edcd019a0d573dfcd9d89bea2a2af7409c050bb92e70f8d17354359d6dd49d3e0b3733194fb14387
-
SSDEEP
24576:S6pQPxQ2JyP2r5mJV91xM7RpbwgIvs7NxqS:SCqm2Jpr0nNM7Dus7NxH
Score
7/10
Malware Config
Signatures
-
resource yara_rule behavioral1/memory/2484-0-0x0000000000400000-0x00000000005BA000-memory.dmp upx behavioral1/files/0x0035000000016312-5.dat upx behavioral1/memory/2484-788-0x0000000000400000-0x00000000005BA000-memory.dmp upx behavioral1/memory/2484-9172-0x0000000000400000-0x00000000005BA000-memory.dmp upx -
Drops desktop.ini file(s) 1 IoCs
description ioc Process File created C:\Program Files\Common Files\Microsoft Shared\Stationery\Desktop.ini 1bd9f382652168dd7310f8bb63037169.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Common Files\Microsoft Shared\ink\de-DE\micaut.dll.mui.exe 1bd9f382652168dd7310f8bb63037169.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\en-US\TipTsf.dll.mui 1bd9f382652168dd7310f8bb63037169.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\oskpred.xml.exe 1bd9f382652168dd7310f8bb63037169.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\hwrespsh.dat.exe 1bd9f382652168dd7310f8bb63037169.exe File created C:\Program Files\Common Files\Microsoft Shared\Stationery\Music.emf 1bd9f382652168dd7310f8bb63037169.exe File created C:\Program Files\Common Files\Microsoft Shared\Stationery\grid_(inch).wmf 1bd9f382652168dd7310f8bb63037169.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\es-ES\FlickLearningWizard.exe.mui.exe 1bd9f382652168dd7310f8bb63037169.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\it-IT\TipBand.dll.mui 1bd9f382652168dd7310f8bb63037169.exe File opened for modification C:\Program Files\7-Zip\Lang\cs.txt 1bd9f382652168dd7310f8bb63037169.exe File created C:\Program Files\Common Files\Microsoft Shared\VC\msdia100.dll.exe 1bd9f382652168dd7310f8bb63037169.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\hwritalm.dat 1bd9f382652168dd7310f8bb63037169.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\ja-JP\InkWatson.exe.mui.exe 1bd9f382652168dd7310f8bb63037169.exe File created C:\Program Files\Common Files\Microsoft Shared\Stationery\Bears.jpg 1bd9f382652168dd7310f8bb63037169.exe File created C:\Program Files\Common Files\Microsoft Shared\Stationery\Cave_Drawings.gif.exe 1bd9f382652168dd7310f8bb63037169.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\it-IT\InputPersonalization.exe.mui.exe 1bd9f382652168dd7310f8bb63037169.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\en-US\mshwLatin.dll.mui 1bd9f382652168dd7310f8bb63037169.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\it-IT\IPSEventLogMsg.dll.mui 1bd9f382652168dd7310f8bb63037169.exe File opened for modification C:\Program Files\7-Zip\Lang\zh-tw.txt 1bd9f382652168dd7310f8bb63037169.exe File created C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPC.DLL.exe 1bd9f382652168dd7310f8bb63037169.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\FlickAnimation.avi 1bd9f382652168dd7310f8bb63037169.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\IpsPlugin.dll.exe 1bd9f382652168dd7310f8bb63037169.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\sr-Latn-CS\tipresx.dll.mui.exe 1bd9f382652168dd7310f8bb63037169.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\fr-FR\IpsMigrationPlugin.dll.mui.exe 1bd9f382652168dd7310f8bb63037169.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\symbols.xml.exe 1bd9f382652168dd7310f8bb63037169.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\ja-JP\ShapeCollector.exe.mui 1bd9f382652168dd7310f8bb63037169.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\ar-SA\tipresx.dll.mui.exe 1bd9f382652168dd7310f8bb63037169.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\ja-JP\TipTsf.dll.mui.exe 1bd9f382652168dd7310f8bb63037169.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\mshwgst.dll 1bd9f382652168dd7310f8bb63037169.exe File opened for modification C:\Program Files\7-Zip\Lang\nb.txt 1bd9f382652168dd7310f8bb63037169.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\IpsMigrationPlugin.dll.exe 1bd9f382652168dd7310f8bb63037169.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\en-US\micaut.dll.mui 1bd9f382652168dd7310f8bb63037169.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\ipsptb.xml.exe 1bd9f382652168dd7310f8bb63037169.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\it-IT\mip.exe.mui 1bd9f382652168dd7310f8bb63037169.exe File created C:\Program Files\7-Zip\Lang\an.txt.exe 1bd9f382652168dd7310f8bb63037169.exe File created C:\Program Files\7-Zip\Lang\mn.txt.exe 1bd9f382652168dd7310f8bb63037169.exe File opened for modification C:\Program Files\7-Zip\Lang\sa.txt 1bd9f382652168dd7310f8bb63037169.exe File created C:\Program Files\7-Zip\Lang\br.txt.exe 1bd9f382652168dd7310f8bb63037169.exe File created C:\Program Files\Common Files\Microsoft Shared\MSInfo\msinfo32.exe 1bd9f382652168dd7310f8bb63037169.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\hwrusalm.dat.exe 1bd9f382652168dd7310f8bb63037169.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\sk-SK\tipresx.dll.mui 1bd9f382652168dd7310f8bb63037169.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\en-US\TipTsf.dll.mui.exe 1bd9f382652168dd7310f8bb63037169.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\fr-FR\FlickLearningWizard.exe.mui.exe 1bd9f382652168dd7310f8bb63037169.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\ja-JP\TipRes.dll.mui 1bd9f382652168dd7310f8bb63037169.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\de-DE\tabskb.dll.mui 1bd9f382652168dd7310f8bb63037169.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\hwrfrash.dat 1bd9f382652168dd7310f8bb63037169.exe File created C:\Program Files\7-Zip\Lang\az.txt.exe 1bd9f382652168dd7310f8bb63037169.exe File created C:\Program Files\Common Files\Microsoft Shared\Stationery\Memo.emf 1bd9f382652168dd7310f8bb63037169.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\de-DE\InputPersonalization.exe.mui.exe 1bd9f382652168dd7310f8bb63037169.exe File created C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPCEXT.DLL.exe 1bd9f382652168dd7310f8bb63037169.exe File created C:\Program Files\Common Files\Microsoft Shared\Stationery\Desktop.ini.exe 1bd9f382652168dd7310f8bb63037169.exe File created C:\Program Files\Common Files\SpeechEngines\Microsoft\TTS20\en-US\MSTTSLoc.dll.mui.exe 1bd9f382652168dd7310f8bb63037169.exe File created C:\Program Files\7-Zip\Lang\fr.txt.exe 1bd9f382652168dd7310f8bb63037169.exe File created C:\Program Files\7-Zip\Lang\pl.txt.exe 1bd9f382652168dd7310f8bb63037169.exe File created C:\Program Files\7-Zip\Lang\ug.txt.exe 1bd9f382652168dd7310f8bb63037169.exe File opened for modification C:\Program Files\7-Zip\Lang\uz-cyrl.txt 1bd9f382652168dd7310f8bb63037169.exe File created C:\Program Files\Common Files\Microsoft Shared\Filters\VISFILT.DLL.exe 1bd9f382652168dd7310f8bb63037169.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\mshwjpn.dll 1bd9f382652168dd7310f8bb63037169.exe File created C:\Program Files\Common Files\Microsoft Shared\Stationery\Peacock.jpg.exe 1bd9f382652168dd7310f8bb63037169.exe File created C:\Program Files\Common Files\Microsoft Shared\Stationery\Pretty_Peacock.jpg.exe 1bd9f382652168dd7310f8bb63037169.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\Microsoft.Ink.dll.exe 1bd9f382652168dd7310f8bb63037169.exe File opened for modification C:\Program Files\7-Zip\Lang\de.txt 1bd9f382652168dd7310f8bb63037169.exe File opened for modification C:\Program Files\7-Zip\Lang\ms.txt 1bd9f382652168dd7310f8bb63037169.exe File opened for modification C:\Program Files\7-Zip\Lang\sv.txt 1bd9f382652168dd7310f8bb63037169.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\fr-FR\InkWatson.exe.mui 1bd9f382652168dd7310f8bb63037169.exe
Processes
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD5b2137d95f05ce3a88174d28d7502383f
SHA14d8bf0ba77a6828d0a951949cc7aa2540d616900
SHA25669125a5ff0fd84f7cf40ff20f1be93b08032de5df50a7334e39a60c481cb6948
SHA5124d1562f7f65d4fd6e28bb2747fc1bac7f0d7b1055f495ee4010ec23ab422d6acdac3fc2f3220d4e0742a90950959a12c0e3f026c2b937ddf089f372b6152cd81