Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
4s -
max time network
132s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
30/12/2023, 20:29
Behavioral task
behavioral1
Sample
1bd9f382652168dd7310f8bb63037169.exe
Resource
win7-20231215-en
windows7-x64
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
1bd9f382652168dd7310f8bb63037169.exe
Resource
win10v2004-20231215-en
windows10-2004-x64
2 signatures
150 seconds
General
-
Target
1bd9f382652168dd7310f8bb63037169.exe
-
Size
1.8MB
-
MD5
1bd9f382652168dd7310f8bb63037169
-
SHA1
acc154702e4305f245e0ba170e83cd02f0fa27c2
-
SHA256
b00820a96165ef6006dd32a0b6d15dfb9bbc40aef1f103c0e03e86b4aa034d27
-
SHA512
e2adebeaef06442af1384390ea693eb3ab710c71ee82d767edcd019a0d573dfcd9d89bea2a2af7409c050bb92e70f8d17354359d6dd49d3e0b3733194fb14387
-
SSDEEP
24576:S6pQPxQ2JyP2r5mJV91xM7RpbwgIvs7NxqS:SCqm2Jpr0nNM7Dus7NxH
Score
7/10
Malware Config
Signatures
-
resource yara_rule behavioral2/memory/3028-0-0x0000000000400000-0x00000000005BA000-memory.dmp upx behavioral2/files/0x00010000000228a0-5.dat upx behavioral2/memory/3028-5895-0x0000000000400000-0x00000000005BA000-memory.dmp upx behavioral2/memory/3028-13377-0x0000000000400000-0x00000000005BA000-memory.dmp upx -
Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\7-Zip\Lang\pt-br.txt.exe 1bd9f382652168dd7310f8bb63037169.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVCatalog.dll.exe 1bd9f382652168dd7310f8bb63037169.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.ro-ro.dll.exe 1bd9f382652168dd7310f8bb63037169.exe File created C:\Program Files\Common Files\microsoft shared\ink\InputPersonalization.exe.exe 1bd9f382652168dd7310f8bb63037169.exe File opened for modification C:\Program Files\7-Zip\Lang\kab.txt 1bd9f382652168dd7310f8bb63037169.exe File created C:\Program Files\Common Files\System\Ole DB\fr-FR\msdasqlr.dll.mui.exe 1bd9f382652168dd7310f8bb63037169.exe File created C:\Program Files\Common Files\System\ado\de-DE\msader15.dll.mui.exe 1bd9f382652168dd7310f8bb63037169.exe File created C:\Program Files\Common Files\System\ado\msado20.tlb.exe 1bd9f382652168dd7310f8bb63037169.exe File created C:\Program Files\Common Files\microsoft shared\ink\TipRes.dll 1bd9f382652168dd7310f8bb63037169.exe File created C:\Program Files\7-Zip\Lang\el.txt.exe 1bd9f382652168dd7310f8bb63037169.exe File created C:\Program Files\Common Files\System\Ole DB\sqloledb.dll 1bd9f382652168dd7310f8bb63037169.exe File created C:\Program Files\Common Files\System\ado\ja-JP\msader15.dll.mui 1bd9f382652168dd7310f8bb63037169.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.he-il.dll.exe 1bd9f382652168dd7310f8bb63037169.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.cs-cz.dll 1bd9f382652168dd7310f8bb63037169.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.hi-in.dll.exe 1bd9f382652168dd7310f8bb63037169.exe File created C:\Program Files\Common Files\microsoft shared\ink\es-ES\TabTip.exe.mui 1bd9f382652168dd7310f8bb63037169.exe File created C:\Program Files\7-Zip\Lang\mng2.txt.exe 1bd9f382652168dd7310f8bb63037169.exe File created C:\Program Files\7-Zip\Lang\sw.txt.exe 1bd9f382652168dd7310f8bb63037169.exe File opened for modification C:\Program Files\7-Zip\Uninstall.exe 1bd9f382652168dd7310f8bb63037169.exe File created C:\Program Files\Common Files\System\Ole DB\fr-FR\sqlxmlx.rll.mui.exe 1bd9f382652168dd7310f8bb63037169.exe File created C:\Program Files\Common Files\System\msadc\msadco.dll.exe 1bd9f382652168dd7310f8bb63037169.exe File created C:\Program Files\Common Files\System\Ole DB\es-ES\msdasqlr.dll.mui.exe 1bd9f382652168dd7310f8bb63037169.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.es-es.dll.exe 1bd9f382652168dd7310f8bb63037169.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\SharedPerformance.man.exe 1bd9f382652168dd7310f8bb63037169.exe File created C:\Program Files\Common Files\microsoft shared\ink\es-ES\tabskb.dll.mui.exe 1bd9f382652168dd7310f8bb63037169.exe File opened for modification C:\Program Files\7-Zip\Lang\io.txt 1bd9f382652168dd7310f8bb63037169.exe File created C:\Program Files\Common Files\System\Ole DB\es-ES\sqloledb.rll.mui 1bd9f382652168dd7310f8bb63037169.exe File created C:\Program Files\Common Files\System\Ole DB\ja-JP\sqloledb.rll.mui.exe 1bd9f382652168dd7310f8bb63037169.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.ms-my.dll.exe 1bd9f382652168dd7310f8bb63037169.exe File created C:\Program Files\Common Files\microsoft shared\MSInfo\fr-FR\msinfo32.exe.mui 1bd9f382652168dd7310f8bb63037169.exe File created C:\Program Files\7-Zip\Lang\ast.txt.exe 1bd9f382652168dd7310f8bb63037169.exe File opened for modification C:\Program Files\7-Zip\Lang\bn.txt 1bd9f382652168dd7310f8bb63037169.exe File created C:\Program Files\7-Zip\Lang\hr.txt.exe 1bd9f382652168dd7310f8bb63037169.exe File created C:\Program Files\7-Zip\Lang\kaa.txt.exe 1bd9f382652168dd7310f8bb63037169.exe File created C:\Program Files\Common Files\System\msadc\de-DE\msdaremr.dll.mui.exe 1bd9f382652168dd7310f8bb63037169.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-core-file-l1-2-0.dll.exe 1bd9f382652168dd7310f8bb63037169.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-core-synch-l1-2-0.dll.exe 1bd9f382652168dd7310f8bb63037169.exe File opened for modification C:\Program Files\Common Files\microsoft shared\OFFICE16\Office Setup Controller\pidgenx.dll 1bd9f382652168dd7310f8bb63037169.exe File created C:\Program Files\Common Files\microsoft shared\ink\InkObj.dll 1bd9f382652168dd7310f8bb63037169.exe File created C:\Program Files\Common Files\microsoft shared\ink\de-DE\ShapeCollector.exe.mui 1bd9f382652168dd7310f8bb63037169.exe File created C:\Program Files\7-Zip\Lang\az.txt.exe 1bd9f382652168dd7310f8bb63037169.exe File created C:\Program Files\Common Files\System\Ole DB\ja-JP\oledb32r.dll.mui.exe 1bd9f382652168dd7310f8bb63037169.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe.exe 1bd9f382652168dd7310f8bb63037169.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\concrt140.dll.exe 1bd9f382652168dd7310f8bb63037169.exe File created C:\Program Files\Common Files\microsoft shared\ink\Microsoft.Ink.dll 1bd9f382652168dd7310f8bb63037169.exe File created C:\Program Files\Common Files\System\msadc\en-US\msdaprsr.dll.mui.exe 1bd9f382652168dd7310f8bb63037169.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-string-l1-1-0.dll.exe 1bd9f382652168dd7310f8bb63037169.exe File created C:\Program Files\Common Files\microsoft shared\ink\de-DE\InkObj.dll.mui.exe 1bd9f382652168dd7310f8bb63037169.exe File opened for modification C:\Program Files\7-Zip\Lang\el.txt 1bd9f382652168dd7310f8bb63037169.exe File created C:\Program Files\7-Zip\Lang\gl.txt.exe 1bd9f382652168dd7310f8bb63037169.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVIsvSubsystemController.dll 1bd9f382652168dd7310f8bb63037169.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\FrequentOfficeUpdateSchedule.xml 1bd9f382652168dd7310f8bb63037169.exe File created C:\Program Files\Common Files\microsoft shared\MSInfo\it-IT\msinfo32.exe.mui.exe 1bd9f382652168dd7310f8bb63037169.exe File created C:\Program Files\Common Files\System\msadc\msadds.dll.exe 1bd9f382652168dd7310f8bb63037169.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-filesystem-l1-1-0.dll.exe 1bd9f382652168dd7310f8bb63037169.exe File opened for modification C:\Program Files\7-Zip\Lang\an.txt 1bd9f382652168dd7310f8bb63037169.exe File created C:\Program Files\Common Files\System\ja-JP\wab32res.dll.mui 1bd9f382652168dd7310f8bb63037169.exe File created C:\Program Files\Common Files\System\msadc\en-US\msadcer.dll.mui.exe 1bd9f382652168dd7310f8bb63037169.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.ja-jp.dll 1bd9f382652168dd7310f8bb63037169.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe.exe 1bd9f382652168dd7310f8bb63037169.exe File created C:\Program Files\Common Files\System\msadc\ja-JP\msaddsr.dll.mui 1bd9f382652168dd7310f8bb63037169.exe File created C:\Program Files\Common Files\System\msadc\msadcor.dll.exe 1bd9f382652168dd7310f8bb63037169.exe File opened for modification C:\Program Files\7-Zip\Lang\pa-in.txt 1bd9f382652168dd7310f8bb63037169.exe File created C:\Program Files\7-Zip\Lang\tg.txt.exe 1bd9f382652168dd7310f8bb63037169.exe
Processes
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
94KB
MD59b40c5fecc584d988a6616c1caaacdff
SHA1d02dc025166b549c36987d6db5098771d34629fb
SHA256fa15427be34f2b9a8baae1a7e5467015c2a495a63c47e031baf39bac69130b3b
SHA512417572c9a0c8ff260304d0242a81549e62ec853a7f2f7284d5dc1ed8f18040fa0e7218a009ebe2b5f7f2ebfab2b4e635ad6fcb74c25e86271973f272ba60d894