Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
120s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20231129-en -
resource tags
arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system -
submitted
31/12/2023, 13:09
Behavioral task
behavioral1
Sample
3759966c28ed960c7be9af9a7568ab9f.exe
Resource
win7-20231129-en
windows7-x64
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
3759966c28ed960c7be9af9a7568ab9f.exe
Resource
win10v2004-20231222-en
windows10-2004-x64
2 signatures
150 seconds
General
-
Target
3759966c28ed960c7be9af9a7568ab9f.exe
-
Size
1.8MB
-
MD5
3759966c28ed960c7be9af9a7568ab9f
-
SHA1
26add402d2839a7054b5fe94ff6683dc67e90612
-
SHA256
a6d200046d11c56f4949ae2137778e29f0b1ee8212984feb42d8dd2349891696
-
SHA512
dc889890b27ed6c4d0e055f8ec979fca42718a0672d331f793d44e1368b11bb331bec4a301c5371d250c2eac0e35f00c53147618a277cfa22d3f1749e009f6fe
-
SSDEEP
24576:S6pQPxQ2JyP2r5mJV91xM7RpbwgIvs7NxqUkH5:SCqm2Jpr0nNM7Dus7Nx2Z
Score
7/10
Malware Config
Signatures
-
resource yara_rule behavioral1/memory/2932-0-0x0000000000400000-0x00000000005BA000-memory.dmp upx behavioral1/files/0x000900000001412c-5.dat upx behavioral1/memory/2932-2609-0x0000000000400000-0x00000000005BA000-memory.dmp upx behavioral1/memory/2932-9165-0x0000000000400000-0x00000000005BA000-memory.dmp upx -
Drops desktop.ini file(s) 9 IoCs
description ioc Process File created C:\Program Files\Microsoft Games\Solitaire\desktop.ini 3759966c28ed960c7be9af9a7568ab9f.exe File created C:\Program Files\desktop.ini 3759966c28ed960c7be9af9a7568ab9f.exe File created C:\Program Files\Microsoft Games\FreeCell\desktop.ini 3759966c28ed960c7be9af9a7568ab9f.exe File created C:\Program Files\Microsoft Games\Hearts\desktop.ini 3759966c28ed960c7be9af9a7568ab9f.exe File created C:\Program Files\Microsoft Games\Mahjong\desktop.ini 3759966c28ed960c7be9af9a7568ab9f.exe File created C:\Program Files\Microsoft Games\Purble Place\desktop.ini 3759966c28ed960c7be9af9a7568ab9f.exe File created C:\Program Files\Microsoft Games\SpiderSolitaire\desktop.ini 3759966c28ed960c7be9af9a7568ab9f.exe File created C:\Program Files\Common Files\Microsoft Shared\Stationery\Desktop.ini 3759966c28ed960c7be9af9a7568ab9f.exe File created C:\Program Files\Microsoft Games\Chess\desktop.ini 3759966c28ed960c7be9af9a7568ab9f.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Windows Sidebar\Gadgets\Calendar.Gadget\images\calendar_double_orange.png 3759966c28ed960c7be9af9a7568ab9f.exe File created C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\fr-FR\clock.html.exe 3759966c28ed960c7be9af9a7568ab9f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\instrument.dll 3759966c28ed960c7be9af9a7568ab9f.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\core\locale\org-openide-filesystems_zh_CN.jar.exe 3759966c28ed960c7be9af9a7568ab9f.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\modules\locale\org-netbeans-lib-profiler-ui_ja.jar.exe 3759966c28ed960c7be9af9a7568ab9f.exe File created C:\Program Files\VideoLAN\VLC\plugins\mux\libmux_ogg_plugin.dll.exe 3759966c28ed960c7be9af9a7568ab9f.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\video_filter\libmagnify_plugin.dll 3759966c28ed960c7be9af9a7568ab9f.exe File created C:\Program Files\Windows Media Player\Network Sharing\wmpnss_bw32.bmp.exe 3759966c28ed960c7be9af9a7568ab9f.exe File created C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\images\cronometer_m.png.exe 3759966c28ed960c7be9af9a7568ab9f.exe File created C:\Program Files\7-Zip\7zCon.sfx.exe 3759966c28ed960c7be9af9a7568ab9f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\configuration\config.ini 3759966c28ed960c7be9af9a7568ab9f.exe File created C:\Program Files\VideoLAN\VLC\plugins\video_filter\libgaussianblur_plugin.dll.exe 3759966c28ed960c7be9af9a7568ab9f.exe File created C:\Program Files\Windows Sidebar\Gadgets\MediaCenter.Gadget\images\Gadget_Main_Background_Loading.png 3759966c28ed960c7be9af9a7568ab9f.exe File created C:\Program Files\Java\jdk1.7.0_80\bin\jdb.exe.exe 3759966c28ed960c7be9af9a7568ab9f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Pacific\Honolulu 3759966c28ed960c7be9af9a7568ab9f.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.core.databinding_1.4.2.v20140729-1044.jar.exe 3759966c28ed960c7be9af9a7568ab9f.exe File opened for modification C:\Program Files\Mozilla Firefox\ucrtbase.dll 3759966c28ed960c7be9af9a7568ab9f.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\sr\LC_MESSAGES\vlc.mo 3759966c28ed960c7be9af9a7568ab9f.exe File created C:\Program Files\VideoLAN\VLC\lua\http\css\ui-lightness\images\ui-bg_glass_100_f6f6f6_1x400.png.exe 3759966c28ed960c7be9af9a7568ab9f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-modules-javahelp_zh_CN.jar 3759966c28ed960c7be9af9a7568ab9f.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\audio_filter\libchorus_flanger_plugin.dll 3759966c28ed960c7be9af9a7568ab9f.exe File created C:\Program Files\Windows Media Player\fr-FR\wmpnssui.dll.mui 3759966c28ed960c7be9af9a7568ab9f.exe File created C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\Images\0.png.exe 3759966c28ed960c7be9af9a7568ab9f.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\cmm\CIEXYZ.pf.exe 3759966c28ed960c7be9af9a7568ab9f.exe File opened for modification C:\Program Files\Java\jre7\bin\eula.dll 3759966c28ed960c7be9af9a7568ab9f.exe File opened for modification C:\Program Files\Mozilla Firefox\installation_telemetry.json 3759966c28ed960c7be9af9a7568ab9f.exe File created C:\Program Files\VideoLAN\VLC\locale\km\LC_MESSAGES\vlc.mo.exe 3759966c28ed960c7be9af9a7568ab9f.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\ConvertInkStore.exe 3759966c28ed960c7be9af9a7568ab9f.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.director.app_1.0.300.v20140228-1829.jar.exe 3759966c28ed960c7be9af9a7568ab9f.exe File created C:\Program Files\Microsoft Games\Purble Place\PurblePlace.exe.exe 3759966c28ed960c7be9af9a7568ab9f.exe File created C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\es\System.Data.Entity.Resources.dll 3759966c28ed960c7be9af9a7568ab9f.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\ja\LC_MESSAGES\vlc.mo 3759966c28ed960c7be9af9a7568ab9f.exe File created C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\docked_black_moon-full_partly-cloudy.png.exe 3759966c28ed960c7be9af9a7568ab9f.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Jakarta.exe 3759966c28ed960c7be9af9a7568ab9f.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-openide-explorer_ja.jar.exe 3759966c28ed960c7be9af9a7568ab9f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\locale\com-sun-tools-visualvm-jmx_ja.jar 3759966c28ed960c7be9af9a7568ab9f.exe File created C:\Program Files\Windows Sidebar\Gadgets\MediaCenter.Gadget\de-DE\gadget.xml.exe 3759966c28ed960c7be9af9a7568ab9f.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\HueCycle\colorcycle.png.exe 3759966c28ed960c7be9af9a7568ab9f.exe File created C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\undocked_black_moon-first-quarter_partly-cloudy.png.exe 3759966c28ed960c7be9af9a7568ab9f.exe File created C:\Program Files\Common Files\System\Ole DB\it-IT\sqloledb.rll.mui.exe 3759966c28ed960c7be9af9a7568ab9f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-netbeans-core-startup.xml 3759966c28ed960c7be9af9a7568ab9f.exe File created C:\Program Files\Windows NT\TableTextService\TableTextServiceAmharic.txt.exe 3759966c28ed960c7be9af9a7568ab9f.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\ko-kr.xml.exe 3759966c28ed960c7be9af9a7568ab9f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\org-netbeans-swing-outline.xml 3759966c28ed960c7be9af9a7568ab9f.exe File created C:\Program Files\Windows Sidebar\Gadgets\Currency.Gadget\ja-JP\js\currency.js 3759966c28ed960c7be9af9a7568ab9f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-netbeans-modules-applemenu.xml 3759966c28ed960c7be9af9a7568ab9f.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\access\libcdda_plugin.dll 3759966c28ed960c7be9af9a7568ab9f.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\en-US\InkObj.dll.mui.exe 3759966c28ed960c7be9af9a7568ab9f.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\web.xml.exe 3759966c28ed960c7be9af9a7568ab9f.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\hwruklm.dat.exe 3759966c28ed960c7be9af9a7568ab9f.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Indiana\Winamac.exe 3759966c28ed960c7be9af9a7568ab9f.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.util_1.0.500.v20130404-1337.jar.exe 3759966c28ed960c7be9af9a7568ab9f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-swing-tabcontrol_ja.jar 3759966c28ed960c7be9af9a7568ab9f.exe File created C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\en-US\picturePuzzle.html.exe 3759966c28ed960c7be9af9a7568ab9f.exe File created C:\Program Files\VideoLAN\VLC\plugins\control\libwin_msg_plugin.dll.exe 3759966c28ed960c7be9af9a7568ab9f.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Guyana.exe 3759966c28ed960c7be9af9a7568ab9f.exe File created C:\Program Files\VideoLAN\VLC\plugins\audio_filter\libscaletempo_plugin.dll.exe 3759966c28ed960c7be9af9a7568ab9f.exe File created C:\Program Files\Windows Sidebar\Gadgets\Currency.Gadget\de-DE\css\currency.css 3759966c28ed960c7be9af9a7568ab9f.exe File created C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\Images\hint_over.png 3759966c28ed960c7be9af9a7568ab9f.exe File created C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\undocked_black_rainy.png.exe 3759966c28ed960c7be9af9a7568ab9f.exe File created C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\it\PresentationCore.resources.dll.exe 3759966c28ed960c7be9af9a7568ab9f.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\ipscht.xml 3759966c28ed960c7be9af9a7568ab9f.exe File created C:\Program Files\DVD Maker\SecretST.TTF.exe 3759966c28ed960c7be9af9a7568ab9f.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\SpecialOccasion\whitevignette1047.png 3759966c28ed960c7be9af9a7568ab9f.exe
Processes
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1006KB
MD506951708f19bd2401462aa1100a23e57
SHA108b66eb9594ddaff5d728e5fb18ba403baee14f3
SHA256aaa8a3165655b0707c7fb600af152f28a853c57c60744a88d111d0cee635cbb1
SHA512a54b26ddf84ef0a4d18cd13cbcdc226f9af53a062bc5512c497916a9c1f0c9e6a961c47e3bac274470a2e1f275233235074e3a2a6ac81534a2f202dfafdfcb58