Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Overview
overview
10Static
static
10samples (2) (3).zip
windows7-x64
1samples (2) (3).zip
windows10-2004-x64
1100b8bfff5...48.exe
windows7-x64
1100b8bfff5...48.exe
windows10-2004-x64
116b5122423...49.exe
windows7-x64
716b5122423...49.exe
windows10-2004-x64
72727dde741...98.exe
windows7-x64
92727dde741...98.exe
windows10-2004-x64
929dd920ac1...e5.zip
windows7-x64
129dd920ac1...e5.zip
windows10-2004-x64
12001.exe
windows7-x64
92001.exe
windows10-2004-x64
93c5ffe21fd...017.js
windows7-x64
13c5ffe21fd...017.js
windows10-2004-x64
148493bb68b...20.exe
windows7-x64
1048493bb68b...20.exe
windows10-2004-x64
10568a79ce58...19.exe
windows7-x64
9568a79ce58...19.exe
windows10-2004-x64
957de0d2d59...fe.exe
windows7-x64
957de0d2d59...fe.exe
windows10-2004-x64
75e34ceeaf6...05.exe
windows7-x64
15e34ceeaf6...05.exe
windows10-2004-x64
16e2db44578...ac.exe
windows7-x64
96e2db44578...ac.exe
windows10-2004-x64
975342ada93...76.exe
windows7-x64
875342ada93...76.exe
windows10-2004-x64
67e623dca8a...e2.exe
windows7-x64
107e623dca8a...e2.exe
windows10-2004-x64
1087f2db714e...7e.exe
windows7-x64
887f2db714e...7e.exe
windows10-2004-x64
88dcb1af1e7...b0.exe
windows7-x64
78dcb1af1e7...b0.exe
windows10-2004-x64
7Analysis
-
max time kernel
150s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
01/01/2024, 15:12
Behavioral task
behavioral1
Sample
samples (2) (3).zip
Resource
win7-20231129-en
windows7-x64
Behavioral task
behavioral2
Sample
samples (2) (3).zip
Resource
win10v2004-20231215-en
windows10-2004-x64
Behavioral task
behavioral3
Sample
100b8bfff550fb74c98a2ef9a71d4bb53553d2d7ba509bb451fe32814ec57e48.exe
Resource
win7-20231215-en
windows7-x64
Behavioral task
behavioral4
Sample
100b8bfff550fb74c98a2ef9a71d4bb53553d2d7ba509bb451fe32814ec57e48.exe
Resource
win10v2004-20231215-en
windows10-2004-x64
Behavioral task
behavioral5
Sample
16b51224239d3671b1af3e8f2656a2ad1e7f5fb9acb09111a95461338a841b49.exe
Resource
win7-20231215-en
windows7-x64
Behavioral task
behavioral6
Sample
16b51224239d3671b1af3e8f2656a2ad1e7f5fb9acb09111a95461338a841b49.exe
Resource
win10v2004-20231215-en
windows10-2004-x64
Behavioral task
behavioral7
Sample
2727dde7418284bd2b16a032346a9c6921cbfb5e950ad21c9468792b71ee3898.exe
Resource
win7-20231129-en
windows7-x64
Behavioral task
behavioral8
Sample
2727dde7418284bd2b16a032346a9c6921cbfb5e950ad21c9468792b71ee3898.exe
Resource
win10v2004-20231215-en
windows10-2004-x64
Behavioral task
behavioral9
Sample
29dd920ac1453b5be12fcef5af45690dbbe625e985f6692e237a057e832937e5.zip
Resource
win7-20231215-en
windows7-x64
Behavioral task
behavioral10
Sample
29dd920ac1453b5be12fcef5af45690dbbe625e985f6692e237a057e832937e5.zip
Resource
win10v2004-20231215-en
windows10-2004-x64
Behavioral task
behavioral11
Sample
2001.exe
Resource
win7-20231215-en
windows7-x64
Behavioral task
behavioral12
Sample
2001.exe
Resource
win10v2004-20231215-en
windows10-2004-x64
Behavioral task
behavioral13
Sample
3c5ffe21fd24c4daf62f5190d96e65bf7a25232ef9ec956a77db910e90750017.js
Resource
win7-20231215-en
windows7-x64
Behavioral task
behavioral14
Sample
3c5ffe21fd24c4daf62f5190d96e65bf7a25232ef9ec956a77db910e90750017.js
Resource
win10v2004-20231215-en
windows10-2004-x64
Behavioral task
behavioral15
Sample
48493bb68bc1062b11cc505e444db288ec6cba0c979d10a9b5a3ea775daf9420.exe
Resource
win7-20231215-en
windows7-x64
Behavioral task
behavioral16
Sample
48493bb68bc1062b11cc505e444db288ec6cba0c979d10a9b5a3ea775daf9420.exe
Resource
win10v2004-20231215-en
windows10-2004-x64
Behavioral task
behavioral17
Sample
568a79ce585dac32af237cb187b663cb6d2e4f594d66860c7ea1b3c66e4b7919.exe
Resource
win7-20231215-en
windows7-x64
Behavioral task
behavioral18
Sample
568a79ce585dac32af237cb187b663cb6d2e4f594d66860c7ea1b3c66e4b7919.exe
Resource
win10v2004-20231215-en
windows10-2004-x64
Behavioral task
behavioral19
Sample
57de0d2d5945db11d6c845459419a1b48a5cf415a7a0866c40b03afaec6fb4fe.exe
Resource
win7-20231215-en
windows7-x64
Behavioral task
behavioral20
Sample
57de0d2d5945db11d6c845459419a1b48a5cf415a7a0866c40b03afaec6fb4fe.exe
Resource
win10v2004-20231215-en
windows10-2004-x64
Behavioral task
behavioral21
Sample
5e34ceeaf60a7cdfaeee0443a87edb92115727130323314628503dfe755b9505.exe
Resource
win7-20231215-en
windows7-x64
Behavioral task
behavioral22
Sample
5e34ceeaf60a7cdfaeee0443a87edb92115727130323314628503dfe755b9505.exe
Resource
win10v2004-20231215-en
windows10-2004-x64
Behavioral task
behavioral23
Sample
6e2db44578ff2fdcab7938517973ed9bfd3532d7b29b7798ceb9f04ed079c1ac.exe
Resource
win7-20231215-en
windows7-x64
Behavioral task
behavioral24
Sample
6e2db44578ff2fdcab7938517973ed9bfd3532d7b29b7798ceb9f04ed079c1ac.exe
Resource
win10v2004-20231215-en
windows10-2004-x64
Behavioral task
behavioral25
Sample
75342ada938ea71dc863ee603a075a3ff7cbd759a091879f065a849650097a76.exe
Resource
win7-20231215-en
windows7-x64
Behavioral task
behavioral26
Sample
75342ada938ea71dc863ee603a075a3ff7cbd759a091879f065a849650097a76.exe
Resource
win10v2004-20231215-en
windows10-2004-x64
Behavioral task
behavioral27
Sample
7e623dca8a26a45440c331e383ac6ce3783d5c1bd60b91ee91ce0cc5841633e2.exe
Resource
win7-20231215-en
windows7-x64
Behavioral task
behavioral28
Sample
7e623dca8a26a45440c331e383ac6ce3783d5c1bd60b91ee91ce0cc5841633e2.exe
Resource
win10v2004-20231215-en
windows10-2004-x64
Behavioral task
behavioral29
Sample
87f2db714eac44b77889c850b8b6b55e2b117c88ac8f8923b47ac89fecadab7e.exe
Resource
win7-20231215-en
windows7-x64
Behavioral task
behavioral30
Sample
87f2db714eac44b77889c850b8b6b55e2b117c88ac8f8923b47ac89fecadab7e.exe
Resource
win10v2004-20231215-en
windows10-2004-x64
Behavioral task
behavioral31
Sample
8dcb1af1e7886834252394e9710ee72b9bfa910779c4ea041831d0622efa85b0.exe
Resource
win7-20231215-en
windows7-x64
Behavioral task
behavioral32
Sample
8dcb1af1e7886834252394e9710ee72b9bfa910779c4ea041831d0622efa85b0.exe
Resource
win10v2004-20231222-en
windows10-2004-x64
General
-
Target
7e623dca8a26a45440c331e383ac6ce3783d5c1bd60b91ee91ce0cc5841633e2.exe
-
Size
219KB
-
MD5
419ac67a37befc87317f2263e43bbccb
-
SHA1
9a85595a04ac9f2c2b3dbf2a3ec171fc4486e3dd
-
SHA256
7e623dca8a26a45440c331e383ac6ce3783d5c1bd60b91ee91ce0cc5841633e2
-
SHA512
5a1fcacd280ba94f5178db1934b1122cf8e4359372e09812a57ae5601060e78f38f402a24a2b04dfe2fb7f6052cecce68df0aa9f41b48db34513cade81cd1969
-
SSDEEP
3072:W5LZvmXjUjS/oewQhcyibDoO1iPN2HuzNUYi821BNL5kQdL:yLmQu/tJcToO1mNSuWYWIQN
Malware Config
Signatures
-
Dharma
Dharma is a ransomware that uses security software installation to hide malicious activities.
-
Deletes shadow copies 2 TTPs
Ransomware often targets backup files to inhibit system recovery.
-
Renames multiple (159) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Drops startup file 1 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\7e623dca8a26a45440c331e383ac6ce3783d5c1bd60b91ee91ce0cc5841633e2.exe 7e623dca8a26a45440c331e383ac6ce3783d5c1bd60b91ee91ce0cc5841633e2.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\7e623dca8a26a45440c331e383ac6ce3783d5c1bd60b91ee91ce0cc5841633e2.exe = "C:\\Windows\\System32\\7e623dca8a26a45440c331e383ac6ce3783d5c1bd60b91ee91ce0cc5841633e2.exe" 7e623dca8a26a45440c331e383ac6ce3783d5c1bd60b91ee91ce0cc5841633e2.exe -
Drops desktop.ini file(s) 14 IoCs
description ioc Process File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\Stationery\Desktop.ini 7e623dca8a26a45440c331e383ac6ce3783d5c1bd60b91ee91ce0cc5841633e2.exe File opened for modification C:\$Recycle.Bin\S-1-5-21-2444714103-3190537498-3629098939-1000\desktop.ini 7e623dca8a26a45440c331e383ac6ce3783d5c1bd60b91ee91ce0cc5841633e2.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\Stationery\Desktop.ini 7e623dca8a26a45440c331e383ac6ce3783d5c1bd60b91ee91ce0cc5841633e2.exe File opened for modification C:\Program Files\Microsoft Games\Mahjong\desktop.ini 7e623dca8a26a45440c331e383ac6ce3783d5c1bd60b91ee91ce0cc5841633e2.exe File opened for modification C:\Program Files\Microsoft Games\SpiderSolitaire\desktop.ini 7e623dca8a26a45440c331e383ac6ce3783d5c1bd60b91ee91ce0cc5841633e2.exe File opened for modification C:\Program Files\Microsoft Games\Solitaire\desktop.ini 7e623dca8a26a45440c331e383ac6ce3783d5c1bd60b91ee91ce0cc5841633e2.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\DataServices\DESKTOP.INI 7e623dca8a26a45440c331e383ac6ce3783d5c1bd60b91ee91ce0cc5841633e2.exe File opened for modification C:\Program Files\desktop.ini 7e623dca8a26a45440c331e383ac6ce3783d5c1bd60b91ee91ce0cc5841633e2.exe File opened for modification C:\Program Files\Microsoft Games\Purble Place\desktop.ini 7e623dca8a26a45440c331e383ac6ce3783d5c1bd60b91ee91ce0cc5841633e2.exe File opened for modification C:\Program Files (x86)\desktop.ini 7e623dca8a26a45440c331e383ac6ce3783d5c1bd60b91ee91ce0cc5841633e2.exe File opened for modification F:\$RECYCLE.BIN\S-1-5-21-2444714103-3190537498-3629098939-1000\desktop.ini 7e623dca8a26a45440c331e383ac6ce3783d5c1bd60b91ee91ce0cc5841633e2.exe File opened for modification C:\Program Files\Microsoft Games\Chess\desktop.ini 7e623dca8a26a45440c331e383ac6ce3783d5c1bd60b91ee91ce0cc5841633e2.exe File opened for modification C:\Program Files\Microsoft Games\FreeCell\desktop.ini 7e623dca8a26a45440c331e383ac6ce3783d5c1bd60b91ee91ce0cc5841633e2.exe File opened for modification C:\Program Files\Microsoft Games\Hearts\desktop.ini 7e623dca8a26a45440c331e383ac6ce3783d5c1bd60b91ee91ce0cc5841633e2.exe -
Drops file in System32 directory 1 IoCs
description ioc Process File created C:\Windows\System32\7e623dca8a26a45440c331e383ac6ce3783d5c1bd60b91ee91ce0cc5841633e2.exe 7e623dca8a26a45440c331e383ac6ce3783d5c1bd60b91ee91ce0cc5841633e2.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\dt_socket.dll.id-4D74230D.[[email protected]].bgtx 7e623dca8a26a45440c331e383ac6ce3783d5c1bd60b91ee91ce0cc5841633e2.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\atl.dll 7e623dca8a26a45440c331e383ac6ce3783d5c1bd60b91ee91ce0cc5841633e2.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\FD00438_.WMF 7e623dca8a26a45440c331e383ac6ce3783d5c1bd60b91ee91ce0cc5841633e2.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\modules\locale\org-netbeans-modules-profiler-selector-ui_zh_CN.jar.id-4D74230D.[[email protected]].bgtx 7e623dca8a26a45440c331e383ac6ce3783d5c1bd60b91ee91ce0cc5841633e2.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\America\Guayaquil 7e623dca8a26a45440c331e383ac6ce3783d5c1bd60b91ee91ce0cc5841633e2.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\en-US\settings.html 7e623dca8a26a45440c331e383ac6ce3783d5c1bd60b91ee91ce0cc5841633e2.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\PDFSigQFormalRep.pdf 7e623dca8a26a45440c331e383ac6ce3783d5c1bd60b91ee91ce0cc5841633e2.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\Office.en-us\PSCONFIG.CHM 7e623dca8a26a45440c331e383ac6ce3783d5c1bd60b91ee91ce0cc5841633e2.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\cs\LC_MESSAGES\vlc.mo.id-4D74230D.[[email protected]].bgtx 7e623dca8a26a45440c331e383ac6ce3783d5c1bd60b91ee91ce0cc5841633e2.exe File opened for modification C:\Program Files\Common Files\System\Ole DB\fr-FR\msdasqlr.dll.mui 7e623dca8a26a45440c331e383ac6ce3783d5c1bd60b91ee91ce0cc5841633e2.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\bin\jp2native.dll.id-4D74230D.[[email protected]].bgtx 7e623dca8a26a45440c331e383ac6ce3783d5c1bd60b91ee91ce0cc5841633e2.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\notification_plugin.jar.id-4D74230D.[[email protected]].bgtx 7e623dca8a26a45440c331e383ac6ce3783d5c1bd60b91ee91ce0cc5841633e2.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\PUBSPAPR\PDIR7B.GIF 7e623dca8a26a45440c331e383ac6ce3783d5c1bd60b91ee91ce0cc5841633e2.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\org-openide-compat.xml 7e623dca8a26a45440c331e383ac6ce3783d5c1bd60b91ee91ce0cc5841633e2.exe File opened for modification C:\Program Files\Mozilla Firefox\browser\VisualElements\PrivateBrowsing_150.png 7e623dca8a26a45440c331e383ac6ce3783d5c1bd60b91ee91ce0cc5841633e2.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.alert_5.5.0.165303.jar.id-4D74230D.[[email protected]].bgtx 7e623dca8a26a45440c331e383ac6ce3783d5c1bd60b91ee91ce0cc5841633e2.exe File opened for modification C:\Program Files\Microsoft Office\Office14\1033\BHOINTL.DLL 7e623dca8a26a45440c331e383ac6ce3783d5c1bd60b91ee91ce0cc5841633e2.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\TN00330_.WMF.id-4D74230D.[[email protected]].bgtx 7e623dca8a26a45440c331e383ac6ce3783d5c1bd60b91ee91ce0cc5841633e2.exe File created C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\BULLETS\BD15019_.GIF.id-4D74230D.[[email protected]].bgtx 7e623dca8a26a45440c331e383ac6ce3783d5c1bd60b91ee91ce0cc5841633e2.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.feature_3.9.0.v20140827-1444\asl-v20.txt 7e623dca8a26a45440c331e383ac6ce3783d5c1bd60b91ee91ce0cc5841633e2.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Europe\Stockholm.id-4D74230D.[[email protected]].bgtx 7e623dca8a26a45440c331e383ac6ce3783d5c1bd60b91ee91ce0cc5841633e2.exe File opened for modification C:\Program Files\VideoLAN\VLC\lua\http\requests\vlm.xml 7e623dca8a26a45440c331e383ac6ce3783d5c1bd60b91ee91ce0cc5841633e2.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-api-search_zh_CN.jar 7e623dca8a26a45440c331e383ac6ce3783d5c1bd60b91ee91ce0cc5841633e2.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0241077.WMF.id-4D74230D.[[email protected]].bgtx 7e623dca8a26a45440c331e383ac6ce3783d5c1bd60b91ee91ce0cc5841633e2.exe File created C:\Program Files\Microsoft Office\Office14\Custom.propdesc.id-4D74230D.[[email protected]].bgtx 7e623dca8a26a45440c331e383ac6ce3783d5c1bd60b91ee91ce0cc5841633e2.exe File opened for modification C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\BULLETS\BD15136_.GIF 7e623dca8a26a45440c331e383ac6ce3783d5c1bd60b91ee91ce0cc5841633e2.exe File opened for modification C:\Program Files\7-Zip\7zCon.sfx.id-4D74230D.[[email protected]].bgtx 7e623dca8a26a45440c331e383ac6ce3783d5c1bd60b91ee91ce0cc5841633e2.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Etc\GMT-11 7e623dca8a26a45440c331e383ac6ce3783d5c1bd60b91ee91ce0cc5841633e2.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-core-windows_ja.jar 7e623dca8a26a45440c331e383ac6ce3783d5c1bd60b91ee91ce0cc5841633e2.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\SO02025_.WMF 7e623dca8a26a45440c331e383ac6ce3783d5c1bd60b91ee91ce0cc5841633e2.exe File opened for modification C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\LINES\BD14595_.GIF 7e623dca8a26a45440c331e383ac6ce3783d5c1bd60b91ee91ce0cc5841633e2.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\dcommon\gifs\leftnav.gif 7e623dca8a26a45440c331e383ac6ce3783d5c1bd60b91ee91ce0cc5841633e2.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\BD19986_.WMF 7e623dca8a26a45440c331e383ac6ce3783d5c1bd60b91ee91ce0cc5841633e2.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0198022.WMF 7e623dca8a26a45440c331e383ac6ce3783d5c1bd60b91ee91ce0cc5841633e2.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0241019.WMF.id-4D74230D.[[email protected]].bgtx 7e623dca8a26a45440c331e383ac6ce3783d5c1bd60b91ee91ce0cc5841633e2.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\PE02262_.WMF 7e623dca8a26a45440c331e383ac6ce3783d5c1bd60b91ee91ce0cc5841633e2.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\ks_IN\LC_MESSAGES\vlc.mo 7e623dca8a26a45440c331e383ac6ce3783d5c1bd60b91ee91ce0cc5841633e2.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Font\MinionPro-BoldIt.otf 7e623dca8a26a45440c331e383ac6ce3783d5c1bd60b91ee91ce0cc5841633e2.exe File created C:\Program Files\7-Zip\Lang\ko.txt.id-4D74230D.[[email protected]].bgtx 7e623dca8a26a45440c331e383ac6ce3783d5c1bd60b91ee91ce0cc5841633e2.exe File opened for modification C:\Program Files\InstallUnregister.mhtml 7e623dca8a26a45440c331e383ac6ce3783d5c1bd60b91ee91ce0cc5841633e2.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Europe\Oslo.id-4D74230D.[[email protected]].bgtx 7e623dca8a26a45440c331e383ac6ce3783d5c1bd60b91ee91ce0cc5841633e2.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\SlideShow.Gadget\images\play_down.png 7e623dca8a26a45440c331e383ac6ce3783d5c1bd60b91ee91ce0cc5841633e2.exe File created C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\reviews_sent.gif.id-4D74230D.[[email protected]].bgtx 7e623dca8a26a45440c331e383ac6ce3783d5c1bd60b91ee91ce0cc5841633e2.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0309585.JPG 7e623dca8a26a45440c331e383ac6ce3783d5c1bd60b91ee91ce0cc5841633e2.exe File created C:\Program Files (x86)\Microsoft Office\MEDIA\CAGCAT10\J0183290.WMF.id-4D74230D.[[email protected]].bgtx 7e623dca8a26a45440c331e383ac6ce3783d5c1bd60b91ee91ce0cc5841633e2.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\PUBSPAPR\PDIR43B.GIF.id-4D74230D.[[email protected]].bgtx 7e623dca8a26a45440c331e383ac6ce3783d5c1bd60b91ee91ce0cc5841633e2.exe File created C:\Program Files\7-Zip\Lang\co.txt.id-4D74230D.[[email protected]].bgtx 7e623dca8a26a45440c331e383ac6ce3783d5c1bd60b91ee91ce0cc5841633e2.exe File opened for modification C:\Program Files\7-Zip\readme.txt.id-4D74230D.[[email protected]].bgtx 7e623dca8a26a45440c331e383ac6ce3783d5c1bd60b91ee91ce0cc5841633e2.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\1033\ACERECR.DLL 7e623dca8a26a45440c331e383ac6ce3783d5c1bd60b91ee91ce0cc5841633e2.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\PUBSPAPR\PDIR44B.GIF.id-4D74230D.[[email protected]].bgtx 7e623dca8a26a45440c331e383ac6ce3783d5c1bd60b91ee91ce0cc5841633e2.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Irkutsk 7e623dca8a26a45440c331e383ac6ce3783d5c1bd60b91ee91ce0cc5841633e2.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\NA02417_.WMF.id-4D74230D.[[email protected]].bgtx 7e623dca8a26a45440c331e383ac6ce3783d5c1bd60b91ee91ce0cc5841633e2.exe File opened for modification C:\Program Files\Java\jre7\lib\amd64\jvm.cfg.id-4D74230D.[[email protected]].bgtx 7e623dca8a26a45440c331e383ac6ce3783d5c1bd60b91ee91ce0cc5841633e2.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\update_tracking\org-netbeans-modules-profiler-attach.xml.id-4D74230D.[[email protected]].bgtx 7e623dca8a26a45440c331e383ac6ce3783d5c1bd60b91ee91ce0cc5841633e2.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\144DPI\(144DPI)alertIcon.png 7e623dca8a26a45440c331e383ac6ce3783d5c1bd60b91ee91ce0cc5841633e2.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\AN04117_.WMF.id-4D74230D.[[email protected]].bgtx 7e623dca8a26a45440c331e383ac6ce3783d5c1bd60b91ee91ce0cc5841633e2.exe File created C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\BL00390_.WMF.id-4D74230D.[[email protected]].bgtx 7e623dca8a26a45440c331e383ac6ce3783d5c1bd60b91ee91ce0cc5841633e2.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Pacific\Port_Moresby.id-4D74230D.[[email protected]].bgtx 7e623dca8a26a45440c331e383ac6ce3783d5c1bd60b91ee91ce0cc5841633e2.exe File created C:\Program Files\Java\jre7\lib\zi\Africa\Accra.id-4D74230D.[[email protected]].bgtx 7e623dca8a26a45440c331e383ac6ce3783d5c1bd60b91ee91ce0cc5841633e2.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\NA00454_.WMF.id-4D74230D.[[email protected]].bgtx 7e623dca8a26a45440c331e383ac6ce3783d5c1bd60b91ee91ce0cc5841633e2.exe File opened for modification C:\Program Files\7-Zip\Lang\ar.txt 7e623dca8a26a45440c331e383ac6ce3783d5c1bd60b91ee91ce0cc5841633e2.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Etc\GMT-10.id-4D74230D.[[email protected]].bgtx 7e623dca8a26a45440c331e383ac6ce3783d5c1bd60b91ee91ce0cc5841633e2.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0382931.JPG 7e623dca8a26a45440c331e383ac6ce3783d5c1bd60b91ee91ce0cc5841633e2.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\SO00915_.WMF 7e623dca8a26a45440c331e383ac6ce3783d5c1bd60b91ee91ce0cc5841633e2.exe -
Interacts with shadow copies 2 TTPs 1 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
pid Process 2216 vssadmin.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 3008 7e623dca8a26a45440c331e383ac6ce3783d5c1bd60b91ee91ce0cc5841633e2.exe 3008 7e623dca8a26a45440c331e383ac6ce3783d5c1bd60b91ee91ce0cc5841633e2.exe 3008 7e623dca8a26a45440c331e383ac6ce3783d5c1bd60b91ee91ce0cc5841633e2.exe 3008 7e623dca8a26a45440c331e383ac6ce3783d5c1bd60b91ee91ce0cc5841633e2.exe 3008 7e623dca8a26a45440c331e383ac6ce3783d5c1bd60b91ee91ce0cc5841633e2.exe 3008 7e623dca8a26a45440c331e383ac6ce3783d5c1bd60b91ee91ce0cc5841633e2.exe 3008 7e623dca8a26a45440c331e383ac6ce3783d5c1bd60b91ee91ce0cc5841633e2.exe 3008 7e623dca8a26a45440c331e383ac6ce3783d5c1bd60b91ee91ce0cc5841633e2.exe 3008 7e623dca8a26a45440c331e383ac6ce3783d5c1bd60b91ee91ce0cc5841633e2.exe 3008 7e623dca8a26a45440c331e383ac6ce3783d5c1bd60b91ee91ce0cc5841633e2.exe 3008 7e623dca8a26a45440c331e383ac6ce3783d5c1bd60b91ee91ce0cc5841633e2.exe 3008 7e623dca8a26a45440c331e383ac6ce3783d5c1bd60b91ee91ce0cc5841633e2.exe 3008 7e623dca8a26a45440c331e383ac6ce3783d5c1bd60b91ee91ce0cc5841633e2.exe 3008 7e623dca8a26a45440c331e383ac6ce3783d5c1bd60b91ee91ce0cc5841633e2.exe 3008 7e623dca8a26a45440c331e383ac6ce3783d5c1bd60b91ee91ce0cc5841633e2.exe 3008 7e623dca8a26a45440c331e383ac6ce3783d5c1bd60b91ee91ce0cc5841633e2.exe 3008 7e623dca8a26a45440c331e383ac6ce3783d5c1bd60b91ee91ce0cc5841633e2.exe 3008 7e623dca8a26a45440c331e383ac6ce3783d5c1bd60b91ee91ce0cc5841633e2.exe 3008 7e623dca8a26a45440c331e383ac6ce3783d5c1bd60b91ee91ce0cc5841633e2.exe 3008 7e623dca8a26a45440c331e383ac6ce3783d5c1bd60b91ee91ce0cc5841633e2.exe 3008 7e623dca8a26a45440c331e383ac6ce3783d5c1bd60b91ee91ce0cc5841633e2.exe 3008 7e623dca8a26a45440c331e383ac6ce3783d5c1bd60b91ee91ce0cc5841633e2.exe 3008 7e623dca8a26a45440c331e383ac6ce3783d5c1bd60b91ee91ce0cc5841633e2.exe 3008 7e623dca8a26a45440c331e383ac6ce3783d5c1bd60b91ee91ce0cc5841633e2.exe 3008 7e623dca8a26a45440c331e383ac6ce3783d5c1bd60b91ee91ce0cc5841633e2.exe 3008 7e623dca8a26a45440c331e383ac6ce3783d5c1bd60b91ee91ce0cc5841633e2.exe 3008 7e623dca8a26a45440c331e383ac6ce3783d5c1bd60b91ee91ce0cc5841633e2.exe 3008 7e623dca8a26a45440c331e383ac6ce3783d5c1bd60b91ee91ce0cc5841633e2.exe 3008 7e623dca8a26a45440c331e383ac6ce3783d5c1bd60b91ee91ce0cc5841633e2.exe 3008 7e623dca8a26a45440c331e383ac6ce3783d5c1bd60b91ee91ce0cc5841633e2.exe 3008 7e623dca8a26a45440c331e383ac6ce3783d5c1bd60b91ee91ce0cc5841633e2.exe 3008 7e623dca8a26a45440c331e383ac6ce3783d5c1bd60b91ee91ce0cc5841633e2.exe 3008 7e623dca8a26a45440c331e383ac6ce3783d5c1bd60b91ee91ce0cc5841633e2.exe 3008 7e623dca8a26a45440c331e383ac6ce3783d5c1bd60b91ee91ce0cc5841633e2.exe 3008 7e623dca8a26a45440c331e383ac6ce3783d5c1bd60b91ee91ce0cc5841633e2.exe 3008 7e623dca8a26a45440c331e383ac6ce3783d5c1bd60b91ee91ce0cc5841633e2.exe 3008 7e623dca8a26a45440c331e383ac6ce3783d5c1bd60b91ee91ce0cc5841633e2.exe 3008 7e623dca8a26a45440c331e383ac6ce3783d5c1bd60b91ee91ce0cc5841633e2.exe 3008 7e623dca8a26a45440c331e383ac6ce3783d5c1bd60b91ee91ce0cc5841633e2.exe 3008 7e623dca8a26a45440c331e383ac6ce3783d5c1bd60b91ee91ce0cc5841633e2.exe 3008 7e623dca8a26a45440c331e383ac6ce3783d5c1bd60b91ee91ce0cc5841633e2.exe 3008 7e623dca8a26a45440c331e383ac6ce3783d5c1bd60b91ee91ce0cc5841633e2.exe 3008 7e623dca8a26a45440c331e383ac6ce3783d5c1bd60b91ee91ce0cc5841633e2.exe 3008 7e623dca8a26a45440c331e383ac6ce3783d5c1bd60b91ee91ce0cc5841633e2.exe 3008 7e623dca8a26a45440c331e383ac6ce3783d5c1bd60b91ee91ce0cc5841633e2.exe 3008 7e623dca8a26a45440c331e383ac6ce3783d5c1bd60b91ee91ce0cc5841633e2.exe 3008 7e623dca8a26a45440c331e383ac6ce3783d5c1bd60b91ee91ce0cc5841633e2.exe 3008 7e623dca8a26a45440c331e383ac6ce3783d5c1bd60b91ee91ce0cc5841633e2.exe 3008 7e623dca8a26a45440c331e383ac6ce3783d5c1bd60b91ee91ce0cc5841633e2.exe 3008 7e623dca8a26a45440c331e383ac6ce3783d5c1bd60b91ee91ce0cc5841633e2.exe 3008 7e623dca8a26a45440c331e383ac6ce3783d5c1bd60b91ee91ce0cc5841633e2.exe 3008 7e623dca8a26a45440c331e383ac6ce3783d5c1bd60b91ee91ce0cc5841633e2.exe 3008 7e623dca8a26a45440c331e383ac6ce3783d5c1bd60b91ee91ce0cc5841633e2.exe 3008 7e623dca8a26a45440c331e383ac6ce3783d5c1bd60b91ee91ce0cc5841633e2.exe 3008 7e623dca8a26a45440c331e383ac6ce3783d5c1bd60b91ee91ce0cc5841633e2.exe 3008 7e623dca8a26a45440c331e383ac6ce3783d5c1bd60b91ee91ce0cc5841633e2.exe 3008 7e623dca8a26a45440c331e383ac6ce3783d5c1bd60b91ee91ce0cc5841633e2.exe 3008 7e623dca8a26a45440c331e383ac6ce3783d5c1bd60b91ee91ce0cc5841633e2.exe 3008 7e623dca8a26a45440c331e383ac6ce3783d5c1bd60b91ee91ce0cc5841633e2.exe 3008 7e623dca8a26a45440c331e383ac6ce3783d5c1bd60b91ee91ce0cc5841633e2.exe 3008 7e623dca8a26a45440c331e383ac6ce3783d5c1bd60b91ee91ce0cc5841633e2.exe 3008 7e623dca8a26a45440c331e383ac6ce3783d5c1bd60b91ee91ce0cc5841633e2.exe 3008 7e623dca8a26a45440c331e383ac6ce3783d5c1bd60b91ee91ce0cc5841633e2.exe 3008 7e623dca8a26a45440c331e383ac6ce3783d5c1bd60b91ee91ce0cc5841633e2.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
description pid Process Token: SeBackupPrivilege 1644 vssvc.exe Token: SeRestorePrivilege 1644 vssvc.exe Token: SeAuditPrivilege 1644 vssvc.exe -
Suspicious use of WriteProcessMemory 10 IoCs
description pid Process procid_target PID 3008 wrote to memory of 2856 3008 7e623dca8a26a45440c331e383ac6ce3783d5c1bd60b91ee91ce0cc5841633e2.exe 28 PID 3008 wrote to memory of 2856 3008 7e623dca8a26a45440c331e383ac6ce3783d5c1bd60b91ee91ce0cc5841633e2.exe 28 PID 3008 wrote to memory of 2856 3008 7e623dca8a26a45440c331e383ac6ce3783d5c1bd60b91ee91ce0cc5841633e2.exe 28 PID 3008 wrote to memory of 2856 3008 7e623dca8a26a45440c331e383ac6ce3783d5c1bd60b91ee91ce0cc5841633e2.exe 28 PID 2856 wrote to memory of 2960 2856 cmd.exe 30 PID 2856 wrote to memory of 2960 2856 cmd.exe 30 PID 2856 wrote to memory of 2960 2856 cmd.exe 30 PID 2856 wrote to memory of 2216 2856 cmd.exe 31 PID 2856 wrote to memory of 2216 2856 cmd.exe 31 PID 2856 wrote to memory of 2216 2856 cmd.exe 31 -
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\7e623dca8a26a45440c331e383ac6ce3783d5c1bd60b91ee91ce0cc5841633e2.exe"C:\Users\Admin\AppData\Local\Temp\7e623dca8a26a45440c331e383ac6ce3783d5c1bd60b91ee91ce0cc5841633e2.exe"1⤵
- Drops startup file
- Adds Run key to start application
- Drops desktop.ini file(s)
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3008 -
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:2856 -
C:\Windows\system32\mode.commode con cp select=12513⤵PID:2960
-
-
C:\Windows\system32\vssadmin.exevssadmin delete shadows /all /quiet3⤵
- Interacts with shadow copies
PID:2216
-
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1644
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\osetup.dll.id-4D74230D.[[email protected]].bgtx
Filesize4.5MB
MD55019059ebb1cdec7e40470a95820415a
SHA1166e7a8d29c9c7e4c5bf0461d79ef5df8d91dfa6
SHA2565f5a4c4f6284e0de8a13b747a17f46ba1131f2da6b9d8ac3f1c37d3fa731a90b
SHA5129dc4036433bab9b7472216e602ab9f17bea4096758edb1b20f86eee1cb638debf505255948551c0449547d9504252f1b421b43bfdbb563064c351f997cd8666b