Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
120s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20231129-en -
resource tags
arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system -
submitted
02/01/2024, 18:00
Behavioral task
behavioral1
Sample
3ea36b6095b1688db07ffb52a585696c.exe
Resource
win7-20231129-en
windows7-x64
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
3ea36b6095b1688db07ffb52a585696c.exe
Resource
win10v2004-20231215-en
windows10-2004-x64
3 signatures
150 seconds
General
-
Target
3ea36b6095b1688db07ffb52a585696c.exe
-
Size
1.8MB
-
MD5
3ea36b6095b1688db07ffb52a585696c
-
SHA1
6ec2dc7f038b74bee43867675f355feb1e6445be
-
SHA256
98d61e8693a668a67b83bf9388cb7182eae322f785cf995370fcc4409a21794e
-
SHA512
c9509abf0b3372c8d5e97406081bca0e118c0e627a04bd2470ecaf9b8c410c8ab8b2f8e974198ae0e9051a161e2f207ee5ffffdd2cf66147867654b36bcafaf6
-
SSDEEP
24576:S6pQPxQ2JyP2r5mJV91xM7RpbwgIvs7NxqUkHZ:SCqm2Jpr0nNM7Dus7Nx25
Score
7/10
Malware Config
Signatures
-
resource yara_rule behavioral1/memory/2220-0-0x0000000000400000-0x00000000005BA000-memory.dmp upx behavioral1/memory/2220-2961-0x0000000000400000-0x00000000005BA000-memory.dmp upx behavioral1/memory/2220-9186-0x0000000000400000-0x00000000005BA000-memory.dmp upx -
Drops desktop.ini file(s) 9 IoCs
description ioc Process File created C:\Program Files\Microsoft Games\Chess\desktop.ini 3ea36b6095b1688db07ffb52a585696c.exe File created C:\Program Files\desktop.ini 3ea36b6095b1688db07ffb52a585696c.exe File created C:\Program Files\Common Files\Microsoft Shared\Stationery\Desktop.ini 3ea36b6095b1688db07ffb52a585696c.exe File created C:\Program Files\Microsoft Games\FreeCell\desktop.ini 3ea36b6095b1688db07ffb52a585696c.exe File created C:\Program Files\Microsoft Games\Hearts\desktop.ini 3ea36b6095b1688db07ffb52a585696c.exe File created C:\Program Files\Microsoft Games\Mahjong\desktop.ini 3ea36b6095b1688db07ffb52a585696c.exe File created C:\Program Files\Microsoft Games\Purble Place\desktop.ini 3ea36b6095b1688db07ffb52a585696c.exe File created C:\Program Files\Microsoft Games\Solitaire\desktop.ini 3ea36b6095b1688db07ffb52a585696c.exe File created C:\Program Files\Microsoft Games\SpiderSolitaire\desktop.ini 3ea36b6095b1688db07ffb52a585696c.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Etc\GMT+11 3ea36b6095b1688db07ffb52a585696c.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Etc\GMT-8 3ea36b6095b1688db07ffb52a585696c.exe File created C:\Program Files\Common Files\System\Ole DB\en-US\sqloledb.rll.mui.exe 3ea36b6095b1688db07ffb52a585696c.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\FlipPage\NavigationLeft_SelectionSubpicture.png.exe 3ea36b6095b1688db07ffb52a585696c.exe File created C:\Program Files\Internet Explorer\en-US\iexplore.exe.mui 3ea36b6095b1688db07ffb52a585696c.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\com.jrockit.mc.feature.console_5.5.0.165303\feature.xml.exe 3ea36b6095b1688db07ffb52a585696c.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.swt.win32.win32.x86_64_3.103.1.v20140903-1947.jar 3ea36b6095b1688db07ffb52a585696c.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\lib\locale\jfluid-server_ja.jar.exe 3ea36b6095b1688db07ffb52a585696c.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Pacific\Guam 3ea36b6095b1688db07ffb52a585696c.exe File created C:\Program Files\VideoLAN\VLC\plugins\demux\libsmf_plugin.dll.exe 3ea36b6095b1688db07ffb52a585696c.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\baseAltGr_rtl.xml 3ea36b6095b1688db07ffb52a585696c.exe File created C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\36.png 3ea36b6095b1688db07ffb52a585696c.exe File created C:\Program Files\Windows Photo Viewer\PhotoViewer.dll 3ea36b6095b1688db07ffb52a585696c.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\security\javafx.policy 3ea36b6095b1688db07ffb52a585696c.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-modules-options-api_zh_CN.jar.exe 3ea36b6095b1688db07ffb52a585696c.exe File created C:\Program Files\Windows Sidebar\Gadgets\RSSFeeds.Gadget\en-US\settings.html 3ea36b6095b1688db07ffb52a585696c.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\sawindbg.dll 3ea36b6095b1688db07ffb52a585696c.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-modules-applemenu_zh_CN.jar.exe 3ea36b6095b1688db07ffb52a585696c.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-netbeans-modules-autoupdate-ui.xml 3ea36b6095b1688db07ffb52a585696c.exe File created C:\Program Files\Java\jre7\lib\zi\America\Regina.exe 3ea36b6095b1688db07ffb52a585696c.exe File created C:\Program Files\Java\jre7\lib\zi\Etc\UCT.exe 3ea36b6095b1688db07ffb52a585696c.exe File created C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\de\Microsoft.Build.Engine.resources.dll.exe 3ea36b6095b1688db07ffb52a585696c.exe File opened for modification C:\Program Files\VideoLAN\VLC\lua\playlist\bbc_co_uk.luac 3ea36b6095b1688db07ffb52a585696c.exe File created C:\Program Files\Windows Sidebar\Gadgets\SlideShow.Gadget\en-US\settings.html 3ea36b6095b1688db07ffb52a585696c.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\LICENSE 3ea36b6095b1688db07ffb52a585696c.exe File created C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\fr-FR\js\weather.js.exe 3ea36b6095b1688db07ffb52a585696c.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\ja-JP\mip.exe.mui.exe 3ea36b6095b1688db07ffb52a585696c.exe File opened for modification C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\et.pak 3ea36b6095b1688db07ffb52a585696c.exe File created C:\Program Files\Java\jdk1.7.0_80\bin\jconsole.exe.exe 3ea36b6095b1688db07ffb52a585696c.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Jakarta 3ea36b6095b1688db07ffb52a585696c.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Asia\Oral 3ea36b6095b1688db07ffb52a585696c.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\en-US\IPSEventLogMsg.dll.mui 3ea36b6095b1688db07ffb52a585696c.exe File opened for modification C:\Program Files\DismountConfirm.vstm 3ea36b6095b1688db07ffb52a585696c.exe File created C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\am.pak.exe 3ea36b6095b1688db07ffb52a585696c.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.w3c.dom.smil_1.0.0.v200806040011.jar.exe 3ea36b6095b1688db07ffb52a585696c.exe File created C:\Program Files\Java\jre7\COPYRIGHT.exe 3ea36b6095b1688db07ffb52a585696c.exe File opened for modification C:\Program Files\Microsoft Office\Office14\ONLNTCOMLIB.DLL 3ea36b6095b1688db07ffb52a585696c.exe File created C:\Program Files\VideoLAN\VLC\lua\playlist\anevia_streams.luac.exe 3ea36b6095b1688db07ffb52a585696c.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Travel\TravelIntroToMainMask.wmv.exe 3ea36b6095b1688db07ffb52a585696c.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-modules-favorites_zh_CN.jar.exe 3ea36b6095b1688db07ffb52a585696c.exe File created C:\Program Files\Java\jre7\bin\dt_socket.dll.exe 3ea36b6095b1688db07ffb52a585696c.exe File created C:\Program Files\Windows Sidebar\Gadgets\RSSFeeds.Gadget\images\buttonDown_Off.png.exe 3ea36b6095b1688db07ffb52a585696c.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\de-DE\mip.exe.mui 3ea36b6095b1688db07ffb52a585696c.exe File created C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\de\System.Speech.resources.dll 3ea36b6095b1688db07ffb52a585696c.exe File created C:\Program Files\Java\jre7\lib\zi\America\Moncton.exe 3ea36b6095b1688db07ffb52a585696c.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\javacpl.cpl 3ea36b6095b1688db07ffb52a585696c.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Africa\Casablanca 3ea36b6095b1688db07ffb52a585696c.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Asuncion 3ea36b6095b1688db07ffb52a585696c.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Etc\GMT+10 3ea36b6095b1688db07ffb52a585696c.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-openide-windows.xml.exe 3ea36b6095b1688db07ffb52a585696c.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\stream_out\libstream_out_autodel_plugin.dll 3ea36b6095b1688db07ffb52a585696c.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\en-US\TipTsf.dll.mui.exe 3ea36b6095b1688db07ffb52a585696c.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\p2\org.eclipse.equinox.p2.engine\profileRegistry\JMC.profile\1423861240811.profile.gz.exe 3ea36b6095b1688db07ffb52a585696c.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.rjmx_5.5.0.165303\icons\day-of-week-16.png.exe 3ea36b6095b1688db07ffb52a585696c.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.rjmx_5.5.0.165303\lib\pop3.jar 3ea36b6095b1688db07ffb52a585696c.exe File created C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\WinFXList.xml.exe 3ea36b6095b1688db07ffb52a585696c.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\java.dll 3ea36b6095b1688db07ffb52a585696c.exe File created C:\Program Files\VideoLAN\VLC\locale\fi\LC_MESSAGES\vlc.mo.exe 3ea36b6095b1688db07ffb52a585696c.exe File created C:\Program Files\VideoLAN\VLC\plugins\demux\libnsv_plugin.dll.exe 3ea36b6095b1688db07ffb52a585696c.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.artifact.repository.nl_zh_4.4.0.v20140623020002.jar 3ea36b6095b1688db07ffb52a585696c.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.babel.nls_eclipse_ja_4.4.0.v20140623020002\feature.xml 3ea36b6095b1688db07ffb52a585696c.exe File created C:\Program Files\Java\jre7\lib\zi\America\Whitehorse.exe 3ea36b6095b1688db07ffb52a585696c.exe File created C:\Program Files\Mozilla Firefox\defaultagent.ini.exe 3ea36b6095b1688db07ffb52a585696c.exe File created C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\de\System.Data.Entity.Design.Resources.dll 3ea36b6095b1688db07ffb52a585696c.exe