Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
152s -
max time network
160s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
04/01/2024, 09:58
Behavioral task
behavioral1
Sample
408df544d4bd432caf29dce93c86beeb.exe
Resource
win7-20231215-en
windows7-x64
0 signatures
150 seconds
Behavioral task
behavioral2
Sample
408df544d4bd432caf29dce93c86beeb.exe
Resource
win10v2004-20231215-en
windows10-2004-x64
2 signatures
150 seconds
General
-
Target
408df544d4bd432caf29dce93c86beeb.exe
-
Size
1.8MB
-
MD5
408df544d4bd432caf29dce93c86beeb
-
SHA1
292ded5521834362150eb39da40b820ed541be05
-
SHA256
eb1136911284567518a32846b18cc7acb689fe11b1158a2171538d6462124d48
-
SHA512
4fbb440f3fd38efb0caab195b43c0f482b2b3e61c5409d48e82661f215139facbc3d25d8f3d611207f3aca57b60d15636a1b413b71966421bb36f271714e8b39
-
SSDEEP
24576:S6pQPxQ2JyP2r5mJV91xM7RpbwgIvs7NxqB:SCqm2Jpr0nNM7Dus7NxI
Score
7/10
Malware Config
Signatures
-
resource yara_rule behavioral2/memory/2692-0-0x0000000000400000-0x00000000005BA000-memory.dmp upx behavioral2/files/0x0002000000022910-5.dat upx behavioral2/memory/2692-294-0x0000000000400000-0x00000000005BA000-memory.dmp upx -
Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Common Files\System\msadc\it-IT\msadcer.dll.mui 408df544d4bd432caf29dce93c86beeb.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.kk-kz.dll 408df544d4bd432caf29dce93c86beeb.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-core-synch-l1-2-0.dll.exe 408df544d4bd432caf29dce93c86beeb.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-environment-l1-1-0.dll.exe 408df544d4bd432caf29dce93c86beeb.exe File opened for modification C:\Program Files\7-Zip\7zFM.exe 408df544d4bd432caf29dce93c86beeb.exe File opened for modification C:\Program Files\7-Zip\Lang\pt-br.txt 408df544d4bd432caf29dce93c86beeb.exe File created C:\Program Files\Common Files\System\Ole DB\en-US\msdasqlr.dll.mui.exe 408df544d4bd432caf29dce93c86beeb.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.sk-sk.dll 408df544d4bd432caf29dce93c86beeb.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\RepoMan.dll 408df544d4bd432caf29dce93c86beeb.exe File created C:\Program Files\Common Files\System\Ole DB\msdasqlr.dll 408df544d4bd432caf29dce93c86beeb.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.ar-sa.dll.exe 408df544d4bd432caf29dce93c86beeb.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.pl-pl.dll 408df544d4bd432caf29dce93c86beeb.exe File created C:\Program Files\Common Files\microsoft shared\ink\ipsjpn.xml 408df544d4bd432caf29dce93c86beeb.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.zh-tw.dll 408df544d4bd432caf29dce93c86beeb.exe File created C:\Program Files\Common Files\microsoft shared\ink\IpsMigrationPlugin.dll.exe 408df544d4bd432caf29dce93c86beeb.exe File created C:\Program Files\Common Files\microsoft shared\ink\fr-FR\InputPersonalization.exe.mui 408df544d4bd432caf29dce93c86beeb.exe File created C:\Program Files\Google\Chrome\Application\106.0.5249.119\Extensions\external_extensions.json.exe 408df544d4bd432caf29dce93c86beeb.exe File opened for modification C:\Program Files\7-Zip\7zCon.sfx 408df544d4bd432caf29dce93c86beeb.exe File created C:\Program Files\Common Files\System\ado\msadox28.tlb 408df544d4bd432caf29dce93c86beeb.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\C2R32.dll.exe 408df544d4bd432caf29dce93c86beeb.exe File created C:\Program Files\Common Files\microsoft shared\OFFICE16\Office Setup Controller\pidgenx.dll.exe 408df544d4bd432caf29dce93c86beeb.exe File created C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\keypad.xml 408df544d4bd432caf29dce93c86beeb.exe File created C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\ja-jp.xml 408df544d4bd432caf29dce93c86beeb.exe File opened for modification C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\sr.pak 408df544d4bd432caf29dce93c86beeb.exe File created C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\ur.pak.exe 408df544d4bd432caf29dce93c86beeb.exe File created C:\Program Files\7-Zip\Lang\ro.txt.exe 408df544d4bd432caf29dce93c86beeb.exe File created C:\Program Files\Common Files\System\Ole DB\fr-FR\msdasqlr.dll.mui.exe 408df544d4bd432caf29dce93c86beeb.exe File created C:\Program Files\Common Files\microsoft shared\MSInfo\es-ES\msinfo32.exe.mui.exe 408df544d4bd432caf29dce93c86beeb.exe File created C:\Program Files\Internet Explorer\ieinstal.exe 408df544d4bd432caf29dce93c86beeb.exe File created C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\ar.pak.exe 408df544d4bd432caf29dce93c86beeb.exe File opened for modification C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\id.pak 408df544d4bd432caf29dce93c86beeb.exe File created C:\Program Files\Google\Chrome\Application\chrome.VisualElementsManifest.xml.exe 408df544d4bd432caf29dce93c86beeb.exe File opened for modification C:\Program Files\7-Zip\Lang\br.txt 408df544d4bd432caf29dce93c86beeb.exe File opened for modification C:\Program Files\Common Files\microsoft shared\VC\msdia90.dll 408df544d4bd432caf29dce93c86beeb.exe File created C:\Program Files\Common Files\microsoft shared\ink\ipsen.xml 408df544d4bd432caf29dce93c86beeb.exe File created C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\zh-dayi.xml.exe 408df544d4bd432caf29dce93c86beeb.exe File created C:\Program Files\Common Files\microsoft shared\ink\it-IT\TipRes.dll.mui 408df544d4bd432caf29dce93c86beeb.exe File opened for modification C:\Program Files\Google\Chrome\Application\106.0.5249.119\nacl_irt_x86_64.nexe 408df544d4bd432caf29dce93c86beeb.exe File opened for modification C:\Program Files\Google\Chrome\Application\chrome_proxy.exe 408df544d4bd432caf29dce93c86beeb.exe File created C:\Program Files\7-Zip\Lang\hy.txt.exe 408df544d4bd432caf29dce93c86beeb.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-core-localization-l1-2-0.dll 408df544d4bd432caf29dce93c86beeb.exe File created C:\Program Files\Common Files\microsoft shared\ink\InkDiv.dll.exe 408df544d4bd432caf29dce93c86beeb.exe File created C:\Program Files\Common Files\microsoft shared\ink\ipsrus.xml.exe 408df544d4bd432caf29dce93c86beeb.exe File created C:\Program Files\Google\Chrome\Application\106.0.5249.119\vk_swiftshader_icd.json.exe 408df544d4bd432caf29dce93c86beeb.exe File created C:\Program Files\Internet Explorer\en-US\ieinstal.exe.mui.exe 408df544d4bd432caf29dce93c86beeb.exe File created C:\Program Files\Common Files\System\Ole DB\de-DE\sqlxmlx.rll.mui.exe 408df544d4bd432caf29dce93c86beeb.exe File created C:\Program Files\Common Files\System\ado\it-IT\msader15.dll.mui.exe 408df544d4bd432caf29dce93c86beeb.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.pt-pt.dll.exe 408df544d4bd432caf29dce93c86beeb.exe File created C:\Program Files\Common Files\microsoft shared\ink\en-US\rtscom.dll.mui 408df544d4bd432caf29dce93c86beeb.exe File created C:\Program Files\Common Files\microsoft shared\ink\fr-FR\TabTip.exe.mui.exe 408df544d4bd432caf29dce93c86beeb.exe File created C:\Program Files\Common Files\microsoft shared\ink\fr-FR\rtscom.dll.mui.exe 408df544d4bd432caf29dce93c86beeb.exe File created C:\Program Files\Common Files\microsoft shared\ink\it-IT\tipresx.dll.mui.exe 408df544d4bd432caf29dce93c86beeb.exe File created C:\Program Files\7-Zip\Lang\da.txt.exe 408df544d4bd432caf29dce93c86beeb.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.hi-in.dll 408df544d4bd432caf29dce93c86beeb.exe File created C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOLoader.dll.exe 408df544d4bd432caf29dce93c86beeb.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-multibyte-l1-1-0.dll 408df544d4bd432caf29dce93c86beeb.exe File created C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE.exe 408df544d4bd432caf29dce93c86beeb.exe File created C:\Program Files\Common Files\microsoft shared\ink\de-DE\TabTip.exe.mui.exe 408df544d4bd432caf29dce93c86beeb.exe File created C:\Program Files\Common Files\microsoft shared\ink\fr-FR\InputPersonalization.exe.mui.exe 408df544d4bd432caf29dce93c86beeb.exe File created C:\Program Files\Common Files\microsoft shared\ink\pl-PL\tipresx.dll.mui 408df544d4bd432caf29dce93c86beeb.exe File created C:\Program Files\7-Zip\Lang\sr-spl.txt.exe 408df544d4bd432caf29dce93c86beeb.exe File opened for modification C:\Program Files\7-Zip\Lang\vi.txt 408df544d4bd432caf29dce93c86beeb.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RCom.dll 408df544d4bd432caf29dce93c86beeb.exe File created C:\Program Files\Google\Chrome\Application\106.0.5249.119\chrome_wer.dll.exe 408df544d4bd432caf29dce93c86beeb.exe
Processes
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.8MB
MD55d9347ebab3e936cc85bd5e296af9214
SHA1e29d0a13696f7302820b83b30f420d615787bc4f
SHA256f983cc7fc66bf965d0b266b42a2932946071c1e2bb0e328279ad75bf228befa6
SHA512562fa75c1f0817e98f9c3ec4efc1ab5143845ccc1d11c89f1455553a7a9a9423b8b767feb3c814aa29e66fc414ad0420735aee382e6a94d49959538c1bb1e993