Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
252s -
max time network
281s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
11/01/2024, 00:52
Behavioral task
behavioral1
Sample
5218dfcbd880a0fd340e50b59dcb4dc3.exe
Resource
win7-20231215-en
windows7-x64
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
5218dfcbd880a0fd340e50b59dcb4dc3.exe
Resource
win10v2004-20231222-en
windows10-2004-x64
2 signatures
150 seconds
General
-
Target
5218dfcbd880a0fd340e50b59dcb4dc3.exe
-
Size
1.8MB
-
MD5
5218dfcbd880a0fd340e50b59dcb4dc3
-
SHA1
50e17e9677b6c8c181300de6b0ce803c0ab4814c
-
SHA256
05fa96a7bd95098154c88cbbf8f90ca339139600e5426e3bd9540cd422b9fcba
-
SHA512
2f70c9c694d2427226c8eb45d1b426068bc1e4db350fe9730432add44bd9e86acff5b47c709f59b3497cce31a1830e307ef6877606ed8cfdfb3f05f8e9ac2040
-
SSDEEP
24576:S6pQPxQ2JyP2r5mJV91xM7RpbwgIvs7NxqE:SCqm2Jpr0nNM7Dus7NxN
Score
7/10
Malware Config
Signatures
-
resource yara_rule behavioral1/memory/3016-0-0x0000000000400000-0x00000000005BA000-memory.dmp upx behavioral1/files/0x000e0000000122db-5.dat upx behavioral1/memory/3016-315-0x0000000000400000-0x00000000005BA000-memory.dmp upx -
Drops desktop.ini file(s) 1 IoCs
description ioc Process File created C:\Program Files\Common Files\Microsoft Shared\Stationery\Desktop.ini 5218dfcbd880a0fd340e50b59dcb4dc3.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\7-Zip\Lang\ca.txt.exe 5218dfcbd880a0fd340e50b59dcb4dc3.exe File opened for modification C:\Program Files\7-Zip\Lang\zh-cn.txt 5218dfcbd880a0fd340e50b59dcb4dc3.exe File created C:\Program Files\Common Files\Microsoft Shared\Stationery\Desktop.ini.exe 5218dfcbd880a0fd340e50b59dcb4dc3.exe File opened for modification C:\Program Files\7-Zip\Lang\az.txt 5218dfcbd880a0fd340e50b59dcb4dc3.exe File opened for modification C:\Program Files\7-Zip\Lang\va.txt 5218dfcbd880a0fd340e50b59dcb4dc3.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\base_kor.xml.exe 5218dfcbd880a0fd340e50b59dcb4dc3.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\ipsplk.xml 5218dfcbd880a0fd340e50b59dcb4dc3.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\ja-JP\rtscom.dll.mui 5218dfcbd880a0fd340e50b59dcb4dc3.exe File created C:\Program Files\Common Files\Microsoft Shared\VSTO\10.0\1033\VSTOLoaderUI.dll.exe 5218dfcbd880a0fd340e50b59dcb4dc3.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\TipBand.dll.exe 5218dfcbd880a0fd340e50b59dcb4dc3.exe File created C:\Program Files\7-Zip\Lang\yo.txt.exe 5218dfcbd880a0fd340e50b59dcb4dc3.exe File created C:\Program Files\Common Files\Microsoft Shared\OFFICE14\MSOXMLMF.DLL.exe 5218dfcbd880a0fd340e50b59dcb4dc3.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\Content.xml 5218dfcbd880a0fd340e50b59dcb4dc3.exe File created C:\Program Files\Common Files\Microsoft Shared\OFFICE14\CsiSoap.dll.exe 5218dfcbd880a0fd340e50b59dcb4dc3.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\TabTip.exe 5218dfcbd880a0fd340e50b59dcb4dc3.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\TipRes.dll.exe 5218dfcbd880a0fd340e50b59dcb4dc3.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\ko-KR\tipresx.dll.mui.exe 5218dfcbd880a0fd340e50b59dcb4dc3.exe File opened for modification C:\Program Files\7-Zip\7zFM.exe 5218dfcbd880a0fd340e50b59dcb4dc3.exe File created C:\Program Files\7-Zip\Lang\an.txt.exe 5218dfcbd880a0fd340e50b59dcb4dc3.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\TipRes.dll 5218dfcbd880a0fd340e50b59dcb4dc3.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\fr-FR\TipRes.dll.mui 5218dfcbd880a0fd340e50b59dcb4dc3.exe File created C:\Program Files\Common Files\Microsoft Shared\MSInfo\msinfo32.exe 5218dfcbd880a0fd340e50b59dcb4dc3.exe File created C:\Program Files\Common Files\Microsoft Shared\VSTO\10.0\VSTOLoader.dll.exe 5218dfcbd880a0fd340e50b59dcb4dc3.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\dicjp.bin 5218dfcbd880a0fd340e50b59dcb4dc3.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\de-DE\tabskb.dll.mui 5218dfcbd880a0fd340e50b59dcb4dc3.exe File opened for modification C:\Program Files\7-Zip\Lang\uk.txt 5218dfcbd880a0fd340e50b59dcb4dc3.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\en-US\delete.avi.exe 5218dfcbd880a0fd340e50b59dcb4dc3.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\es-ES\mshwLatin.dll.mui 5218dfcbd880a0fd340e50b59dcb4dc3.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\base_heb.xml 5218dfcbd880a0fd340e50b59dcb4dc3.exe File created C:\Program Files\7-Zip\descript.ion.exe 5218dfcbd880a0fd340e50b59dcb4dc3.exe File created C:\Program Files\Common Files\Microsoft Shared\Stationery\Bears.htm 5218dfcbd880a0fd340e50b59dcb4dc3.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\VSTO\10.0\VSTOMessageProvider.dll 5218dfcbd880a0fd340e50b59dcb4dc3.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\it-IT\InkWatson.exe.mui.exe 5218dfcbd880a0fd340e50b59dcb4dc3.exe File opened for modification C:\Program Files\7-Zip\Lang\ko.txt 5218dfcbd880a0fd340e50b59dcb4dc3.exe File created C:\Program Files\7-Zip\Lang\ru.txt.exe 5218dfcbd880a0fd340e50b59dcb4dc3.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\ipsen.xml.exe 5218dfcbd880a0fd340e50b59dcb4dc3.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\et-EE\tipresx.dll.mui.exe 5218dfcbd880a0fd340e50b59dcb4dc3.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\base.xml.exe 5218dfcbd880a0fd340e50b59dcb4dc3.exe File created C:\Program Files\Common Files\Microsoft Shared\Stationery\HandPrints.jpg.exe 5218dfcbd880a0fd340e50b59dcb4dc3.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\ipscht.xml 5218dfcbd880a0fd340e50b59dcb4dc3.exe File opened for modification C:\Program Files\7-Zip\Lang\fi.txt 5218dfcbd880a0fd340e50b59dcb4dc3.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\Filters\VISFILT.DLL 5218dfcbd880a0fd340e50b59dcb4dc3.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\bg-BG\tipresx.dll.mui.exe 5218dfcbd880a0fd340e50b59dcb4dc3.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\en-US\boxed-split.avi.exe 5218dfcbd880a0fd340e50b59dcb4dc3.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\en-US\tabskb.dll.mui 5218dfcbd880a0fd340e50b59dcb4dc3.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\it-IT\mshwLatin.dll.mui 5218dfcbd880a0fd340e50b59dcb4dc3.exe File opened for modification C:\Program Files\7-Zip\Lang\pt.txt 5218dfcbd880a0fd340e50b59dcb4dc3.exe File created C:\Program Files\7-Zip\Lang\sk.txt.exe 5218dfcbd880a0fd340e50b59dcb4dc3.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\Alphabet.xml.exe 5218dfcbd880a0fd340e50b59dcb4dc3.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\es-ES\TipRes.dll.mui 5218dfcbd880a0fd340e50b59dcb4dc3.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main.xml.exe 5218dfcbd880a0fd340e50b59dcb4dc3.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\da-DK\tipresx.dll.mui 5218dfcbd880a0fd340e50b59dcb4dc3.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\lt-LT\tipresx.dll.mui.exe 5218dfcbd880a0fd340e50b59dcb4dc3.exe File created C:\Program Files\Common Files\Microsoft Shared\Stationery\Blue_Gradient.jpg 5218dfcbd880a0fd340e50b59dcb4dc3.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\VSTO\vstoee100.tlb 5218dfcbd880a0fd340e50b59dcb4dc3.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\Microsoft.Ink.dll.exe 5218dfcbd880a0fd340e50b59dcb4dc3.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\fr-FR\IPSEventLogMsg.dll.mui 5218dfcbd880a0fd340e50b59dcb4dc3.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\oskpred\oskpredbase.xml 5218dfcbd880a0fd340e50b59dcb4dc3.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\ipssrl.xml.exe 5218dfcbd880a0fd340e50b59dcb4dc3.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\it-IT\tabskb.dll.mui.exe 5218dfcbd880a0fd340e50b59dcb4dc3.exe File opened for modification C:\Program Files\7-Zip\Lang\kk.txt 5218dfcbd880a0fd340e50b59dcb4dc3.exe File opened for modification C:\Program Files\7-Zip\Lang\sr-spl.txt 5218dfcbd880a0fd340e50b59dcb4dc3.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\it-IT\IPSEventLogMsg.dll.mui 5218dfcbd880a0fd340e50b59dcb4dc3.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\auxpad\auxbase.xml 5218dfcbd880a0fd340e50b59dcb4dc3.exe
Processes
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.8MB
MD5a229195c91b5e50289b145c03d91622c
SHA11c3c0509bfae7fef7980c8258921055e382d2601
SHA25694da7dda4796377e6bf14ea36dc4ed163451ee2e95849ff8a68c84f59e9f9606
SHA5120c3024a07c487c5a78ea6557ba83118eb38e20b52e53d41163a047c7e240107571e28457754c8536dfaf64ae186a12865587fd2992855cd273e5807f58506d72