Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
165s -
max time network
177s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
11/01/2024, 04:56
Behavioral task
behavioral1
Sample
52973686becef51d18042af00d558223.exe
Resource
win7-20231129-en
windows7-x64
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
52973686becef51d18042af00d558223.exe
Resource
win10v2004-20231215-en
windows10-2004-x64
2 signatures
150 seconds
General
-
Target
52973686becef51d18042af00d558223.exe
-
Size
1.8MB
-
MD5
52973686becef51d18042af00d558223
-
SHA1
e1b80e8396faeb5a8c807cba57a8fa13abeab5c3
-
SHA256
1113e6d7ccdfc6b98aa0257073f90d713a129e0ffdee0de5ef35daa12d64cd77
-
SHA512
8202b420c76ca8a30143e07f53ad46ee4a93d470d5d6de0eceea849909735238eebe268d58bd3851ed116270095c3696e00a9f3a393874398559307fba03f6ad
-
SSDEEP
24576:S6pQPxQ2JyP2r5mJV91xM7RpbwgIvs7NxqY:SCqm2Jpr0nNM7Dus7Nxd
Score
7/10
Malware Config
Signatures
-
resource yara_rule behavioral2/memory/3712-0-0x0000000000400000-0x00000000005BA000-memory.dmp upx behavioral2/files/0x0002000000022910-5.dat upx behavioral2/memory/3712-157-0x0000000000400000-0x00000000005BA000-memory.dmp upx -
Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_SubTest1-ul-oob.xrm-ms.exe 52973686becef51d18042af00d558223.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_Subscription2-pl.xrm-ms 52973686becef51d18042af00d558223.exe File created C:\Program Files\Java\jdk-1.8\bin\api-ms-win-core-processenvironment-l1-1-0.dll.exe 52973686becef51d18042af00d558223.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javap.exe 52973686becef51d18042af00d558223.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\lib\deploy\ffjcext.zip 52973686becef51d18042af00d558223.exe File created C:\Program Files\Java\jre-1.8\bin\ssvagent.exe.exe 52973686becef51d18042af00d558223.exe File opened for modification C:\Program Files\Java\jre-1.8\lib\images\cursors\cursors.properties 52973686becef51d18042af00d558223.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\HomeStudentR_Grace-ppd.xrm-ms 52973686becef51d18042af00d558223.exe File created C:\Program Files\Microsoft Office\root\Licenses16\Outlook2019R_Grace-ul-oob.xrm-ms.exe 52973686becef51d18042af00d558223.exe File created C:\Program Files\Microsoft Office\root\Licenses16\Outlook2019VL_MAK_AE-ppd.xrm-ms.exe 52973686becef51d18042af00d558223.exe File opened for modification C:\Program Files\Java\jdk-1.8\THIRDPARTYLICENSEREADME.txt 52973686becef51d18042af00d558223.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jdeps.exe 52973686becef51d18042af00d558223.exe File created C:\Program Files\Java\jdk-1.8\jre\lib\cmm\CIEXYZ.pf.exe 52973686becef51d18042af00d558223.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\PersonalPipcR_OEM_Perp-ul-phn.xrm-ms 52973686becef51d18042af00d558223.exe File created C:\Program Files\Microsoft Office\root\Integration\C2RManifest.PowerPoint.PowerPoint.x-none.msi.16.x-none.xml.exe 52973686becef51d18042af00d558223.exe File opened for modification C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-001B-0409-1000-0000000FF1CE.xml 52973686becef51d18042af00d558223.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\MondoR_KMS_Automation-ul-oob.xrm-ms 52973686becef51d18042af00d558223.exe File created C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusR_Subscription4-ul-oob.xrm-ms.exe 52973686becef51d18042af00d558223.exe File created C:\Program Files\Java\jdk-1.8\legal\javafx\gstreamer.md.exe 52973686becef51d18042af00d558223.exe File created C:\Program Files\Java\jre-1.8\bin\api-ms-win-crt-environment-l1-1-0.dll.exe 52973686becef51d18042af00d558223.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\HomeStudent2019R_Trial-ul-oob.xrm-ms 52973686becef51d18042af00d558223.exe File opened for modification C:\Program Files\Google\Chrome\Application\106.0.5249.119\VisualElements\Logo.png 52973686becef51d18042af00d558223.exe File created C:\Program Files\Internet Explorer\ielowutil.exe.exe 52973686becef51d18042af00d558223.exe File created C:\Program Files\Java\jre-1.8\legal\javafx\icu_web.md.exe 52973686becef51d18042af00d558223.exe File created C:\Program Files\Microsoft Office\root\Licenses16\Outlook2019R_OEM_Perp-pl.xrm-ms.exe 52973686becef51d18042af00d558223.exe File opened for modification C:\Program Files\Google\Chrome\Application\106.0.5249.119\libEGL.dll 52973686becef51d18042af00d558223.exe File opened for modification C:\Program Files\Java\jre-1.8\legal\jdk\relaxngcc.md 52973686becef51d18042af00d558223.exe File created C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Fonts\Constantia-Franklin Gothic Book.xml.exe 52973686becef51d18042af00d558223.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\AccessVL_KMS_Client-ul-oob.xrm-ms 52973686becef51d18042af00d558223.exe File created C:\Program Files\Microsoft Office\root\Licenses16\MondoR_Retail-pl.xrm-ms.exe 52973686becef51d18042af00d558223.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusR_Subscription4-pl.xrm-ms 52973686becef51d18042af00d558223.exe File created C:\Program Files\Common Files\microsoft shared\ink\fi-FI\tipresx.dll.mui 52973686becef51d18042af00d558223.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-core-string-l1-1-0.dll.exe 52973686becef51d18042af00d558223.exe File opened for modification C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-00E2-0409-1000-0000000FF1CE.xml 52973686becef51d18042af00d558223.exe File created C:\Program Files\Common Files\microsoft shared\ink\de-DE\TabTip.exe.mui.exe 52973686becef51d18042af00d558223.exe File opened for modification C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\zh-CN.pak 52973686becef51d18042af00d558223.exe File created C:\Program Files\Java\jdk-1.8\bin\api-ms-win-core-localization-l1-2-0.dll.exe 52973686becef51d18042af00d558223.exe File opened for modification C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\bn.pak 52973686becef51d18042af00d558223.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\kinit.exe 52973686becef51d18042af00d558223.exe File opened for modification C:\Program Files\Java\jre-1.8\lib\cmm\sRGB.pf 52973686becef51d18042af00d558223.exe File created C:\Program Files\Microsoft Office\root\Licenses16\HomeBusiness2019R_OEM_Perp2-ul-phn.xrm-ms.exe 52973686becef51d18042af00d558223.exe File created C:\Program Files\Microsoft Office\root\Licenses16\PowerPointR_Grace-ppd.xrm-ms.exe 52973686becef51d18042af00d558223.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.ro-ro.dll.exe 52973686becef51d18042af00d558223.exe File created C:\Program Files\Common Files\microsoft shared\ink\el-GR\tipresx.dll.mui.exe 52973686becef51d18042af00d558223.exe File created C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\symbols\symbase.xml 52973686becef51d18042af00d558223.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\HomeStudentVNextR_Grace-ul-oob.xrm-ms 52973686becef51d18042af00d558223.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.sk-sk.dll.exe 52973686becef51d18042af00d558223.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\StreamServer.dll 52973686becef51d18042af00d558223.exe File opened for modification C:\Program Files\Common Files\microsoft shared\VSTO\vstoee.dll 52973686becef51d18042af00d558223.exe File created C:\Program Files\Java\jdk-1.8\bin\msvcp140.dll.exe 52973686becef51d18042af00d558223.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\glib-lite.dll 52973686becef51d18042af00d558223.exe File created C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Fonts\Candara.xml.exe 52973686becef51d18042af00d558223.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\OneNoteVL_KMS_Client-ul-oob.xrm-ms 52973686becef51d18042af00d558223.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\ClientCapabilities.json 52973686becef51d18042af00d558223.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-core-synch-l1-1-0.dll.exe 52973686becef51d18042af00d558223.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\jawt.dll 52973686becef51d18042af00d558223.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe 52973686becef51d18042af00d558223.exe File created C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\am.pak.exe 52973686becef51d18042af00d558223.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\orbd.exe 52973686becef51d18042af00d558223.exe File opened for modification C:\Program Files\Java\jre-1.8\lib\jfr.jar 52973686becef51d18042af00d558223.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusR_Subscription5-pl.xrm-ms 52973686becef51d18042af00d558223.exe File created C:\Program Files\Java\jdk-1.8\bin\api-ms-win-core-rtlsupport-l1-1-0.dll.exe 52973686becef51d18042af00d558223.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\management.dll 52973686becef51d18042af00d558223.exe File created C:\Program Files\Java\jdk-1.8\jre\legal\jdk\pkcs11wrapper.md.exe 52973686becef51d18042af00d558223.exe
Processes
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.8MB
MD5795831989a907603576014d1437af2b0
SHA101f304ef5d779d2da8f975d6765fbef9a4b983df
SHA25634cd1d28f34941a168ffdd24379531983b26ef99b495c523920ee355b3603699
SHA5120462eb15d3c36b1114557d5913fda206c7da28afbb093a3fbc3b2a625f7d6b96e5471cc689bba10949bacfcf2655077ec1a70bb8798ff8d8216a3e1604d15715