Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
154s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
28/02/2024, 08:29
Behavioral task
behavioral1
Sample
ab72f514f38fc72c85dcc28e7479e4ed.exe
Resource
win7-20240221-en
windows7-x64
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
ab72f514f38fc72c85dcc28e7479e4ed.exe
Resource
win10v2004-20240226-en
windows10-2004-x64
3 signatures
150 seconds
General
-
Target
ab72f514f38fc72c85dcc28e7479e4ed.exe
-
Size
1.8MB
-
MD5
ab72f514f38fc72c85dcc28e7479e4ed
-
SHA1
7c2cdc3db1174992aa4d986970f1f07f864105a0
-
SHA256
6bc43aa9c5918cf4b25a285509026e433d3487117c2d9ea850be9bdf2372e5c1
-
SHA512
167bfc3911b07cbc78945a2e8b05e901daa95ac3a15e58ee1df848046d7b1d11a8a98bbbf336931040c51f2547d5eab24369202910e761fd258a076479f7fd96
-
SSDEEP
24576:S6pQPxQ2JyP2r5mJV91xM7RpbwgIvs7Nxq0:SCqm2Jpr0nNM7Dus7Nxp
Score
7/10
Malware Config
Signatures
-
resource yara_rule behavioral2/memory/3004-0-0x0000000000400000-0x00000000005BA000-memory.dmp upx behavioral2/files/0x00020000000227b7-5.dat upx behavioral2/memory/3004-679-0x0000000000400000-0x00000000005BA000-memory.dmp upx -
Drops desktop.ini file(s) 1 IoCs
description ioc Process File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\DataServices\DESKTOP.INI ab72f514f38fc72c85dcc28e7479e4ed.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Java\jre-1.8\lib\management-agent.jar.exe ab72f514f38fc72c85dcc28e7479e4ed.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Power Map Excel Add-in\VISUALIZATIONDIRECTX.DLL.exe ab72f514f38fc72c85dcc28e7479e4ed.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.MashupEngine.dll ab72f514f38fc72c85dcc28e7479e4ed.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.OData.Edm.NetFX35.V7.dll ab72f514f38fc72c85dcc28e7479e4ed.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\LogoImages\PowerPntLogo.scale-80.png ab72f514f38fc72c85dcc28e7479e4ed.exe File opened for modification C:\Program Files\7-Zip\Lang\mr.txt ab72f514f38fc72c85dcc28e7479e4ed.exe File created C:\Program Files\Common Files\microsoft shared\ink\sk-SK\tipresx.dll.mui ab72f514f38fc72c85dcc28e7479e4ed.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jjs.exe ab72f514f38fc72c85dcc28e7479e4ed.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\schemagen.exe ab72f514f38fc72c85dcc28e7479e4ed.exe File created C:\Program Files\Microsoft Office\root\Licenses16\PublisherR_Trial-ul-oob.xrm-ms.exe ab72f514f38fc72c85dcc28e7479e4ed.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.NetFX40.exe ab72f514f38fc72c85dcc28e7479e4ed.exe File created C:\Program Files\Common Files\microsoft shared\ink\ipscsy.xml.exe ab72f514f38fc72c85dcc28e7479e4ed.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ADDINS\otkloadr_x64.dll ab72f514f38fc72c85dcc28e7479e4ed.exe File opened for modification C:\Program Files\7-Zip\Lang\cy.txt ab72f514f38fc72c85dcc28e7479e4ed.exe File created C:\Program Files\Microsoft Office\root\Licenses16\Outlook2019VL_MAK_AE-ppd.xrm-ms.exe ab72f514f38fc72c85dcc28e7479e4ed.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\LivePersonaCard\images\default\linkedin_ghost_company.png ab72f514f38fc72c85dcc28e7479e4ed.exe File created C:\Program Files\Microsoft Office\root\Integration\Addons\OneDriveSetup.exe.exe ab72f514f38fc72c85dcc28e7479e4ed.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusR_Subscription3-pl.xrm-ms ab72f514f38fc72c85dcc28e7479e4ed.exe File created C:\Program Files\Java\jdk-1.8\jre\lib\deploy\messages_de.properties.exe ab72f514f38fc72c85dcc28e7479e4ed.exe File created C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_SubTest3-ppd.xrm-ms.exe ab72f514f38fc72c85dcc28e7479e4ed.exe File created C:\Program Files\Microsoft Office\root\Office15\pidgenx.dll.exe ab72f514f38fc72c85dcc28e7479e4ed.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\AppvIsvSubsystems64.dll ab72f514f38fc72c85dcc28e7479e4ed.exe File created C:\Program Files\Common Files\microsoft shared\ink\ipsen.xml.exe ab72f514f38fc72c85dcc28e7479e4ed.exe File created C:\Program Files\Java\jdk-1.8\jre\lib\deploy.jar.exe ab72f514f38fc72c85dcc28e7479e4ed.exe File created C:\Program Files\Java\jre-1.8\lib\deploy\messages_zh_CN.properties.exe ab72f514f38fc72c85dcc28e7479e4ed.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-crt-private-l1-1-0.dll ab72f514f38fc72c85dcc28e7479e4ed.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectPro2019R_Grace-ppd.xrm-ms.exe ab72f514f38fc72c85dcc28e7479e4ed.exe File created C:\Program Files\Microsoft Office\root\Licenses16\client-issuance-root.xrm-ms.exe ab72f514f38fc72c85dcc28e7479e4ed.exe File created C:\Program Files\Common Files\microsoft shared\ink\fr-FR\TipRes.dll.mui.exe ab72f514f38fc72c85dcc28e7479e4ed.exe File opened for modification C:\Program Files\Google\Chrome\Application\106.0.5249.119\WidevineCdm\_platform_specific\win_x64\widevinecdm.dll ab72f514f38fc72c85dcc28e7479e4ed.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019R_OEM_Perp4-ppd.xrm-ms ab72f514f38fc72c85dcc28e7479e4ed.exe File created C:\Program Files\Microsoft Office\root\Licenses16\Word2019R_OEM_Perp-ul-phn.xrm-ms.exe ab72f514f38fc72c85dcc28e7479e4ed.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\client_eula.txt ab72f514f38fc72c85dcc28e7479e4ed.exe File created C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\oskmenu.xml ab72f514f38fc72c85dcc28e7479e4ed.exe File created C:\Program Files\Microsoft Office\root\Integration\SPPRedist.msi.exe ab72f514f38fc72c85dcc28e7479e4ed.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProPlusR_OEM_Perp5-ul-oob.xrm-ms.exe ab72f514f38fc72c85dcc28e7479e4ed.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\CHART.DLL ab72f514f38fc72c85dcc28e7479e4ed.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\legal\jdk\xalan.md ab72f514f38fc72c85dcc28e7479e4ed.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019R_PrepidBypass-ul-oob.xrm-ms ab72f514f38fc72c85dcc28e7479e4ed.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\BORDERS\MSART11.BDR ab72f514f38fc72c85dcc28e7479e4ed.exe File created C:\Program Files\Microsoft Office\root\Office16\AUDIOSEARCHLTS.DLL.exe ab72f514f38fc72c85dcc28e7479e4ed.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\server\jvm.dll ab72f514f38fc72c85dcc28e7479e4ed.exe File created C:\Program Files\Microsoft Office\root\Licenses16\HomeStudentVNextR_Retail-pl.xrm-ms.exe ab72f514f38fc72c85dcc28e7479e4ed.exe File created C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_SubTest3-pl.xrm-ms.exe ab72f514f38fc72c85dcc28e7479e4ed.exe File created C:\Program Files\Microsoft Office\root\Client\api-ms-win-crt-string-l1-1-0.dll.exe ab72f514f38fc72c85dcc28e7479e4ed.exe File created C:\Program Files\Microsoft Office\root\Client\concrt140.dll.exe ab72f514f38fc72c85dcc28e7479e4ed.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\HomeStudentVNextR_Retail-ul-phn.xrm-ms ab72f514f38fc72c85dcc28e7479e4ed.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\msix.dll.exe ab72f514f38fc72c85dcc28e7479e4ed.exe File opened for modification C:\Program Files\Java\jdk-1.8\legal\javafx\public_suffix.md ab72f514f38fc72c85dcc28e7479e4ed.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ExcelVL_KMS_Client-ul-oob.xrm-ms.exe ab72f514f38fc72c85dcc28e7479e4ed.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe ab72f514f38fc72c85dcc28e7479e4ed.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\msvcp140.dll ab72f514f38fc72c85dcc28e7479e4ed.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Cartridges\sqlpdw.xsl.exe ab72f514f38fc72c85dcc28e7479e4ed.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\Access2019VL_KMS_Client_AE-ul-oob.xrm-ms ab72f514f38fc72c85dcc28e7479e4ed.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessR_OEM_Perp2-ul-oob.xrm-ms ab72f514f38fc72c85dcc28e7479e4ed.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\HomeStudentR_Grace-ul-oob.xrm-ms ab72f514f38fc72c85dcc28e7479e4ed.exe File created C:\Program Files\Microsoft Office\root\Licenses16\WordR_Retail-ppd.xrm-ms.exe ab72f514f38fc72c85dcc28e7479e4ed.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\MSOUC_K_COL.HXK ab72f514f38fc72c85dcc28e7479e4ed.exe File created C:\Program Files\Microsoft Office\root\Office16\FPA_f4\FA000000005.exe ab72f514f38fc72c85dcc28e7479e4ed.exe File opened for modification C:\Program Files\Google\Chrome\Application\106.0.5249.119\libGLESv2.dll ab72f514f38fc72c85dcc28e7479e4ed.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\dtplugin\deployJava1.dll ab72f514f38fc72c85dcc28e7479e4ed.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019R_Trial-ppd.xrm-ms.exe ab72f514f38fc72c85dcc28e7479e4ed.exe File created C:\Program Files\Java\jre-1.8\legal\javafx\directshow.md.exe ab72f514f38fc72c85dcc28e7479e4ed.exe File created C:\Program Files\Microsoft Office\root\Licenses16\HomeStudent2019R_Trial-ul-oob.xrm-ms.exe ab72f514f38fc72c85dcc28e7479e4ed.exe
Processes
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.7MB
MD5b905fc4a7696d39bd4f7c74ceb890369
SHA1742078ab4eb2b2b88e975ca1bf7554b3b0fba2d1
SHA2568e24e3cc8db4f99afe561ff3bfa9e5fef57390df8e70d77bf513d1bb2a23225a
SHA512fa424b656dfaf8a98fc653fa20a2989f48a9dd57462e33857a5da8f42a84619870c5edb9c6eec7e52be5ff3bf6540c32e92626965fae2cb129345b7e739e6db8