Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
05/03/2024, 21:18
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
b5aea2b93aba350d1894b31d961a9ad4.exe
Resource
win7-20240221-en
windows7-x64
0 signatures
150 seconds
Behavioral task
behavioral2
Sample
b5aea2b93aba350d1894b31d961a9ad4.exe
Resource
win10v2004-20240226-en
windows10-2004-x64
5 signatures
150 seconds
General
-
Target
b5aea2b93aba350d1894b31d961a9ad4.exe
-
Size
2.5MB
-
MD5
b5aea2b93aba350d1894b31d961a9ad4
-
SHA1
65267b1519ac5243de4b2449a97766df685228e3
-
SHA256
56c62276b68f133cf2fc26d1e39403178811d0547da3d441e508efc20b02bd14
-
SHA512
d67fca70c721687fb21773e556786b4bbce1f50a3359ec8a21bcf773a9b82e7f9368c830d141b5fea3a3f9b03c394d304fc55bd0ac37e1fb843b43171f2f8631
-
SSDEEP
49152:DQbYcMaLfU0mx9F9t6jQa2b8xmN3Aek03noj45wlDT3fR:C5XHjz2beUJF3noxDDp
Score
6/10
Malware Config
Signatures
-
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" b5aea2b93aba350d1894b31d961a9ad4.exe -
Drops autorun.inf file 1 TTPs 1 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf b5aea2b93aba350d1894b31d961a9ad4.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\chrmstp.exe b5aea2b93aba350d1894b31d961a9ad4.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jhat.exe$ b5aea2b93aba350d1894b31d961a9ad4.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\outicon.exe b5aea2b93aba350d1894b31d961a9ad4.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe$ b5aea2b93aba350d1894b31d961a9ad4.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\filecompare.exe$ b5aea2b93aba350d1894b31d961a9ad4.exe File created C:\Program Files\7-Zip\7zG.exe b5aea2b93aba350d1894b31d961a9ad4.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Source Engine\OSE.EXE b5aea2b93aba350d1894b31d961a9ad4.exe File opened for modification C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe b5aea2b93aba350d1894b31d961a9ad4.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe b5aea2b93aba350d1894b31d961a9ad4.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\rmid.exe b5aea2b93aba350d1894b31d961a9ad4.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.DBConnection.exe$ b5aea2b93aba350d1894b31d961a9ad4.exe File created C:\Program Files\7-Zip\7z.exe b5aea2b93aba350d1894b31d961a9ad4.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe b5aea2b93aba350d1894b31d961a9ad4.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javadoc.exe b5aea2b93aba350d1894b31d961a9ad4.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe b5aea2b93aba350d1894b31d961a9ad4.exe File created C:\Program Files\Java\jdk-1.8\bin\javadoc.exe b5aea2b93aba350d1894b31d961a9ad4.exe File created C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe b5aea2b93aba350d1894b31d961a9ad4.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\xjc.exe$ b5aea2b93aba350d1894b31d961a9ad4.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.DBConnection.exe b5aea2b93aba350d1894b31d961a9ad4.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\wordicon.exe$ b5aea2b93aba350d1894b31d961a9ad4.exe File created C:\Program Files\Java\jdk-1.8\bin\jcmd.exe b5aea2b93aba350d1894b31d961a9ad4.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\wsgen.exe b5aea2b93aba350d1894b31d961a9ad4.exe File opened for modification C:\Program Files\Microsoft Office\Office16\OSPPREARM.EXE$ b5aea2b93aba350d1894b31d961a9ad4.exe File created C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE b5aea2b93aba350d1894b31d961a9ad4.exe File created C:\Program Files\Microsoft Office\root\Office16\msoia.exe b5aea2b93aba350d1894b31d961a9ad4.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.DBConnection.exe b5aea2b93aba350d1894b31d961a9ad4.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\outicon.exe b5aea2b93aba350d1894b31d961a9ad4.exe File created C:\Program Files\Java\jdk-1.8\bin\jdeps.exe b5aea2b93aba350d1894b31d961a9ad4.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe b5aea2b93aba350d1894b31d961a9ad4.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe$ b5aea2b93aba350d1894b31d961a9ad4.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\java.exe$ b5aea2b93aba350d1894b31d961a9ad4.exe File created C:\Program Files\Microsoft Office\root\Office16\VPREVIEW.EXE b5aea2b93aba350d1894b31d961a9ad4.exe File created C:\Program Files\Microsoft Office\root\Office16\WORDICON.EXE b5aea2b93aba350d1894b31d961a9ad4.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\EQUATION\eqnedt32.exe b5aea2b93aba350d1894b31d961a9ad4.exe File opened for modification C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe$ b5aea2b93aba350d1894b31d961a9ad4.exe File created C:\Program Files\Java\jdk-1.8\bin\rmid.exe b5aea2b93aba350d1894b31d961a9ad4.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe b5aea2b93aba350d1894b31d961a9ad4.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.NetFX40.exe b5aea2b93aba350d1894b31d961a9ad4.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe$ b5aea2b93aba350d1894b31d961a9ad4.exe File created C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe b5aea2b93aba350d1894b31d961a9ad4.exe File opened for modification C:\Program Files\Microsoft Office\root\Integration\Addons\OneDriveSetup.exe b5aea2b93aba350d1894b31d961a9ad4.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\excelcnv.exe$ b5aea2b93aba350d1894b31d961a9ad4.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javah.exe b5aea2b93aba350d1894b31d961a9ad4.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javaws.exe b5aea2b93aba350d1894b31d961a9ad4.exe File created C:\Program Files\Java\jdk-1.8\bin\jjs.exe b5aea2b93aba350d1894b31d961a9ad4.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jps.exe$ b5aea2b93aba350d1894b31d961a9ad4.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\xlicons.exe b5aea2b93aba350d1894b31d961a9ad4.exe File opened for modification C:\Program Files\Mozilla Firefox\uninstall\helper.exe$ b5aea2b93aba350d1894b31d961a9ad4.exe File opened for modification C:\Program Files\Mozilla Firefox\plugin-container.exe$ b5aea2b93aba350d1894b31d961a9ad4.exe File created C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\setup.exe b5aea2b93aba350d1894b31d961a9ad4.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe$ b5aea2b93aba350d1894b31d961a9ad4.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe$ b5aea2b93aba350d1894b31d961a9ad4.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Smart Tag\SmartTagInstall.exe b5aea2b93aba350d1894b31d961a9ad4.exe File opened for modification C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE$ b5aea2b93aba350d1894b31d961a9ad4.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\msoia.exe b5aea2b93aba350d1894b31d961a9ad4.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\POWERPNT.EXE$ b5aea2b93aba350d1894b31d961a9ad4.exe File created C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe b5aea2b93aba350d1894b31d961a9ad4.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ONENOTE.EXE$ b5aea2b93aba350d1894b31d961a9ad4.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\OLicenseHeartbeat.exe b5aea2b93aba350d1894b31d961a9ad4.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe b5aea2b93aba350d1894b31d961a9ad4.exe File created C:\Program Files\Java\jdk-1.8\bin\javac.exe b5aea2b93aba350d1894b31d961a9ad4.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe b5aea2b93aba350d1894b31d961a9ad4.exe File created C:\Program Files\Microsoft Office\root\Office16\msotd.exe b5aea2b93aba350d1894b31d961a9ad4.exe File created C:\Program Files\Java\jdk-1.8\bin\jhat.exe b5aea2b93aba350d1894b31d961a9ad4.exe -
NTFS ADS 1 IoCs
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf b5aea2b93aba350d1894b31d961a9ad4.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 2016 b5aea2b93aba350d1894b31d961a9ad4.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\b5aea2b93aba350d1894b31d961a9ad4.exe"C:\Users\Admin\AppData\Local\Temp\b5aea2b93aba350d1894b31d961a9ad4.exe"1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:2016
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=1324 --field-trial-handle=2280,i,1836084024518340990,18250262151825427757,262144 --variations-seed-version /prefetch:81⤵PID:648
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2.5MB
MD5b5aea2b93aba350d1894b31d961a9ad4
SHA165267b1519ac5243de4b2449a97766df685228e3
SHA25656c62276b68f133cf2fc26d1e39403178811d0547da3d441e508efc20b02bd14
SHA512d67fca70c721687fb21773e556786b4bbce1f50a3359ec8a21bcf773a9b82e7f9368c830d141b5fea3a3f9b03c394d304fc55bd0ac37e1fb843b43171f2f8631