Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
144s -
max time network
155s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
09/03/2024, 12:59
Behavioral task
behavioral1
Sample
bbddb636f1cbe30c64e820a58c677c84.exe
Resource
win7-20240221-en
windows7-x64
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
bbddb636f1cbe30c64e820a58c677c84.exe
Resource
win10v2004-20240226-en
windows10-2004-x64
2 signatures
150 seconds
General
-
Target
bbddb636f1cbe30c64e820a58c677c84.exe
-
Size
2.8MB
-
MD5
bbddb636f1cbe30c64e820a58c677c84
-
SHA1
486c36f492e5798040587dc3bc5244fefcec2e87
-
SHA256
7e9248061bd2904b58399299976d7f7e11218f0851eadbfecad1e14b65330190
-
SHA512
0808545fa8e416ca8776c6c26e94f88b58aa7f36f80c6c5ce3f47638e4ab40fcee2f7a37603212d7d8b3203b15843bb84d58ac735f2ed8ca4984b176473ef314
-
SSDEEP
24576:S6pQPxQ2JyP2r5mJV91xM7RpbwgIvs7NxqUkHE6pQPxQ2JyP2r5mJV91v:SCqm2Jpr0nNM7Dus7Nx2kCqm2Jpr0nb
Score
7/10
Malware Config
Signatures
-
resource yara_rule behavioral2/memory/976-0-0x0000000000400000-0x00000000005BA000-memory.dmp upx behavioral2/files/0x00020000000227dd-5.dat upx behavioral2/memory/976-461-0x0000000000400000-0x00000000005BA000-memory.dmp upx -
Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.cs-cz.dll.exe bbddb636f1cbe30c64e820a58c677c84.exe File created C:\Program Files\Common Files\microsoft shared\ink\InkDiv.dll.exe bbddb636f1cbe30c64e820a58c677c84.exe File created C:\Program Files\Common Files\microsoft shared\ink\zh-TW\tipresx.dll.mui.exe bbddb636f1cbe30c64e820a58c677c84.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\lib\jfr.jar bbddb636f1cbe30c64e820a58c677c84.exe File opened for modification C:\Program Files\Java\jdk-1.8\legal\jdk\unicode.md bbddb636f1cbe30c64e820a58c677c84.exe File created C:\Program Files\Common Files\System\msadc\it-IT\msaddsr.dll.mui.exe bbddb636f1cbe30c64e820a58c677c84.exe File created C:\Program Files\Java\jdk-1.8\COPYRIGHT.exe bbddb636f1cbe30c64e820a58c677c84.exe File created C:\Program Files\Java\jdk-1.8\bin\keytool.exe.exe bbddb636f1cbe30c64e820a58c677c84.exe File opened for modification C:\Program Files\Java\jre-1.8\THIRDPARTYLICENSEREADME.txt bbddb636f1cbe30c64e820a58c677c84.exe File opened for modification C:\Program Files\Java\jre-1.8\lib\amd64\jvm.cfg bbddb636f1cbe30c64e820a58c677c84.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-core-handle-l1-1-0.dll.exe bbddb636f1cbe30c64e820a58c677c84.exe File opened for modification C:\Program Files\Java\jdk-1.8\legal\jdk\relaxngcc.md bbddb636f1cbe30c64e820a58c677c84.exe File opened for modification C:\Program Files\Microsoft Office\root\Integration\C2RManifest.office32ww.msi.16.x-none.xml bbddb636f1cbe30c64e820a58c677c84.exe File created C:\Program Files\Java\jdk-1.8\bin\rmid.exe.exe bbddb636f1cbe30c64e820a58c677c84.exe File created C:\Program Files\Internet Explorer\fr-FR\iexplore.exe.mui.exe bbddb636f1cbe30c64e820a58c677c84.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\legal\javafx\libxml2.md bbddb636f1cbe30c64e820a58c677c84.exe File opened for modification C:\Program Files\Java\jre-1.8\lib\ext\jaccess.jar bbddb636f1cbe30c64e820a58c677c84.exe File opened for modification C:\Program Files\7-Zip\Lang\it.txt bbddb636f1cbe30c64e820a58c677c84.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-crt-private-l1-1-0.dll bbddb636f1cbe30c64e820a58c677c84.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe bbddb636f1cbe30c64e820a58c677c84.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\lib\deploy\messages.properties bbddb636f1cbe30c64e820a58c677c84.exe File created C:\Program Files\Java\jre-1.8\bin\javaws.exe.exe bbddb636f1cbe30c64e820a58c677c84.exe File created C:\Program Files\Java\jre-1.8\bin\management.dll.exe bbddb636f1cbe30c64e820a58c677c84.exe File created C:\Program Files\Common Files\System\Ole DB\es-ES\sqlxmlx.rll.mui.exe bbddb636f1cbe30c64e820a58c677c84.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\ServiceWatcherSchedule.xml bbddb636f1cbe30c64e820a58c677c84.exe File opened for modification C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\lv.pak bbddb636f1cbe30c64e820a58c677c84.exe File opened for modification C:\Program Files\Java\jre-1.8\lib\deploy\messages_ko.properties bbddb636f1cbe30c64e820a58c677c84.exe File created C:\Program Files\Internet Explorer\uk-UA\ieinstal.exe.mui bbddb636f1cbe30c64e820a58c677c84.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\JavaAccessBridge-64.dll.exe bbddb636f1cbe30c64e820a58c677c84.exe File created C:\Program Files\Java\jre-1.8\lib\ext\sunmscapi.jar.exe bbddb636f1cbe30c64e820a58c677c84.exe File created C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-0018-0000-1000-0000000FF1CE.xml.exe bbddb636f1cbe30c64e820a58c677c84.exe File created C:\Program Files\Java\jdk-1.8\jre\lib\ext\cldrdata.jar.exe bbddb636f1cbe30c64e820a58c677c84.exe File created C:\Program Files\7-Zip\Lang\vi.txt.exe bbddb636f1cbe30c64e820a58c677c84.exe File opened for modification C:\Program Files\Java\jdk-1.8\legal\jdk\pkcs11wrapper.md bbddb636f1cbe30c64e820a58c677c84.exe File created C:\Program Files\Java\jre-1.8\bin\deploy.dll.exe bbddb636f1cbe30c64e820a58c677c84.exe File created C:\Program Files\Common Files\microsoft shared\ink\ipssrl.xml.exe bbddb636f1cbe30c64e820a58c677c84.exe File opened for modification C:\Program Files\7-Zip\Lang\ro.txt bbddb636f1cbe30c64e820a58c677c84.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.pt-pt.dll.exe bbddb636f1cbe30c64e820a58c677c84.exe File opened for modification C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Fonts\Consolas-Verdana.xml bbddb636f1cbe30c64e820a58c677c84.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\i640.hash.exe bbddb636f1cbe30c64e820a58c677c84.exe File opened for modification C:\Program Files\Java\jre-1.8\legal\jdk\jpeg.md bbddb636f1cbe30c64e820a58c677c84.exe File created C:\Program Files\Java\jdk-1.8\jre\lib\charsets.jar.exe bbddb636f1cbe30c64e820a58c677c84.exe File created C:\Program Files\Common Files\microsoft shared\ink\pt-BR\tipresx.dll.mui.exe bbddb636f1cbe30c64e820a58c677c84.exe File created C:\Program Files\Common Files\System\msadc\es-ES\msaddsr.dll.mui bbddb636f1cbe30c64e820a58c677c84.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe bbddb636f1cbe30c64e820a58c677c84.exe File opened for modification C:\Program Files\Java\jre-1.8\lib\deploy\messages_zh_CN.properties bbddb636f1cbe30c64e820a58c677c84.exe File created C:\Program Files\Internet Explorer\uk-UA\iexplore.exe.mui bbddb636f1cbe30c64e820a58c677c84.exe File created C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Effects\Frosted Glass.eftx.exe bbddb636f1cbe30c64e820a58c677c84.exe File opened for modification C:\Program Files\7-Zip\Lang\sk.txt bbddb636f1cbe30c64e820a58c677c84.exe File created C:\Program Files\Java\jre-1.8\bin\javacpl.cpl.exe bbddb636f1cbe30c64e820a58c677c84.exe File created C:\Program Files\Common Files\System\ado\adovbs.inc.exe bbddb636f1cbe30c64e820a58c677c84.exe File created C:\Program Files\Common Files\microsoft shared\ink\ipsel.xml.exe bbddb636f1cbe30c64e820a58c677c84.exe File opened for modification C:\Program Files\Java\jdk-1.8\legal\javafx\jpeg_fx.md bbddb636f1cbe30c64e820a58c677c84.exe File created C:\Program Files\Common Files\microsoft shared\ink\Alphabet.xml bbddb636f1cbe30c64e820a58c677c84.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe.exe bbddb636f1cbe30c64e820a58c677c84.exe File opened for modification C:\Program Files\Google\Chrome\Application\106.0.5249.119\vulkan-1.dll bbddb636f1cbe30c64e820a58c677c84.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe bbddb636f1cbe30c64e820a58c677c84.exe File opened for modification C:\Program Files\Microsoft Office\root\Client\vccorlib140.dll bbddb636f1cbe30c64e820a58c677c84.exe File created C:\Program Files\Internet Explorer\iediagcmd.exe.exe bbddb636f1cbe30c64e820a58c677c84.exe File created C:\Program Files\Java\jdk-1.8\include\jvmti.h.exe bbddb636f1cbe30c64e820a58c677c84.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\prism_d3d.dll.exe bbddb636f1cbe30c64e820a58c677c84.exe File created C:\Program Files\Java\jre-1.8\bin\api-ms-win-crt-conio-l1-1-0.dll.exe bbddb636f1cbe30c64e820a58c677c84.exe File opened for modification C:\Program Files\Java\jre-1.8\lib\fonts\LucidaBrightItalic.ttf bbddb636f1cbe30c64e820a58c677c84.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-core-memory-l1-1-0.dll.exe bbddb636f1cbe30c64e820a58c677c84.exe
Processes
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2.8MB
MD5cf8518f141d12a908eea1442c84c4b67
SHA1bd22c4675073065651904e212a3093d287554393
SHA256703a65d43381721f0e8dcf0a4ca7ccea1de6081eb41a00e049464d37996ce5af
SHA5128e31016341381b60fcaf510e5f3e9731a8cd7a978bae6dbe2900879ec51646afe385829eb37924129b82ea747ac29a77cbdb28424d835d9b879c4a34b90a66a5